ML20056F335
| ML20056F335 | |
| Person / Time | |
|---|---|
| Issue date: | 06/04/1993 |
| From: | Taylor J NRC OFFICE OF THE EXECUTIVE DIRECTOR FOR OPERATIONS (EDO) |
| To: | Rogers, Selin I, The Chairman NRC COMMISSION (OCM) |
| References | |
| NUDOCS 9308270002 | |
| Download: ML20056F335 (28) | |
Text
-i.
.. ?
o o
W p uco UNITED STATES f
- [
NUCLEAR REGULATORY COMMISSION f
WASHINGTON, D.C. 20065 0001 June 4, 1993
+
MEMORANDUM FOR:
The Chairman Comissioner Rogers Comissioner Curtiss Comissioner Remick Commissioner de Planque FROM:
James M. Taylor Executive Director for Operations
SUBJECT:
ROLE OF AE00 IN OVERSIGHT OF OPERATING REACTORS On December 17, 1992, the Office for Analysis and Evaluation of Operational Data (AE0D) briefed the Commission on the role of AE00 in the oversight of operating reactors. During the briefing, several items of interest were raise.d by the Commissioners.
In the Staff Requirements Memorandum (SRM),'
dated December 31, 1992, the Commission requested that the staff evaluate the following items:
(1)
Determine whether there is a method available which could calculate the difference in operator performance with and without the annunciators available (specifically without annunciators and not knowing they are inoperable), and if so,_ describe the differences; 7
(2)
The role of AEOD in the medical and materials areas, and the potential for performance indicators in these areas; and (3)
The correlation of resource application to specific plants with the perceived performance of the plants.
Operator Response and Annunciators:
AEOD is not aware of any applied methods to calculate the difference in operator performance with and without annunciators available. However, we are able to survey operating experience related to annunciator failures and estimate the impact on frequency of scrams and increased risk.
The staff believes that annunciator systems are an important aid for safe a
plant operations. Complex system operations are aided by the use of g
annunciators and computer-based monitoring to alert operators to respond to developing problems.
It is unlikely that nuclear power plants could function 5g effectively in the long term with todays staffing levels without the extensive array of alarms to aid in system monitoring. Both power generation capability and availability of safety systems are greatly improved due to the use of el annunciator systems.
WI
.p U
N30 R E CEMIER EGPY tP pp f py,, E $4+
g/ 78- [
9308270002 930604
. ~f' PDR COMMS NRCC
- g,,y)
CORRESPONDENCE PDR3 d
e e
The Commissioners,
During shutdown conditions many of the automatic functions are not available and manual actions are required to perform safety functic.is. AE0D's analyses did not attempt to address the impact of loss of annunciators during shutdown.
i Based on data reported to the NRC, annunciator systems are highly reliable; events of substantial losses of annunciators occur at a rate of approximately 0.14 per reactor year with an average duration of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. This means that annunciator systems availability is greater than 99 percent. Also, review of the 319 automatic reactor scrams for 1991 - 1992 identified no reactor scrams resulting from failure of operators to take action because an annunciator did not alert the operator of the need to respond.
Review of the events provides no basis to expect that extended loss of annunciators or events in which the operator is not aware of the loss of annunciators have resulted in additional reactor scrams.
The ASP computer program was utilized to estimate the conditional core damage probability of human errors by assuming that operators would not actuate equipment or recover failed equipment during a transient or accident if the annunciators were unavailable and varying the hours of annunciator inoperability. The ASP estimated conditional core damage probability range was E-10 to E-05.
In addition to the ASP calculations, risk calculations based on probabilistic risk assessment concepts were performed to estimate the impact of loss of annunciator events.
We calculated several sequences including reactor trips, loss-of-offsite power, and loss of coolant.
We concluded that the overall additional risk due to loss of annunciator events is small.
If the operator is assumed twice as likely to make an error which results in core damage due to loss of annunciators, the increase in overall risk per reactor year due to reactor trips is approximately 0.25 percent; the increase in overall risk per reactor year due to loss-of-offsite power events is approximately 2.5 percent; the increase in overall risk per reactor year due to loss-of-coolant accidents is approximately.003 percent. Additional details are provided in Enclosure 1.
Three factors contribute to the low overall risk contribution due to loss of annunciator events:
(1) low frequency of high risk events, (2) low frequency of loss of annunciators (high availability), and (3) low risk of core damage even with degraded operator action because many important safety functions are automatic.
If annunciator systems achieve availability levels consistent with the current reported levels, the average risk contribution appears minimal.
Increased AE0D Role in Medical and Other Materials Program:
Because materials license programs are very dissimilar, an evaluation of performance is more effectively done on an industry basis (e.g., industrial radiography, fuel cycle facilities, medical facilities, etc.). We believe that the materials events data can be useful in gauging overall industry performance for various materials licensee categories and for identifying problem areas either in program operation, the industry, or specific equipment.
o o
The Commissioners '
We are reviewing options for enhancing our efforts at identifying radiation safety-related problems in the materials area. One option is to reallocate contractor budgeted funds to redesign our nonreactor database in order to improve coding of the events and to include the proper structure for coding radiation accidents and programmatic failure type data. Additionally, we would establish an on-call assistance contract with a government laboratory to assist in special reviews of incidents or equipment of material licensee facilities.
Also, we are considering two options in our efforts at evaluating the performance (and identifying potential performance indicators) for materials licensees and identifying industry problems in the materials area:
(1) we expect to review the results of the staff's special task force on developing common performance indicators for materials licensees, and (2) we could consider enhancing our program to permit:
developing the methodology to assess the risk significance of individual events such as precursors to potentially more significant events; and implementing a program with attributes similar to the Accident Sequence Precursor Program for reactors, and evaluate whether the materials event data can be used for trending performance in certain materials license areas.
Further details regarding AE0D's role in the medical and materials area are provided in Enclosure 2, as well as discussions on program background and ongoing activities.
Inspection Resources and Plant Performance:
On average, plants perceived as performing poorly receive more inspection hours than good performing plants (see figures in Enclosure 3). However, in the case of single unit sites nationwide, poor performers receive far fewer inspection hours than some other plants not identified as good or poor performers. This analysis is, however, based on a very limited sample of only two plants and any meaningful correlation is doubtful.
In the case of dual unit sites nationwide, there is considerable overlap in inspection hours between the two groups - that is, several good performers are inspected more than some poor performers. The range of inspection hours among both good and poor performers is very large and is dominated by generic area team inspection and resident inspector hours. Discretionary inspection hours during the period of this study have been a small part of the total hours. The staff is addressing the issue of offering licensees the incentive of fewer inspection hours for good performance.
Further details of this analysis are discussed in Enclosure 3.
r, The Commissioners We believe that our response meets the intent of your request. However, if there are any additional questions regarding these items, we are available for further discussions.
Odginalsigned by James M.TapW James M. Taylor Executive Director for Operations
Enclosures:
As stated cc w/ enclosures:
SECY OGC OPA OCA DIG Office Directors, Regions ACRS ACNW OP SDBU/CR ASLBP Distribution:
PDR Central File AE0D'R/F DSP R/F ROAB R/F OEDO R/F REF: M921217 (WITS92-315)
MTaylor, EDO JSniezek, EDO HThompson, EDO JB1aha, EDO JKnubel, EDO JKauffman, AE0D JIbarra, AEOD Glanik AEOD JRosenthal, AE00 VBenaroya, AEOD GHolahan, AE00 Dross, AE0D EJordan, AE00 DHickman, AE00 SPettijohn, AE00 PBaranowsky, AE0D JRaines, AE0D 93-202 SRohrer, AE0D 93-202 WBeckner, NRR SLong, NRR See previous concurrence ROAB C:ROAB DD:AE0D D:AE00 EDO EDO ED JIbarra:mmk* JRosenthal* Dross
- EJordan* JSniezek HThompson J,T or 5/6/93 5/6/93 5/6/93 5/6/93 5/ /93 5/ /93 p/ / /93
The Commissioners We are reviecing options for enhancing our efforts at identifying radiation safety-related problems in the materials area. One option is to reallocate contractor budgeted funds to redesign our nonreactor database in order to improve coding of the events and to include the proper structure for coding radiation accidents and programmatic failure type data. Additionally, we would establish an on-call assistance contract with a government laboratory to assist in special reviews of incidents or equipment of material licensee facilities.
Also, we are considering two options in our efforts at evaluating the performance (and identifying potential performance indicators) for materials licensees and identifying industry problems in the materials area:
(1) we expect to review the results of the staff's special task force on developing common performance indicators for materials licensees, and (2) we cc0ld consider enhancing our program to permit:
/
/
developing the methodology to assess the risk significan6e of individual events such as precursors to potentially more significant events; and implementing a program with4 ttributes similar to the Accident Sequence Precursor Program'for reactors, and
,/
evaluate whether the materials event data can'be used for trending performance in certain materials license a,reas.
Further details regarding AE00's role in the m$ dical and materials area are provided in Enclosure 2, as well as discussi6ns on program background and ongoing activities.
/
/
Inspection Resources and Plant Performance:
/
On average, plants perceived as p/ However, in the case of single unit sites, erforming poorly receive more inspection hours than good performing plants poor performers receive far fewer inspection hours than some other plants not so identified.
In the case of' dual unit sites, there is considerable overlap in inspection hours between,the two groups, that is, several good performers are inspected more than some poor performers.
While there appears to 6 a slight negative correlation between plant performance and NRC resources, the range of inspections hours among all plants is so large that no' systematic program for adjusting NRC resources to match perceived performsnce is apparent.
Further details are provided in.
/
We believe that our response meets the intent of your request.
However, if there are any additional questions regarding these items, we are available for further discussions.
James M. Taylor Executive Director for Operations
Enclosures:
As stated cc w/ enclosure:
See next page Distribution: See next page s
/)
/
See previous concurrenc p'/
4
\\
T New Concurrence:
o ROAB o 4 C:R0 DD;AEOD _ :A Ob' EDO EDO EDO JIbard:mmk JR dnthal DR6ks EJordan JSniezek HIhompson JTaylor 5/G/93 5/, 93 5/\\ /93 5/g/93 5/ /93 5/ /93 5/ /93 I
r Q
Q
~~
The Commissioners -
cc w/ enclosure:
SECY OGC OPA OCA DIG Office Directors, Regions ACRS ACNW OP SDBU/CR ASLBP Distribution:
PDR Central File AE0D R/F DSP R/F ROAB R/F OEDO R/F REF: M921217 (WITS92-315)
MTaylor, ED0 JSniezek, EDO HThompson, EDO JBlaha, EDO JKnubel, EDO JKauffman, AE0D JIbarra, AEOD GLanik AE0D JRosenthal, AE0D VBenaroya, AE00 GHolahan, AE0D Dross, AEOD EJordan, AEOD DHickman, AE0D SPettijohn, AEOD PBaranowsky, AE0D JRaines, AE0D 93-202 SRohrer, AE00 93-202 WBeckner, NRR Slong, NRR
The Commissioners '
We are reviewing options for enhancing our efforts at identifying radiation safety-related problems in the materials area. One option is to reallocate contractor budgeted funds to redesign our nonreactor database in order to improve coding of the events and to include the proper structure for coding radiation accidents and programmatic failure type data. Additicaally, we would establish an on-call assistance contract with a government laboratory t assist in special reviews of incidents or equipment of material licensee facilities.
Also, we are considering two options in our efforts at evaluating the performance (and identifying potential performance indicators) for ma)1) rials licensees and identifying industry problems in the materials area: f we expect to review the results of the staff's special task force on eveloping common performance indicators for materials licensees, and (2) w could consider enhancing our program to permit:
developing the methodology to assess the risk signifi nce of
=
individual events such as precursors to potentially re significant events; and implementing a program wit attributes similar to the Accident Sequence Precursor Progra for reactors, and evaluate whether the materials event data ca be used for trending performance in certain materials license areas.
Further details regarding AE0D's role in the dical and materials area are i
provided in Enclosure 2, as well as discussi s on program background and ongoing activities.
Inspection Resources and Plant Performa e:
On average, plants perceived as perf ming poorly receive more inspection hours than good performing plants.
owever, in the case of single unit sites, poor performers receive far fewer nspection hours than some other plants not so identified.
In the case of al unit sites, there is considerable overlap in inspection hours between th two groups, that is, several good performers are inspected more than some oor performers.
While there appears to be slight negative correlation between plant performance and NRC reso rces, the range of inspections hours among all plants is so large that no sy tematic program for adjusting NRC resources to' match perceived performanc is apparent.
Further details are provided in We believe that r response meets the intent of your request.
However, if there are any ditional questions regarding these items, we are available for
~
further discu sions.
James M. Taylor Executive Director for Operations Encl sures: As stated cc w/ enclosure:
See next page
- S previous concurrence:
Distribution:
See next page AB*
ROAB C:ROAB*
TPAB AC:TPAB*
DSP*
Kauffman GLanik JRosenthal DHickman JJohnson VBenaroya 3/19/93sr:mmk 3/--/93 3/19/93 3/--/93 3/22/93 3/22/93 D:DSP*
DD:AEGD*
D:AE0D*
ED0 EDO EDO TNovak Dross EJordan J5niezek HThompson JTaylor 3/24/93 3/24/93 3/31/93 4/ /93 4/ /93 4/ /93
e 4
The Commissioners developing the methodology to assess the risk significance of individual events such as precursors to potentially more significant events; and implementing a program with attributes similar to the Accident Sequence Program for reactors, and
+
evaluate whether the materials event data can be used for trending performance in certain materials license areas.
Further details regarding AEOD's role in the medical and materials area are provided in Enclosure 2, as well as discussions on program background and ongoing activities.
/
/
Inspection Resources and Plant Performance:
On average, plants perceived as performing poorly receive more inspect, ton hours than good performing plants. However, in the case of single ur(it sites, poor performers receive far fewer inspection hours than some other plants not so identified.
In the case of dual unit sites, there is consid able overlap in inspection hours between the two groups, that is, several od performers are inspected more than some poor performers.
While there appears to be a slight negative correlation etween plant performance and NRC resources, the range of inspectio hours among all plants is so large that no systematic program for adjustin iRC resources to match perceived performance is apparent. Further detail are provided in Enclosure 3.
We believe that our response meets the inte of your request. However, if there are any additional questions regardi these items, we are available for further discussions.
James M. Taylor Executive Director for Operations
Enclosures:
As stated (see next page for istribution)
(*See previous oncurrence)
ROAB*
AB C:ROAB*
TPAB AC:TPAB*
DSP*
JKauffman GLanik JRosenthal DHickman JJohnson VBenaraya 3/19/93s 3/--/93 3/19/
3/--/93 3/22/93 3/22/93 D:DSV DD:AEOD*
EDO ED0 EDO TNp(ak Dross o an JSniezek HThompson JTaylor 24/93 3/24/93 p//(/93
/ /93
/ /93
/ /93
~
The Commissioners -
cc:
SECY OGC OPA OCA DIG Office Directors, Regions ACRS ACNW OP SDBU/CR ASLBP Distribution:
WITS92-315 M921217 PDR DCS AE00 Action 93-02 (Raines/Rohrer)
AEOD R/F DSP R/F ROAB R/F TPAB R/F JKauffman GLanik JRosenthal DHickman JJohnson VBenaroya TNovak SPettijohn EDO R/F JTaylor Dross EJordan JSniezek HThompson JBlaha JKnubel e
s h
6 6
P 3
s L
~
O O
The Commissioners i developing the methodology to assess the risk significance of e
individual events such as precursors to potentially more significant events; and implementing a program with attributes similar to the Accident Sequence Program for reactors, and l
+
evaluate whether the materials event data can be used for trending performance in certain materials license areas.
i Further details regarding AE0D's role in the medical and materials area are provided in Enclosure 2, as well as discussions on program background and ongoing activities.
1 Inspection Resources and Plant Performance-On average, plants perceived as performing poorly receive more inspection hours than good performing plants. However, in the case of single unit sites, poor performers receive far fewer inspection hours than some other plants not so identified.
In the case of dual unit sites, there is considerable overlap in inspection hours between the two groups, that is, several good per ormers are inspected more than some poor performers.
j While there appears to be a slight negative correlation between lant i
performance and NRC resources, the range of inspections hour mong both good and poor performers is so large that no systematic program or adjusting NRC resources to match perceived performance is apparent.
F her details are provided in Enclosure 3.
We believe that our response meets the intent of yo r request.
However, if there are any additional questions regarding thes items, we are available for further discussions.
Jam M. Taylor i
E cutive Director 3
for Operations i
Enclosures:
As stated
/
(see next page for distribution)
I
(*See previous concurrence)
ROAB*
ROAB C:R0AB*
TPAB AC:TPAB*
DSP*
j JKauffman Glanik JRosenthal DHickman JJohnson VBenaroya i
3/19/9)sr 3/--/93 3/19/93 3/--/93 3/22/93 3/22/93
/
1 D:Dyd*
DD:AE0D*
D:AE00 EDO EDO ED0 I
3vak Dross EJordan JSniezek HThompson JTaylor 3 2 /93 3/24/93
/ /93
/ /93
/ /93
/ /93
O e,.
v The Commissioners explore ways to improve the collection and coding of materials event e
data.
Further details regarding AE0D's role in the medical and mate ~ rials area are provided in Enclosure 2, as well as discussions on program background and ongoing activities.
Inspection Resources and Plant Performance:
On average, plants perceived as performing poorly receive more inspection hours than good performing plants.
However, in the case of single unit sites, poor performers receive far fewer inspection hours than some other plants not so identified.
In the case of dual unit sites, there is considerable overlap in inspection hours between the two groups, that is, several good performers are inspected more than some poor performers.
In addition, the plant with the fewest inspection hours of any dual unit site has not been identified as a good performer.
While there appears to be a slight negative correlation between plant performance and NRC resources, the range of inspections hours among both good and poor performers is so large that no systematic program for adjusting NRC resources to match perceived performance is apparent.
Further details are provided in Enclosure 3.
We believe that our response meets the intent of your request. However, if there are any additional questions regarding these items, we are available for further discussions.
James M. Taylor Executive Director for Operations
Enclosures:
Distribution:
As stated WITS92-315 M921217 PDR DCS AE0D Action 93-02 (Raines/Rohrer) cc:
SECY AE0D R/F DSP R/F ROAB P/F TiAB R/F OGC JKauffman Glanik JRosenthal DHickman OPA JJohnson
/
VBenaroya TNovak SPettijohn OCA Dross
/
EJordan EDO R/F JTaylor 0IG JSniezek HThompson JBlaha JKnubel Office Directors, Regions ACRS, ACNW, OP, SDBU/CR ASLBP
(*See previous concurrence)
ROAB*
RCAB C:ROAB*
TPAB AC:TPAB*
DSP*
JKauffman Glanik JRosenthal DHickman JJohnson VBenaroya w, {f/p3 3f; 3/19/93 3/--/93 3/22/93 3/22/93 3/19/93sr D0:AEOD D:AE0D EDO ED0 ED0 ak
,, DRiiis i EJordan JSniezek HThompson JTaylor 3 / /93 ' g \\/93
/ /93
/ /93
/ /93
/ /93 i
i
v V
The Commissioners explore ways to improve the collection and coding of materials event e
data.
Further details regarding AEOD's role in the medical and materials area are provided in Enclosure 2, as well as discussions on program background and ongoing activities.
Inspection Resources and Plant Performance:
On average, plants perceived as performing poorly receive more inspection hours that good performing plants. However, in the case of single unit sites, poor performers receive far fewer inspection hours than some other plants not so identified.
In the case of dual unit sites, there is considerable overlap in inspection hours between the two groups, that is, several good performers are inspected more than some poor performers.
In addition, the plant with the fewest inspection hours of any dual unit site has not been identified as a good performer.
While there appears to be a slight negative correlation between plant performance and NRC resources, the range of inspections hours among both good and poor performers is so large that no systematic program for adjusting NRC resources to match perceived performance is apparent.
Further details are provided in Enclosure 3.
We believe that our response meets the intent of your request.
F.cwever, if there are any additional questions regarding these items, we are available for further discussions.
James M. Taylor Executive Director for Operations
Enclosures:
Distribution:
As stated WITS92-315 AEOD Action 93-02 (Raines/Rohrer) cc:
SECY AEOD R/F DSP R/F ROAB R/F TPAB R/F OGC JKauffman Glanik JRosenthal DHickman OPA JJohnson VBenaroya TNovak SPettijohn OCA Dross EJordan EDO R/F JTaylor JSni ze HThompson JBl aha JKnubel ROAB ' N ROAB C:F11AB TPAB AC:TPAirf DSP %
JKaufban Glanik JRos nthal DHickman JJohnsofy#
VBenaroya
) //p/93
/ /93
.3 /t t/93 3/c/93 3 /fi /93sr
/ /93 1
D:DSP DD:AEOD D:AE0D EDO EDO EDO TNovak Dross EJordan JSniezek HThompson JTaylor
' /93
/ /93
/ /93
/ /93
/ /93
/ /93 W
~
A a
w w
9 1.
Determine whether there is a method available which could calculate the difference in operator performance with and without the annunciators available (specifically without annunciators and not knowing they are inoperable), and if so, describe the differences.
Purpose:
During the AE0D presentation to the Commission on December 17, 1992, the staff was questioned regarding the potential differences in operator performance depending upon the availability or lack of availability of plant annunciator systems. AE00 suggested the Accident Sequence Precursor Program (ASP) could be used to attempt an estimate of the impact of inoperable annunciator systems. This paper reports the results froia that effort.
AEOD is not aware of modelling capability suitable for quantification of the potential difference in operator performance depending on the availability or lack of availability of plant annunciator systems. Conceptually, human reliability analysis techniques could address this question, but the issue is not addressed specifically by current techniques. The current techniques account for the human reliability by using a rough probability of operator error.
However, risk estimates based on current techniques can provide some perspective withcut answering the specific question of operator performance differences with and without annunciators.
Based on operating experience available on annunciator losses, reactor trips, and loss-of-offsite power (LOOP) events, several risk calculations were done which, we believe, demonstrate that the overall risk contribution due to loss of annunciator events is small.
Discussion:
Complex system operations are aided by the use of annunciators and computer based monitoring to alert operators to respond to developing problems.
It is unlikely that nuclear power plants could function effectively in the long term without the extensive array of alarms to aid in system monitoring. Both power generation capability and availability of safety systems are greatly improved due to the use of annunciator systems. However, the annunciators are only aids that would prompt operator actions to prevent further degradation of a function. Most safety functions will automatically activate when the conditions reach actuation setpoints.
AEOD collected data on events of substantial loss of annunciators and plant process computers for the period 1985 - 1993. The plant process computer provides alternate annunciator indications and can be used when the annunciator system is unavailable.
Sources of information included Licensee Event Reports, Emergency Notification System reports, and Resident Inspector
- Reports, i
w w -
A total of 110 loss of annunciator or computer events were identified. This corresponds to a frequency of occurrence of approximately 0.14 per reactor year.
Four events coincided with a reactor trip. Nine events involved the simultaneous loss of annunciators and the plant process computer.
For 36 events which included information on the duration, the average loss of annunciators was about 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.
Similarly, 59 loss of computer events averaged about 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />.
The number of events per year and number of events versus duration are shown in Figures I and 2.
As another measure of the potential impact of loss of as little as a single annunciator on operator performance, 319 LERs which reported reactor trips were reviewed (years 1991 - 1992). The review identified no reactor trips that were attributed to an inoperable annunciator leading to lack of operator action which could have prevented the trip.
During shutdowr. conditions, many of the automatic safety systems may not be i
available and operator action is required to perform safety functions.
Current probabilistic risk assessment and ASP do not specifically model operator and annunciator interactions during shutdown. Unavailability of automatic safety system response coupled with loss of annunciators to alert operator to initiate action may result in increased risk of core damage when shutdown. Annunciator systems may be degraded more often during shutdown conditions because of maintenance activities. The risk associated with shutdown is currently being addressed by NRR and RES, and this paper does not address annunciator losses during shutdown.
Errors of omission are factored broadly into the existing probabilistic risk assessment methodologies. However, errors of commission have not been factored into the methodologies due to lack of human reliability modelling capability.
Efforts are planned by RES to attempt to model errors of commission as an extension of the probabilistic risk assessment shutdown risk analyses.
Procedures, training, and effective command and control mitigate errors of commission but we have no specific insight on how to treat errors of commission with respect to loss of annunciators.
Some loss of annunciator events have occurred and the control room operators were not aware of the loss. We have no specific insights on how this might affect risk except to note that if another perturbation were to occur, it is likely that the operators would be immediately aware of the loss of annunciators, except for the case of loss of individual annunciators. Also, most operating procedures (especially emergency operating procedures) rely on indication rather than annunciators for cues to operator action.
In addition, review of reactor trips over a 2-year period did not find any undisclosed loss of annunciator events which were subsequently revealed.
Extended loss of annunciator events which are known to the operator can probably be discounted. Once a loss of annunciators is known, compensatory actions are usually taken and the control operators rely on alternate indications.
~
O O.
Loss of Annunciators or Computer (s)
Events Per Year No. of Events 16 14 12 10
(,
e
)
l !
c B
e O
~
4
-l --i-l +
t-
'd 4
L :l vOi -
=
85 BG 87 88 89 90 91 92 93 Year E Loss of Annunciators
- \\' loss of Computers (Through March 1993)
Figure 1 Loss of Annunciators or Computer (s)
Events Per Year Loss of Annunciator or Computer (s)
Reported Event Durations No. of Events 20 15
]
?
a 10
'l
'l q
5 3]
d 3 l d
lj j
d
{
j y
.b-4-5 P 83 P E.
l l
l l
PP 0 -4 O I 2 3 4 5 6 7 8 9 10 Ii 12 10 14 15 16 17 18 19 Length of Event (hours)
M less of Annunciators 3 less of Computer (s)
N*d.6.[$[E'.*r'.'I'..4.r.i..)
Figure 2 Loss of Annunciators or Computer (s)
Reported Event Durations
[
Calculations:
The ASP computer program was utilized to estimate conditional core damage probability for trips, LOCAs, and LOOPS by varying the duration of time annunciators were inoperable from I hour to 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> and varying the non-recovery factors in the event branches from the existing non-recovery factor to complete failure. That is, we assumed that the operators would not actuate equipment or recover failed equipment during a transient or accident if the annunciators were unavailable. The conditional core damage probability magnitude ranged from E-10 to E-05.
The following calculations use nominal probability and risk values from various probabilistic risk assessments and ASP calculations to estimate the potential core damage risk per year for various scenarios to try to understand the potential consequences of loss of annunciator events.
By equating the estimated core damage risk of an event to the same event accompanied by a loss j
of annunciators, a measure of the impact of human error due to loss of annunciators can be calculated.
Event scenarios can be dependent on the loss of annunciators while other events are independent of the loss of annunciators. The coupling factor will influence the method to do the calculations.
Note that the following calculations do not include shutdown events.
The calculations for LOOP and reactor trip are cases where the data and logic indicate that the occurrence of the event and the loss of annunciators may be dependent.
For example, in some cases, LOOP results in a greater likelihood of loss of power to the annunciators.
However, certain events are likely to be independent of loss of annunciator events.
For example, in most cases, the occurrence of a loss-of-coolant i
accident (LOCA) would not be expected to either cause or be caused by a loss of annunciators. This same logic holds for other events such as anticipated
)
transient without ceram, intersystem LOCAs, steam generator tube ruptures, and others.
Dependent Events Reactor Trip ASP estimates the conditional core damage probability for a simple trip to be 3E-07; and an average plant experienced about 2 trips per year. The risk of core damage per reactor year resulting from these trips is estimated to be 2 x i
3E-07 per reactor year. On the other hand, operating data shows that 4 trips in the past 800 reactor years of operation have occurred concurrent with loss of annunciators. The risk of core damage per reactor year resulting from trips with loss of annunciators can then be estimated to be (4/800) x 3E-07 x A, where A is a factor by which the probability of human error leading'to core damage must be multiplied due to loss of annunciators.
If for purposes of i
comparison of risk, we equate the risk per reactor year due to normal trips and the risk per reactor year due to trips accompanied by loss of annunciators, we have the following:
2 x 3E 3E-07 x 4/800 x A
g g
w w ;
Solving for A equals 400. This means to achieve a level of risk equal to that of normal trips, operators must be almost 400 times more likely to damage the core without annunciators than with annunciators.
Even with a multiplier of 400, the resultant risk due to trips accompanied by loss of annunciators is approximately E-07 per reactor year.
Another way of looking at this comparison is that if the operator is twice as likely to make an error which results in core damage due to loss of annunciators, the increase in overall risk per reactor year due to reactor trips is approximately 0.25 percent. This is expected because operating i
experience shows that approximately 0.25 percent of reactor trips are accompanied by loss of annunciators.
i Loss-of-offsite power i
Using a calculation similar to above, ASP calculates the conditional core damage probability for a single LOOP event to be 5E-04 and the frequency of a l
LOOP is 1E-01 per year. On the other hand, operating data shows that 2 LOOPS in the past 800 reactor years of operation have occurred concurrent with loss of annunciators. The risk of core damage per reactor year resulting from LOOPS with loss of annunciators can then be estimated to be (2/800) x 5E-04 x i
B, where B is a factor by which the probability of human error leading to core l
damage must be multiplied due to loss of annunciators. Again, for purposes of comparison of risk, we equate the risk per reactor year due to normal LOOPS and the risk per reactor year due to LOOPS accompanied by loss of i
annunciators, we have the following:
i IE-01 x 5E SE-04 x 2/800 x B Solving for B equals 40. This means to achieve a level of risk equal to that of normal LOOPS, operators must be about 40 times more likely to damage the core without annunciators than with annunciators. Again, with a multiplier of 40, the resultant risk due to LOOPS accompanied by loss of annunciators is approximately SE-05 per reactor year.
Again, if the operator is twice as likely to make an error which results in core damage due to loss of annunciators, the increase.in overall risk per reactor year due to LOOPS is approximately 2.5 percent. This is expected because operating experience shows that approximately 2.5 percent of LOOPS are accompanied by loss of annunciators.
Independent Events Loss-of-coolant accident The assumption that the loss of annunciators and the event of concern are independent changes the calculation such that the risk of a concurrent event and loss of annunciators is the product of the risk per reactor year of the event times the probability of loss of annunciator. The independent probability of loss of annunciators is the ratio of hours lost in one year of operation compared to hours of operation in one year.
It is possible to calculate risk numbers similar to those above for trips and LOOPS, but with loss of annunciators assumed to be independent. ASP
g
- i i
calculates the conditional core damage probability for a single LOCA event to be IE-05 and the frequency of IE-02 per year. On the other hand, operating data shows that annunciators are lost 0.1375 times per year for a duration of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> average. The risk of core damage per reactor year resulting from LOCAs with loss of annunciators can then be estimated to be (.275/8760) x IE-05 x IE-02 x C, where C is a factor by which the probability of human error leading to core damage must be multiplied due to loss of annunciators. Again, for purposes of comparison of risk, we equate the risk per reactor year due to normal LOCAs and the risk per reactor year due to LOCAs accompanied by loss of
[
annunciators, we have the following:
IE-02 x IE IE-05 x (.275/8760) x IE-02 x C Solving for C equals 31,854.5. This means to achieve a level of risk equal to that of normal LOCAs, operators must be about 32,000 times more likely to damage the core without annunciators than with annunciators. Again, even with t
a multiplier of 32,000, the resultant risk due to LOCAs accompanied by loss of l
annunciators is approximately 1E-07 per reactor year.
i Another way of looking at this comparison is that if the operator is twice as likely to make an error which results in core damage due to loss of annunciators, the increase in overall risk per reactor year due to LOCAs is approximately 0.003 percent. This is expected if LOCAs are independent of loss of annunciator events such that one in 32,000 LOCAs would be accompanied by loss of annunciators.
The primary reasons for the risk probability due to loss of annunciators is small are:
(1) low frequency of high risk events, (2) low frequency of loss of annunciators (high availability), and (3) low risk of core damage even with degraded operator action because many important safety functions are automatic.
Conclusions-Based on data reported to the NRC, annunciator systems are highly reliable; events of substantial losses of annunciators occur at a rate of approximately 0.14 per reactor year with an average duration of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. This means that annunciator systems availability is greater than 99 percent.
Review of the 319 automatic reactor trips for 1991 - 1992 identified no I
reactor trips resulting from failure of operators to take actions because an annunciator did not alert him of the need to respond.
l
!^
ASP calculations in which the operator was assumed not to actuate equipment or recover failed equipment during a transient or accident if the annunciators i
were unavailable estimated the conditional core damage probability to range from E-10 to E-05. Another second method of risk calculations was also utilized. These risk calculations estimated the degradation of operator performance which would have to occur during a transient or accident with concurrent loss of annunciators to yield the same risk as the event with operable annunciators.
Large factors were calculated which appear improbable.
O O
\\
- i During shutdown conditions many of the automatic functions are not available and manual actions are required to perform safety functions. This response does not attempt to address the impact of loss of annunciators during shutdown.
NRR and RES are currently addressing risk contributions during shutdown conditions.
s I
1
't i
I
O w
2.
The role of AE0D in medical and materials area should be evaluated and the potential for some kind of performance indicator in these areas should be considered by the staff.
General In accordance with its responsibility for evaluating and analyzing operating data for material licensees, AEOD collects, reviews and codes materials license event data, and maintains a database of material license events. The data primarily is derived from telephone reports or written reports of events submitted to the NRC by material licensees.
The reports are submitted to NRC under the applicable reporting requirements for the licensed materials program. Over the period 1988 - 1991, NRC material licensees submitted to the NRC an average of 300 reportable events annually not including medical misadministrations. An average of 400 diagnostic and 16 therapy misadministrations were submitted during this period. The data for 1992 shows that about 380 reportable non-misadministration events and 30 medical misadministrations events were submitted. The substantial decrease in the number of medical misadministrations submitted primarily is due to changes in reporting requirements for medical misadministrations. AE0D also receives summary data on misadministration and non-misadministration events from Agreement States which is reviewed and coded.
In the past, Agreement States have not routinely submitted this information. AEOD is preparing a request for Office of Management and Budget clearance to collect this data from Agreement States and is working with the Office of State Programs to resolve the issue of Agreement State reporting.
Reportina Reouirements for Materials licensees The materials license reporting requirements focus almost exclusively on radiological safety concerns. The type of ever,t required to be reported generally is a radiological safety event that results in a consequence, for example, a medical misadministration, a radiation overexposure, a lost or abandoned radioactive source, an unintentional release of radioactive materials, or a leaking radioactive source. On the other hand, very few materials licensee reporting requirements require reporting of events without consequence.
For example, precursor events related to process safety or managerial controls where a radiation overexposure or releases of material, etc. did not occur.
Two exceptions are:
(1) the reporting requirement under 10 CFR 34.30 for radiography licensees to report specific radiography equipment problems without regard to whether an overexposure occurred as a result of the equipment problem, and (2) the reporting requirements under Bulletin 91-01, " Reporting Loss of Criticality Safety Controls," October 18, 1991, which clarifies ambiguities in 10 CFR 70.52 on the need to report potential criticalities to NRC.
Materials License Event Databases AE00 maintains the data on material events for NRC licensees and Agreement State licensees in dBase III plus compatible databases. The information required to be included in materials event reports submitted to the NRC by NRC licensees generally is specified by the applicable reporting requirements.
a
o e
Typically, the required items for licensee reports are: licensee identifying information, the type of event (e.g., radiation overexposure, misadminis-tration, leaking source etc.), the date of the event, the cause of the event and licensee proposed corrective action.
Because there is not a standard format for reporting materials license events and because of the diversity in materials licensed programs, there are inconsistencies among licensee reports.
This is especially evident in the narrative descriptions of events and the causes ascribed for events.
Onacina AEOD Activities for haterial License Oversicht AEOD ongoing activities relatec to evaluating operating data has primarily been focused in three areas. T1ey are: (1) the routine review of material license events as they are reported to the NRC to assess the significance of the events in regard to health and safety and assess whether an event is generic to a specific licensed program or method of operation, (2) performing case studies and engineering evaluations of a collection of events or a single event to determine the cause(s) of the event (s) in order to make recommendation for preventing a recurrence of the event (s) and to feedback the information to the industry, and (3) developing methods to feedback the result of operating experience to the industry.
In regard to the first area, AEOD has identified a number of events that required further investigation and have followed-up these events with the Office of Nuclear Materials Safety and Safeguards or the regional offices.
In regard to the second area, AEOD has performed case studies that identified generic problems in the materials area and provided recommendations which were adopted and incorporated in rulemaking. An example is: the medical Quality Management Program which has its basis in recommendations contained in the AE0D case study report:
AE0D/C505, " Case Study Report on the Therapy Misadministrations Reported to the NRC Pursuant to 10 CFR 35.42."
In regard to the third area: AE00 findings have formed the basis for Information Notices, AE00 case study reports have been sent out to affected material licensees, AEOD developed
" good safety practices" videos for nuclear medicine and teletherapy radiotherapy and is developing a good " safety practices video" for industrial radiography.
Proposed AEOD Activities for Material License Oversicht Because materials license programs are very dissimilar, an evaluation of performance is more effectively done on an industry basis (e.g., industrial radiography, fuel cycle facilities, medical facilities, etc.). Based on Abnormal Occurrence (AO) events, and IITs and AITs in the materials area, the industries where serious events have occurred are medical, industrial radiography, well logging, manufacturing and distribution and fuel cycle.
In addition, materials licensed programs for well logging, industrial gauges, irradiators, and R&D Broad licensees had at least one event that met the criteria for an A0 between 1985 and 1991 (see Attachment 1). We believe that the materials events data reported to NRC can be useful in gauging overall industry performance for various materials license categories and for identifying problem areas either in program operation, the industry, or specific equipment.
n e
i '-
a
~
We are reviewing options for enhancing our efforts at identifying radiation safety-related problems in the materials area. One option is to reallocate contractor budgeted funds to redesign our nonreactor database in order to j
improve coding of the events and to include the proper structure for coding i
radiation accidents and programmatic failure type data. Additionally, we would establish an on-call assistance contract with a government laboratory to assist in special reviews of incidents or equipment of material licensee i
facilities.
Also, we are considering two options in our efforts at evaluating the.
performance (and identifying potential performance indicators) for materials licensees and identifying industry problems in the materials area:
(1) we expect to review the results of the staff's special task force on developing common performance indicators for materials licensees, and (2) we could consider enhancing our program to permit:
developing th'e methodology to assess the risk significance of individual events such as precursors to potentially more significant events; and implementing a program with attributes similar to the ASP l
Program for reactors, and evaluate whether the materials event data can be used for trending e
performance in certain materials license areas.
j s
b i
f f
i P
O O
e
-4_
Breakdown of Abnormal Occurrences (A0s) for Materials Licenses 1985 - 1991 1
Type Licensed Program No. A0s Basis Medical 71 Diagnostic and therapy (Misadministration) misadministrations 3
Well Logging 3
Lost source, breakdown in management Industrial Radiography 14 Personnel overexposure Irradiators 2
Breakdown in management R&D Broad 3
Contamination Manufacturing and 3
Product defect, shipping, Distribution breakdown in management Industrial Gauges 1
Exposure to member of the public UF, Plants 1
Ruptured Uf, Cylinder Fuel Fabrication 2
Potential criticality Research Reactor 1
Breakdown in management Service License 1
Unqualified personnel I
i f
O O
i..
tnc,osure 3 i
3.
The staff should address how resources applied to specific plants correlate with the perceived performance of the plants.
Summary:
On average, plants perceived as performing poorly receive more inspection hours than good performing plants (see figures on pages 4 and 5). However, in the case of single unit sites nationwide, poor performers receive far fewer inspection hours than some other plants not identified as good or poor performers. This analysis is, however, based on a very limited sample of only two plants and any meaningful correlation is doubtful.
In the case of dual unit sites nationwide, there is considerable overlap in inspection hours between the two groups - that is, several good performers are inspected more than some poor performers. The range of inspection hours among both good and poor performers is very large and is dominated by generic area team inspection and resident inspector hours. Discretionary inspection hours during the period of this study have been a small part of the total hours. The staff is addressing the issue of offering licensees the incentive of fewer inspection i
hours for good performance.
Analysis Methodoloav:
A good measure of NRC resources applied to specified plants is the 10 CFR Part 170 billings for those plants. These billings cover the cost of the plant--
l specific inspections, licensing actions, and licensed operator examinations conducted by the NRC. Licensing actions and operator examinations are usually i
performed in response to licensee requests, or are scheduled at regular intervals for all plants, and _are therefore not related to the staff's
.l perception of plant performance. Plant-specific inspections, however, can be adjusted to apply NRC resources where they are felt to be most needed.. But because inspection fees lag inspection-hours by nine months to several years, a better measure of inspection resources expended is the tabular listing of inspection hours by reactor unit contained in the NRR Management and Program Information book (the white book).
Good measures of perceived performence are the lists of problem facilities and good performing plants identified by NRC senior managers at their. biannual meetings. Any correlation of applied resources to perceived performance should be most apparent when comparirg these two groups. Other plants are discussed at these meetings that have not been officially designated as problem plants, and inspection hours t'or such plants may have been increased because of concerns about their perforeance. These plants were not included in this analysis.
3 Good performing plants were first identified at the January 1990 Senior Management Meeting. ' The inspection hours per_ unit are available in a consistent format from FY90 through FY92. Therefore, only data from 1990 to 1992 have been used in this analysis.
It was assumed that resource f
i
<m()
e w
2 adjustments for plants identified as having either good or poor performance would occur both prior to as well as after such identification. Consequently, the average inspection hours per year were calculated for all plants over the entire three year interval.
It should also be noted that plants under construction (Comanche Peak 2, Watts Bar, and Bellefonte) or in extended regulatory shutdown (Browns Ferry) have been excluded. The lists of good and poor performing plants since January of 1990 are shown in Table 1.
The rule for assignment of resident inspectors, referred to as the N+1 rule, results in considerable differences in inspection hours per unit between single unit sites and multiple unit sites. Hence the analysis was performed separately for single unit and dual unit sites (no three unit sites other than Browns Ferry have been identified as good or poor performers).
This analysis was performed on an industry-wide basis and did not consider the distribution of inspection hours by region.
O 9
Table 1 SENIOR MANAGEMENT MEETING RESULTS 1990 - 1992 PROBLEM PLANTS BROWNS FERRY 1, 2 and 3 BRUNSWICK 1 and 2 CALVERT CLIFFS I and 2 DRESDEN 2 and 3 FITZPATRICK NINE MILE POINT I and 2 PEACH BOTTOM 2 and 3 PILGRIM SURRY I and 2 TURKEY POINT 3 and 4 ZION 1 and 2 GOOD PLANTS CALLAWAY DIABLO CANYON 1 and 2 KEWAUNEE PRAIRIE ISLAND 1 and 2 ST LUCIE 1 and 2 SUMMER SUSQUEHANNA 1 and 2 i
THREE MILE ISLAND 1 YANKEE R0WE J
INSPECTION HOURS PER UNIT Single Unit Sites Thousands of Hours / Year 10 O
8-M x
+
6-l II i
4-O 2-O Poor Performers All Plants Good Performers Three year average (1990-1992)
_ _,~ -~ e
_. - ~,.
-..-...,,-w-sm.,
e,+--......,.- -
-en t-
.v.-r w,-
e.
mm we
+-
l l
INSPECTION HOURS PER UNIT Dual Unit Sites 1
Thousands of Hours / Year 10
'h 8-6-
T i
55
+
4-E2 y
e 7
=
2-0 Poor Performers All Plants Good Perforrners Three year average (1990-1992)
,.-~...-.5-.-.-
4-,
e c
,4-,-.
, - +
e
-