ML20092K414
| ML20092K414 | |
| Person / Time | |
|---|---|
| Site: | 05200003 |
| Issue date: | 06/07/1995 |
| From: | Rempe J IDAHO NATIONAL ENGINEERING & ENVIRONMENTAL LABORATORY |
| To: | Palla R NRC |
| Shared Package | |
| ML20092K409 | List: |
| References | |
| JLR-18-95, NUDOCS 9509250381 | |
| Download: ML20092K414 (23) | |
Text
-a n
+
L /NEA Annemm rn hmmeenn, e
June 7,1995 i
Mr. Robert Palla US Nuclear Regulatory Commission Washington, D. C. 20555 4
\\
TRANSMrITAL OF INFORMATION DISCUSSING AP600 LEVEL 2 HUMAN ACTIONS -
JLR-18-95 i
Dear Mr. Palla:
Please find enclosed a copy of information prepared by Dr. Harold S. Blackman discussing the manner in which Westinghouse quantified level 2 human actions in the AP600 PRA. As indi-cated by Dr. Blackman, the Westinghouse assumptions appear optimistic. In fact, requantification calculations performed by Dr. Blackman indicate that failure probabilities may be as much as an order of magnitude higher. Base on the enclosed information,I would recommend that sensitivity calculations be performed to assess the importance of Westinghouse assumptions related to human actions. Perhaps these sensitivity studies could be included in the planned Westinghouse imponance analyses or as pan of the IRRAS Level 2 database verification work that we are dis-cussing. If you have any questions about the enclosed information, please contact Dr. Blackman (208-526-0245) or me (208-526-2897).
Sincerely, j
s2/ N mflo Dr. Joy L. Rempe Nuclear Accident AnalysisTechnologies Enclosure I
cc:
S. F. Armour, DOE-ID, MS 1219
- gg,2;ggg gggg4gga A
16laho Technologies Company P. O. Box 1625 Maho Falls, 10 83415
Encl:sure
- June 6,1995 i
Date:
June 5,1995 JLR-18-95 Page 1 of 22
. To:
J. L. Rempe -
-l From:
H. S. Blackman
Subject:
HUMAN ACTIONS IN LEVEL 2 AP600 PRA -
'Ibe ap proach I have taken to comment on the human actions you identified in your memo of Apr:111 is as follows. I first reviewed the analysis conducted by Westinghouse forits yh, then conducted one or two additional analyses based on the available ia ation. In general,I found the following three items of concem across all of the failure rates calculated by Westinghouse.
1.
Multiple Recovery Paths 2.
No Diagnosis 3,
. Non-Standard Quantification of THERP Trees Multiple Recovery Paths
' Westinghouse a plies multiple secoveries for every human action in their analysis. This is of concem, as I setieve it to be an unrealistic representation of operating conditions in real plants. It is especially o stimistic given that no control room, no procedures, and no agreed upon operating philosop )y exists (there is an apparent dichotomy between the SSAR and the PRA). That is, Westinghouse routinely applies recovery values for the shift technical advisor, the senior reactor operator, and also something unique to this work called " slack time". Time is the sole determining factor as to when these various recovery factors are applied. The conditions are as follows:
Time window > 10 minute and slack time >5 minutes-STA recovery applied Time window > 5 minutes and slack time > or = 0- SRO recovery applied Slack time > 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> - Special recovery applied In general, where time available is less than 30 minutes Westinghouse does apply only recovery by the STA. In cases where time available exceeds one hour a third opportunity for recovery is provided, that Westinghouse terms " slack time". All of these recoveries are based upon a T E!RP value for "one-of-a-kind checking with alert factors". This value is intended for use in normal o serating conditions, which is generally not the case in most of these recovery situations. Tus value is probably inappropriately used. I also have never seen this many recoveries credited in any past PRA. This is not to say that Westinghouse could not engmeer the system so that three recoveries are possible, but it is to say that I
' have never seen that accomplished before.
No Diagnosis Westinghouse asserts that the procedural system in place at current Westinghouse plants
. limia== the need for diagnosis, and reduces the operator function to detection and action.
e 1The symptomed based 3rocedures do indeed, function this way. Unfortunately operating expenence has shown t sat operators do still diagnose and, in fact, will circumvent procedures,; skip ahead to solutions (which I believe Westinghouse plants also allow) when
l A
operators "know" what the event is. Conventional PRA's do include diagnosis for the operator, to account for the cognitive processing that does take place with the operator and to account for decisions that the operator may make,in spite of procedural systems etc. I have a great deal of reservation about the lack of any diagnose in the AP600 PRA.
Westinghouse is putting enormous faith in their procedures, administrative controls, and operators which has not been borne out by experience.
Non Standard Ounntification of THERP Trees Although a small matter, Westinghouse has chosen to quantify only the main branches of the THERP trees for the HRA. This does not fully account for all the recovery paths, and success paths. Generally it does not make a huge difference in the calculated value, but none-the-less is less than accurate.
Recalculations The Table below shows the recalculations performed. As previously mentioned, two levels of recalulations were performed, first was a reduction in the number of recoveries, and an increase in the assumed dependency. Second, for two cases, was a recalculation including a diagnosis task. Obviously, these values are generally higher in terms of the overall failure rate calculated. The column entitled AP600 shows the value provided by Westinghouse, the column AP600-THERP Tree is the recalculation meluding all recoveries and success paths, the column INEL modified represents the reduction of the number of l
recoveries and the increase in dependency from moderate to high, and the last column INEL New Model, includes a diagnosis task. I have attached the trees and tables for REN-MAN-02 and CIA-MAN-01 as examples for your review.
Iluman I rror
.\\P600
\\[
INiii.
I N iii. %u T
- Tree
\\ludified
\\lodel W 'FP f f 24
.002 fs :
.s l REN-MAN-03 l.0034 l
l.0071 l
l l VLN MAN-01 l.000162 l
l.0015 l
l l CID-MAN-01 l.0012 l
l.012 l
l l CIA-MAN-01 l.0059 l.0059 l.0075 l.03 l
l CIC-MAN-01 l.00012 l
l.012 l
l l CIB-MAN-01 l.00134 l
l.00266 l
l l CIB-MAN-00 l.00184 l
l.0036 l
l l ADN-MAN-01 l.000493 l
l.0033 l
l l ADN-REC-01 l
l l
l l
l LPM-MAN-01 l.0022 l
l.0042 l
l l LPM-MAN 02 l.0065 l
l.0057 l
l l LPM-MAN-03 l.083 l
l.6 l
l Of particular significance is the increase for the category titled INEL new model, which inc; udes diagnosis. These represent an order of magnitude shift in the failure probability. I have included the trees and tables for both of these examples for your information.
Summarv I believe that the Westinghouse HRA is an optimistic analysis of the operator's role in the i
AP600 as compared to convent onal PRAs. The analysis is a thorough, and i
7 i-urAerstandable one, however gives an inordinate amount of credit for recovery, and treats the operators as more of an autotron than a thinking human being. The use of certain values for recovery seem in.yr riate and the actua?quantification of the THERP trees is e
more of an estimate than a thorough quantification. The importance of time in the Weingb== recovery methods does make the calculation of time windows particularly l
isiporutat,in that additional recoveries are based upon this value. The thermal-hydraulic run, and the code used, take on a greater importance for the HRA because of this reason.
After having said all of this it is important to note that I have not rerun any of these numbers through the complete ana)ysis and therefore have no idea whether any of these changes are risk significant.
l
ll'
- IMEL New Model Table 3. ren-man-02 felttodefuse s.88050 e.seest (u) uses Tableu-45 25 u
.E UOMO Opsetwselectsvroegcentrol(meeu 8.08 8.821 (u)
- s. gen 185 U E-ANet) -
-letsadopenta selecte ureng tental(some 931 0.51 (15) hen 95 U S
eAN88) 9.90H endisV2 steps (semeesANee)
' - 0.ON 9.N1
( 5.9) 0.00M 585
.U ZD saandgemiaenkvinops(meen s.51 c.53
- ( 5.s) s.sen
$ss 5.s 2-ANGO) un uretinTetainth un e:
( 5.ei Totalr(f): 0.027 y
s
.I 4
h Il-MAY-95 PrintDate:ll-MAY 95 c...% n..- te.u av." -- -
test IevhlonDate:- -
INEL New Model Failure Paths and Total Failure Probabilities Table 3b.
ren-man-02 Median Mean Failure Paths (> = IFA)
Calculations (Medians Displayul)
Results Results I
A E0005 0.00050 0.00081 2
mac 1.0ma0u aast 0.0066 0.011 3
eBtDE 1.0 xE013 x 0.49 x E038 x E52 0.00013 0.00033 4
abDE 1.0 m R99 x 0.038 x 0.52 0.019 0.032 1
Total Failure Probability 0.027 0.044 Error Factor 5.0 5.0 l
i o
1jj a
a a
a a
3 m
. O h
- 5 3' a^
u a..
[
a a
8 2
8 n
13 bc SE a
a a
a a
15 i
_fn*i aaaa8 393 in
[']$
a a
a a
a 1
y 1-g"
]
'.I $l$I i
a e
=
=
.! I 3'
1 1
i s
I c.
g!)
s b
f f
I l}iglig!
a e
f I
!]lII]
sn V
O W
O %
W.
1 l
E 1 k!
i x
i )
I u
%o5i a
9 e
a R
e a
E e
1 i
e 1
3 3
3 3
3 3
3 3
3 E
E I
E E
E I
E I
E m
I C.
o n
I
=D i
D i
l I.
i-3 2
2 2
2 2
3 g
8 o
M
=
e e
o a
a a
a a
a 8-
_e.
s T
j E
.a a
a a
a a
.=
a.
.a.
.a i
y
-s w
O !
bl f
i m
e e
j 4
8 4
2 8
g a
o e
o a
d a
o a
J
-3' w5 3
4 E.
e
.m 5
A j
a a
k
=
2 i
a a
a s
ei o
o a
W Cl>5 6r N
35s E.
j
=
m S
S.
a-
=
m S.
w O
S to 2
g H
o f$
g 5
2
+
E
=
2 o
2 0
E 2
l i
C C
4
INEL Modified Table 2a: HEPs for ren-man-02 Human Action / Error Nominal Erwr Sourter Stephy-Modifier Modi 6er
'HIERP Median Fnor ErwrType Median Factor THERP Step or forPSFs Sourte Depend-OIEP Factor i
HEP Table #
Dynamic ency (Mean M
A Fall to respond to 15 nlarms 0.0080 10 SBS 10 ZD 0.040 10 (0.065)
B Sta fails to respond to I/5 storms 0.0080 10 SBS 10 MD 0.18 10 (0.20)
C SRO fails to respond to 15 alarms 0.0080 10 SBS 10 HD 0.51 10 (053)
D Select wrongcontrol 0.0026 10 SBS 10 ZD 0.013 10 (0.021) 4 E
STAfails-0.0026 10 SBS 10 MD 0.15 10 (0.16)
F SRO fails 0.026 10 SBS 10 HD 0.57 10 (0.60)
G Omit 1/2 steps 0.0076 10 SIE 10 ZD 0.038 10 (0.061) 11 STA fails-0.0076 10 SBS 10 MD 0.18 10 (0.20)
I SRO fails 0.0076 10 SBS 50 HD 0.52 50 (0.53)
.i'
.m m
INEL Modified Failure Paths and Total Failure Probabilities Table 2b.
ren-man-02 Median Mean Failure Paths (> = IFA)
Calculations (Medians Displayed)
Results Results I
ABC 0.04 x 0.18 x 0.52 0.0037 0.0068 2
ABtDEF 0.04 x 0.18 x 0.48 x 0.013 x 0.15 x 0.57 0.000003 0.000012 3
ABedGlH 0.04 x 0.18 x 0.48 x 0.99 x 0.038 x 0.18 x 0.52 0.000012 0.000037 4
AbDEF 0.04 x 0E2 x 0.013 x 0.15 x 0.57 0.000037 0.00011 5
.N 0.04 x 022 x 0.013 x 035 x 0.038 x 0.18 x 0.52 0.000001 0.000005 6
EdGHI 0.04 x OA2 x 0.99 x 0.038 x 0.18 x 0.52 0.00011 0.00032 7
aDEF 0.% a 0.013 x 0.15 x 0.57 0.0011 0.0019 8
mDEGE 0.% x 0.013 x 0.15 x 0.44 x 0.038 x Q.18 x 0.52 0.000003 0.0000(B 9
aDeGHI 0.96 x 0.013 x 0.85 x 0.038 x 0.18 x 0.52 0.000037 0.00010 10 adGHI 0.% x 0.99 x 0.038 x 0.18 x 0.52 0.0033 0.0058 Total Failurt Probability 0.0083 0.015 Error Factor 5.0 5.0 t
O
- +.
m
AP600 THERP Tree Table 1. ren-man-02 m.n r.e.
m.a.ce m cm m.v.a.
we m.m.rwi usmu tweim vense.a es=* swr w?m FedterespondtoV5alersu 0.040 0.M5 (10)
'O.000s 515 LI ZD 5tafadstereupendtoV5aleras 0.41 0.65
( 5.0) 021 95 LG ZD
-20felstorespondtoV5alwes 0.8 0.'11
( 5.0) 8.M1 585 tg LD
/
-th=creet 0.54 Os
( 5.s)
Smi 5:5 to m
0.0011 e
Wmteatrol 0.00 0.0 21
( 5.0) 0.00M
$85 5.0 ZD f
STAfaIL.
0.41 0.65
( 5.0) 0.001 95 5.0 ZD Guof*
8.u Os
( 5.0) emi
$s5 to LD
/
thacreet 0.54 as (5.o)
Smi 5:5 te m
e.00015 I
OudtV2 steps g.0M O.M1
( 5.0) 0.0816 585 5.8 ZD j
5TAfals-0.41 0.6s
( 5.0) 0m1 585 5.0 ZD i
20fa81 0.u 0.17
( 5.0) 0m1 95 10 LD l1 thecreet 0.54 0.51
( 5.0) 8.M1 585 10 HD 0.coess MehretinTetelr(th 0.0024 n:
( 5.01 TotalP(f): 0.0025 re.. % n e 1a.u n."
testRevisionDate 18 MAY 95 rrhtDate:18-MAY 95
~ '
=.
AP600 THERP Tree Table la: HEPs for ren-man-02 Hanusa Action /Fnor Nominal Error Sourte/
Step-by. ModiSer Modifier THERP Median Error ErterType Median Factor THERP Step or forPSFs Sourte LW OIEP Factor HEP TaNe#
Dynarnic ency (Mean M
i A
Fail to respond to 15 alarms 0.0080 10 SBS 10 ZD 0.040 10 (0.065)
B Pm fails to respond to 1/5 alarms 0.081 10 SBS 10 ZD 0.41 10 (0.65)
C SRO fails to respond to 15 alarms 0.081 10 SBS 1.0 LD 0.13 10 (0.17)
D time credit 0.081 10 SBS 1.0 HD 0.54 10 (0.57)
E Select wrong control 0.0026 10 SBS 10 ZD 0.013 10 (0.021) l F
STAfails 0.081 10 SBS 10 ZD 0.41 10 (0.65)
G SRO fails 0.081 10 SBS 1.0 LD 0.13 10 (0.17)
H time credit 0.081 10 SBS 1.0 HD 0.54 10 (0.57)
I Omit 1/2 steps 0.0576 10 SBS 10 2D 0.038 10 (0.061)
J STAfails 0.081 10 SBS 10 ZD 0.41 10 (0.65)
K SRO fails 0.081 10 SBS 1.0 ID 0.13 10 (0.17) m
e,
. -. - -. ~...-
AP600 THERP Tree TaNe la: HEPs for ren-man-02 Hanna W /Enor Nominal Error Sourte/
Step by-Modi 5er Modifier THERP Mechan Error ErrorType Median Factor THERP Step or IhrPSFs Soorte Depend-CHEP Factor HEP Table #
Dynamic ency (Mesa M
L da d 0.081 10 SBS I.0 HD 0.54 10 (0.57) l 4
i b
9 O
u
=
____,e..
.e---
y_.
- + -
m=.s e
AP600 THERP Tree Failure Paths and Total Failure Probabilities TaNelb. ren-man-02 Median Mean Results Results Calculations (Medians Displayal)
Failure Paths (> = IF4) 0.0011 0.0042 E04:0A1 x0.13 x0.54 1
ABCD 0.000005 0.000047 d
0.04 x 0.41 x 0.87 x0.013 xOA1 x 0.13 x 0.54 2
ABtEFGII 0.000015 0.00013 0.04 x OA1 x OE7 x 0.99 x 0.038 x OA1 x0.13 x0.54 3
ABeelJKL 0.0000(B 0.000030 0.04 x 0.6 x 0.013 x0.41 x 0.13 x E54
-J 4
AbEPCH 0.000025 0.000087 0.04 x 0.6 x 0.99 x0.038 x OA1 x0.13 x 0.54 5
fbelJKL 0.00035 0.0013 J
6 a$rEA$
O.96 x0.013 x0A1 x0.13 x 0.54 0.000004 0.000042 0.96 x0.013 x0.41 x0.87 x0.038 xOAI a13 x 0.54 7
aEFElJKL 0.000007 0.000027 0.% x 0.013 x 0.6 x 0.038 x OA1 x 0.13 x0.54 8
mEflJKL 0.0010
, 0.0036 0.96x0.99x0.038xOA1x0.13x0.54 9
setJKL 0.0025 0.0094 Total Failure Probability 5.0 5.0 ErrorFactor t
e e
y -
p w
2
,a a-a xN E
si I
r O
k O~
O k
k-i E
3 3
3 3
3 3
I
=
}
N, c
t 1
-e 3
9 a
e 5
5 5
5 5
3 g
I 5
5 5
5 5
5 5
A 1
iE g
8 s
j$
5 5
5 5
5
{
H 8
E
)!
5 E
5 I
5
-e vs a
d*
}
e C3 b
h E
g 4
-5 g
z a
s 5
i a
1 i
'G
}
s
}
}
5 1
~
5 E
t ig E.
.g W
l 5
=
2 s
=
=
I s
ga
- (
j
AP600 TilERP Tree Failure Paths and Total Failure Probabilities TaNe cia-man 01 (Base Case)
Median Mean Failure Paths (> = 1FA)
Calculations (Medians Displayed)
Results Results I
AB 0.008 x at 0.00080 0.0021 2
AbG 0.008 x 0.9 x 0.013 x 0.1 0.000009 0.000037 3
AbcEF 0.008 x 0.9 x 0.99 x 0.038 x 0.1 0.000027 0.00011 4
aCD 0.99x0.013x0.1 0.0013 0.0033 5
p EF 0.99 x 0.013 x 0.9 x 0.038 x OLI 0.000044 0.00017 6
scEF 0.99 x 0.99 x 0.638 x 0.1 0.0037 0.0096 Total Failum Pmbability 0.0059 0.015 Error Factor 5.0 5.0 P
O
AP600 THERP Tree Table : HEPS for cia-man 01 (Base Case)
Human Action / Ermr Norninal Ermr Sourcef Step-by. Modi 5er ModiSer THERP Median Ermr EnorType Median Factor 1HERP Step or forPSFs Soune Depend-CHEP Factor HEP Table #
Dynamic ency (Mean M
A Operator fails to mpond to la slanns-0.0016 10 10 ZD 0.0000 50 (0.013) l B
SRO fails to respond to la alarms-0.10 10 1.0 ZD 0.10 10 (0.16)
C Opemtor selects wnmgcontrol for la 0.0026 10 10 ZD 0.013 10 volws-(0.021)
D SRO selects weengcontrol for la 0.10 10 1.0 ZD 0.10 10 volws-(0.16)
E Operatoromits step to close la ulws-0.0076 10 50 ZD 0.038 10 (0.061)
F SRO omits step to close la vntwo-0.10 10 1.0 ZD 0.10 10 (0.16) a
a.m4m a
4.-
i.
d' ul Ej 3!
f 2
e 2
s 2
e E
3 3
3 3
3 3
m
=
}
E!
o l
Er 3
E E.
I.
E 5
E
=
n 1
_h S
S S
S S
1 5 d
d d
d 3
d T!
2 E.
v g
k h.
E E
D a
a a
a d
5!
8 l et a
a 3
d 3
&a a
o i
m
\\
w f 8
vs 5
I I
E m
e ars
,N CO df r
r CD "E3 C:l:
.m s
1
.2 9
1 3
1 1
8 g
g 1
.v
)
f y
g g
2 E
E r
.c
-f 8
E t
g a
t
~
a at I
JJ R I
a e'
E 1l
~
e i
i I
e I
i
l 4
E m
jj
^
a a
a a
a a
sg-e OW O eue O ese e 26 "at 2e se se h
O 9
0 3
S S
e S
4 1,ig a
s a
s a
s 3
al 4
s t
ww g
a E
?
5 6.
-8 a
a a
a a
a la.
_,bW w
S fh 5
E E
E e
e e
e e
e g
A g
e L
i
-i i
- o g
6 6
S
}
S
-i j
E 1
,a 5
=y
\\
E L
E g
5
}
L 2
E t
1
~
2 e
f a
=
3 a
g i
E l
2 k~l g
- e 1
INEL Modified Failure Paths and Total Failure Probabilities l
l Table cia-man 01 (Base Case)
Median Mean Failure Paths (> = IFA)
Calculations (Medians Displayed)
Results Results I
AB E00s mal 3 0.0010 0.0022 2
AbCD E008 xE87 xE013 xal3 0.000012 0.000039 3
AbcEF 0.008 x E87 x E99 x OE8 xR13 0.000033 0.00011 4
=CD E99 0.013xal3 0.0016 0.0036 5
pOREF E99 xE013 xE87 xE038 xR13 0.000054 0.00018 6
=cEF E99 x 0.99 x0.038 x E13 0.0047 0.010 Total Failure Prubability 0.0075 0.017 Error Factor 5.0 5.0 D
e
INEL New Model
' Table. cia-man 01(Base Case)
. ~ e.
~
hMtedegnese 0.48 aft
( 5.8) 8.48 10 -
8 oe. w i. w i. v u e e e.MM un tu) im u
8 Mn
-0peraser eafts stop te dese v2 selves-e.eu e.s21 (Le) 8.sen 18 8
20s.Itsstoptedesev2velves-031 c.51 (Es) s.seM 18 8
0.M34 OperaterselectswrongcentrolfuV2 0.0M 0.M1
( 5.0) 8.MM E0 8
valm-
/f 'Fmoseiscinerengcentreifwv2velves-0.52 e.53 (Le) s.esM Le 8
\\
- o. cow mweileimanth o.sv n:
( 5.o)
TotalP(f): 0.030 feoDebaGbe. MEavC3.
N N.Y9 O*
INEL New Model Failure Paths and Total Failure Probabilities Table cia-man 01 (Base Case)
Median Mean Failure Paths (> = 1FM)
Calculations (Medians Displayed)
Results Results I
AB 0.48x0.005 0.0038 0.010 2
AKD 0.48x0.99x0.013x051 0.0031 0.0082 3
AbOdU 0.48 x 0.99 x 0.013 x 0.49 x 0.038 x 0.52 0.000060 0.00026 4
AhtU 0.48 x 0.99 x 0.99 x 0.038 x 0.52 0.0093 0.024 5
pCD 0.52 x 0.013 x 0.51 0.0034 0.0024 6
aOlU 0.52 x 0.013 x 0.49 x 0.038 x 052 0.000066 0.000075 7
ac E 052 x 0.99 x 0.038 x052 0.010 0.0071 Total Failure Probability 0.030 0.053 Error Factor 5.0 5.0 0
l ijj a
a a
a a
a est A
t hM st et ig en s
goe A
o
[
e e
e a
e e
U 2
I@
s a
a a
a a
4 af gIl 8
m lli 5
1 6j ij a
a a
a a
a f
e g
i.
n e
a u
o g
E l
]
3 6
6 5
5 E
1 j
F B
2 It t
f
=
a a
a t
i I
s 2
2 l
]
5 3
R I R-l
<m u
a w
w 4
9 I
.