ML052170207
| ML052170207 | |
| Person / Time | |
|---|---|
| Issue date: | 08/05/2005 |
| From: | Sunil Weerakkody Plant Systems Branch |
| To: | Marion A Nuclear Energy Institute |
| Gallucci R, NRR/DSSA/SPLB, 415-1255 | |
| References | |
| NEI-04-02, NUREG/CR-6850, RG-1.174, RG-1.200 | |
| Download: ML052170207 (8) | |
Text
From:
Sunil Weerakkody To:
Alex, MARION, Date:
8/5/05 11:13AM
Subject:
Input for discussion at today's public meeting Alex:
We are glad to see that NEI-04-02 refers to the finalized (1.174) and evolving (RG 1.200, NUREG/CR-6850) as standards for acceptance.
I want to use the attachment to continue constructive discussion on this subject with the industry today. Our end objective is to make sure that the licensees who adopt 805 end up in a regulatory predicatable end state with respect to Quality of Fire PRAs.
Mike Tschiltz and John Hannon will decide on what if any of this needs to be included in the reg guide. Thanks.
Sunil Weerakkody Chief, Fire Protection NRC\\NRR\\DSSA\\SPLB Tel: 301-415-2870 Mail Stop: O-11 A-11 Office: O-11 D-22 CC:
Gallucci, Ray; Hannon, John; Tschiltz, Michael; Wong, See-Meng
Quality of Fire PRA Analysis for Applications Regulatory Guide (RG) 1.174 provides general guidance on the quality of a Probabilistic Risk Assessment (PRA) analysis used to support an application in terms of its appropriateness with respect to [1] scope, [2] level of detail, and [3] technical acceptability. [RG 1.174, Section 2.2.3]
The quality of a Fire Probabilistic Risk Assessment (FPRA) analysis must be consistent with RG 1.174 guidance. These three aspects of a FPRA must be commensurate with the application for which it is intended and the role the FPRA results play in the regulatory decision process... [RG 1.174, Section 2.2.3, extended to FPRA] that integrates risk insights with considerations of defense in depth and safety margins. While the required scope, level of detail, and technical acceptability may vary with the application, an over-riding requirement is that the FPRA should realistically reflect the plants actual design, construction, operational practices, and operational experience. [RG 1.174, Section 2.2.3, extended to FPRA]
The staff plans to use completed regulatory documents such as the RG 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, and NUREG/CR-6850, EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities, as well as applicable criteria in draft guidance documents such as RG 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, to achieve a predictable regulatory environment with respect to FPRA Quality for plants that adopt National Fire Protection Association (NFPA) 805. The NFPA-805 pilot plant program will provide feedback that will help to enhance the guidance for use in subsequent NFPA-805 applications that employ FPRA.
With regard to scope, a FPRA application must address those plant operating modes and fire initiating events to the extent necessary to characterize the risk aspects of the application.
However, while desirable (see a fully acceptable FPRA analysis discussed below), it is not
[always] necessary to have a FPRA of such scope that treats all operating modes and fire initiating events. [RG 1.174, Section 2.2.3.1, extended to FPRA]. Nonetheless, the analyst must understand the limitations of the particular FPRA that was performed. With respect to level of detail, failure to model the plant (or relevant portion of the plant) at the appropriate level of detail may result in calculated risk values that do not appropriately capture the risk significance of the proposed change.
In other words, the level of detail required to support a FPRA application must be sufficient to model the impact of the proposed change. The characterization of the problem should include establishing a cause-effect relationship to identify portions of the FPRA affected by the issue being evaluated.... If the impacts of a change to the plant cannot be associated with elements of the FPRA, the FPRA should be modified accordingly or the impact of the change should be evaluated qualitatively as part of the integrated decision-making process... In any [application],
the effects of the changes on the reliability and unavailability of systems, structures, and components, [including fire protection systems and features, or on feasible and reliable operator actions for safe shutdown response], should be appropriately accounted for.
[RG 1.174, Section 2.2.3.2, extended to FPRA]
Technical acceptability of a FPRA used for an application is determined by the adequacy of the
[PRA] modeling and the reasonableness of the assumptions and approximations. A FPRA used in [an application] should be performed correctly, in a manner that is consistent with accepted practices, commensurate with the required scope and level of detail as discussed above. [While different] approaches may be used to assess the technical acceptability of a
2 FPRA, one approach [is] a peer review of the FPRA... [The licensee submittal] should include the qualification of the reviewers, the summarized review findings, and resolutions to these findings where applicable. [RG 1.174, Section 2.2.3.3, extended to FPRA]
Industry FPRA certification programs and FPRA cross-comparison studies could also be used to help assess appropriate scope, level of detail, and technical acceptability of the FPRA. If such programs or studies are to be used, a description of the program, including the approach and standard or guidelines to which the FPRA is compared, the depth of the review, and the make-up and qualifications of the personnel involved should be considered as part of the review. provided for NRC review. [RG 1.174, Section 2.2.3.3, extended to FPRA]
Based on the peer review or certification/cross-comparison process, and on the findings from this process, the licensee should justify why the FPRA is adequate for the application in terms of scope, level of detail, and technical acceptability... [Although a staff assessment] cannot be replaced in its entirety by a peer review or certification/cross-comparison,[RG 1.174, Section 2.2.3.3, extended to FPRA] the staffs assessment of the peer review and its findings, including any resolutions, should determine whether the quality of the FPRA analysis is of sufficient rigor for an application.
General Attributes of a Fully Acceptable Fire PRA Analysis for Applications The following are four general attributes of what would be considered a fully acceptable FPRA for applications. First, the FPRA should address all fire initiating events for all modes of operation including low power and shutdown to ensure that the effect on risk from licensee-initiated changes is adequately characterized in a manner sufficient to support a technically defensible determination of the level of risk. Second, the FPRA should calculate core damage frequency (CDF) and large early release frequency (LERF) so that these measures can be compared against regulatory thresholds, such as those defined in RG 1.174. Third, the FPRA must reasonably represent the current configuration and operating practices at the plant to ensure that estimates of CDF and LERF adequately reflect the facility for which a decision must be made. Finally, the PRA should have sufficient technical adequacy including consideration of uncertainty, as well as a sufficient level of detail to provide confidence that the total CDF and LERF, and changes in total CDF and LERF, adequately reflect the proposed change.
Uncertainty must be considered to ensure that the decision is robust and accommodates limitations of the particular FPRA that was performed.
From:
Sunil Weerakkody To:
Alex, MARION, Date:
8/5/05 11:38AM
Subject:
Additional Information for today's public meeting Alex:
We plan to use the attached examples today to have a productive discussion on how we could overcome some differences we have on the risk analysis portion of NEI-04-02. Ray will be putting this in public ADAMs. Bob will share this with all known participants of today's call.
Sunil Weerakkody Chief, Fire Protection NRC\\NRR\\DSSA\\SPLB Tel: 301-415-2870 Mail Stop: O-11 A-11 Office: O-11 D-22 CC:
Gallucci, Ray; Radlinski, Robert; Wong, See-Meng
EXAMPLE 1.
Enhancement of the Fire Protection Program That Results in an Increase in Flooding Risk The automatic sprinkler systems in the emergency diesel generator (EDG) rooms will be expanded to provide coverage of the EDG instrument racks, one in each room. This requires that 5 ft. of piping and one sprinkler head be added to each system. While it is recognized that increasing the suppression capability will not increase (and will likely decrease) both the core damage frequency (CDF) and large early release frequency (LERF) due to fire in the EDG rooms, the additional piping and sprinkler heads will increase the potential for inadvertent sprinkler actuation, and therefore flooding, in each room. An increase in both CDF and LERF due to EDG room flooding will result.
Without attempting to quantify the potential reduction in fire CDF and LERF resulting from suppression capability enhancement, we pursue a bounding analysis for the increases in flooding CDF and LERF. If we can show that these increases, which bound the overall (if any) increases in total CDF and LERF (including any reduction in fire CDF and LERF), are inconsequential (<1E-8/yr for CDF and <1E-9/yr for LERF), we need pursue this analysis no further.
Piping and sprinkler heads are not explicitly modeled for flooding CDF and LERF. Instead, they are implicitly embedded in the flooding frequencies for the two EDG rooms, which is 0.0060/yr per room. The plant PSA indicates that each flooding initiator contributes 3.0% to the total flooding CDF and LERF, each of which contributes 5.0% to the total internal plus external events CDF and LERF, 5.0E-5/yr and 2.0E-6/yr, respectively. Thus, the baseline flooding CDF and LERF for each EDG room, i.e., given the baseline initiator frequency of 0.0060/yr, is (0.030)(0.050)(5.0E-5/yr) = 7.5E-8/yr for CDF and (0.030)(0.050)(2.0E-6/yr) = 3.0E-9/yr for LERF.
A review of generic data for leak/rupture of piping and sprinkler heads provides the following estimates:
Piping.
3.0E-9/hr-ft (leak) and 1.0E-10/hr-ft (rupture) from WSRC-TR-93-262, Savannah River Site Generic Data Base Development, 1993. The total leak plus rupture frequency becomes 3.1E-9/hr-ft, or 2.7E-5/yr-ft, assuming 8760 hr/yr.
Sprinkler Head.
High estimate = 6.2E-7/hr, or 0.0054/yr, assuming 8760 hr/yr (leak [due to inadvertent actuation]) from Dexter and Perkins, Component Failure-Rate Data with Potential Applicability to a Nuclear Fuel Reprocessing Plant, Savannah River Laboratory, 1982.
Low estimate = 1.6E-6/yr (leak), from 12/19/77 Factory Mutual Research letter from M.
Miller to N. Alvarez at Lawrence Livermore National Laboratory (LLNL), as reported in S.
Brereton, et al., Atomic Vapor Laser Isotope Separation Criticality Risk Assessment, LLNL, 1998. A reasonable estimate of the leak rate would be the geometric mean of the high and low values, or 9.3E-5/yr.
2 For each EDG room, the increase in flooding frequency would be the sum of the contributions from the additional 25 ft of piping and one sprinkler head, i.e., (5 ft)(2.7E-5/yr-ft) + 9.3E-5/yr =
2.3E-4/yr. Since the baseline CDF and LERF due to flooding in each EDG room are proportional to the baseline flooding frequency, the potential increases in flooding CDF and LERF per EDG room are as follows: (2.3E-4/yr)/(0.0060/yr) * (7.5E-8/yr) = 2.9E-9/yr for CDF and (2.3E-4/yr)/(0.0060/yr) * (3.0E-9/yr) = 1.1E-10/yr for LERF. Since both EDG rooms contribute, the total increases in flooding CDF and LERF are double, i.e., 5.7E-9/yr for CDF and 2.3E-10/yr for LERF.
These increases can be assumed to bound the total increases in CDF and LERF due to the enhancement of the automatic suppression system since any reduction in CDF and LERF from improved fire suppression has not been considered. Since both fall below the thresholds for inconsequential increases, no further analysis is warranted.
EXAMPLE 2.
Enhancement to Reduce Potential for Shutdown That Results in an Increase in Fire Risk A plants Control Rod Microprocessor Rod Position Indication (MRPI) display cabinet, located in the Relay Room, has a tendency to overheat. This can cause a loss of MRPI which requires a manual plant shutdown via Technical Specifications. To reduce the likelihood of overheat, and therefore manual shutdown, a fan will be installed in front of the MRPI display cabinet to provide additional cooling. While it is recognized that decreasing the likelihood of the need for manual shutdown will not increase (and may decrease) both the CDF and LERF, the addition of the fan will increase the combustible loading in the Relay Room. This will increase both the CDF and LERF due to fire.
Without attempting to quantify the potential reduction in the internal events CDF and LERF resulting from the decreased likelihood of manual shutdown, we pursue a bounding analysis for the increases in fire CDF and LERF due to the additional fan. If we can show that these increases, which bound the overall (if any) increases in total CDF and LERF (including any reduction in the internal events CDF and LERF), are inconsequential (<1E-8/yr for CDF and
<1E-9/yr for LERF), we need pursue this analysis no further.
The plants fire PSA indicates that the ignition frequency of 0.083/yr for the Relay Room includes the contribution from two existing HVAC fans, contributing a total of 5.4E-5/yr to this ignition frequency, or (5.4E-5/yr)/2 = 2.7E-5/yr per fan. The total ignition frequency for the Relay Room results from contributions in addition to that from the HVAC fans (whose contribution of 5.4E-5/yr is <0.1% of the total of 0.083/yr). Therefore, we can bound the increase in Relay Room ignition frequency from the addition of the fan by assuming a fractional increase of (2.7E-5/yr)/(5.4E-5/yr)*(0.0010) = 5.0E-4 in the Relay Room ignition frequency.
The plants fire PSA indicates that a Relay Room fire contributes 2.0% to the total fire CDF and LERF, each of which contributes 5.0% to the total internal plus external events CDF and LERF, 5.0E-5/yr and 2.0E-6/yr respectively. Thus, the total baseline fire CDF and LERF for the Relay Room, i.e., given the baseline initiator frequency of 0.083/yr, is (0.020)(0.050)(5.0E-5/yr) =
5.0E-8/yr for CDF and (0.020)(0.050)(2.0E-6/yr) = 2.0E-9/yr for LERF. Increasing the Relay Room ignition frequency by a fractional amount of 5.0E-4 results in increases in fire CDF and LERF of (5.0E-4)(5.0E-8/yr) = 2.5E-11/yr for CDF and (5.0E-4)(2.0E-9) = 1.0E-12/yr for LERF.
These increases can be assumed to bound the total increases in CDF and LERF due to the addition of the fan since any reduction in CDF and LERF from decreasing the likelihood of a manual shutdown has not been considered. Since both fall below the thresholds for inconsequential increases, no further analysis is warranted.
EXAMPLE 3.
Simplification in the Fire Protection Program That Results in an Increase in Total Risk A plants Fire Detection Instrumentation Panel (FDIP), a feature of the plant fire protection program, has four independent power sources, one of which is an obsolete battery that the plant would like to remove and not replace. The plants PSA indicates that failure of the FDIP, although modeled in the PSA, does not contribute to CDF or LERF above the calculational truncation value of 1.0E-10/yr. (This implies that there is no minimal cut set including failure of the FDIP with a CDF or LERF >1.0E-10/yr.) Since the batterys only function is to serve as a backup supply to the FDIP, it does not contribute to CDF or LERF above the 1.0E-10/yr threshold either.
Without attempting to quantify the actual contribution of failure of the FDIP to CDF and LERF, we pursue a bounding analysis for the increases in CDF and LERF due to the removal of the obsolete battery. If we can show that these increases are inconsequential (<1E-8/yr for CDF and <1E-9/yr for LERF), we need pursue this analysis no further.
To bound the potential increases in total CDF and LERF resulting from removal of the battery, we first assume that failure of the FDIP cannot contribute >1.0E-10/yr to the total CDF and LERF, based on the truncation value. The battery has a failure probability of 0.0020. Each of the other power sources, an additional (newer) battery and two battery chargers, has a failure probability of 5.0E-4. Since failure of all four supplies (two batteries and two battery chargers) would be necessary to fail power to the FDIP, the probability of loss of power would be the product of these four failure probabilities, i.e., (0.0020)(5.0E-4)3 = 2.5E-13. Since any minimal cut set including loss of power to the FDIP would have to include this product, we can bound the contribution by the product itself, i.e., 2.5E-13/yr (this conservatively assumes all other elements of the minimal cut set have frequencies/probabilities = 1.0).
With the obsolete battery removed, the maximum contribution from the minimal cut set including loss of power to the FDIP increases to (5.0E-4)3/yr = 1.3E-10/yr (an increase by a factor of 1/0.0020 = 500). This corresponds to the maximum potential increases in CDF and LERF resulting from removal of the obsolete battery. Since both fall below the thresholds for inconsequential increases, no further analysis is warranted.