ML070650160

Meeting Handout on MP2 SPAR Model

ML070650160
Person / Time
Site:	Perry
Issue date:	02/28/2007
From:	Bucheit D, Kindred G, Sowers G - No Known Affiliation, FirstEnergy Corp
To:	Office of Nuclear Reactor Regulation
DUBE DONALD, NRR/DRA/301 415-1483
Shared Package
ML070640582	List: ML070650160
References
Download: ML070650160 (5)

Text

During May 2004 Perry experienced a shaft coupling failure on an Emergency Service Water Pump. It took about 6 weeks (lots of OT on my part and the NRC contact) of constant communication with the regulator to resolve the SDP. The final result was Green; however, the NRC was pushing very hard to characterize the significance as White. Our SRA retired, thus the assessment was being performed by an SRA at NRR. We had the NRC's contractor, INEEL make several changes to the SPAR input deck, including initiating event frequencies, failure rates of components and other data.

We also spent significant time on common mode opposed to common cause.

Partitioning of the sequence of events was performed to take credit for pump run time. We hired a consultant to run conditional probabilities with Saphire using the Perry SPAR model. The cutsets were compared with our WinNUPRA results. Also, we discovered the NRC was inappropriately using 1.0 opposed to logical failure for conditional scenarios which gave a result about one magnitude higher. We had to hire an expert to explain that to the regulator. This issue appeared to be a strait-forward evaluation of a pump failure; however, it turned out to be complex in respect to the modeling by the NRC's contractor. For base case applications the results of the SPAR model solutions were good, it was when conditional scenarios were applied that the seems began to unravel.

Gerry W. Kindred Probabilistic Risk Assessment Perry Nuclear Power Plant First Energy Corporation

Here are some bullets on the Kewaunee SPAR models.

The NRC's external event SPAR model for Kewaunee was developed from the Kewaunee IPEEE model. Kewaunee is one of 7 units that the NRC has developed full scope SPAR models.

Dominion has not reviewed the NRC's SPAR model for Kewaunee, but has discussed key differences with the internal events models through reviews of the ROP SDP Phase 2 worksheets.

For more severe fires, the Kewaunee IPEEE fire model assumes that operators isolate offsite power and one entire safeguards train.

In reality, there are other options available before doing this. The SPAR model is expected to also contain this conservatism.

Fire modeling was performed in the Kewaunee IPEEE fire model with the COMPBRN code, which is known to be very conservative. In many

cases, fires were assumed to fail all equipment in a compartment (e.g.,

cable spreading room, switchgear rooms, relay rooms). The SPAR model is expected to also contain this conservatism.

The fire damage calculations in the Kewaunee IPEEE fire model assumed unqualified cable, when Kewaunee actually has cables qualified to IEEE-383. The SPAR model is expected to also contain this conservatism.

All cabling to a given component was considered to fail the component if the cable is damaged by fire (i.e., including instrumentation that may not impact functionality), unless it was clearly labeled otherwise.

The SPAR model is expected to also contain this conservatism.

Thomas G. Hook Nuclear Engineering Supervisor, PRA Applications Nuclear Analysis and Fuel IN3SW 8-730-2327 (tie-line)

Yes, I believe that the MP2 SPAR model does not credit the Charging pumps as additional SGTR mitigation strategy. When NRC Region 1 and we first started our SDP investigation, the NRC was initially questioning our crediting these pumps since we have downgraded them previously as non-risk significant and then removed them from the Tech. Specs.

That;s why we had to go to RELAP analysis to make a convincing case.

Also, I think that the SPAR models are based in some degree on generic guidance contained in WCAPs. In this case the applicable WCAP is WCAP-15955, Steam Generator Tube Rupture PSA Notebook, and it states explicitly that the charging pumps were not credited in the results.

In lieu of the charging pumps I noted that the MP2 SPAR model credits depressurization of the RCS down to the LPSI shutoff pressure (about 200 psia for MP2) when the HPSI pumps are not available for SGTR. This is at best a questionable proposition since the MP2 EOPs have never contained such guidance and the chances of success are rather slim.

This was a second major difference between our models.

Thirdly, there were differences in the top cutset sequences for SGTR.

This was related to the SPAR event tree for SGTR which was different from ours and included refilling of the RWST if the SDC was not available. Again, the EOP procedural guidance is somewhat vague here.

Another difference was the modeling of the Aux. Feedwater flow to the SGs after an accident. We changed our model to more closely correspond to the guidance contained in the EOPs which made a significant difference. We described these changes to the NRC in some detail, but I have no idea whether they have been incorporated in the SPAR model.

The NRC identified the SGTR event as the most affected by the AR model for MP2 does not credit Dave Bucheit

PVNGS Observations concerning SPAR Modeling Logic

1. SPAR GTG fault tree assigns probability that GTGs are unavailable to the subject unit since they may be aligned to other units that are also in an SBO condition. Although PVNGS does not model cross-unit SBO conditions, the decision to align GTGs to another unit would not be solely dependent on DG failures in another unit, but also upon the failure of the turbine driven AFW pump in the other units. If AFA is functioning in the other units (2&3) during an SBO, but failed in Unit 1, then GTGs would be aligned to Unit 1; there would be no probability of alignment to an inappropriate unit.

2. SPAR models GTGs to support 4160VAC Class power versus supporting the mitigating systems (AFW and HPSI). SPAR assigns a 50% probability that the GTGs are aligned to the wrong bus. PVNGS models GTGs to support the mitigating systems. In fact, Operations will assess the availability of AFW pumps and decide how to align the GTGs to maintain AFW functional, and as necessary a HPSI pump.

SPAR model gates ACP-PBA-ALIGN and ACP-PBB-ALIGN should be deleted (fault trees ACP-PBA-AC and ACP-PBB-AC), or replaced with GTG ANDed with AF failures on the train.

3. SPAR provides no credit for operator recovery of AFW A pump start failures with battery available. Cutsets appear for AFW A pump, but it is recoverable with just the battery available or with GTG available to A ESF bus. SPAR model lists probability of 1.00 for failure to recover start or run failures of turbine driven pump. In fact, the trubine driven AFW A pump is recoverable without control power (from a battery of restored AC power). PVNGS conservatively models the AFW A pump as recoverable and available with battery power available, and long term operation requires restoration of power to battery chargers.

4. SPAR assumes RCP seal failure LOCA probability on loss of power. In fact, CEOG analysis CE NPSD-1199-P concluded that PVNGS does not have a RCP seal failure LOCA. Maximum RCP leak rate is no greater than 17 gpm per pump, capable of makeup by the charging system, which would not require HPSI makeup. This CEOG analysis has been submitted for NRC review, and all issues were resolved. Two charging pumps are included in the GTG load profile.

5. The LOOP-1 and SBO event tree function events CBO and RSUB are dependent operator actions; performed by the same control room operator. Dependency should be eliminated or reconciled.

6. The SPAR SBO event tree asks for PSV and RCP seal functions upon success of AFW success. In fact, PVNGS PSVs will not lift on early AFW success, and RCP seals will not leak greater than charging capability. Thus neither function should be asked after AFW success.

7. SPAR sub-event tree SBO-1 asks for HPI, HPR, and CSR for SRV (fail to reseat) sequences. PVNGS models the PSV failure to reseat, but the energy released to containment [prior to cooldown and depressurization with successful AFW] during an SBO event does not challenge the containment structure. Thus SGHR should be asked instead of CSR. SGHR and HPSI can be powered by GTGs.

8. SPAR results include dependent HRAs for aligning AFW pumps (AFW-XHE-*) and starting secondary cooling (CND-XHE-*). These dependencies should be eliminated or reconciled. [This is a slight non-conservatism in SPAR.]

9. SPAR model credits either GTG to support a unit. In fact, both GTGs are required for sequences requiring HPSI and AFW pump (B or N). [This is a slight non-conservatism

in SPAR.] Both GTGs are also required in parallel to supply 2 units. SPAR model does not credit that 2 GTGs can supply more than one unit in an SBO (selective logic).

10. Gates GTG-17 and GTG-18 do not credit the probability of concurrent LOOP in Units 2 and 3, respectively. Only a subset of LOOP events (grid, and weather) impact multiple units. The plant-centered, switchyard-centered, and consequential LOOP events may not impact more than one unit, in which case failure of the other unit DGs is not a failure mechanism for supplying GTG power to Unit 1.

11. SPAR models GTG unavailability with multi-unit SBO considerations. PVNGS PRA Model does not address impact of other units; the probabilities for these cutsets is very small except for the 6 DG common cause event. It has not been confirmed that the 2DG and 6DG common cause events do not double count events from the common cause database. (fault trees GTG, EPS-DGA, EPS-DGB) SPAR models these common cause events as independent events in the fault tree, but in fact the events are dependent.

Event Probabilities

1. IELOOP is almost 3 times greater than PVNGS PRA (5.88E-2/year compared to 2.13E-2/year). PVNGS models switchyard-centered, grid related, severe weather, and extreme weather in the IELOOP frequency. Plant-centered faults leading to an initiating event are modeled with fault trees for complex initiators. These complex initiators are captured in the IEPBA/IEPBB initiating events. Consequential LOOP events (LOOP occuring as a result of a plant transient, 1.82E-3) are modeled specifically in the offsite power fault trees.

2. GTG operator action is less than PVNGS PRA (1.00E-1 compared to 1.60E-1). The SPAR value is applied regardless of the time actually needed to align the GTGs (one or two hours). The PVNGS value of 0.16 is applied to a one-hour start; if two hours or more are available (due to successful AFA operation) an adjustment factor of 0.25 is applied resulting in an HRA value of 4E-3. The adjustment represents the longer time available, lower stress, and recovery by E-Plan TSC personnel.

3. GTG fail to run events (2.02E-2, 7.7E-4 CCF) are at least a decade larger than the PVNGS values (9.67E-4, 4.01E-5 CCF). PVNGS models GTG failure to provide power to ESF bus in greater detail, including bus, breaker, controls, and batteries.

GTG fail to start events (4.0E-2) are almost twice as large as the PVNGS values (2.3E-2).

Gerry Sowers