ML20092L019

Forwards Comments Following Presentations by BNL & Sandia on Low Power Shutdown Accident Frequencies.Concern Raised Re Level of Cooperation to Be Expected from Surry

ML20092L019
Person / Time
Site:	Surry
Issue date:	03/21/1990
From:	Youngblood R BROOKHAVEN NATIONAL LABORATORY
To:	Robinson D NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES)
Shared Package
ML20092K912	List: ML20092K908 ML20092L019 ML20092L044
References
FOIA-91-267 NUDOCS 9202260124
Download: ML20092L019 (6)

Text

_ ____ __ ___

Lncloture 3 37 n v.

E. ;

L BROOKHAVEN NAllONAL LABORATORY hesaa '; 0

.<t ASSOCINED UNIVERS111ES. INC.

w Upton. long Wond. New York i1973 (516)?82s DeDonment of Nuclear f regy r15 666 2 3 6 3 Huilding 130 March 21,1990

-Dick Robinson Probabilistic Risk Analysis Branch Division of Systems Research Mail Stop NLS 345 U.S. Nuclear Regulatory Commission Washington, DC 20555 Re:

Senior Consultant Group Activities cr. " Low Power and Shutdown Accident Frequencies" Project

Dear Dick:

It was a pleasure to join you and the other members of the Senior Consultant Group in Albuquerque for the briefing by BNL and Sandia.

Enclosed are my comments on the briefings.

I will also review the material suppli.:J to us at the meeting, and if I have any additional comments,1_ will let you know.

Unless I see something unexpected in the new material,-the attachment to this -letter fulfills my action item from that meeting.

One concern which was mentioned at the

meeting, but not adequately resolved, is the level of cooperation which we can expect from Surry.

I gather that the-choice of Surry was driven in part b> the need to compare with -1150, and perhaps a wish to avoid doing anoi..er shutdown study of Zion.

These factors are certainly legitimate considerations, liowever, prospects for cooperation from the plant must also weigh

heavily, This point seems especially important to me, because the kind of hazard assessment which I am recommending in the attachment would 9202260124 910726 PDR FOIA 6

REDDA91-267-PDR I

g om.m.m a w m am m xonsy ue m m.y m

I k

ideally involve the a ctive participation (at the level of perhaps a staff week) of an operationr type.

This kind of cooperation involves inore than transinittal of inforinatian, it seeins to ine that at this early stage, llN1, has relatively little to lose from changing plants (certainly less than it will have later).

This would not be the first project to spin its wheels for lack of sufficient infor nation, but in an area as unexplored and as potentially significant as this one, the consequences of a lack of cooperation will be particularly regrettable, if a high-level of cooperation is not obtained soon, i

then consideration should be given to analyzing a different plant.

Sincerely yours, j

,j f '&)(/(

CL9f R. Young lood Facilities Risk Analysis Group Enc.

cc:

R. A. Bari (Enc.)

W. Y. Kato (Enc.)

W. T. Pratt (Enc.)

i l

L L

i 2

u

.-,,a-.

- - - - -,. + - -,... - - - - - -, _. -,...,. -.. -., -.. -,... -.. -,. -,.., - - -

-..-,a.---,.,..---,..,-

_ _ _ _ _ _ - _. \\

Comments Following l'resentatinns by llNL nnd SNI, on Low Power and Shutdown Accident Frequencies IL Youngblood I

Member, Senior Consulting Group i

The Senior Consulting Group is called upon to express its priorities and reconimendations as early in the process as possible.

The following comments are offered in that spirit.

My reconunendations are based on my belief that both teams (BNL and SNL) are highly qualified in systems analysis and human factors modelling, and can be expected to do a good job of quantifying scenarios once they arc Identified.

It seems to me that in thir project, identifying the scenarios is the trick, and it is more of a trick at shutdown than it is at full power operation.

This argues for project priorities which are different from those which were set in 1150, for example.

Numerous comments were made by other members of the SCG.

I agree with nearly all of them.

One "c' Hh seems to me to be paiticularly important is that it would be useful both teams to pick one or two areas (" modes" or perhaps even subsets of modes) and carry the analysis all the way through for the selected areas, rather than trying to do all ateas at once in. parallel.. -This has the programmatic merit of producing results at an cally st ge of the project, and the technical merit of helping to set priorities in the rest of the work.

In calling for particular intermediate results, some of the recommendations made below would have similar effects, although they have been offered for different reasons.

Identifiention of Initiating Events in the area of initiating event identification, both labs are making heavy use of the historical record.

It is appropriate to do this, but it seems to me that one or two important steps have been skipped by both labs.

First of all, the notion of " initiating event" is itself hazy (at least, no one at the meeting could explain it except by example), and needs to be defined, At the meeting, I argued that initiating events at power operation are extremely _ well defined, i.e., it is formally possible to decide whether any given event is an " initiator "

At power operation, there is an envelcpe in physical state-space inside which operation is allowed to continue, and outside which a plant trip is warranted; any excursion outside this envelope is an initiator.

No comparable definition for non power modes was articulated at the meeting; rather, the attitude seemed to be that you I

I 1

i e

t know an initiator when you see one.

Actually, after a few days' reflection, this definition doesn't look as bad to me as it did in Albuquerque; the events that people are seizing on as " initiators" have the property that somebody had to do something. In response.

In my terminology, the l

response is required because the event constitutes an excursion outside of some envelope, which I still argue needs to be carefully defined.

We can recognize initiators in the historical

record, because somebody needed to do something in response to themt but the historical approach will only alert us to initiators which have occurred, and in fact only to initiators which (a) have occurred, (b) were either serious in themselves or became serious as a result of an inadequate first response, (c) were written up -and _(d) were read about by the team.

Initiators which don't strongly resemble events that we read about won't be identified except by a' systematic (algorithmie) approach to identification of initiators.

- At the_ meeting, I gave Donnie - Whitehead some references to methods of

-hazard identification which are used in the chemical process industry.

These may be overkill for the needs of this project, but right now it's too early to tell<

l Reconunendations:

Develop a formal, explicit, physical definition of initiating event in each alignment of each mode.

i Specify (and then apply) a

formal, algorithmic approach to development of a list of initiating events at each alignment of each mode.

Note that -the chemical process hazard technique mentioned above is applied' in process variable space, and if this is donc carefully enough.

t!)ere is some chance of picking up events in _which flashing occurs in an elevated section of piping (to use one of Warren Lyons' examples).

Event ' Sequence Dingrams Evant Sequence Diagrams (ESDs) have become increasingly popular as-a modelling step, in a. way, they're just flowcharts, but it is very useful to ' apply them systematically at an early stage of scenario development.

PLG-began 'using them some years ago (I don't know who first used them

- systematically).

Part of their value lies in communication with plant

personnel, which many of us feel is an important element of this project.

Since-operator response to very diverse situations is a major element of

-this project, ESDs -_would appear to be especially valuable here, in fact, an BSD on which key operator actions are ' highlighted in scenario-specific i

2

-contexts should - be a prerequisite to expenditure of effort in human factors analysis.

Itecommendation:

Develop Event Sequence Diagrams on which key operator actions are highlighted.-

Allocntion of itesources f(isk (according to Kaplan and Garrick) is best thought of as a set of triplets: scenarios, likelihoods of_ the scenarios, and consequences of the scenarios.

The effort in this project is concerned primarily with the first two clernents (it is understood that core damage events are the general consequence type of interest).

The scope of this project includes a great deal of relatively unexplored territory, and there is anecdotal evidence that minor _ variations-in system _ alignments in various = modes can have considerable _lmpact on initiating events and on response to initiating

events, it seems to me that it is Inore important to do a thorough job of scenario development than an elaborate job of quantification.

Without some : sort of quantification, there is no way to set priorities within the project, but a screening process can.iuffice.

Even if comparison with 1150 is, the goal, it will not be well served by a careful quantification of an incomplete scenario set.

it would be preferable to come out with a somewhat. uncertain quantification of a scenario set that _we felt good about.

Both. labs -appear to be geared up to invest substantial resources in quantification.

Both_-labs -are _ searching data - bases.

Both-labs are spending

- time thinking about which PC package to' use.

Both teams. have lined up i

human; factors specialists well in advance of having identified the scenarios, the "e rro r s,'_'

and the-associated procedural / physical /etc.

information.which human factors people require as input.

It is too early to be certain that-any of this activity is unnecessary; some of it is necessary.

But it~ should not be allowed to consume more than its fair share of

lesources. _ lt is clear that human response will be important to the evolution' of the scenarios, but significant expenditure of project resources in -human factors-analysis per sc (as opposed to identification of key actions) can be justified only after the scenario., are v 11 developed and the priorities are clear.

3

Itecommendation:

Complete and document the initiating event exercise and the Event Sequence Diagram exercise before investing too substantially in data crunching or human factors analysis.

Trunention nnd Completeness One of the stated project goals is to compare the risk from low power and shutdown with the risk from full power operation.

This poses a significant challenge.

The 1150 analyses resulted in fairly small core damage frequencies, so that in order to argue that the risk from shutdown is relatively small, it is necessary to consider initiating events down to extremely. low frequencies.

In fact, the_ natural truncation level of this problem - may turn - out to be-so low that it is necessary to consider

coincidents initiators.

(Example 'given at meeting:

loss of - service water followed by a random loss of offsite power within a few hours.

The frequency of this conjunction could.be of order 10 8 per year, and this might not be negligible on the scale of events being analyzed.)

Of course, it may turn out that risk from shutdown is relatively large, saving us a lot of trouble.

Recommendation:

iw?'g the process of. screening initiating events, care should be altiators are not discarded.unless they are clearly incapable of tak c.

afi. Sc :t e ris!f profile.

Since it is the stated intention to consider offsite

~

cor; y es eventually, this logically implies an extremely low frequency cutofi 11. initiators which can occur with an open containment.

To put it another -way, the cutoff must be a very small fraction of the frequency of large releases 'from accidents initiated at full power,.

if an extremely low-cdf begins to emerge, coincident initiators need

to : be considered..

The screening of the initiator-set should be documented.

This - need not be-elaborate,- but there should be a table establishing the disposition of -

initiators (either that they were explicit.ly analyzed, subsumed by another, or. considered incredible),

p l

q l

I r. -.

..m

..m.

-