ML17219A484
| ML17219A484 | |
| Person / Time | |
|---|---|
| Site: | Saint Lucie  |
| Issue date: | 04/01/1987 |
| From: | Woody C FLORIDA POWER & LIGHT CO. |
| To: | NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM) |
| Shared Package | |
| ML17219A485 | List: |
| References | |
| GL-84-13, L-87-147, NUDOCS 8704060349 | |
| Download: ML17219A484 (37) | |
Text
EGG-REQ-7842 November 1988 TECHNICAL EVALUATIONREPORT
/daho A REVIEW OF THE FLORIDA POWER AND LIGHT CNPANY SAFETY EVALUATIONS FOR EXTENDING THE ST. LJCIE National PLANT, UNIT NO. 2 FSFAS SUBGROUP RELAY TEST En gineerin g INTERVAL Laboratory Managed Dav)d P. Mackowfak by the U.S.
Oepanment of Energy Prepared for the
~gE&z&~
n U.S. NUCLEAR REGULATORY COMMISSION Work perronned under ME Conuect No. DF:ANT-7NNlSP I
8704060349 87pppg
,, 'PDR",'ADOCK 05000389, I '-;
'3 r'pP
EGG-REQ-7842 A REVIEW OF THE FLORIDA POWER AND LIGHT COMPANY SAFETY EVALUATIONS FOR EXTENDING THE ST. LUCIE PLANT, UNIT NO. 2 ESFAS SUBGROUP RELAY TEST INTERVAL David P. Mackowiak Published November 1988 EGEG Idaho, Inc.
Idaho Falls, Idaho 83415 Prepared for the U.S. Nuclear Regulatory Commission Washington, DC 20555 Under DOE Contract No. DE-AC07-76ID01570 FIN No. D6023
ABSTRACT This review examines the Florida Power and Light Company's (FPL's) request to the Nuclear Regulatory Commission (NRC) to amend the operating license for FPL's St. Lucie Plant, Unit No. 2. The proposed amendment would change the surveillance test interval of the Engineered Safety Features Actuation System (ESFAS) subgroup relays from 6 to 18 months.
EGKG Idaho, Inc., at the Idaho National Engineering Laboratory (INEL),
conducted the review to assist the NRC in assessing the validity of FPL's claim that extending the subgroup relay test interval will not significantly impact the ESFAS availability. We examined FPL's modelin'g E
methodologies and assumptions, compared their models to the system drawings, and checked their model quantifications for accuracy. FPL's data were examined and compared to data from other sources. We conducted uncertainty and time-dependent reliability analyses to assess the impact of test interval extensions on the ESFAS availability. The uncertainty analyses showed the 6-month and the 18-month system unavailability distribution means to represent different populations. Based on these results, we conclude the impact of subgroup relay test interval extension to be significant and reject FPL's claim that the impact is insignificant.
FIN No. 06023 Review of P 1 ant-Speci fi c Licensing Actions For Operating Reactor Issues
SUMMARY
This is a review of the Florida Power and Light Company's (FPL's) request to the Nuclear Regulatory Commission (NRC) I to extend the surveillance test interval of the Engineered Safety Feature Actuation System (ESFAS) subgroup relays at its St. Lucie Plant, Unit No. 2.
To support its request, FPL provided the NRC with Safety Evaluations of the impact of reduced testing on two subsystems of the ESFAS, the Safety Injection Actuation Signal (SIAS), and the Auxiliary Feedwater Actuation System (AFAS). FPL analyzed the SIAS and AFAS separately because they are different designs manufactured by different companies.
The review was done to'ssess the validity of FPL's claim that the test interval extension does not significantly affect the availability of the ESFAS, and therefore involves no significant hazards considerations and does not result in a safety margin reduction. The NRC's Office of, Nuclear Reactor Regulation (NRR) requested the Probabilistic Risk Assessment (PRA)
Unit of EGKG Idaho, Inc. (EKING), at the Idaho National Engineering Laboratory (INEL), to conduct the review.
The review assessed the adequacy of FPL's SIAS and AFAS analyses methodologies, data, and assumptions. Specifically, we determined the
'adequacy of the failure rate data FPL used for the ESFAS subgroup relays and compared them to other sources. Me also determined the impact of the surveillance reduction on ESFAS availability by using uncertainty and time-dependent reliability analysis computer codes.
Based. on the data and methodology reviews and on the uncertainty analyses, we conclude that the test interval extention impact on the ESFAS availability will be significant and reject FLP's assertion that the impact is insignificant. For the'AFAS model, had the uncertainty analyses shown no significant impact due to test interval extension, the FRACTIC III analyses'esults showed that time-dependent reliability behavior would have to be accounted for to accurately assess the impact of subgroup relay test interval extentions.
ACKNOWLEOGMENTS
.'ppreciate the assistance of Scott D. Mathews and John P. Poloski in conducting this review.
ACRONYMS AFAS Auxiliary Feedwater Actuation System Auxiliary Feedwater System CCC Consolidated Controls Corp.
CE Combustion Engineering EGKG EGKG Idaho, Inc.
EPRI Electric Power Research Institute ESFAS Engineered Safety Features Actuation System FPL Florida Power and Light Company INEL Idaho National Engineering Laboratory.
IREP Interim Reliability Evaluation Program IRRAS Integrated Reliability and Risk Assessment System LPSI Low Pressure Safety Injection MOCARS Monte Carlo Simulation NRC Nuclear Regulatory Commission NRR Office of Nuclear Reactor Regulation PRA Probabilistic Risk Assessment SIAS Safety Injection Actuation Signal SL 2 St. Lucie Plant, Unit No. 2
CONTENTS ABSTRACT o ~ ~ ~
'o
~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ o ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
S UMMARY o ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ o ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ o ~ ~ ~ ~
ACKNOWLEDGMENTS iv ACRONYMS ~ ~ ~ v
- 1. INTRODUCTION ........ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ 1
- 2. SIAS AND AFAS DATA REVIEW 2~1 SIAS Data . ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
2~2 AFAS Data .............................................,...
- 3. SIAS REVIEW . ~ ~ ~ ~ ~ ~ ~
3.1 SIAS System Description . ~.....
3.2 SIAS Methodology Review .
3.3 SIAS Uncertainty Analyses ..
3.4 SIAS Time-Dependent Reliability Analyses .
- 4. AFAS REVIEW 13 4.1 AFAS System Description . 13 4.2 AFAS Methodology Review . 15 4.3 AFAS Uncertainty Analyses ...,.......... 16 4.4 AFAS Time-Dependent Reliability Analyses . 16
- 5. CONCLUSIONS 22 6 REFERENCES ............ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ \~0~~~~~~~~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ 23 FIGURES
- 1. SIAS actuation logic diagram
- 2. SIAS reliability block diagram .........................
- 3. AFAS b',ock diagram .................. ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ 14 vi
- 4. Time-dependent 0 AFAS unavailability .
plot of the FPL data, for a 6-month test interval 20
- 5. Time-dependent AFAS unavailability plot of the FPL data for an 18-month test interval ........................................ 21 TABLES
- 1. Summary of NUREG/CR-3862 AFAS-initiating transients for Combustion Engineering reactors 5
................ .... 10
- 3. Summary of FRANTIC III SIAS time-dependent reliability analyses with a comparison to MOCARS and FPL SIAS unavailability point estimates ....... .............................................
~ ~ ... 12
- 4. Summary of MOCARS AFAS uncertainty analyses for FPL and E GEG data ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ 17
- 5. Summary of FRANTIC III AFAS time-dependent reliability analyses with a comparison to MOCARS and FPL AFAS unavailability point estimates......,.......................... 18
- 1. INTROOUCT ION This report presents a review of the Florida Power and Light Company 1
(FPL) submittal for proposed Engineered Safety Features Actuation System (ESFAS) and Auxiliary Feedwater Actuation System (AFAS) surveillance test interval changes at its St. Lucie Plant, Unit No. 2 (SL 2). Personnel in the Probabilistic Risk Assessment (PRA) Unit of ERG Idaho, Inc. (EGEG) at the Idaho National Engineering Laboratory (INEL), conducted this review at the request of the Nuclear Regulatory Commission (NRC), Office of Nuclear Reactor Regulation (NRR). The FPL submittal, Reference 1, presented analyses of a typical ESFAS subsystem and the AFAS show the proposed subgroup relay test interval changes did not significantly .affect the systems'vailability. The EGKG review assessed the adequacy of the FPL submittals'ethodologies, data, assumptions, and conclusions.
The FPL analyses used standard reliability/availability modeling and estimation techniques to demonstrate quantitatively the effects of ESFAS and AFAS subgroup relay testing frequency on system availability. FPL used a reliability block diagram to model the Safety Injection Actuation Signal (SIAS) ESFAS subsystem and a fault tree to model the Auxiliary Feedwater Actuation System (AFAS). For both models, FPL intentionally overestimated the system availability by not including wire/cable faults, test or maintenance unavailability, manual initials, or common cause failures. FPL did this to maximize the relative importance of the subgroup relays to the calculated system availability. The two system models were reduced to Boolean equations and were quantified using published component failure rates with the time between component failures used as a variable where appropriate. From these analyses, FPL concluded the ESFAS and AFAS actuation logic surveillance test intervals could be safely extended from the present 6 months to 18 months.
In a letter dated June 19, 1985, 2 the NRC transmitted to FPL the results of the NRC staff review of FPL's request for surveillance test
changes, a request for more information regarding FPT's evaluation, and a copy of the NRC draft Safety Evaluation Report that provided the bases for denying FPL's .request. The major relevant disagreement the NRC n d with FPL's analyses was with the failure rates FPL used for the subgroup relays. Using the FLP assumptions and methodologies and the different failure rates, the NRC results showed higher changes in system availability than FPL did. From this, the NRC concluded the ESFAS and AFAS are sensitive to changes in test interval and tentatively denied FPL's request.
3 FVL responded to the NRC's review by supplying additional information to support their contention that even using the NRC's failure rate data, the estimated change in ESFAS/AFAS availability was not statistically significant.
On March 7, 1986, the NRC issued a memorandum recommending FPL's application be denied unless further review substantiates FPL's contention that the reduction in ESFAS/AFAS availability resulting from the proposed surveillance frequency reduction is statistically insignificant.
The NRC requested EMG to review the FPL submittals, References 1 and 3, to specifically determine the adequacy of '.he failure rate data used in the FPL submittals and determine whether or not the impact of the proposed surveillance frequency reduction on the ESFAS/AFAS availability is statistically significant. The results of the ERG review comprise the body of this report. Section 2 presents the review of the FPL data used for the SIAS and AFAS analyses. Section 3 presents the review of the FPL SIAS analysis. Section 4 presents the review of the FPL AFAS analysis.
The conclusions of the review are presented in Section 5.
- 2. SIAS AND AFAS DATA REVIEW For their ESFAS analyses, FPL used data from two primary sources; a reliability study done for SL 2 by Consolidated Controls Corp.,
5 CCC-ER-1213 and- a draft Interim Reliability Evaluation Program (IREP) component failure rate report. 6 The data in CCC-ER-1213 were obtained from MIL-HDBK-217B.7 FPL used the median component failure rate data from these two reports to quantify the ESFAS unavailabilities.
For our review, we compared the FPL component failure rate data to data for similar components from IEEE Std 500"1984 and the IREP Procedures Guide, NUREG/CR"2728. 9 In general, the FPL failure rate data were higher than the failure rates given in IEEE Std 500 and NUREG/CR 2728.
2.1 SIAS Data The one'xception to the comparison discussed above is the failure rate FPL used for the SIAS subgroup relay K501B short to power failure mode. FPL used a MIL-HDBK-217B derived value of 6E-8/hr. The IREP Procedures Guide recommends a median valve of 1E-6/hr. To determine the effect of the different component failure rates on system unavailability, we conducted uncertainty and time-dependent reliability analyses using the FPL SIAS model and both the FPL data and the NUREG/CR-2728 recommended values. The results of these analyses are discussed in Section 3.
2.2 AFAS Data The relay failure modes of contacts fail to transfer (open or shut) and coil .short to power dominated the FPL AFAS data. FPL used a draft IREP (Reference 6) value of 1E-7/hr for contact transfer fai lures for all relays except for actuation relay K810, where they used a CCC-ER-1213 (Reference 5) value of 6E-8/hr. For the relay coil short to power failure they used a draft IREP value of 1E-8/hr.
For the EG8G data used to conduct the uncertainty analyses, we used the NUREG/CR-2728 median values of 1E-4/demand for contact transfer failures and 1E-6/hr for relay coil short to power failures. For the 6-month time-dependent reliability analysis, we used the NUREG/CR-2728 mean values of 3E-4/demand and 3E-6/hr for the contact failures and the coil failures, respect'Tvely.
For the 18-month test interval time-dependent reliability analysis, we used the NUREG/CR-2728 recommended procedure (Reference 9, Part III, Section 5. 1, page 125) of making the upper bound on the demand failure probability the computational median for test intervals on the order of a refueling cycle, 18 months. This NUREG/CR-2728 recommendation affected only the contact transfer failures and resulted in a mean value of 3E-3/demand. The results of the AFAS uncertainty and time-dependent'eliability analyses are discussed in Section 4.
We also reviewed the data FPL used to determine the effective AFAS test interval by taking into account the average number of transients that actuate the AFAS during a year. They used EPRI NP-2230 10 data to ,
calculate an average of 2.67 AFAS-actuating transients per year.
We used data from NUREG/CR"3862 and calculated the same number of AFAS actuating transients per year. Our results are summarized in Table 1. However, as Table 1 shows, several plants went as long as three years with only one transient that would actuate the AFAS, and, of the 67 plant years considered, 13 years (19% of the total) had no transients that would activate the AFAS. Because of the variability of the transient rate and because FPL is relying on "miracles" (unplanned transients) to test the AFAS, we reject their inclusion of transients as a valid reduction in the effective test interval for availability analysis purposes.
~ V\ S ~ 10'SS 0+ RFAUPT ION IH FtFOVllCR FIUV I I LhUPI YOTll LASS AF Ff E VATFR I ALL LOOPS I OR ne ff OVllfe fLAV lH Tfe FlOV IH llelLITY - OPERATOR fRRhR littHAHICll AR DR flgDV VARI)ITY hl)C ~ CAUSES OR ne p: lnnj O~
nr OAHHg)g AHOFH~ER f pu~p<
VACUUH f AI<<LALonps I na AR ~ll'2$
(ho I H n Ln UP F HI HA OF 3 1EAH REL CIPCULAIIVG Vill'R lff vALvf3 AR 0 ll S OF SERVIC F Vllf P SYSTE 8 UR 4$ ~ Al LAYS OC IXFCIIF PAVf ~
SPFC If'IClYIOHS l REACIUR SUPPLIER-CE
~ $ 00000 ~ 00 $ 00 ~ ~ 0 ~ 0 ~ 00 ~ 0 ~ 00 00000 ~ ~ 00 0000000 ~0 000 ~ 0 ~ ~ 0 ~ 00 ~ 0000 ~ 0 ~ 00 ~ 0000 ~ 0 ~ 0 ~ 0 ~ 0000$ ~ 0 ~ 0000000 ~ 00 ~ 00000000 ~ 0000 ~ $ 00 ~ 0 ~ 0 ~ 0 ~ 0 ~ 000 ~ 0 ~ 00 ~ 0000 ~
RflCTUR YFARS PLAHTS 1 2 3 4 3 4 7 8 P 10 11 Lt 13 14 IS lb 17 18 LP 20 tl 22 23 TOTAL Pl I I SAhf S 10 '0 2 2 10 0 0 42 Tilt ll 1 1
~ 04 IIAIHE YAHREE t. 1 3 2 0 0 I 2 I 2 0 LS Ytl 221 I+
FART CALHAUH Tiobtn 1 t 1 0 0 1 1 C 0 804 ~
~
8 CALV$ CLIFF 1 4 P b 2 2 4 27 750108 7084 HTLLSTAHF 12 1 ~ 0 7 S 3 0 0 2P TSl tb ~$0 ST$ LUCIE P 0 t. L 3 0 0 tO
. 'B.') b 2 1 1~0~
~ 4t 18 770401
~ R<AHSAS 2 ooitb 7 8 t n,t0 tO ST ~ LUC E 2 'I 1 30boe 4 ~ RP T Off( fffHfS 5) 18 14 14 t) 2) 1) I/f
'$:)8 Ill'lH Slo b )"
3.8P S.eb t ft l <h i 3 l li0 3.48 3.1b 3.03 t.o7 3.u4 t.ob 3 nt f o3 f.oL 2t.o7 t.eb tt.e4 i.e4 83 1 Tk Ã3 t UH OEV
~ $00 ~ 0 ~ 000 ~ 00000$ 00 ~ '0 '000 00000 ~ 0 ~ 0$ $ 0$ ~ $ 0$ $ $ ~ 0 ~ ~ 000
$ ~ ~ 0000 ~ ~ 000 ~ ~ 0 ~ 0 ~ 0 ~ 0 ~ 00 ~ 0 ~ 0 ~0 '01 ~ 00 ~ 0 ~ 0 ~ 000 ~ 00000 ~ 00000 ~ 0 '00 ~ 000000 ~ 00000 ~ 000 ~ 0 TABLE'1. 'UNDRY OF NUREG(CR-3062 AFAS-INITIAXINGTRANSIENTS FOR COMBUSTION ENGINEERING REACTORS
1 f'
I'I
- 3. SIAS REVIEW 3.1 S stem Oescri tion FPL modeled the SIAS as a typical SL 2 ESFAS subsystem. The SIAS is initiated by either two Low Pressurizer Pressure signals or two High Containment Pressure signals. There are four independent measurement channels. One channel may be bypassed for test or maintenance. Bistables condition the signals and, through isolation modules, provide inputs to the actuation modules. Upon a valid trip signal, the actuation modules'elay drivers deenergize the SIAS subgroup relays which actuate safeguards equipment. Figure 1, from Reference 1, shows the actuation logic for the SIAS subsystem.
3.2 SIAS Methodolo Review FPL constructed a reliability block diagram, Figure', to model the SIAS. The system boundaries were chosen in accordance with Regulatory Guide 1.22 12 definitions of Protection System and Actuation Device. The model included the measurement channels, bistables, isolation and actuation modules, associated power supplies, subgroup relay, and the control circuit and circuit breaker for the Low Pressure Safety Injection (LPSI) Pump 2A, a typical safeguard equipment. The SIAS model does not include the pump and its motor driver.
To maximize the importance of the subgroup relays to the calculated system avail'ability, FPL intentionally overestimated the SIAS availability by not including all possible component fault models or common cause failures. Specifically, FPL did not include wire or cable faults, test or maintenance unavailability contributions, manual system initiation, or common cause failures.
FPL translated the reliability block diagram directly into a Boolean equation. The system unavailability was calculated from the Boolean equation with the time between actuation logic tests for the
PR'R flttC ffltc PSCtR Cour: Coalf. Co ~ Ce<ur IXCSC. PCS'. Pec55 MCSC. cecil. FC'C I<. ACSi,
/JESS IPSr. IeesC i~sr.
iuM I <ear. I<esf. ~ fair. east.
Loop StoP S,ooP LOOP CooP La<oP soaP A CI D A S C O I
PAtt etcas. sttte I<>> IICSC ACS S. CSllS, CIS CS<aC CeC Csoa 4 ~ I IaeCC daecc I doc c I Ca<a< a ~
d<sfohat ~ SisrAtae d<sr<htaC RAFA ie<CfA<laCC ela aiacatS ~ I Iria ca
~
SIA5 gRat 5<I I55NMt
~ It
<AQ 4$
C~)
~ 5<A rn<
d<s
$ <A)
Sz
'<AS eat <P d<sfettat till I<AS PiSeAtat t6 5<A j
O<I~CC MC 5<AS neat te Ci CPP3 c~3 &3 CCP) let) oc (ps.t) (PL.+) (Ps-I)
Wfc C~y (<cs At ISO lg iSo eg>> ISo e Ice 0 Iso I 4 I see eg h se OC Aef:
~ he ~ S seAS Acf:
~ eeo. Q Stets Aar
~ IeO. I 5<A5 lIcr, SAC Acr, S<AS Acr.
swats j% eeoo, 4 55SX S i<ac.r.
SsgS hCVVhrlooS fsoOuLK A IIC. C. Sa Ih S hC1alhreths fSOSSat.+ Lac<ac'ol'4 (ARr -Oo) C<<e<fLy L ~
L<<<c<C 'Roc% coo<c Z 4+ A a.oC.<C g. oF A Lc<o<c Cole%: Ptd 5$ . carr. tat st. Selatec Peti<. Cfa<e T< AIC C 5 .
3viA.Y gtaAy CCaAF }
CSC sec<cfC I
e<te<e a w.akoaa C<<a<Ca'etota<<
<ICao<S e<Ccoe5 Sac+ CCo<ISa CeeC<eeo CRC 0 KCLta.g ca<<ano 5 ~le c,C~>F C<<F<ee<C aef kCLAy ICS A.R.C, Goeetiea. c Acor cC ea I'. ~
Figure 1. SIAS actuation logic diagram
0 Sh Oh s04e PS-Q-HA CsI log sI MSQAfSI Csli Css SlsSs 'fl, SI A MCASACIIO IP CssasestI MC l,+I'C 4$ Hh)
PS.LH h
~ SCIQQ(sICWT Cage.~4, PS C, (CAssC ps ANfbi MtAQCCMCNP C~l MO (SA~C h$ PIA)
PS<-a-A Kfol Cl LP5f tsl (CssSl: 1, II)
Pf-Cyl ZA H 0'A?A PI'4f. Xh'l t$ 4- OSI +As lyl P5 l HA OSLO+
MCACACIICsh Csl&4IO VI h NCASQPCHCIIS'IIAslslCI Me (QLHC As'S A)
Hth&ACHCSlf CSIASlsICI. MC (SsAHC A Mh) g/Q ~ IC tlA'IgCBCQ< . ~ ~ ~ 4IPI QQ ('AsSC AS Mh~
Figure 2. SIAS reliability block diagram
subgroup relay left as a variable. The resulting expression I
was then quantified using the current semi-annual (9380 hr) and the proposed refueling outage (13,140 hr) surveillance test intervals.
We compared She FPL reliability block diagram to the SIAS system block diagram and the FPL Boolean equation to the reliability block diagram. No discrepancies were found in either the reliability block diagram or the Boolean equation.
3.3 SIAS Uncertaint Anal ses To determine whether or not the FPL SIAS system 6-month and 18-month availabilities were the same statistically, we conducted uncertainty 13 analyses using the Monte Carlo Simulation (MOCARS) computer code.
MOCARS allows a user to make distribution and simulation limit inferences from either a user supplied model or a system unavailability function.
MOCARS uses Monte Carlo techniques to make such inferences by randomly sampling from specified probability distributions. MOCARS runs were made for both the FLP and the EG8G data using an assumed error factor of 10 and an assumed log-normal component failure rate distribution for the current 6-month and the proposed 18-month iest intervals. The results of the SIAS MOCARS runs are summarized in Table 2. A large sample Z test for the equality of population variances and a two-sample t test for the equality of population means were performed on both the FPL 6-month and 18-month MOCARS results and the EG8G 6-month and 18-month MOCARS results. For both the FPL data and the EMG data, the 6-month and 18-month distribution means were found to be from different populations. In other words, the true values of the SIAS 6-month and 18-month system unavailabi lities for both the FPL data and the EShG data are statistically different.
3.4 SIAS Time-Oe endent Reliabilit Anal ses FPL did not use a time"dependent reliability analysis in their SIAS evaluation. They used an average unavailability for the basic events calculated by:
1ABLE 2. SUGARY OF HOCARS SIAS UNCERTAINTY ANALYSES RESULTS FOR FPL AND EG&G DATA FPL Data EG&G Data Test Interval Test Interval 6 month 18 month 6 month '18 month Sample size 3000 3000 3000 3000 Nominal sample value 1.41E-3a 1.67E-3b 4.12E-3 2.56E-2 Distribution mean 3.74E-3 4.51E-3 l. 26E-2 7.50E-2 Distribution standard 5.89E-3 7.00E-3 3.68E -2 1.84E-1 deviation Distribut'ion median 2.09E-3 2.56E-3 6.07E -3 2.91E-2 5'A 95'A 5g 95'A 5A 95'X 5'A 95'A Lower Upper Lower Upper Lower Upper Lower Upper Bound Bound Bound Bound Bound Bound Bound Bound Distribution 90K Confidence interval 4.87E -3 1. 22E -2 6.23E 4 1.44E -2 1.30E-3 3.88E-2 4.05E-3 0.26
- a. This value agrees with the FPL 6-month SIAS system unavailability of 1.3E-3 in Reference 1, Page 10 of 14.
- b. 1his value agrees with the FPL 18-month system unavailability of 1.6E-3 in Reference 1, Page 10 of 14.
where Q
= average unavailability component failure rate T = fault exposure time, where the fault exposure time is one-half the time between tests.
We used the FRANTIC III14 computer code to conduct time-dependent analyses using the FPLmodel and both FPL data and EG8G data to determine if time dependency should be taken into account for the proposed 18-month test interval. Table 3 is a summary of the FRANTIC III SIAS time"dependent reliability analyses along with a comparison of the FRANTIC III results with the MOCARS and FPL SIAS unavailability point estimates. Tabl'e 3 shows that for the FPL and EGEG data sets there is general agreement in the results regardless of the computer program used. For the SIAS system, component unavailability adjustments to account for time-dependent behavior are not necessary.
11
TABLE 3.
SUMMARY
OF FRANTIC III SIAS TIME-DEPENDENT RELIABILITY ANALYSES WITH A COMPARISON TO MOCARS AND FPL SIAS UNAVAILABILITYPOINT ESTIMATES FPL Data ERG Data Test Interval Test Interval 6 month 18 month 6 month 18 month FRANTIC III SIAS mean 1.49E-3 2.38E-3 9.54E-3 2 '8E-2 MOCARS SIAS point 1.41E-3 1.67E-3 4. 12E-33 2. 56E-2 estimates FPL SIAS point estimate 1.3E-3 1.6E"3 12
A i
V I I
- 4. AFAS REVIEW 4.1 S stem Descri tion FPL modeled the AFAS separately from the ESFAS because Combustion Engineering (CE) designed the AFAS while Consolidated Controls Corp. (CCC) designed the ESFAS. The AFAS, shown in Figure 3, includes input signals from Steam Generators A and B (SG-A, SG-B) level, pressure, and Feedwater Header A and B (FH-A, FH-B) pressure. There are four measurement channels of each parameter. Any two channels providing a coincident trip signal will actuate the AFAS. The system is designed to allow by-pass of one channel and may be operated in a two-out of-three logic. Normally, a low level condition fn the steam generators will cause the AFAS to actuate Auxiliary Feedwater System (AFW) components to direct flow to the steam generators. If a steam or feedline break exists, differential steam generator or feedwater header pressure will cause the AFAS to isolate flow to the faulted generator. Bistable outputs are arranged to identify the ruptured generator. AFAS-1 actuates AFW components which provide or prevent flow to SG-A. AFAS controls flow to SG-B. The bistable relay contacts are combined into six "AND" gates which represent all possible combination of 2 of 4 channel inputs. Each 2 of 4 logic matrix deenergizes four matrix relays whose contacts are arranged in series to form a six-input ".OR" gate. Any open contact will deenergize this path and provide a signal to its trip relay. When the trip relay times out, the trip relay deenergizes, which deenergizes for AFAS initiation relays. The initiation relay contacts are combined in a "selective" 2 of 3 logic.
Coincidental signals from matrix ladder combinations AB, AD, CB, and CD will deenergize two interposing relays. This removes power from the subgroup qctuation relays which control AFW components. Of the ten actuation relays per channel, Ave are latching and five are cycling. When steam generator level increases to a setpoint, the cycling relays will reenergize, closing AFW pump discharge valves to prevent overfilling a steam generator and/or allowing restoration of main feedwater. The latching relays control AFW pumps and remain deenergized until AFAS is reset.
13
5 tA WITIATIOH I LV) ACLAT G
14 AI ACLAT IJAT L RELAY AIR Bl To. IHT gLCAPES
~ A T
A HIT A iIALIEL
- t/0 TRIP T SELECTIVE LAYA L AIR14 PR~SS I ALLE tg T.A A W
EWHd bl A
To NQ RELA .
141%
HT P ACLAT
~ A Sl A
M I I I All ACTUATIOH RCLAT . RELATS
.I l VEL I RP I RE TAIP I II RQS LATe Wl IA RC A SELECTlvE t/S II AIR II II ~ LOG 8 AEIAT LaMTC C Hl T HT C PQI RELAY 81 III .4 48 ~ ACTUATIOII L T ~ C, AELA'f$
H H AC AT
~ I 114 ~ I l. I 1 RELAY H
A AJP I -C L VCL LO LV A.R L. SECCC I R CLAT ting/5 LAY IIAI.RTL. C ACT TIOH PRES HI RPO d W ITIAI10 H CLAC HG R LAYS I T, I CLAT t4.C RE CLAT Pfw% 4 R Ay RPOSIIKs W T I R LAT RCLAY LAY0 SCLCCTIVE t/S HATRII LOGIC D I LR-~VL MA l LAOOCA 0
RELAY I II HT AP 0 ACQHIIOII I PLAT 40 PA OT CLAT I
A o CLAT PA SS Af CD TI HA .R A I LA WH dP II ISL rTTa
~ 4 I I t Figure 3. AFAS block diagram
4.2 AFAS Methodolo Review For the 'AFAS, FPL used a fault tree to model the system. The AFAS system boundaries were chosen, as were the SIAS boundaries, in accordance with Regulatory Guide 1.22.(Reference 12) definitions of Protection System 7j and Actuation Device. FPL developed the AFAS model to consider the actuation path of one typical component, Faults were developed to the component level for measurement channels, bistables, logic matrices, trip relays, initiation relays, associated power supplies, subgroup relays, and the control circuit and circuit breaker for the AFW Pump 2A. The AFAS model did not include the pump and its motor driver.
In a similar manner to their SIAS analysis, FPL intentionally overestimated the AFAS availability to maximize the subgroup relay importance by not including all possible component fault modes or common cause failures. They did not include wire or cable faults, test or maintenance unavailability contributors, manual system initiation, circuit breaker control power, or common cause failures.
FPL solved the fault tree for minimal cutsets, retaining cutsets up to order 3. All higher order cutsets were truncated. The cutsets were then quantified with the time between actuation relay tests left as a variable.
The resulting expression for AFAS unavailability was then quantified using the current semi-annual (4380 hr) and the proposed refueling outage (13, 140 hr) surveillance test intervals.
For our review, we compared the FPL fault tree to the actuation logic diagram. No discrepancies were noted. We also solved the FPL AFAS fault tree for minimal cutsets of order'three or fewer as FPL did, using the Integrated Reliability and Risk Analysis System ( IRRAS) computer code. 15 When the FPL component unavailabilities were substituted for the basic events in the cutsets and the two test interval times substituted for the time variable, the EMG AFAS system unavailabilities were approximately three times greater than the corresponding FPL results. Since we used FPL's fault tree and data, the obvious answer was the minimal cutset lists 15
were different. We inspected the IRRAS cutset list for cutsets that, .if left out of the quantification process, would account for the differences in ERG and FPL AFAS unavailabilities. We found two second-order cutsets involving internal faults of the four trip delay devices. that account for the different results. After checking the actuation logic diagram; the fault tree general assumptions, the fault tree itself, and the FPL AFAS data table, we can find no logical reason to remove the two cutsets from the list. Since FPL did not include a cutset list in its SL 2 submittal, there is no way of resolving the apparent discrepancy with FPL. For the EG&G review, we included all IRRAS cutsets in the quantification and uncertainty and time-dependent reliability analyses.
4.3 AFAS Uncertaint Anal ses We conducted uncertainty analyses of the AFAS for the same reasons we analyzed the SIAS. We wanted to determine if the AFAS 6-month and 18-month system mean unavai labilities were statistically different. We used MOCARS for both the FPL data and the EG8G data again using an err or factor of 10 and a lognormal component failure rate distribution. The results of the AFAS MOCARS runs are summarized in Table 4. We tested both the FPL and EG8G 6-month and 18-month MOCARS results with large sample Z tests for population variance equality and two-sample t tests for population mean equality. For both the FPL and EGKG results, the 6-month mean and the 18-month mean were statistically different.
4.4 AFAS Time-Oe endent Reliabilit Anal ses FPL used average component unavailabilities for the AFAS analysis just as they did for the SIAS. To determine if time-dependent reliability analyses were necessary for the AFAS, we used the minimal cutsets from Section 4';2;and conducted FRANTIC III runs using FPL and MG component failure rate data for the current and proposed test intervals. The FRANTIC III results. are summarized in Table 5 and are compared to the 16
h hr TA. A.
SUMMARY
OF MOCARS Af'AS UNCERTAINTY ANALYSES FOR I .HO ECCcC DATA FPL Data C Oaa Tes In er a I Tes In e a
~non h lg ~mon h mon h 1 mon Sample size 3000 3000 3000 3000 Nomina I sample value 8. 11E-3 5.50E-2 1. 82E-2 1. 96E" 1 Oistribution mean 5. 42E-3 3.88E-1 8.89E-2 9. 71E-1 Distribution standard 1. 98E-1 1.25E+0 2. 12E-1 1. 84E+0 deviation Distribution median 1.82E-2 .11 5. 19E-2 .61 5$ 95K 5X 95'X 5X 5% 95$
Lover Upper Lover Upper Lover Upper Lover Upper
. Botlfnd Bound ~oiind pound ~hou d Bound 8ourad 8ound 4.87E-3 0. 17 1 '7E-2 1 ' 1.82E-2 0.24 0.22 1.0 17
TABLE 5.
SUMMARY
OF FRANTIC III AFAS TIME-OEPENOENT RELIABILITY ANALYSFS WITH A COMPARISON TO MOCARS AND FPL AFAS UNAVAILABILITYPOINT ESTIMATES FPL Oata ERG Oata Test Interval Test Interval Unavai labi lit 6 month 18 month 6 month 18 month FRANTIC III AFAS mean 5.66E-2 3. 19E-1 8. 80E-2 5. 01E-1 MOCARS AFAS point 8. 11E"3 5.50E-2 1.82E-2 1.96E-1 estimate FPL AFAS point estimate 2.5E-3 4.7E-3 18
HOCARS and FPL unavailability point estimates. For the FPL data, Table 5 shows the FRANTIC mean is greater than the MOCARS point estimates by a factor of 6-7 for both test intervals. For the EG&G data, the FRANTIC III mean is greater than the HOCARS point estimates by a factor of <<5 for a 6-month test inMrval and a factor of -2.6 at 18 months. Figures 4 and 5, the FRANTIC plots for the FPL data for 6-month and 18-month test intervals, respectively, show the peak unavailabilities at the end of the test intervals to be approximately two times higher than the mean values and to reach values that are unacceptable from a risk standpoint. These peak values show that, had the uncertainty analyses not already shown a significant impact, time dependent reliability analyses would have to be used to assess the impact of the test interval change.
19
10 0.0 50.0 l00.0 150.0 z(>0.0 2'.)0.0 300.0 3SO.O 400.0 450.0 S00.0 550.0 I:I.fll "il:I) l'll'1I: IN DRYS Figure 4. Time-dependent AFAS unavailability plot of the FPL data for a 6-month test interval
10 g 10 10 0.0 SO.O 100.0 150.0 200.0 250.0 300.0 350.0 400.0 450-0 SOO.O 550-0 ELAPSED TINE IN DFIYS Figure 5. Time-dependent AFAS unavailability plot of the FPL data for an 18-month test interval
~
- 5. CONCLOSIONS Based on the data and methodology reviews and the uncertainty and time-dependent reliability analyses, we conclude that test interval extension to 18 months will have a significant impact on the ESFAS and AFAS system avai labi lities as modeled by FPL and reject FPL's assertion that it will not. The uncertainty analyses using the FPL data for both systems showed the 6-month and 18-month distribution means to be statistically different. The AFAS time"dependent reliability analyses showed FPL's point estimate to underestimate the time-dependent mean unavailability by a factor of -7 and the peak unavailability by factor of '12. For. the AFAS model, had the uncertainty analyses shown no impact, the FRANTIC III results for FPL component failure rate data show time dependent reliability behavior would have to be accounted for to accurately assess the impact of subgroup relay test interval changes.
22 ~
V
~ a, l
I 'h
'1
- 6. REFERENCES Florida Power and Light Company, Evaluation of Surveillance Fre uency of En ineered Safet Features Actuation S stem ESFAS /Auxiliar Feedwater Actuation S stem AFAS Sub rou Rela s L-84-183, May 22, 1984.
E. J. Butcher letter to J. W. Williams, Jr., Emer enc Safet Feature Actuator S stem Instrumentation Surveillance Re uirement, Nuclear Regulatory Commission, June 14, 1985.
Florida Power and Light Company, Additional Information in Su ort of the Pro osed Chan e to St. Lucie Unit No. 2 ESFAS/AFAS Surveillance R. D. Walker memorandum for T. M. Novak, Emer enc Safet Feature Actuation S stem ESFAS -Surveillance Re uirements TAC Number-55063 Docket No. 50-389, Nuclear Regulatory Commission, March 7, 1986.
Consolidated Controls Corp. Reliabilit Anal sis of En ineered Safe uard Panels for St. Lucie Nuclear Power Station Unit 2, Engineering Report No. 1213, April 26, 1978.
Nuclear Regulatory Commission, Com onent Failure Rates for Nuclear Plant Safet S stem Reliabilit Anal sis, draft, September 23, 1980, Rome Air Development Center, Mil itar Handboo: Rel iabi1 it Prediction of Electronic E ui ment, MIL-HOBK-217B, March 17, 1978.
Institute of Electrical and Electronics Engineers, IEEE Guide to the Collection and Presentation of Electrical Electronic and Sensin Com onent Reliabilit Data for Nuclear Power Generatin Stations, IEEE Std-500, June 1977.
O. D. Carlson et al., Interim Reliabilit Evaluation Pro ram Procedures Guide, NUREG/CR-2728, SAN082-100, January 1983.
A. S. McClymont and B. W. Pochlman, ATWS: A Rea raisal Part 3:
Fre uenc of Antici ated Transients, NP-2230, January 1982.
O. P. Mackowiak et al., Oevelo ment of Transient Initiatin Event Fre uencies For Use In Probabilistic Risk Assessment, NUREG/CR-3862, EGG-2323, May 1985.
Nuclear Regulatory Commission, Re viator Guide 1.22: Periodic Testin of Protection S stem Actuation Functions, February 17, 1972.
S. D. Matthews and J. P. Poloski, MOCARS: A Monte Carlo code for Determinin Distribution and Simulation Limits and Rankin S stem Com onents b Im ortance, TREE-1138, Revision 1, August 1978.
23
- 14. T. Ginzburg and J. T. Powers, FRANTIC III A Com uter Code for Time-De endent Reliabilit Anal sis Methodolo Manual, A-3230,"
April 1984.
- 15. K. D.,Ru'ssell et al., Inte rated Reliabilit and Risk Anal sis S stem IRRAS Users Guide Version 1.0 DRAFT , NUREG/CR-4944, EGG-2495 DRAFT), February 1987.
24
NIC IOIII I7 Ils
~ U L NUCLtaa 1IOULkfOI T COIQSIISION ~ atfQaf NVWI1 IkINfkvvtv TIOC Tkf vks Nk, I aNI NNCU IIO7, 770l, 57O7 BIBLIOGRAISHIC DATA SHEET EGG>>RE(-7842 Sll INSTNVCTIQNS QN fssl alvlaSI f ST LI kNO SVI'Isf Ll 5 LlafI ~ Lalsa A Review of:the Florida Power and Light Company Safety Evaluations for Extending the St. Lucie ~ l Oaf atIOa I CQNI'TIO Plant, Unit No. 2 ESFAS Subgroup Relay Test Inter a ~ KSN T ss Ttaa
~ kvfssOasts :lo vember 1988 Oaf t atIQaf David P. Nackowiak MON f ss
~ sSSVIO Ttaa November 1 sHB I ktaIOavsNO QataNstaf ION Nassl aNO slalLINO a001ISS ~ lsfsvkf Iv Cksal ~ MOIICflfataINQaa VNlf NVsstta Probabi 1 i sti c Ri s k Assessment Uni t Iss Qss Qaalsf NVWI1 EG&G Idaho, Inc.
P.O. Box 1625 Idaho Falls, ID 83415 D6023 so STQNSQNINQ oaoaaltaf IQN Navt aNQ ssaILING kook IllII~Ze Ckasl ss ~ 5 Tat OT atTOaf Division Engineering and Systems Technology Techni ca 1 Office of Nuclear Reactor Regulatory ~ II1IOQ COVI150 llka>>>> &>>I U.S. Nuclear Regulatory Commission Washington, DC 20555 lf SVITLIWNfaav NOTIS Docket No. 50-389 li alt ~ 1aCT IIOTssksvs kl'>>I This review examines the Florida Power and Light Company's (FPL's) request to the Nuclear Regulatory Commission (NRC) to amend the operating license for FPL's St. Lucie Plant Unit No. 2. The proposed amendment would change the surveillance test interval of the Engineered Safety Features System (ESFAS) Subgroup relays from 6 to 18 months. The review was conducted to assist the NRC in assessing the validity of FPL's claim that extending the subgroup relay test interval will not significantly impact the ESFAS availability. The review examined FPL's modeling methodologies and assumptions, compared their models to the system drawings, and checked their model quantifications for accuracy. FPL's data were examined and compared to data from other sources. Uncertainty and time-dependent reliability analyses were conducted to assess the impact of test interval changes on the ESFAS availability. The uncertainty analyses results showed the 6-month and the 18-month system unavailability distribution means ta represent different populations. Based on these results, we conclude the impact of subgroup relay test interval extension to be significant and reject FPL's claim that the impact is insignificant.
I ~ OOCVsstlsf allaLTSII ~ 15 ~ IIQQQS OISC1ITTQal I~ kvalakllasf T
's STITIMINT Unl imi ted I~ SICValf v CLktll~ ICATION IT>> OSIER IOINTIIstatsQTIN INOIO ftaW Unclassified
~