ML18260A249

From kanterella
Jump to navigation Jump to search
Development of Supplemental Guidance for Common Cause Failure
ML18260A249
Person / Time
Issue date: 09/17/2018
From: Ching Ng
NRC/NRR/DRA/ARCB
To:
Ng C
References
Download: ML18260A249 (14)
v • d • e


Text

Development of Supplemental Guidance for Common Cause Failure I. Background On January 2018, NEI issued Revision 1 of a White Paper with a suggested methodology on the qualitative assessment of Common Cause Failure (CCF) for the Significance Determination Process (SDP). The White Paper was distributed to internal NRC stakeholders in the headquarters (HQ) and regional offices for comment. In response to comments from internal stakeholders and the contents of the White Paper, the following proposed assessment is presented. It is intended that this will constitute guidance for the Senior Reactor Analysts (SRAs) and management members of the Significance and Enforcement Review Panel (SERP). This developed guidance is intended to be used at the discretion of NRC stakeholders, e.g., analysts and management, and is part of the tools used in making a decision using a risk-informed 1 process.

II. Major Internal Stakeholder Comment Areas to Address in Response to the NEI White Paper NRC internal stakeholders from HQ and regional offices have had an opportunity to comment on the NEI White Paper. The following are summarized from the most frequent comments:

  • The staff will develop a tabletop exercise to demonstrate use of the guidance for the internal stakeholders.
  • Many of the practices that licensees have adopted for minimizing CCF have been reflected in the currently collected alpha-factor data.
  • Use of qualitative factors for assessment could be too subjective.
  • Any CCF assessment methodology needs to take into account factors that will not only lower CCF contribution but, should consider cases where the CCF could potentially increase the contribution, e.g., intersystem dependencies, should also be considered.
  • Much of the process for considering qualitative factors currently exists in the RASP Manual
  • Can causal factors be deduced from data?

III. Requirements After reviewing the comments and a discussion with internal stakeholders, the following group of areas needed to be addressed.

  • Any adjustments to the CCF probability need to take into account new factors, not previously accounted for in the development of alpha-factor data. For those potential intersystem dependencies, consider operational history (e.g., circuit breaker failures).
  • The industry is welcome to present additional methods for consideration providing that they have not already been accounted for in the existing data.
  • A flowchart could be used for the methodology with tables (see Figure 1 and suggested RASP guidance below).
  • Need to have a consistent definition of coupling and causal factors.
  • Whatever methodology is adopted, it should be simple and clear to use with defensible and consistent results.

1 A risk-informed process is an approach to regulatory decision-making that considers both quantitative and qualitative risk insights.

Page 1 of 14

Development of Supplemental Guidance for Common Cause Failure IV. Suggested Guidance It is recognized that in some cases treatment of the impact of common cause failure (CCF), as it is applied by this process, could deviate from its key principles 2. In addition to the potential of an overly-conservative (higher) CCF probability estimate, such deviations could likewise drive an under-conservative (lower) estimate. Given a Performance Deficiency (PD) impacting a modeled SSC in a Common Cause Component Grouping (CCCG), analysts should continue using the established SAPHIRE quantitative assessment methodology for adjusting CCF probabilities in SPAR models which use the alpha factor approach. However, for those cases where a potential exists for the quantitative assessment of CCF having a substantial impact to the assessment color, the following suggested guideline can be used by SERP members as a decision-making augmentation tool. This should never deviate from the SDP as a risk-informed process.

A description of the suggested guidance on considering qualitative and other factors is described and diagrammatically shown in Figure 1 below. Note that Steps 1 and 2 which are related to performance and review of sensitivity analyses are performed routinely by analysts with guidance contained in the RASP Handbook 3. Therefore, it is expected for analysts to perform a sensitivity analysis.

1. Perform a sensitivity on CCF.

The analyst shall perform a sensitivity calculation on the SSC in the CCCG which is impacted by the PD with and without the SAPHIRE adjustment of CCF probability. Please see the exercise example on retaining the base CCF using the SAPHIRE software.

2. Does a quantitative sensitivity show a color change?

If the resultant CDF or LERF results in a color change, e.g., White to Green, then continue to Step 3. Otherwise, exit using the full computed CCF SDP results following the established guidance.

3. Does the PD involve SSCs that could be part of an intersystem CCCG OR is there indication of the PD in an extent of condition evaluation?

Although SSCs within a CCCG are generally part of an intra-system interaction, it is recognized that there is a potential underestimate of the risk contribution from specific inter-system SSCs of like design, environment, operating, maintenance, etc. Examples to consider are described in detail below. Although not modeled, these SSCs intersystem common cause factors could increase their impact on a risk estimate of performance deficiency potentially offsetting any benefit. Likewise, if an extent-of-condition evaluation was performed on other SSCs within the same CCCG with indications of the same degradation mechanism found, it could also have an impact on increasing the likelihood of CCF. Therefore for either case, if the response is yes, analysts shall exit and use the full computed SAPHIRE adjusted CCF SDP results and follow the established guidance.

Guidance for considering intersystem CCF Although the argument can be made for expanding the scope of intersystem CCF to encompass most SSCs in the plant, the analyst should limit the areas to consider as those SSCs which have identical duty cycles, similar sizes, loads, maintenance/testing procedures, and environment. Examples include similar circuit breakers housed in 2 USNRC Office of Nuclear Regulatory Research, Basis for the Treatment of Potential Common-Cause Failure in the Significance Determination Process, NUREG-2225, Section 3.3. (ML18033A152) 3 USNRC Office of Nuclear Regulatory Research, Risk Assessment of Operational Events (RASP)

Handbook, Internal Events Volume 1, Revision 2.02, December 2017. (ML17348A149)

Page 2 of 14

Development of Supplemental Guidance for Common Cause Failure cubicles within a switchgear enclosure, similarly sized motor-operated valves in piping within a room or enclosure, and similar transmitters and relays mounted within a panel or a rack.

4. Have measures been taken for the SSC outside the standard CCF reduction practices?

Over the past years, licensees have taken measures to reduce CCF by operation changes, maintenance crew changes, staggered testing, etc. Much of the benefit of these measures have been reflected in the current alpha-factor data gathered by the Idaho National Laboratory (INL). From the insights gained from data collection, CCF contributors have been grouped in terms of the following high level causal factors:

  • Design
  • Environment
  • Human
  • Component
  • Unknown
  • Other Failure causes result in the following coupling factors between SSCs in the same CCCG:
  • Design
  • Quality
  • Maintenance
  • Operation
  • Environment To avoid double-counting consideration of these measures, two paths were adopted based on whether the licensee took additional measures or not.

4a. If Yes (measures were taken which are not reflected in the data collection),

then use the following guidance:

This assumes that the licensee had taken additional measures into account at the time of the performance deficiency. Contact the RES representative who will perform an evaluation of causal factors related to the performance deficiency. The deliverable will be a revised set of -factors to be used in a revised CCF estimate.

NOTE: Some causal factors may have the potential to ultimately increase the CCF contribution to risk. To assess qualitative factors, go to Step 4c.

4b. If No, (measures were already taken which are reflected in the data collection) then use the following guidance:

This implies that the current -factors are up-to-date with respect to reflecting measures that are taken at the plant. Analysts should use the SAPHIRE computed CCF as a quantitative basis. To assess qualitative factors, go to Step 4c.

4c. Consider qualitative factors:

Qualitative factors can optionally be considered for cases where the resultant CDF or LERF is within a half-order of magnitude, e.g., between 1 x 10-6 per year and 5 x10-6 per year, near the Green-White CDF threshold, or 5 x10-6 per year to 1 x10-5 per year for the White-Yellow CDF threshold, etc. In making a qualitative assessment, analysts and decision-makers should consider the corresponding Page 3 of 14

Development of Supplemental Guidance for Common Cause Failure CDF and LERF on the full SAPHIRE adjusted CCF probability and the uncoupled non-adjusted CCF as boundary cases. One of the attributes that decision-makers should use in the assessment of qualitative factors is the relative contribution of high level coupling and causal factors to the particular performance deficiency. There are sources of information which analysts and decision-makers can reference4 which display these factors for complete and partial events.

Analysts and decision-makers can fit the performance deficiency against the chart of relative contribution of CCF causal factors. It is important to note that a qualitative assessment is bidirectional in that it can be used to justify and increase as well as reduction of the impact on CCF.

4 General Insights from Analysis of Common-Cause Failure Data at U.S. Nuclear Power Plants 1997-2012, Idaho National Labs for NRC RES, November 2013. https://nrcoe.inel.gov/resultsdb/CCF/

Page 4 of 14

Development of Supplemental Guidance for Common Cause Failure Figure 1 - Proposed Flowchart on Supporting Qualitative Consideration Perform a sensitivity on CCF

1. (Routinely performed by SRAs)

Does a No quantitative sensitivity show a color change?

2.

Yes Does the PD involve Yes SSCs that could be part of an intersystem

3. CCCG OR is there indication of the PD in an extent of condition evaluation?

Use full SDP CCF No A

Page 5 of 14

Development of Supplemental Guidance for Common Cause Failure A

Yes Have measures Contact RES to refine CCF been taken for -factor estimate using the SSC outside contributing causal

4. the standard factors. SRA to use new CCF reduction factors in CCF calculation.

practices?

4a.

No Consider qualitative Use full SDP factors influencing the CCF color determination 4b. 4c.

Reference material on causal and coupling factors Page 6 of 14

Development of Supplemental Guidance for Common Cause Failure V. Exercise example - Auxiliary Feedwater System (AFW) at a PWR Plant A. Model An example was developed to outline use of the methodology which is derived from a plant in the fleet. The performance deficiency is not an actual case but, based on several cases.

The plant is a Westinghouse PWR with two steam generator loops each on a dual unit site.

The AFW system for each unit consists of one turbine-driven and one motor-driven pump.

The success criterion is that sufficient AFW flow be provided to one-out-of-two steam generators by either pump. Each motor-driven AFW pump (one from each unit) is part of a CCCG and the evaluation will be made on the SPAR model using the SAPHIRE code.

Figure 2 - AFW System for Example Page 7 of 14

Development of Supplemental Guidance for Common Cause Failure B. Performance Deficiency

1. Description A performance deficiency was identified involving an improperly implemented procedure which rendered motor-driven (MD) AFW pump 12 unavailable. It was determined that the pump will not start on demand. An extent-of-condition evaluation was done and, for this exercise, both types of results will be presented.

C. Exposure Time The SRA concluded that this specific condition lasted for one month.

D. Assumptions

  • For this example, the contribution to core damage is computed. The same methodology should be used for estimating large early release as well.
  • The system and plant for this example were selected to show that the contribution of CCF in most cases gravitate around a color threshold which lends itself to using a risk-informed decision which is a tenet of the SDP. This case is common to many findings.
  • The SPAR model used for this example did not have the contributions made by external events. In an actual evaluation, an estimate of the external event contribution shall be included.
  • In the qualitative evaluation of Step 4c, a quantitative example using percentages of each coupling factor independently was presented for illustration only. Analysts are not expected to perform a detailed analysis for each coupling factor.
  • Point estimates of CDP were presented here for illustrative purposes. In an actual SDP evaluation, analysts will evaluate the impact of uncertainty and may perform sensitivity analyses to bound it.
  • For the configuration in this example, 2 represents the total two-pump CCF for staggered tested systems. This is dependent on configuration and success criteria.

E. Qualitative Consideration The following steps were performed following the flowchart outlined in Figure 1.

1. Perform a Sensitivity on CCF a) Standard NRC SDP Evaluation Set event AFW-MDP-FS-12 (AFW MOTOR DRIVEN PUMP 12 FAILS TO START) to logical TRUE in SAPHIRE. This will allow the software to automatically adjust the CCF for the failure to start event for MD AFW pump
12. The CCF probability for failure to start (event AFW-MDP-CF-FS which is 2 for this type of configuration) has increased from 3.10 x 10-5 to 3.95 x 10-2.

Page 8 of 14

Development of Supplemental Guidance for Common Cause Failure Table A- Standard Evaluation Results Conditional Nominal Event Description Value Value AFW MOTOR DRIVEN PUMP 12 AFW-MDP-FS-12 True 7.84E-4 FAILS TO START CCF OF AFW MOTOR-DRIVEN AFW-MDP-CF-FS 3.95E-2 3.10E-5 PUMPS TO START The CDP (core damage probability) is 1.91 x 10-6 which is in the lower end of the White range.

b) No CCF Contribution (a lower bound)

Set event AFW-MDP-FS-12 (AFW MOTOR DRIVEN PUMP 12 FAILS TO START) to 1.0 in SAPHIRE. Setting the probability of failure to 1.0 will not allow the automatic adjustment of CCF for the event. Although setting the probability of failure to start to 1.0 will generate non-minimal cutsets, it will slightly overestimate the result. The CCF probability for failure to start (event AFW-MDP-CF-FS) has remained unchanged at 3.10 x 10-5.

Table B- No CCF Adjustment Results Event Description Conditional Nominal Value Value AFW-MDP-FS-12 AFW MOTOR DRIVEN PUMP 12 1.00E+0 7.84E-4 FAILS TO START AFW-MDP-CF-FS CCF OF AFW MOTOR-DRIVEN 3.10E-5 3.10E-5 PUMPS TO START The CDP is 9.21 x 10-7 which is in the upper end of the Green range.

2. Did the quantitative sensitivity show a color change?

Since the response is Yes, proceed to 3.

3. Does the PD involve SSCs that could be part of an intersystem CCCG OR is there indication of the PD in an extent of condition evaluation?

a) For this example, the motor-driven AFW pumps do not share attributes with other motor-driven pumps within the same room or enclosure.

Therefore, the response to the intersystem question is no.

b) As stated in the description, an extent-of-condition evaluation was inconclusive.

Since the response to both question is no, proceed to Step 4.

Page 9 of 14

Development of Supplemental Guidance for Common Cause Failure

4. Have measures been taken for the SSC outside the standard CCF reduction practices?

For this example, it is assumed that the licensee provided evidence that they take additional measures outside of standard industry practice to reduce CCF. Therefore, proceed to 4a and 4c, otherwise, proceed to 4b and 4c.

4a. Contact RES to refine CCF -factors estimate using contributing causal factors. SRA to use new factors in CCF calculation.

The INL contractor was contacted for a refined set of -factors for a condition which matched the AFW pump performance deficiency. The data for this case is based on the following beta-distribution parameters.

Table C - Sample Refined CCF Alpha Factors Revised a b Mean Median 5th 95th Factor Percentile Percentile 1 40.1 0.571 0.986 0.993 0.949 0.999 2 0.571 40.1 0.0140 0.0072 0.0001 0.0511 The revised -factors were then factored into the SPAR model with the following results:

Table D- Refined Alpha Factor Results Event Description Conditional Nominal Value Value AFW-MDP-FS-12 AFW MOTOR DRIVEN PUMP True 7.84E-4 12 FAILS TO START ZA-MDP-FS-AFW-02A02 Alpha factor 2 in group size 2 for 1.40E-2 3.95E-2 component MDP with failure mode FS : AFW AFW-MDP-CF-FS CCF OF AFW MOTOR-DRIVEN 1.44E-2 3.10E-5 PUMPS TO START The CDP (core damage probability) is 1.28 x 10-6 which is in the low end of the White range around the Green-White threshold value.

Proceed to Step 4c.

4b. Continue with full CCF calculation For this example, the licensee provided evidence that additional measures are in place to reduce CCF. However, for cases where there are no measures, the SRA shall use the CDP for the SAPHIRE adjusted full CCF contribution before proceeding to Step 4c.

Page 10 of 14

Development of Supplemental Guidance for Common Cause Failure 4c. Consider qualitative factors influencing the color determination Since the revised quantified CDP presented in this example is numerically on the Green-White borderline, qualitative factors should be additionally considered. In an actual SDP case, analyst and SERP members will evaluate each estimate on a case-by-case basis using the principles of good regulation and concepts of risk-informed decision-making. For this example, to investigate the impact of how individual coupling factors can influence the result, several cases will be quantified representing each of the five coupling factors and how different types of performance deficiencies could influence the result slightly. Please note that this is an exercise and not all performance deficiencies can be easily classified to fall completely under one of these categories since there is a degree of overlap and some uncertainty regarding identifying the coupling factor. In many cases, the actual coupling factor can be related to a root cause which may not be immediately apparent in the SDP.

In addition, as stated in the assumptions, a straight multiplier was used on the 2 factor which might underestimate the actual impact. Using the report as a guide 5, a typical breakdown of coupling factors for CCF is presented on Figure 3 and CDP result for each corresponding factor is presented on Table 5 below. Figure 4 is a chart of each computed CDP for the bounding cases of the standard adjustment and no CCF adjustment. It is followed by proportional adjustments based on the five individual coupling factors, and finally the revised factor. Although no case is clearly White or Green in characterization, the CCF contribution can be influenced by understanding the nature of the PD.

5 General Insights from Analysis of Common-Cause Failure Data at U.S. Nuclear Power Plants 1997-2012, Idaho National Labs for NRC RES, November 2013. https://nrcoe.inel.gov/resultsdb/CCF/

Page 11 of 14

Development of Supplemental Guidance for Common Cause Failure Figure 3 - Sample Distribution of Coupling Factors Table E - Tabulation of Coupling Factor Results Standard Revised NRC No CCF data for 2 Adjustment Adjustment Factor Design Maintenance Environmental Hardware Operational Value used TRUE 1 46% 33% 16% 3.0% 2.4%

CDP (for one-month exposure) 1.91E-06 9.21E-07 1.28E-06 1.12E-06 1.06E-06 9.88E-07 9.50E-07 9.40E-07 2 Factor 3.95E-02 3.95E-02 1.40E-02 1.82E-02 1.30E-02 6.32E-03 1.19E-03 9.48E-04 Page 12 of 14

Development of Supplemental Guidance for Common Cause Failure Figure 4 - Example Plant Model PD on CCF of Motor-Driven AFW Pump Fails to Start 2.5E-06 2.0E-06 Core Damage Probability for One-Month Duration Green-White quantitative 1.5E-06 threshold 1.0E-06 5.0E-07 0.0E+00 Standard NRC No CCF Design Maintenance Environmental Hardware Operational Revised data for Adjustment Adjustment 2 factor Attribute of PD Page 13 of 14

This Page Intentionally Left Blank Page 14 of 14

Retrieved from "https://kanterella.com/w/index.php?title=ML18260A249&oldid=1922629"