ML16089A062
| ML16089A062 | |
| Person / Time | |
|---|---|
| Site: | Beaver Valley  |
| Issue date: | 03/30/2016 |
| From: | FirstEnergy Nuclear Operating Co |
| To: | Plant Licensing Branch 1 |
| Lamb T, NRR/DORL/LPLI-2 | |
| References | |
| Download: ML16089A062 (46) | |
Text
FirstEnergy Nuclear Operating Company Meeting to Discuss BVPS Draft PRA RAI March 30, 2016
Beaver Valley FPRA Dependency Analysis Mark Manoleras Director Site Engineering Tom Lentz Manager Fleet Licensing Phil Lashley Supervisor Fleet Licensing Dave McCreary Fleet Licensing Engineer Carmen Mancuso Manager Site Design Engineering Colin Keller Manager Fleet Design Engineering Mike Testa NFPA 805 Project Manager Ray Fine Supervisor Fleet PRA Bill Etzel PRA Engineer Rick Stremple PRA Engineer Doug Rapp PRA Engineer March 30, 2016 2
Beaver Valley FPRA Dependency Analysis Objectives
- Discuss Joint HEPs in BVPS FPRA in relation to draft PRA RAI 01.f.ii.01.01
- 1 Summarize our understanding of RAI
- a) We are here to provide for adequate justification that the BVPS quantitative fire risk estimates exclude the impact of unrealistically low joint HEPs
- 2 Clarify previous RAI responses
- a) Quantification methods used by Beaver Valley and how they relate to joint HEPs
- b) Methods of addressing dependencies at Beaver Valley
- c) Comparison of non-minimal sequences to minimal cutsets
- 3 Summarize results of dependency analysis
- a) Compare to 1E-05 floor value March 30, 2016 3
Beaver Valley FPRA Dependency Analysis Previous RAIs
- Requested specific examples and ranges of values
- Responses appeared unrealistic
- Examples of joint HEPs and value ranges were from full non-minimal accident sequences and contained non-consequential failures
- i.e., failures which do not affect whether the sequence progresses to core damage
- All sequence failures are present, not only minimal cutset
- Very different from more common minimal cutset examples, in both content and value March 30, 2016 4
Beaver Valley FPRA Dependency Analysis Beaver Valley used an established process to identify and evaluate joint HEPs
- Examples in previous RAI responses were not translated into minimal cutset, so they seem unrealistically low if considered in the same context as minimal cutset values Evaluation found that no dependent joint HEPs have values below 1E-05
- Each of these is specifically justified as to why its value is appropriate (reference dependency analyses, PRA-BV1-13-025-R00 and PRA-BV2-12-002-R00)
March 30, 2016 5
Beaver Valley FPRA Dependency Analysis BVPS dependency analysis
- How we do it at BVPS, and how it relates to more common CAFTA methods
- Many details are different, but we address the same fundamental concepts Intent is to ensure joint HEPs are properly accounted for in order to minimize non-conservative impact of lower-order joint HEPs on quantitative risk estimate March 30, 2016 6
Beaver Valley FPRA Dependency Analysis BVPS methodology for identifying joint HEPs is effectively the same as other NFPA 805 RISKMAN licensee
- Use same tool to map HFEs to split fractions
- Identify joint HEPs in sequence results based on the split fraction mapping
- Difference is that BVPS did not translate sequence results to minimal cutsets before evaluating joint HEPs for dependencies March 30, 2016 7
Beaver Valley FPRA Dependency Analysis Fundamental differences in PRA software quantification methodology require treatment of joint HEPs in BVPS FPRA different from most other licensees Comparison of BVPS FPRA model and standard linked fault tree models
- Compare and contrast model construction and quantification methods
- Focus on how these differences affect treatment of dependent HFEs
- Explain why the results may appear very different March 30, 2016 8
Beaver Valley FPRA Dependency Analysis CAFTA model
- Essentially quantified as a single top event, for core damage
- Solution represented by a set of minimal cutsets, which separately fail the whole-model fault tree March 30, 2016 9
Beaver Valley FPRA Dependency Analysis BVPS (RISKMAN) model
- Individual functions, systems, or system trains are separate top events (fault trees)
- Top events are linked relationally through event trees
- Split fractions are defined for each top event
- Boundary conditions are set to account for different states of support systems and other accident sequence details relevant to the top event
- House events in the fault tree are used to set the boundary conditions
- Split fraction value is conditional solution of the top event given the set of boundary conditions, calculated using binary decision diagrams (BDD)
- Cutsets can be identified by relative contribution to split fraction value (for a single top event)
March 30, 2016 10
Beaver Valley FPRA Dependency Analysis Split Fraction Boundary Conditions
-
- examples are from BVPS-1 dependency analysis model March 30, 2016 11
Beaver Valley FPRA Dependency Analysis Split Fraction cause table (cutsets)
-
- example is from BVPS-1 dependency analysis model March 30, 2016 12
Beaver Valley FPRA Dependency Analysis BVPS model
- Cutsets for a split fraction do not necessarily correspond to minimal core damage cutsets
- Top event (split fraction) in question may or may not affect sequence progression to core damage
- Results reported as full non-minimal accident sequences containing all split fractions, not only those which would appear in a minimal cutset March 30, 2016 13
Beaver Valley FPRA Dependency Analysis Draft RAI issue on split fraction HH102 (3rd and 4th paragraphs of draft RAI)
- Discussion in previous RAI response was based on the split fraction cutsets from the dependency quantification in which all HEP values were increased
- Each of the 4 actions is intended to accomplish the same goal, and are all under separate branches of OR logic contributing to failure of the fault tree
- Mutually exclusive in minimal cutsets for the split fraction March 30, 2016 14
Beaver Valley FPRA Dependency Analysis General Transient Event Tree (GENTRANS)
March 30, 2016 15
Beaver Valley FPRA Dependency Analysis Split Fraction Rules
- Written in terms of initiating events and state of top events previously evaluated in the sequence
- Both successes and failures are retained and used to define the sequence
- Conditions defined in rules match boundary conditions set in the corresponding split fraction
- When the initiating event is a fire scenario, the appropriate fire effects are set as boundary conditions March 30, 2016 16
Beaver Valley FPRA Dependency Analysis Split Fraction Rules March 30, 2016 17
Beaver Valley FPRA Dependency Analysis Linked Fault Tree Modeling
- Fault tree built around systems and components
- Quantification reveals unforeseen effects which must be adjusted using recovery rules (such as joint HEP dependencies)
BVPS RISKMAN Modeling
- All effects of functional failures or combinations of functional failures must be built into the model and used at the appropriate time by creating the proper set of split fractions and split fraction rules
- RISKMAN results cannot be post-processed March 30, 2016 18
Beaver Valley FPRA Dependency Analysis Linked fault tree quantification results
- Minimal cutsets BVPS (RISKMAN) quantification results
- Full accident sequences which bin to core damage, typically represented by the failed split fractions
- ALL failed split fractions including non-consequential failures (sequences are non-minimal)
- All split fractions used in the sequence can be reported
- Success data is retained, as are event tree bypasses
- Intervening successes are known and can be considered when evaluating dependency March 30, 2016 19
Beaver Valley FPRA Dependency Analysis Sequence quantification
- Total CDF of a single fire sequence is the product of the fire scenario initiating event frequency times all the split fraction terms called in the sequence (not only those which would be in a minimal core damage cutset)
- Failed split fractions are treated as (failure probability)
- Success split fractions are treated as (1-failure probability)
- Normal quantification produces 100s to 100,000s of individual unique sequences progressing to core damage for each fire scenario March 30, 2016 20
Beaver Valley FPRA Dependency Analysis Sequences compared to minimal cutsets
- Each individual sequence has a lower value than a corresponding minimal cutset
- Sequences contain non-consequential failures which reduce their individual value
- Many sequences therefore correspond to the same single minimal cutset, since there will be sequences for every possible combination of non-consequential split fraction success and failure
- The sum of all non-minimal sequences which correspond to a single minimal cutset will yield the same value as that single minimal cutset March 30, 2016 21
Beaver Valley FPRA Dependency Analysis Process for dependency analysis
- Increased HEP values to 0.8
- Did not use 1.0 so sequences containing HEP successes are retained
- Model will not quantify all sequences correctly without proper success terms
- Mapped HFEs to split fractions in which they appear
- HFEs appear in a split fraction if they are in any cutset contributing more than 1.0E-06% of the split fraction value (with HEPs=0.8)
- Determined the joint HEPs in each sequence
- Based on the split fractions selected
- Identified all possible HEP pairings present in the joint HEPs March 30, 2016 22
Beaver Valley FPRA Dependency Analysis Process for dependency analysis
- Identified pairings were evaluated using the general dependence tree
- Pairings retaining a non-zero level of dependence at this point were further examined by an expert panel
- They reviewed more closely the conditions associated with each pair of actions
- Also accounted for other factors such as intervening successes
- Determined which HFEs are actually credited in a given sequence joint HEP, due to mutually exclusive actions within separate cutsets of a single split fraction
- Resulting dispositions and dependency levels were recorded in the BVPS HRA Dependency Analyses March 30, 2016 23
Beaver Valley FPRA Dependency Analysis Dependency analysis expert team
- Part of the draft RAI questions the expert teams ability to justify joint HEP values without looking at the context provided by a minimal cutset joint HEP
- Context is required for the evaluation, and the HEPs in the BVPS models are defined using the accident sequence context to create multiple (mutually exclusive) basic events in a top event representing performance of a single action under different accident sequence conditions
- The necessary context is therefore inherent in the specific action basic events used in the action pairs being evaluated March 30, 2016 24
Beaver Valley FPRA Dependency Analysis Different HEP basic events for different accident sequences
- example Top Event OB - Operators align for primary bleed & feed Basic Event Accident context requiring separate basic events Values OPROB1 OF=S 1.60E-02 OPROB2 OF=F 1.40E-01 Top Event OF - Operators align alternate feedwater (AFW fails)
March 30, 2016 25
Beaver Valley FPRA Dependency Analysis Different HEP basic events for different accident sequences
- example Basic Event Accident context requiring separate basic events Values OPROF1 AF=S
- MA=F 7.81E-05 OPROF2 AF=F
- MF=S
- NOCIA 3.91E-04 OPROF3 AF=F
- MF=F
- NOCIA 9.01E-03 OPROF4 AF=F
- MF=S
- CIA 5.70E-03 OPROF5 AF=F
- MF=F
- MA is long-term makeup to AFW water supply
- MF is Main Feedwater
- CIA is containment isolation phase A (causes Main Feedwater Isolation signal)
- NOCIA is condition without containment isolation phase A (no Main Feedwater Isolation signal)
March 30, 2016 26
Beaver Valley FPRA Dependency Analysis Different HEP basic events for different accident sequences
- example Top Event CD - Operators initiate secondary cooldown/
depressurization - presumes AF=S + OF=S*(MF=S+DF=S)
Basic Event Accident context requiring separate basic events Values OPRCD1 SLOCA 2.10E-05 OPRCD2 SLOCA
- HH=F 1.00E-03 OPRCD7 LOCA
- HH=F
- Support fails 1.30E-02
- HH is high head safety injection system top event
- Support is combination of vital bus power and instrument air
- DF is dedicated AFW March 30, 2016 27
Beaver Valley FPRA Dependency Analysis Different HEP basic events for different accident sequences
- example Fire-specific versions of action basic events
- OPROB1F1 - Operators align for primary bleed & feed, OF=S, all credited instruments/cues unaffected by fire
- OPROB1F2 - Operators align for primary bleed & feed, OF=S, some credited instruments/cues affected by fire but others remain available
- OPROB1F3 - Operators align for primary bleed & feed, OF=S, all credited instruments/cues affected by fire (this version of the action always has a failure probability of 1.0)
March 30, 2016 28
Beaver Valley FPRA Dependency Analysis Process for dependency analysis
- Fundamentally identical to the method in the EPRI HRA Calculator for evaluating CAFTA cutsets
- Our process evaluates all possible HEP pairs, not only those immediately adjacent in time
- HRA calculator assesses A-B-C-D as A-B, B-C, C-D
- Our approach assesses these same pairs but also considers A-C, A-D, B-D
- Allows for uncertainty in timing assessments and sequence-specific details which may alter normal event timing
- Captures all possible joint HEPs, including combinations of different HFEs contributing to different cutsets within a single split fraction
- If A-Bdep.* B-Cdep.* C-Ddep.* A-Cdep.
- A-Ddep.
- B-Ddep.,
then A-B-C-Ddep.
March 30, 2016 29
Beaver Valley FPRA Dependency Analysis Process for dependency analysis
- Pair-wise evaluations are then applied to the longer combination HEPs
- Joint HEPs comprised solely of pairs determined to have zero dependence are screened from further analysis Treatment of joint HEPs in the model
- In a CAFTA model recovery rules are used to replace the dependent joint HEPs in the cutsets with new, higher values incorporating dependency factors
- In a RISKMAN model the results cannot be post-processed
- In the BVPS models, dependent effects are applied to individual HEP basic events and the split fractions are built accordingly, therefore it was not necessary to add split fractions with additional dependence factors at this time
- If new unaddressed dependent HEP combinations are identified in the future, they may be addressed by increasing subsequent split fraction values based on failure of specific preceding split fractions (without changing individual basic events)
March 30, 2016 30
Beaver Valley FPRA Dependency Analysis Dependency analysis results
- Justified zero dependence between HEPs in lower-value joint HEPs without reducing to minimal cutsets
- Low values for such joint HEPs are due to including all possible combinations of non-consequential HEPs
- Dependence between non-consequential HEPs does not alter the quantitative risk estimate, as discussed previously
- Sum of all non-minimal sequences corresponding to a given minimal cutset is the same value as that minimal cutset
- Increasing value of non-consequential HEPs to account for dependency does not change the overall numerical result March 30, 2016 31
Beaver Valley FPRA Dependency Analysis Dependency analysis results
- By evaluating all non-minimal joint HEPs, we inherently address all minimal cutset joint HEPs
- Quantitative risk estimate is no different between minimal cutsets and full non-minimal sequences
- Difference is in level of detail presented in the results, and how those results are examined
- Numerical value of each non-minimal joint HEP has little inherent meaning since most reported HFEs are non-consequential March 30, 2016 32
Beaver Valley FPRA Dependency Analysis Dependencies in a RISKMAN model
- HFE dependencies can be properly addressed in the model structure
- Model is built from the ground up with this in mind
- Create multiple, mutually exclusive basic events representing a single action, to be used in different types of sequences and depending on prior action success/ failure
- Create mutually exclusive fault tree logic for different operator actions within a single top event
- Create mutually exclusive relationships between operator actions in different top events using split fraction rules
- i.e., if one such action fails, the other would not be present in the same minimal cutset March 30, 2016 33
Beaver Valley FPRA Dependency Analysis Compare full sequence joint HEP to minimal cutset joint HEP
- BVPS 2nd round RAI response provided an example BVPS-1 non-minimal joint HEP with a calculated value of 2.09E-40
- Calculated value is the product of the nominal HEPs for all actions potentially credited in all cutsets contributing to the split fractions used in this sequence
- Each cutset is a fraction of the split fraction value, and each HEP is a fraction of a cutset value
- Capturing the joint HEP in this way is intended to produce all possible HEP combinations for evaluation March 30, 2016 34
Beaver Valley FPRA Dependency Analysis Compare full sequence joint HEP to minimal cutset joint HEP
- The example non-minimal joint HEP comes from this sequence:
ZXF*YSB2*YCI1*YDP3*YNB128*YNC134*NA137*NDF045*DPF*IW F*YOC12*YSIS80*YPVA5K*SBF*OS1A*WBF*CTF*IAF*ICF*TBF*OT 1*TTF*MSF*PRF*PL1*ASF*MA2H*MFF*DF1A*OFF*OBF*HH033T*S EF*OCF*LBF*ODF*BIPF*NRF*NMF*QAF*QBF*R2F*RSF*RBF*VBF
- CIE2*REF*SSF*CG1 (the asterisk
- is the logical AND operator, simply stating that all the listed split fractions fail in this sequence)
March 30, 2016 35
Beaver Valley FPRA Dependency Analysis Compare full sequence joint HEP to minimal cutset joint HEP
- The example joint HEP is:
OPRD12*OPRD04*OPRDF1*OPRHH1F1*OPRHH3F1*OPRHH5F1*
OPRHH6F1*OPRMA1F1*OPRMA2F1*OPROS1F1*OPROT1*
OPFCI1*OPRD08*OPRD10*OPRPR1F1*OPRSM5*OPRC11*
OPRD06
- Multiplying these HEPs = 2.09E-40 March 30, 2016 36
Beaver Valley FPRA Dependency Analysis Compare full sequence joint HEP to minimal cutset joint HEP
- By examining the split fractions in this sequence and the corresponding split fraction rules, we can determine that the minimal cutset split fractions for this sequence are YPVA5K
- HH033T
- We then examine the cause table for each split fraction to identify the contributors March 30, 2016 37
Beaver Valley FPRA Dependency Analysis Compare full sequence joint HEP to minimal cutset joint HEP
- Cause table for split fraction YPVA5K
- Only cutset is PVAFPCVRC455C
- OPRSM5
- OPRPR1F1 March 30, 2016 38
Beaver Valley FPRA Dependency Analysis Compare full sequence joint HEP to minimal cutset joint HEP
- Cause table for split fraction HH033T (partial example)
- Contributing cutset is OPRHH1F1*PMOSCHP1A, but this is also due to fire impacts on CBFF4KVS1DF1F11 and CBFF4KVS1DF1F15 in SF boundary conditions March 30, 2016 39
Beaver Valley FPRA Dependency Analysis Compare full sequence joint HEP to minimal cutset joint HEP
- Minimal cutset leading to core damage for this example sequence is therefore:
PVAFPCVRC455C
- OPRPR1F1
- OPRSM5
- CBFF4KVS1DF1F11
- CBFF4KVS1DF1F15
- OPRHH1F1
- PMOSCHP1A
- PVAFPCVRC455C is spurious opening of a PORV
- OPPR1F1 is the operator action to attempt closure of the PORV block MOV at the main control board
- OPRSM5 is the local operator action to close the PORV via the keylock isolation switch in the field
- CBFF4KVS1DF1F11 and CBFF4KVS1DF1F15 are fire induced failures of breakers supplying 4160V AC to the B and C HHSI pumps
- OPRHH1F1 is the operator action to locally start the standby HHSI pump
- PMOSCHP1A is the random failure to start of Charging Pump 1A March 30, 2016 40
Beaver Valley FPRA Dependency Analysis Compare full sequence joint HEP to minimal cutset joint HEP
- Joint HEP from the minimal cutset is therefore OPRHH1F1
- OPRPR1F1
- OPRSM5
- Example joint HEP value is 1.31E-07
- Calculated as the product of the individual HEP values
- Three distinct pairings are present within this joint HEP
- Dependency evaluations for these pairings are listed in Table 1 (next slide)
March 30, 2016 41
Beaver Valley FPRA Dependency Analysis Table 1 Table 1: BVPS-1 Independence Review of Joint HEP OPRHH1F1-OPRPR1F1-OPRSM5 Operator Operator Dependency Override1 Disposition Action 1 Action 2 Category1 Zero dependence established based on different cues for cognition and the time available to accomplish the OPRPR1F1 action is significant (30-60 minutes) when compared to OPRHH1F1. Initial zero dependence level subsequently reviewed by the OPRHH1F1 OPRPR1F1 ZD BVPS PRA team members (including a former BVPS SRO) to verify that it appropriately reflects the nature of the relationships among the HFEs in the context of the accident sequences in which they appear.
FEP operator actions (OPRSM5) are independent among themselves and from the EOP actions as they involve strictly manipulation steps specified clearly in the procedures OPRHH1F1 OPRSM5 ZD and these actions are deemed to have little cognition to consider and involve simply execution of the explicit procedure steps. There is no decision-making for the local operator; these actions are simply a list of things that must be done.
FEP operator actions (OPRSM5) are independent among themselves and from the EOP actions as they involve strictly manipulation steps specified clearly in the procedures OPRPR1F1 OPRSM5 ZD and these actions are deemed to have little cognition to consider and involve simply execution of the explicit procedure steps. There is no decision-making for the local operator; these actions are simply a list of things that must be done.
March 30, 2016 42
Beaver Valley FPRA Dependency Analysis Compare full sequence joint HEP to minimal cutset joint HEP
- Combining the pair-wise evaluations, we see that this joint HEP value below 1E-05 is justified based on zero dependence
- OPRHH1F1 is symptom-based, cued from SI flow indication
- OPRPR1F1 is symptom-based, cued from pressurizer pressure and pressurizer relief line temperature
- Cues for these actions are separate and distinct
- Total system time windows for these actions are also separated by a substantial margin
- OPRSM5 is fire-specific action for a local operator to close the PORVs using the keylock isolation switch
- Not symptom based; instead is performed when the local operator reaches that step in his procedure, regardless of specific plant conditions or cues
- Cue for this action is therefore entirely independent, and action is performed by independent operator March 30, 2016 43
Beaver Valley FPRA Dependency Analysis Dependency analysis results
- Joint HEPs identified to contain potential dependency concerns are captured in the formal dependency analysis and investigated to ensure proper treatment of any dependencies
- Conclusion is that joint HEPs are properly accounted for in model quantification
- Joint HEPs below 1E-05 are specifically justified March 30, 2016 44
Beaver Valley FPRA Dependency Analysis Going Forward Actions
- FENOC intends to provide adequate justification for the alternate method used at BVPS to exclude the impact of unrealistically low joint HEPs
- Response will clarify PRA RAI 01.f.ii.01, to address the reporting of non-minimal sequence results March 30, 2016 45
Beaver Valley FPRA Dependency Analysis Questions and Answers March 30, 2016 46
FirstEnergy Nuclear Operating Company Meeting to Discuss BVPS Draft PRA RAI March 30, 2016
Beaver Valley FPRA Dependency Analysis Mark Manoleras Director Site Engineering Tom Lentz Manager Fleet Licensing Phil Lashley Supervisor Fleet Licensing Dave McCreary Fleet Licensing Engineer Carmen Mancuso Manager Site Design Engineering Colin Keller Manager Fleet Design Engineering Mike Testa NFPA 805 Project Manager Ray Fine Supervisor Fleet PRA Bill Etzel PRA Engineer Rick Stremple PRA Engineer Doug Rapp PRA Engineer March 30, 2016 2
Beaver Valley FPRA Dependency Analysis Objectives
- Discuss Joint HEPs in BVPS FPRA in relation to draft PRA RAI 01.f.ii.01.01
- 1 Summarize our understanding of RAI
- a) We are here to provide for adequate justification that the BVPS quantitative fire risk estimates exclude the impact of unrealistically low joint HEPs
- 2 Clarify previous RAI responses
- a) Quantification methods used by Beaver Valley and how they relate to joint HEPs
- b) Methods of addressing dependencies at Beaver Valley
- c) Comparison of non-minimal sequences to minimal cutsets
- 3 Summarize results of dependency analysis
- a) Compare to 1E-05 floor value March 30, 2016 3
Beaver Valley FPRA Dependency Analysis Previous RAIs
- Requested specific examples and ranges of values
- Responses appeared unrealistic
- Examples of joint HEPs and value ranges were from full non-minimal accident sequences and contained non-consequential failures
- i.e., failures which do not affect whether the sequence progresses to core damage
- All sequence failures are present, not only minimal cutset
- Very different from more common minimal cutset examples, in both content and value March 30, 2016 4
Beaver Valley FPRA Dependency Analysis Beaver Valley used an established process to identify and evaluate joint HEPs
- Examples in previous RAI responses were not translated into minimal cutset, so they seem unrealistically low if considered in the same context as minimal cutset values Evaluation found that no dependent joint HEPs have values below 1E-05
- Each of these is specifically justified as to why its value is appropriate (reference dependency analyses, PRA-BV1-13-025-R00 and PRA-BV2-12-002-R00)
March 30, 2016 5
Beaver Valley FPRA Dependency Analysis BVPS dependency analysis
- How we do it at BVPS, and how it relates to more common CAFTA methods
- Many details are different, but we address the same fundamental concepts Intent is to ensure joint HEPs are properly accounted for in order to minimize non-conservative impact of lower-order joint HEPs on quantitative risk estimate March 30, 2016 6
Beaver Valley FPRA Dependency Analysis BVPS methodology for identifying joint HEPs is effectively the same as other NFPA 805 RISKMAN licensee
- Use same tool to map HFEs to split fractions
- Identify joint HEPs in sequence results based on the split fraction mapping
- Difference is that BVPS did not translate sequence results to minimal cutsets before evaluating joint HEPs for dependencies March 30, 2016 7
Beaver Valley FPRA Dependency Analysis Fundamental differences in PRA software quantification methodology require treatment of joint HEPs in BVPS FPRA different from most other licensees Comparison of BVPS FPRA model and standard linked fault tree models
- Compare and contrast model construction and quantification methods
- Focus on how these differences affect treatment of dependent HFEs
- Explain why the results may appear very different March 30, 2016 8
Beaver Valley FPRA Dependency Analysis CAFTA model
- Essentially quantified as a single top event, for core damage
- Solution represented by a set of minimal cutsets, which separately fail the whole-model fault tree March 30, 2016 9
Beaver Valley FPRA Dependency Analysis BVPS (RISKMAN) model
- Individual functions, systems, or system trains are separate top events (fault trees)
- Top events are linked relationally through event trees
- Split fractions are defined for each top event
- Boundary conditions are set to account for different states of support systems and other accident sequence details relevant to the top event
- House events in the fault tree are used to set the boundary conditions
- Split fraction value is conditional solution of the top event given the set of boundary conditions, calculated using binary decision diagrams (BDD)
- Cutsets can be identified by relative contribution to split fraction value (for a single top event)
March 30, 2016 10
Beaver Valley FPRA Dependency Analysis Split Fraction Boundary Conditions
-
- examples are from BVPS-1 dependency analysis model March 30, 2016 11
Beaver Valley FPRA Dependency Analysis Split Fraction cause table (cutsets)
-
- example is from BVPS-1 dependency analysis model March 30, 2016 12
Beaver Valley FPRA Dependency Analysis BVPS model
- Cutsets for a split fraction do not necessarily correspond to minimal core damage cutsets
- Top event (split fraction) in question may or may not affect sequence progression to core damage
- Results reported as full non-minimal accident sequences containing all split fractions, not only those which would appear in a minimal cutset March 30, 2016 13
Beaver Valley FPRA Dependency Analysis Draft RAI issue on split fraction HH102 (3rd and 4th paragraphs of draft RAI)
- Discussion in previous RAI response was based on the split fraction cutsets from the dependency quantification in which all HEP values were increased
- Each of the 4 actions is intended to accomplish the same goal, and are all under separate branches of OR logic contributing to failure of the fault tree
- Mutually exclusive in minimal cutsets for the split fraction March 30, 2016 14
Beaver Valley FPRA Dependency Analysis General Transient Event Tree (GENTRANS)
March 30, 2016 15
Beaver Valley FPRA Dependency Analysis Split Fraction Rules
- Written in terms of initiating events and state of top events previously evaluated in the sequence
- Both successes and failures are retained and used to define the sequence
- Conditions defined in rules match boundary conditions set in the corresponding split fraction
- When the initiating event is a fire scenario, the appropriate fire effects are set as boundary conditions March 30, 2016 16
Beaver Valley FPRA Dependency Analysis Split Fraction Rules March 30, 2016 17
Beaver Valley FPRA Dependency Analysis Linked Fault Tree Modeling
- Fault tree built around systems and components
- Quantification reveals unforeseen effects which must be adjusted using recovery rules (such as joint HEP dependencies)
BVPS RISKMAN Modeling
- All effects of functional failures or combinations of functional failures must be built into the model and used at the appropriate time by creating the proper set of split fractions and split fraction rules
- RISKMAN results cannot be post-processed March 30, 2016 18
Beaver Valley FPRA Dependency Analysis Linked fault tree quantification results
- Minimal cutsets BVPS (RISKMAN) quantification results
- Full accident sequences which bin to core damage, typically represented by the failed split fractions
- ALL failed split fractions including non-consequential failures (sequences are non-minimal)
- All split fractions used in the sequence can be reported
- Success data is retained, as are event tree bypasses
- Intervening successes are known and can be considered when evaluating dependency March 30, 2016 19
Beaver Valley FPRA Dependency Analysis Sequence quantification
- Total CDF of a single fire sequence is the product of the fire scenario initiating event frequency times all the split fraction terms called in the sequence (not only those which would be in a minimal core damage cutset)
- Failed split fractions are treated as (failure probability)
- Success split fractions are treated as (1-failure probability)
- Normal quantification produces 100s to 100,000s of individual unique sequences progressing to core damage for each fire scenario March 30, 2016 20
Beaver Valley FPRA Dependency Analysis Sequences compared to minimal cutsets
- Each individual sequence has a lower value than a corresponding minimal cutset
- Sequences contain non-consequential failures which reduce their individual value
- Many sequences therefore correspond to the same single minimal cutset, since there will be sequences for every possible combination of non-consequential split fraction success and failure
- The sum of all non-minimal sequences which correspond to a single minimal cutset will yield the same value as that single minimal cutset March 30, 2016 21
Beaver Valley FPRA Dependency Analysis Process for dependency analysis
- Increased HEP values to 0.8
- Did not use 1.0 so sequences containing HEP successes are retained
- Model will not quantify all sequences correctly without proper success terms
- Mapped HFEs to split fractions in which they appear
- HFEs appear in a split fraction if they are in any cutset contributing more than 1.0E-06% of the split fraction value (with HEPs=0.8)
- Determined the joint HEPs in each sequence
- Based on the split fractions selected
- Identified all possible HEP pairings present in the joint HEPs March 30, 2016 22
Beaver Valley FPRA Dependency Analysis Process for dependency analysis
- Identified pairings were evaluated using the general dependence tree
- Pairings retaining a non-zero level of dependence at this point were further examined by an expert panel
- They reviewed more closely the conditions associated with each pair of actions
- Also accounted for other factors such as intervening successes
- Determined which HFEs are actually credited in a given sequence joint HEP, due to mutually exclusive actions within separate cutsets of a single split fraction
- Resulting dispositions and dependency levels were recorded in the BVPS HRA Dependency Analyses March 30, 2016 23
Beaver Valley FPRA Dependency Analysis Dependency analysis expert team
- Part of the draft RAI questions the expert teams ability to justify joint HEP values without looking at the context provided by a minimal cutset joint HEP
- Context is required for the evaluation, and the HEPs in the BVPS models are defined using the accident sequence context to create multiple (mutually exclusive) basic events in a top event representing performance of a single action under different accident sequence conditions
- The necessary context is therefore inherent in the specific action basic events used in the action pairs being evaluated March 30, 2016 24
Beaver Valley FPRA Dependency Analysis Different HEP basic events for different accident sequences
- example Top Event OB - Operators align for primary bleed & feed Basic Event Accident context requiring separate basic events Values OPROB1 OF=S 1.60E-02 OPROB2 OF=F 1.40E-01 Top Event OF - Operators align alternate feedwater (AFW fails)
March 30, 2016 25
Beaver Valley FPRA Dependency Analysis Different HEP basic events for different accident sequences
- example Basic Event Accident context requiring separate basic events Values OPROF1 AF=S
- MA=F 7.81E-05 OPROF2 AF=F
- MF=S
- NOCIA 3.91E-04 OPROF3 AF=F
- MF=F
- NOCIA 9.01E-03 OPROF4 AF=F
- MF=S
- CIA 5.70E-03 OPROF5 AF=F
- MF=F
- MA is long-term makeup to AFW water supply
- MF is Main Feedwater
- CIA is containment isolation phase A (causes Main Feedwater Isolation signal)
- NOCIA is condition without containment isolation phase A (no Main Feedwater Isolation signal)
March 30, 2016 26
Beaver Valley FPRA Dependency Analysis Different HEP basic events for different accident sequences
- example Top Event CD - Operators initiate secondary cooldown/
depressurization - presumes AF=S + OF=S*(MF=S+DF=S)
Basic Event Accident context requiring separate basic events Values OPRCD1 SLOCA 2.10E-05 OPRCD2 SLOCA
- HH=F 1.00E-03 OPRCD7 LOCA
- HH=F
- Support fails 1.30E-02
- HH is high head safety injection system top event
- Support is combination of vital bus power and instrument air
- DF is dedicated AFW March 30, 2016 27
Beaver Valley FPRA Dependency Analysis Different HEP basic events for different accident sequences
- example Fire-specific versions of action basic events
- OPROB1F1 - Operators align for primary bleed & feed, OF=S, all credited instruments/cues unaffected by fire
- OPROB1F2 - Operators align for primary bleed & feed, OF=S, some credited instruments/cues affected by fire but others remain available
- OPROB1F3 - Operators align for primary bleed & feed, OF=S, all credited instruments/cues affected by fire (this version of the action always has a failure probability of 1.0)
March 30, 2016 28
Beaver Valley FPRA Dependency Analysis Process for dependency analysis
- Fundamentally identical to the method in the EPRI HRA Calculator for evaluating CAFTA cutsets
- Our process evaluates all possible HEP pairs, not only those immediately adjacent in time
- HRA calculator assesses A-B-C-D as A-B, B-C, C-D
- Our approach assesses these same pairs but also considers A-C, A-D, B-D
- Allows for uncertainty in timing assessments and sequence-specific details which may alter normal event timing
- Captures all possible joint HEPs, including combinations of different HFEs contributing to different cutsets within a single split fraction
- If A-Bdep.* B-Cdep.* C-Ddep.* A-Cdep.
- A-Ddep.
- B-Ddep.,
then A-B-C-Ddep.
March 30, 2016 29
Beaver Valley FPRA Dependency Analysis Process for dependency analysis
- Pair-wise evaluations are then applied to the longer combination HEPs
- Joint HEPs comprised solely of pairs determined to have zero dependence are screened from further analysis Treatment of joint HEPs in the model
- In a CAFTA model recovery rules are used to replace the dependent joint HEPs in the cutsets with new, higher values incorporating dependency factors
- In a RISKMAN model the results cannot be post-processed
- In the BVPS models, dependent effects are applied to individual HEP basic events and the split fractions are built accordingly, therefore it was not necessary to add split fractions with additional dependence factors at this time
- If new unaddressed dependent HEP combinations are identified in the future, they may be addressed by increasing subsequent split fraction values based on failure of specific preceding split fractions (without changing individual basic events)
March 30, 2016 30
Beaver Valley FPRA Dependency Analysis Dependency analysis results
- Justified zero dependence between HEPs in lower-value joint HEPs without reducing to minimal cutsets
- Low values for such joint HEPs are due to including all possible combinations of non-consequential HEPs
- Dependence between non-consequential HEPs does not alter the quantitative risk estimate, as discussed previously
- Sum of all non-minimal sequences corresponding to a given minimal cutset is the same value as that minimal cutset
- Increasing value of non-consequential HEPs to account for dependency does not change the overall numerical result March 30, 2016 31
Beaver Valley FPRA Dependency Analysis Dependency analysis results
- By evaluating all non-minimal joint HEPs, we inherently address all minimal cutset joint HEPs
- Quantitative risk estimate is no different between minimal cutsets and full non-minimal sequences
- Difference is in level of detail presented in the results, and how those results are examined
- Numerical value of each non-minimal joint HEP has little inherent meaning since most reported HFEs are non-consequential March 30, 2016 32
Beaver Valley FPRA Dependency Analysis Dependencies in a RISKMAN model
- HFE dependencies can be properly addressed in the model structure
- Model is built from the ground up with this in mind
- Create multiple, mutually exclusive basic events representing a single action, to be used in different types of sequences and depending on prior action success/ failure
- Create mutually exclusive fault tree logic for different operator actions within a single top event
- Create mutually exclusive relationships between operator actions in different top events using split fraction rules
- i.e., if one such action fails, the other would not be present in the same minimal cutset March 30, 2016 33
Beaver Valley FPRA Dependency Analysis Compare full sequence joint HEP to minimal cutset joint HEP
- BVPS 2nd round RAI response provided an example BVPS-1 non-minimal joint HEP with a calculated value of 2.09E-40
- Calculated value is the product of the nominal HEPs for all actions potentially credited in all cutsets contributing to the split fractions used in this sequence
- Each cutset is a fraction of the split fraction value, and each HEP is a fraction of a cutset value
- Capturing the joint HEP in this way is intended to produce all possible HEP combinations for evaluation March 30, 2016 34
Beaver Valley FPRA Dependency Analysis Compare full sequence joint HEP to minimal cutset joint HEP
- The example non-minimal joint HEP comes from this sequence:
ZXF*YSB2*YCI1*YDP3*YNB128*YNC134*NA137*NDF045*DPF*IW F*YOC12*YSIS80*YPVA5K*SBF*OS1A*WBF*CTF*IAF*ICF*TBF*OT 1*TTF*MSF*PRF*PL1*ASF*MA2H*MFF*DF1A*OFF*OBF*HH033T*S EF*OCF*LBF*ODF*BIPF*NRF*NMF*QAF*QBF*R2F*RSF*RBF*VBF
- CIE2*REF*SSF*CG1 (the asterisk
- is the logical AND operator, simply stating that all the listed split fractions fail in this sequence)
March 30, 2016 35
Beaver Valley FPRA Dependency Analysis Compare full sequence joint HEP to minimal cutset joint HEP
- The example joint HEP is:
OPRD12*OPRD04*OPRDF1*OPRHH1F1*OPRHH3F1*OPRHH5F1*
OPRHH6F1*OPRMA1F1*OPRMA2F1*OPROS1F1*OPROT1*
OPFCI1*OPRD08*OPRD10*OPRPR1F1*OPRSM5*OPRC11*
OPRD06
- Multiplying these HEPs = 2.09E-40 March 30, 2016 36
Beaver Valley FPRA Dependency Analysis Compare full sequence joint HEP to minimal cutset joint HEP
- By examining the split fractions in this sequence and the corresponding split fraction rules, we can determine that the minimal cutset split fractions for this sequence are YPVA5K
- HH033T
- We then examine the cause table for each split fraction to identify the contributors March 30, 2016 37
Beaver Valley FPRA Dependency Analysis Compare full sequence joint HEP to minimal cutset joint HEP
- Cause table for split fraction YPVA5K
- Only cutset is PVAFPCVRC455C
- OPRSM5
- OPRPR1F1 March 30, 2016 38
Beaver Valley FPRA Dependency Analysis Compare full sequence joint HEP to minimal cutset joint HEP
- Cause table for split fraction HH033T (partial example)
- Contributing cutset is OPRHH1F1*PMOSCHP1A, but this is also due to fire impacts on CBFF4KVS1DF1F11 and CBFF4KVS1DF1F15 in SF boundary conditions March 30, 2016 39
Beaver Valley FPRA Dependency Analysis Compare full sequence joint HEP to minimal cutset joint HEP
- Minimal cutset leading to core damage for this example sequence is therefore:
PVAFPCVRC455C
- OPRPR1F1
- OPRSM5
- CBFF4KVS1DF1F11
- CBFF4KVS1DF1F15
- OPRHH1F1
- PMOSCHP1A
- PVAFPCVRC455C is spurious opening of a PORV
- OPPR1F1 is the operator action to attempt closure of the PORV block MOV at the main control board
- OPRSM5 is the local operator action to close the PORV via the keylock isolation switch in the field
- CBFF4KVS1DF1F11 and CBFF4KVS1DF1F15 are fire induced failures of breakers supplying 4160V AC to the B and C HHSI pumps
- OPRHH1F1 is the operator action to locally start the standby HHSI pump
- PMOSCHP1A is the random failure to start of Charging Pump 1A March 30, 2016 40
Beaver Valley FPRA Dependency Analysis Compare full sequence joint HEP to minimal cutset joint HEP
- Joint HEP from the minimal cutset is therefore OPRHH1F1
- OPRPR1F1
- OPRSM5
- Example joint HEP value is 1.31E-07
- Calculated as the product of the individual HEP values
- Three distinct pairings are present within this joint HEP
- Dependency evaluations for these pairings are listed in Table 1 (next slide)
March 30, 2016 41
Beaver Valley FPRA Dependency Analysis Table 1 Table 1: BVPS-1 Independence Review of Joint HEP OPRHH1F1-OPRPR1F1-OPRSM5 Operator Operator Dependency Override1 Disposition Action 1 Action 2 Category1 Zero dependence established based on different cues for cognition and the time available to accomplish the OPRPR1F1 action is significant (30-60 minutes) when compared to OPRHH1F1. Initial zero dependence level subsequently reviewed by the OPRHH1F1 OPRPR1F1 ZD BVPS PRA team members (including a former BVPS SRO) to verify that it appropriately reflects the nature of the relationships among the HFEs in the context of the accident sequences in which they appear.
FEP operator actions (OPRSM5) are independent among themselves and from the EOP actions as they involve strictly manipulation steps specified clearly in the procedures OPRHH1F1 OPRSM5 ZD and these actions are deemed to have little cognition to consider and involve simply execution of the explicit procedure steps. There is no decision-making for the local operator; these actions are simply a list of things that must be done.
FEP operator actions (OPRSM5) are independent among themselves and from the EOP actions as they involve strictly manipulation steps specified clearly in the procedures OPRPR1F1 OPRSM5 ZD and these actions are deemed to have little cognition to consider and involve simply execution of the explicit procedure steps. There is no decision-making for the local operator; these actions are simply a list of things that must be done.
March 30, 2016 42
Beaver Valley FPRA Dependency Analysis Compare full sequence joint HEP to minimal cutset joint HEP
- Combining the pair-wise evaluations, we see that this joint HEP value below 1E-05 is justified based on zero dependence
- OPRHH1F1 is symptom-based, cued from SI flow indication
- OPRPR1F1 is symptom-based, cued from pressurizer pressure and pressurizer relief line temperature
- Cues for these actions are separate and distinct
- Total system time windows for these actions are also separated by a substantial margin
- OPRSM5 is fire-specific action for a local operator to close the PORVs using the keylock isolation switch
- Not symptom based; instead is performed when the local operator reaches that step in his procedure, regardless of specific plant conditions or cues
- Cue for this action is therefore entirely independent, and action is performed by independent operator March 30, 2016 43
Beaver Valley FPRA Dependency Analysis Dependency analysis results
- Joint HEPs identified to contain potential dependency concerns are captured in the formal dependency analysis and investigated to ensure proper treatment of any dependencies
- Conclusion is that joint HEPs are properly accounted for in model quantification
- Joint HEPs below 1E-05 are specifically justified March 30, 2016 44
Beaver Valley FPRA Dependency Analysis Going Forward Actions
- FENOC intends to provide adequate justification for the alternate method used at BVPS to exclude the impact of unrealistically low joint HEPs
- Response will clarify PRA RAI 01.f.ii.01, to address the reporting of non-minimal sequence results March 30, 2016 45
Beaver Valley FPRA Dependency Analysis Questions and Answers March 30, 2016 46