ML20137S528
| ML20137S528 | |
| Person / Time | |
|---|---|
| Issue date: | 12/02/1985 |
| From: | Advisory Committee on Reactor Safeguards |
| To: | |
| References | |
| ACRS-T-1472, NUDOCS 8512060255 | |
| Download: ML20137S528 (256) | |
Text
{{#Wiki_filter:OR G A A, _ G C 6' f - / 4 7 a
/.
O UNITED STATES NUCLEAR REGULATORY COMMISSION IN THE MATTER OF: DOCKET NO: ADVISORY COMMITTEE ON REACTOR SAFEGUARDS SUBCOMMITTEE ON DECAY HEAT REMOVAL SYSTEMS O . LOCATION: WASHINGTON, D. C. PAGES: 1 - 208 DATE: MONDAY, DECEMBER 2, 1985 4 ACRS0mCECDPY ~ g 'Do Not Remove %m ACRS0^ ice 6 - ACE-FEDERAL REPORTERS, INC. OfficialRepcrters 444 North Capitol Street 8512060255 851202 Washington, D.C. 20001 yllR47$N PDR (202) 34~-3700 NATIONWIDE COVERACE
P CR25255.0 1 DAV/cjg L.j' I UNITED STATES OF AMERICA 2 NUCLEAR REGULATORY COMMISSION 3
% ADVISORY COMMITTEE ON REACTOR SAFEGUARDS 4
SUBCOMMITTEE ON DECAY HEAT REMOVAL SYSTEMS 5 Nuclear Regulatory Commission D Room 1046 1717 H Street, N.W. 7 Washington, D. C. 8 Monday, December 2, 1985 g 10 The subcommittee meeting convened at 1:00 p.m., II Mr. David A. Ward presiding.
,- 12
(_./ ACRS MEMBERS PRESENT: 13 14 MR. DAVID A. WARD 15 MR. JESSE EBERSOLE 16 MR. HAROLD ETHERINGTON 17 MR. CARLYLE MICHELSON 18 DR. CALTON, Consultant 19 MR. DAVIS, Consultant 20 21 22 23 24 ( ) 25 n./ ACE-FEDERAL REPORTERS, INC. 202-347-3700 mwide Coverage 800-336-6646 ,
i i
.. O rostrc wor 1c= ar ===
UNITED STATES NUCLEAR REGULATORY COMMISSIONERS' ADVISORY COMMITTEE ON REACTOR SAFEGUARDS MONDAY, DECEMBER 2, 1985 The contents of this stenographic transcript.of the proceedings of the United States Nuclear Regulatory Commission's Advisory Committee on Reactor Safeguards (ACRS), as reported herein, is an uncorrected record of the discussions recorded at the meeting held on the above date. No member of the ACRS Staff and no participant at this meeting accepts any responsibility for errors or inaccuracies of statement or data contained in this f transcript. 4 4 1 % 1 f O
2550 01 01 2 S DAVbw 1 PROCEEDINGS 2 MR. WARD: The meeting will now come to order. 3 This is a meeting of the Advisory Committee on 4 Reactor Safeguards Subcommittee on the Decay Heat Removal 5 Systems. 6 I'm David Ward, the Subcommittee Chairman. Other 7 ACRS members here are Mr. Ebersole and Mr. Etherington. 8 Mr. Michelson, I believe, will join us later this afternoon, 9 and Mr. Reed may join us tomorrow. 10 We also are privileged to have in attendance ACRS 11 consultants, Mr. Catton and Mr. Davis. 12 The purpose of the meeting is first to discuss (') 13 the issue of auxiliary feedwater system reliability. That 14 will be the sole item on the agenda this afternoon, and 15 then, second, tomorrow, we will review the status of the 16 NRR's resolution position for USIA 45, entitled " Shutdown 17 Decay Heat Removal Requirements." 18 Paul Boehnert, on my right, is the cognizant ACRS 19 Staff member. 20 The rules for participation in today's meeting 21 have been announced as part of the notice of the meeting l 22 previously published in the Federal Register on Tuesday, i 23 November 19, 1985. 24 A transcript is being kept and will be made () 25 available as stated in the Federal Register notice. ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336-6646
2550 01 02 3 1 I request that each speaker each identify herself ()DAVbw 2 or himself and speak with sufficient clarity and volume so 3 that she or his can be readily heard. 4 We have received no written comments from members 5 of the public, nor have we received requests for time to 6 make oral statements from members of the public. 7 I have no comments to make at this time, other 8 than as events move on, and the experience in the industry 9 seems to be telling us again and again that the subject of 10 today's meeting is extremely important and concerns itself 11 with one of the most important safety systems in nuclear 12 power plants.
} 13 Unless Mr. Etherington or Mr. Ebersole have any 14 comments, we'll go ahead with the agenda.
15 First is a speaker from the Office for Analysis 16 and Evaluation of Operational Data, Mr. Rob Dennig. 17 MR. DENNIG: Good afternoon. My name is Bob 18 Dennig. I'm the Section Chief of the Program Development 19 Section in AEOD. 20 I thank you for the opportunity to participate in 21 the meeting, and actually, I'm hoping to learn as much from 22 listening to you as you learn from listening to me, perhaps 23 more. 24 I have agreed, or I agreed when contacted, that 25 we would try to provide some recent context of operational ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 80 4 336 4 646
2550 01 03 4-( '; DAVbw 1 experience as a backdrop for your discussions on auxiliary 2 feed reliability. 3 I notice on the agenda there are two items listed 4 under my bullet. 5 The first item, I'm afraid that I really don't 6 have any material to address or background to address. 7 About the only thing I can say is that the systems are used 8 for startup and shutdown, because we do receive reports in 9 which problems crop up during those phaces of operation, but 10 beyond that I can't really say very much. 11 So my time will be spent on Item No. 2, for which 12 I chose to look at 1984. What I thought I'd try to do -- 13 MR. WARD: Bob, could I interrupt just a minute. 14 I guess the point of the first item on the agenda 15 was to help the Subcommittee develop an appreciation for 16 what the significance of the challenge is to the aux field 17 system. 18 As I understand it, in the large population of 19 plants in the U.S., there's quite a spectrum of how aux 20 field systems are used by design and in practice, relative 21 to main feedwater systems. For example, apparently in some 22 plants, any reactor trip invites a challenge to the aux feed 23 system. 24 In other plants, the main feedwater system can be 25 relied on to carry the plant cooling load for some period of ACE-FEDERAL REPORTERS, INC. l 202-347-3700 NationwideCoverage i 80 4 336-6646 ;
. .- -- , _~ . _ - - ._
3-t 2550 01 04 5 1 time. In order to understand the raw statistics about aux (])DAVbw . l 2 feedwater failures mean, I think we have to understand 4 3 better than we do now or certainly better than I do, how 4 these systems interrelate. 5 If you can help us with that, we'll be grateful. 6 MR. DENNIG: The primary thing that I was able to l 7 do in preparing for today, was to come up with what I would 1 8 characterize as an educated guess, the actual challenges to ; l 9 auxiliary or emergency feedwater systems. Part of that 10 guesswork involved looking at auto start signals for the 11 system. And I think you'll be able to see from some of the 12 signals that I used in coming up with this actual demand ( 13 guess, some of the ways the system is used. Part of the 14 difficulty in preparing for this presentation is that there 15 are a wide range of system designs, and as far as I can tell 16 from looking at published documents, there is always as wide 17 a range of start signals. 18 Almost any statement you make about this 19 particular system, trying to pull together a general 20 picture, generalized to any great extent, you are wrong 21 about some particular set of plants, from what you said, no 22 matter what it is. 23 There seems to be an exception for just about 24 every generalization. So maybe as I go through the early 25 . parts of what I've prepared, that will help introduce some ACE-FEDERAL REPORTERS, INC. 202 .3700, . . - . . . . . . . . _ . .. _-347 Nationwide Coverage 800 336-6646
2550 01 05 6 1 of the ways the system comes on, theoretically comes on. {}DAVbw-2 MR. EBERSOLE: May I ask -- we know there are 3 systems which ramp down on turbine trip, and thus meet the 4 low water demand required by shutdown heat removal. We also 5 know there are many systems that can't do that and must jump 6 to aux feedwater but have the prerogative of some sort of 7 modulated low flow system off the main feedwater system. 8 The lowest class of all plants, of course, have 9 to be the ones that can't use the main feedwater systems, 10 because that's one of the tracks of heat removal. I was 11 astonished in, I think, 1968, to find out that in the 12 presence of no exit at all, there was no qualified heat () 13 removal system for PWRs whatsoever. The AFW system had been 14 relegated to the vendors who had little, if any, special 15 interest in it. 16 Out of that has grown this chaos of design, which 17 you say you can't track down. I don't think we can escape 18 having to track that down, in the absence of any controls 19 over the process. i 20 Probably the worse example of this was, you know, i 21 Davis-Besse. 22 MR. DENNIG: I certainly can' t disagree. 23 As far as I can see, the information even that I A 24 was using to make this preparation, based on post-TMI 25 documents, as far as the prescription for the systems and ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336-6646
2550 01 06 7 1 start signals, and so forth, has evolved, and there are {}DAVbw 2 changes. So the exact status of any one of those systems at 3 any particular time requires a fairly large effort to keep 4 track of it. 5 I apologize for the hand waving. I'm not trying 6 to be evasive, but I'm not your best witness on this, but I 7 can say that part of my job or most of my job involves 8 trying to make generalizations about operating experience. 9 In the U.S. reactor population, that's always difficult to 10 do. We joke about it kind of being like trying to do 11 epidemiology studies on Noah's Ark. There's two of this and 12 two of that and two of the other thing and never much data () 13 on any.particular thing. 14 And this system certainly has that problem. 15 (Slide.) 16 If might, one thing that I'm going to try to do 17 -- 18 (Slide.) 19 -- is pull together an operating demand 20 estimate. The reason why we have to do that, why I wouldn't 21 have the information tabulated somewhere or tracked 22 somewhere, is that the way things stand now, the LER 23 reporting requirements require reporting all the SF 24 -actuations. That's one of the major items in the Rule. The (} 25 problem is that the auxiliary feedwater system is not ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336-6646
2550 01 07 8 1 classified as such. So that particular reporting (']DAVbw 2 requirement will not capture each and every and all 3 engineering aux feedwater system starts of 6mcegency 4 feedwater starts. 5 MR. EBERSOLE: Why isn't that matter fixed? 6 MR. DENNIG: I couldn't say. 7 MR. EBERSOLE: It's certainly the most frequently 8 challenged ESF system, that is, other than the shutdown 9 system, which is usually coincident with it. ~ 10 MR. DENNIG: The state of things as I understand 11 them indicates that some are and some are not. At later 12 plants, apparently there's more uniformity, but amongst the A (/ 13 earlier plants, that's not the case. It almost goes hand in 14 hand with diversity of designs. 15 MR. WARD: What are the ground rules for making 16 that differentiation? Have you been able to puzzle that 17 out? 18 MR. DENNIG: Of what is an ESF and what is not? 19 MR. WARD: Yes. 20 DR. CATTON: Who decides? 21 MR. WERMIEL: My name is Jerry Wermiel with the 22 Staff. I'm going to get into some of that in my 23 presentation, under Item B of the agenda, where I'll try to 24 draw the line, if you will, about approximately what point a 25 plant would have, what would be classified as a ACE-FEDERAL REPORTERS, INC. l 202-347-3700 Nationwide Coverage 800 336-6646
2550 01 08 9 I safety-related or engineering safety feature aux feedwater
}DAVbw 2 system, and where they wouldn't.
3 MR. WARD: Okay. Fine. 4 If we're asking you questions that can better be 5 answered by later speakers, that's an acceptable process for 6 us to take. 7 MR. DENNIG: Another problem with tracking these 8 things, as far as the reporting tools that we have got, if 9 someone will send in a report, say, of a reactor trip, part 10 of the things that happen in that sequence, quite possibly, 11 will be a start of this particular system. 12 We haven't seen consistent explicit reporting of () 13 system starts or sequences following such things as trips s 14 Frequently, the reporting will just say that all systems 15 worked as designed. So that adds a little uncertainty, as 16 far knowing for sure in any particular case whether the 17 system stated or not. 18 So what it boils down to, as far as trying to put 19 together this actual estimate for you is that I used system 20 start signals and reactor trip signals, which I have a 21 fairly good record of, and where a start signal was the same 22 or close to a reactor trip signal, I used the counts of the 23 reactor trip signals as a way of bootstrapping into the 24 challenges to the aux feed system. ( 25 on occasion we do get straight out reports of ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800 336-6646
I l 1 2550 01 09 10 1 actuation of the system as an engineering safety feature.
}DAVbw 2 So I have those, and if you would take that, 3 then, the combination of those two things, as a sor.t of 4 lower bound on the actual operating demands in a particular 5 year.
6 MR. EBERSOLE: May I ask one other detail about 7 this. 8 The challenges to the system, did you 9 differentiate between those that might be called benevolent, 10 which were sort of an exercise, but from which you could 11 fall back to the main feedwater system? In short, you 12 didn't really need it. You started it as a matter of () 13 prudence. 14 MR. DENNIG: No, I'm afraid I did not. Not for 15 this exercise. 16 MR. EBERSOLE: As far as your report would show, 17 they were all critically necessary; right? 18 MR. DENNIG: Yes. 19 MR. EBERSOLE: And that's not really true? 20 MR. DENNIG: No. 21 MR. EBERSOLE: Isn't it important to discern the 22 benevolent and nonbenevolent need for these things in a 23 challenge set ? 24 MR. DENNIG: Yes. 25 MR. EBERSOLE: It's just like a square. Maybe ACE-FEDERAL REPORTERS, INC. 202-347 3700 Nationwide Coverage 800-336-6646
l 2550 01 10 11 T'\DAVbw 1 you don't need it. You've just got it. V 2 MR. DENNIG: I think that would be a beneficient 3 refinement; yes. 4 MR. WARD: But I guess just strictly speaking, as 5 an indication of system reliability, if the start of the 6 system was demanded, whether for a good cause or not -- 7 MR. EBERSOLE: --1. would be conservative. 8 MR. WARD: -- it would be pertinent, it seems to 9 me. 10 (Slide.) 11 MR. DENNIG: For the Westinghouse PWRs, as a 12 group, generalizing again, and again, this statement is 13 probably not true for at least one reactor. 14 Lo lo steam generator level and safety 15 injection, two start signals. 16 So to estimate actual demands of used reactor 17 trips from lo lo steam generator level, the system starts 18 reported as ESF actuations. Safety injection signals 19 reported as ESF actuations, and then I eliminated the double 20 counting. 21 What one comes up with is a figure of 130 22 demands. You start reporting from 34 of 37 licensed plants 23 in 1984, which comes out to be something between 3 and 4 24 demands per plant per year. 25 Again, this is 1984, as an estimate of actual ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336-6646
2550 01 11 12 7" I challenges to the system. (>TDAVbw 2 Again, this is not testing, and this is not use 3 of the system as a start up on a shutdown system under some 4 kind of controlled circumstances. 5 MR. WARD: Let's see. So when you say plants, 6 you mean units, I guess; right? Is that what you mean? 7 MR. DENNIG: If one understands plant as one 8 reactor and one vessel, that's what that means. 9 MR. EBERSOLE: That's the three-per-year per 10 plant, isn't it? 11 MR. DENNIG: A little bit more than that; yes. 12 MR. EBERSOLE: Then this says, since we have a () 13 higher rate of scrams than that, that quite a few plants 14 don't start aux feedwater on stream. 15 MR. DENNIG: This is just Westinghouse plants. 16 The start signals that I was able to identify generic to 17 Westinghouse plants were safety injection, lo lo steam 18 generator level. 19 There's another one. Lo lo steam generator level 20 in one steam generator. The lo lo I'm talking about is two 21 out of four, whatever's needed to be coincident for a trip. 22 So there's one other signal. 23 There's also a differentiation on which type of 24 pump gets started. The lo lo steam generator signal that n (_) 25 I'm talking about, as I understand, starts the ACE-FEDERAL REPORTERS, INC.
- 22 347 3700 Nationwide Coverage 800-336-6646
2550 01 12 13
/~ I turbine-driven pumps. That's what you've got.
V)DAVbw 2 The safety injection signal starts generator 3 pumps. 4 MR. ETHERINGTON: I suppose some of these demands 5 were spurious. Were they all included? 6 MR. DENNIG: The ones derived from the trip 7 signals, I would say not. It's possible that some of the 8 ones that were reported as ESP starts could be characterized 9 as spurious or unneeded, but offhand, I can't tell you. 10 MR. EBERSOLE: A true ESF system ought to really 11 never have to start, because you shouldn't have to have any 12 accidents to start it. Here we have an ESF system that has A () 13 a start every so often, maybe half a dozen tLmes a year. 14 I don't know what the specter of the worst end of 15 that is. You don't have a distribution of that, do you? 16 MR. DENNIG: Oh, sure. Thank you for that 17 question. 18 (Slide.) 19 MR. EBERSOLE: 11. Which one was ll? 20 I hope not Davis-Besse. 21 MR. DENNIG: Out there at 21, this guy. Oh, no. 22 Number of demands, I've got plants, with one demand. I've 23 got one plant with 21. 24 MR. EBERSOLE: We should mark that one. 25 MR. DENNIG: Callaway 1. ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336-6646
2550 01 13 14 1 MR. WARD: That was the start-up period. {}DAVbw 2 MR. DENNIG: Right. The start-up. There should 3 be other biases on this report. You know, the shakedown. 4 MR. WARD: Even so, that's rather many, I would 5 say. 6 MR. THADANI: Ashok Thadani of the NRC Staff. 7 One of the things to keep in mind, it seems to 8 me, is the specific design of some of the plants. Some 9 Westinghouse plants, any time we have reactor trip, we also 10 get demand feed pump trip and demand is placed on aux feed. 11 That is not the case for a lot of other PWR designs. 12 So if you see 19 to 21 challenges to AFW,
) 13 sometimes it's likely caused by that design feature.
14 15 16 17 18 19 20 21 22 23
~
24 25 i
)
ACE-FEDERAL REPORTERS, INC. l 202-347 3700 Nationwide Coverage 800-336-6646 l
2550 02 01 15 1 MR. EBERSOLE: Why should Westinghouse be (~)'T % DAVbur 2 permitted to have that design? 3 MR. THADANI: I raised the same question, and we 4 have gone through that issue in fact recently as part of our 5 PRA review. We raised that question, and the utility -- 6 Northeast in this case -- promised me that they were going 7 to take a very close look to see what the downside was of 8 making a change. We haven't heard back from them, and I 9 don't know the answer, Mr. Ebersole. 10 offhand, I would think that one ought not to trip 11 the aux feed. On the other hand, we don't kncw what the 12 downside is. () 13 MR. EBERSOLE: You know, we have GAC-17, which on 14 the electrical system says you must have the privilege of'AC 15 system reliability, even on the fringes of safety system 16 reliability. 17 It would certainly seem prudent to have that 18 requirement on main feed. After all, that is the endpoint 19 of AC power. 20 MR. THADANI: Certainly, that is my own opinion 21 as well. 22 MR. WARD: But you see, the point you raised is 23 exactly the point brought up at the beginning of the 24 meeting. It is hard to know what to do with these raw data 25 unless you know how the system is used. ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800 336 66 4
2550 02 02 16 DAVbur 1 . MR. THADANI: I agree with you. You have to pin 2 down the cause, and as I say, the design feature that is 3 causing all these challenges, is it really necessary? 4 MR. WARD: I don't know if it is the cause. 5 Rather, it is how much dependence you are putting on that 6 aux feed pump start, and if the overall system is not 7 designed to depend on that aux feed pump start, there may be 8 some subtleties in the design which make it less reliable. 9 I don't know whether that is the case or not. That is what 10 we would like to find out. 11 MR. DENNIG: Let me reiterate one more time that 12 what you are seeing is synthesized. In a large part, it () 13 relies on the assumption that given a trip on lo-lo steam
~
14 generator level, I will get a start of this system based on 15 general statements found in Westinghouse design documents in 16 discussions with some people'in ROAB. That is where this is 17 coming from. 18 So it is kind of dependent necessarily because of
, 19 the way it is done, and as I say, that is the fallback
~
20 because we don't have good tracking of starts in that 21 system. We just don't have any requirement. 22 (Slide.) 23 The case for Combustion Engineering is as 24 follows. Again, this is based on looking at updated FSARs, () 25 Combustion Engineering plants' auto start, their aux feed ACE-FEDERAL REPORTERS, INC. 202-347 3700 Nationwide Coverage 800 33H646
l 2550 02'03 17 l 1 systems on a lo steam generator level. There is also the {)DAVbur 2 trip on lo steam generator level.
. l 3 So once again, estimating demands from reactor 4 trips from lo steam generator levels, those efforts are 5 reported as ESF actuations and then eliminated the overlap, 6 resulting in'22 demands from eight of 12 plants licensed in 7 '84, a high of six, which was Arkansas 2. That comes out to 8 something approximating two per plant per year, which is 9 less than my guesstimate for the Westinghouse per year.
10 MR. EBERSOLE: Is this the kind of number on 11 demand frequency that they would stack up against the 10 to 12 the minus 4 failure rate' per demand? () 13' You know,' Combustion has that sort of goal. At 14 Palo Verde they don't even have any other way to cool it. 15 MR. DENNIG: In the sense of throwing in actual 16 demands and using them in the denominator? 17 MR. EBERSOLE: Yes. f 18 MR. DENNIG: I would suspect that that is really 19 standard procedure. 20 MR. EBERSOLE: About six per year is the nominal 21 demand frequency? 22 MR. DENNIG: No, two. , 23 MR. EBERSOLE: I am sorry, two. 24 That is 22 from eight plants? O 25 MR. DENNIG: Remember again the kind of ACE-FEDERAL REPORTERS, INC.
'202-347-3700 Nationwide Coverage 800 336-66 4
2550 02 04 18 T'\DAVbur 1 calculation you are talking about, this doesn't include any V 2 kind of test situations. Those usually get thrown in, too, 3 plus the failures during tests. 4 Does anybody else have anything? 5 MR. WARD: I don't want to be picky, but when you 6 say -- I will go ahead, anyway. When you say two per year, 7 do you get that by dividing 8 into 22? 8 DR. CATTON: After you subtract 6. 9 MR. DENNIG: No, I wouldn't do that. Yes, that 10 is how I should come up with it. It should be 12 into 22. 11 I have got 12 plants out there. Theoretically, they all t 12 could have been reporting. O I thought you said only eight plants; (_/ 13 MR. WARD: 14 you have data from only eight plants? 15 MR. DENNIG: I have data from all 12 plants. 16 MR. WARD: I see. You have data from all 12. I 17 was misinterpreting that. I am sorry. 18 MR. EBERSOLE: But again, if you generalize -- 19 MR. WARD: Four plants had zero, in other words? 20 Is that what you are saying? 21 MR. DENNIG: No, you are right. It should be 22 22 divided by 8. 23 DR. CATTON: If you take the high volume of 6 and 24 subtract the 6 and divide by 7, you get close to two. O e s/ 25 MR. WARD: There's all kinds of ways you could ACE-FEDERAL REPORTERS, INC. l 202-347 3700 Nationwide Coverage 800 336-6646
h 2550 02 05 19
).
DAVbur 1 get two. 2 (Laughter.) 3 MR. WARD: I think he really means three,
! 4 though.
5 DR. CATTON: If he has got one squirrelly 6 plant -- 7 MR. MICHELSON: He isn't going to have one 8 squirrelly -- 9 DR. CATTON: He has a high volume of 6. 10 MR. WARD: Why don't we ask Bob? What did you 11 mean, Bob? 12 MR. DENNIG: I am using LER data. I have got 13 stuff from eight plants. Zero is from i2 plants. So as far 14 as actual demands are concerned, I will backtrack again and ! 15 I will say that 12 is the number that I would use to make an 16 average. ' 17 MR. EBERSOLE: What sort of average do you use by ! 18 picking the average versus the worst plant, since I would , 19 imagine we would get as much news out of the worst plant as 20 we would the best? 21 MR. DENNIG: No particular rationale. Just l 22 trying to generalize. 23 MR. EBERSOLE: That is pretty terrible. When we 24 have got both spectrums, you will want the worst end that 25 will do us in. ACE-FEDERAL REPORTERS, INC.
- 202-347-3700 Nationwide Coverage 800-336 4 646 - . - . . _ . - __ _ _ _ _ . _ - - __ __ . _ , _ . _ . _ . _ _. _ _ . ,. _ .. - ~ _.. _ _ . _ . . _ . . _ _ _ - _ _ _ _ . , _ _ . .
2550 02 06 20 1 MR. DENNIG: You really wouldn't, given any other (}DAVbur 2 choice. You would stick with plant specific information. 3 MR. EBERSOLE: People who don't have standard 4 plants, the worst one is your marker plant, what do you do? 5 I would rather deal with one plant. I don't know 6 how good the logic would be in getting a distribution of 7 six. 8 Don' t let me hold you up. 9 MR. THADANI: Ashok Thadani again, Mr. Ebersole. 10 As part of some of the recent discussions on the 11 issue of the auxiliary feedwater system, the staff has met 12 with a number of utilities.. One of them has to be Arkansas 13 Unit 2. 14 And, yes, indeed, over the last, I think, roughly 15 five years, they have had, I think, 11 loss of feedwater 16 events, as I recall, which was much higher than the norm, 17 and the utility is in the process of implementing some 18 improvements in their main feedwater system to reduce the 19 frequency of those transients. 20 And that issue of challenges presented from 21 actual loss of feedwater events is also part of the recent 22 CRGR package that I suspect the staff is going to tell you 23 about. 24 MR. EBERSOLE: I see. Thank you. O-s 25 (Slide.) ACE-FEDERAL REPORTERS, INC. 202 347-3700 Nationwide Coverage 800-336-6646
2550 02 07 21 1 MR. DENNIG: Last but not least, Babcock and ({ } DAVbur 2 Wilcox units. 3 I didn't have any good handle to use statistics 4 from scram information to augment reports of ESF 5 actuations. I just listed a couple of the starts that I 6 could identify. One could, if one went through the gray 7 books, possibly do a better job of coming up with a number 8 similar to what I did for Westinghouse and CE. What that 9 left me with was just using the reports of ESF actuation, 10 which came out to be three starts at two of seven units that 11 were licensed for 1984. 12 MR. EBERSOLE: Do you have any data on the ('/ A-
'\
13 boilers? 14 MR. DENNIG: No, sir. 15 MR. EBERSOLE: Those are the feedwater systems on 16 boil. Why isn't that included in the investigation? You 17 know, the aux feedwater system. What do they call it? 18 MR. DENNIG: HPSI, RCIC. 19 MR. EBERSOLE: Just because it is not called 20 feedwater? 21 MR. DENNIG: I am not sure. 22 MR. EBERSOLE: It is feedwater. 23 MR. DENNIG: This is true. 24 MR. MICHELSON: Ref resh my memory. The new 25 reporting system was January of '75, is that right? ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800 336-6646
2550 02 08 22 1 MR. DENNIG: January of '84. (])DAVbur 2 MR. MICHELSON: Sure, '84. Was it '84 or '85? 3 MR. DENNIG: '84. 4 MR. MICHELSON: So all your information came from 5 the new reporting system? 6 MR. DENNIG: Specifically from 1984. This 7 doesn' t include 1985 information. 8 MR. MICHELSON: I realize that. 9 MR. DENNIG: But, yes. 10 MR. MICHELSON: Why do you seem to have 11 difficulty getting the information that you need for this 12 statistical study? ( 13 I thought all those actuations would be 14 adequately reported. Am I missing something? 15 MR. DENNIG: If it were true that this particular 16 system was designated as an engineered safety feature, we 17 would get that. 18 MR. MICHELSON: It hasn't been in all cases? 19 MR. WARD: I don't think you were here at the 20 beginning, but he brought out at the start that in some 21 plants it is not an ESF. We are going to hear more of an 22 explanation of that from NRR in a little while. 23 MR. MICHELSON: Yes, that would make quite a 24 difference. 4 25 On those that are classified as ESF, did you have ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336-6646
2550 02 09 23 ("TDAVbur 1 any difficulty with the kinds of information that the LER V 2 gave? 3 MR. DENNIG: I can't give a real good answer to 4 that because that would require compiling which places it is 5 and which places it isn't, which I did not do, to make that 6 judgment. 7 But outside of that problem, we still have 8 difficulty in getting detailed discussion of things like 9 post-trip actuations, so that there is that problem. 10 MR. MICHELSON: Is this an item that has been 11 highlighted to the utilities as in need of improvement? 12 MR. DENNIG: Oh , ye s . I believe the revision to bs_/ 13 NUREG-1022 specifically called that out as a problem, and 14 then we have an ongoing LER quality program that is linked 15 up with SALP -- one of the things that gets pinned on, if 16 necessary. 17 MR. MICHELSON: You are hitting at when it is an 18 ESF, but if it isn't an ESF you don't have a leg to stand on 19 very well, do you? 20 MR. EBERSOLE: Well, there is another leg. 21 MR. MICHELSON: Let me get the answer to my 22 $bestion first. 23 Is there a problem if it is a non-ESF? Are they 24 even writing LERs on it then unless it is related to some 25 other aspect? ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336-6646
2550 02 10 24 1 MR. DENNIG: If it is an ESF, I believe we get (])DAVbur 2 the report. 3 MR. MICHELSON: If it is not an ESF, how do you 4 happen to get it? 5 MR. DENNIG: The only way you get it then is if 6 it is part of a reportable sequence and they are kind enough 7 to call out all the steps in the sequence. Sometimes that 8 d.oes not happen. It doesn't happen even when the thing is 9 an ESF. The statement will be made that all engineered 10 safety features performed as designed. 11 To make use of that, either you have got to have 12 the person looking at that know that for this particular G 1 k> 13 plant that is an ESF and it does start, and therefore I have 14 got to hit on that. 15 What we would certainly prefer and what they are 16 supposed to do is call ece specifically what the systems l 17 are. 18 MR. MICHELSON: So it hasn't been working quite 19 as planned? l 20 MR. DENNIG: I think that is correct. 21 MR. EBERSOLE: So it isn't an ESF, but is it a 22 safety grade system? 23 And now I am going to go back now to service 24 water. That is not an ESF either. It is a safety grade 25 system which you lose all the time. ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800 336-6646
2550 02 11 25 1 Why should we only look at the system, you know, . (-)DAVbur 2 which has an occasional demand versus those we head for all 1 3 the time? Can you not get it on the grounds that it is a 4 safety grade system? Is it a safety grade system? 5 MR. DENNIG: We get reports of problems with the 6 system through the route of saying -- and I will show this a 7 little later. This is a reporting requirement for reports 8 of failures of systems that are required for accident 9 mitigation, removal of decay heat, and a couple of other 10 things. 11 So as one removes decay heat, we would argue 12 that, yes, we should get reports of all problems with the 13 system but not all actuations of the system. 14 MR. WERMIEL: Maybe I can help, Mr. Ebersole. 15 The service water generally is safety related or ESF because 16 it is a support system for post-LOCA safe shutdown. 17 MR. EBERSOLE: That is all? What about new LOCA 18 shutdown? 19 MR. WERMIEL: That is part of the problem. In 20 the old days, as I understand it, from what I have been able 21 to see, most of the review of engineered safety features 22 were safety-related -- equipment systems and problems and 23 structures. That was geared around the large LOCA, and for 24 that reason equipment and systems and structures required to 25 support shutdown following such an event received that ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800 336-6646
2550 02 12 26 (mjDAVbur 1 classification. 2 Others, unfortunately, even though they may -- 3 like aux feed -- be challenged, didn't receive that same 4 treatment. 5 It wasn' t until -- as I will get into a little 6 bit in my presentation -- the advent of the standard review 7 plan was it really recognized that indeed there are other 8 events or challenges to plant systems that would warrant 9 better classification, better quality, better attention to 10 the availability of other systems, 11 MR. EBERSOLE: As a matter of fact, it doesn't 12 have to be an event. It is an everyday affair, isn't it, 13 that you have to have these things running? 14 MR. WERMIEL: In some plants, well, service water 15 definitely. 16 MR. EBERSOLE: So certainly the most critical 17 demand is the one that comes quick. 18 MR. WERMIEL: As I said, the service water was 19 treated as an ESF system or a safety system. 20 (Slide.) 21 MR. DENNIG: Okay. The other half of the 22 discussion has to do with the reported problems that we have 23 knowledge of. Again, this is based on licensee event 24 reports under the new reporting requirements. l ( 25 We have one particular criterion that covers ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800 336-6646
2550 02 13 27 1 basically an operating problem or unavailability of the ( }DAVbur 2 system that is used for shutdown, removal of residual heat, 3 control of the release of radioactive material, or 4 mitigating the consequences of an accident. 5 We would argue that auxiliary feedwater fits at 6 least the remove residual heat criterion. 7 In reporting from licensees, just for your 8 information, we ask them to indicate which reporting 9 requirement they are responding to. A lot of-times, more 10 than one will apply, but they don' t indicate that more than 11 one would apply. 12 So indications of aux feed problems can be found () .13 reported under ESF actuations, tech spec violations. There 14 is a criterion that covers common cause, degraded condition, 15 or the system fault, which is the paragraph that I alluded 16 to at the top of the slide. 17 MR. EBERSOLE: What would a fire be called?
-18 MR. DENNIG: What would a fire be called?
19 MR. EBERSOLE: Is it an accident? 20 MR. DENNIG: There is another criterion that 21 talks about threats, external threats or internal threats to 22 equipment and safety of personnel. Most likely a fire would 23 come under that situation. 24 25 ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336-6 4 6
2550 03 01 28 1 MR. MICHELSON: Would you consider that the {}DAV/bc 2 auxilliary feedwater is not a safety system at a particular 3 plant, which I gather can be the case? Then your first 4 bullet doesn' t apply at all, since it doesn' t perform any 5 safety function; even though it may remove residual heat, it 6 doesn't perform any safety function by definition. 7 Main feedwater removes residual heat, too, in a 8 way, but it has no safety function other than some isolation 9 and tripping requirements. 10 (Slide.) 11 MR. DENNIG: This slide summarizes what we had 12 reported for 1984 via LER's. It's not voluminous, there's () 13 not a great deal. Again, the criteria that we are reporting 14 are set very high at system level. These are multi-train 15 systems and a number of things have to fail before the 16 system is unavailable. 17 There are no particular highlights. Let me say 18 something about the first item under Westinghouse that 19 refers to an advent at Trojan in September of '84, in which 20 the plant was able to recover using a motor-driven startup 21 pump that is apparently not part of the d'bfined aux 22 feedwater boundaries. 23 It was just there for operational purposes and , 24 that's what they used to recover. 25 MR. EBOERSOLE: They had a pump similar to Davis-ACE-FEDERAL REPORTERS, INC.
- 2 3mm sanon.iae comage m33me
. _.- - - _ _ _ 7 -_
2550 03 02 29 DAV/bc 1 , Besso that was ready to go, right. Is that what you say? 2 MR. DENNIG: I'm not that familiar with the 3 configurations. !- 4 MR. WERMIEL: I can answer that, Mr. Ebersole. 5 In about 1981, they added a large startup motor to the 6 pump. It's a manual start pump. It can be loaded on a 7 diesel generator because it is operated from an on site bus 8 and it is also tech spec-ed. Its operability is governed by ? 9 tech specs. . 10 MR. EBOERSOLE: Was that mandated by NRC, or was 11 it just something they volunteered? 12 MR. WERMIEL: This was a volunteered backfit. 13 The utility had been having over a number of years problems 14 with the direct diesel-driven and the turbine-driven aux 15 feedwater pumps, both of which, incidentally, were 16 classified as engineered safety features or safety-related. 17 They added this motor-driven pump to provide 18 additional diversity and capability for startup and shutdown 19 without having to rely on two safety pumps. 20 MR. EBOERSOLE: Had they performed a-PRA that 21 showed that they needed to do nothing to this? 22 MR. WERMIEL: I'm not aware of what had been 23 done. 24 MR. MICHELSON: What is the classification of the 4 - 25 Turkey Point auxilliary feedwater system? Is it safety-ACE-FEDERAL REPORTERS, INC. 202 Nationwide Coverage 800-336 66 4
- ~ _ _ ___- . _ . ._ __ _. _ _-347-3700 - - . _ . .
2550 03 03 30 1 related? [")T m DAV/bc 2 MR. WERMIEL: I don't believe it is, no. I 3 believe that plant is so old that they did not classify it 4 as such. 5 MR. MICHELSON: So that event may not even be on 6 this listing. 7 MR. DENNIG: The two train level failures on test 8 under Westinghouse, those are both Turkey Point. 9 MR. MICHELSON: The real one wasn't under test. 10 MR. WERMIEL: No, they had a demand where two out 11 of three pumps failed to operate, as I understand, on 12 demand. /~N ') ( 13 MR. MICHELSON: There's some question about the 14 true availability of the third one as well. Clearly, to 15 quit. 16 MR. WERMIEL: As I understand, that was in '85. 17 That was in June. It wouldn't be in this. 18 MR. MICHELSON: I'm sorry, this is only '84. I 19 stand corrected. 20 MR. WARD: Is that right, Bob? Are these '84 21 events operating problems? 22 MR. DENNIG: Exclusively, yes. And the only 23 other system level failure on demand is under Baocock and 24 Wilcox. That was Oconee III. There was a nine-minute lapse 25 due to some missed timing on some valves opening and ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336-6646
2550 03 04 31 1 closing recovered from the event by opening the proper {)DAV/bc 2 isolation valve on there, which is the feedwater system. So 3 that was nine minutes for that one. 4 MR. EBOERSOLE: How many of these failures 5 contradict the standing PRA on nominal grounds? Any of 6 them? You know, that's the popular way of not getting , 7 things done, is to do a PRA. 8 MR. DENNIG: I would say that there are no 9 situations that were described in the events that I reviewed 10 that are not on the list of things to include in a PRA. 11 MR. EBOERSOLE: Oh, is that so? Because they're 12 not a safety feature?
) ) 13 MR. DENNIG: One of the specific instances 14 encompassed by a PRA, that is another question. But, as far 15 as unusual things that aren't covered by the methodology, i
16 MR. WARD: Okay. A similar question, I guess. 17 If I look just simplemindedly at the aux feed requirement in 18 th'e standard review plan of the reliability requirement, the 19 standard review plan as given, a reliability of 10 to the 20 minus 4. So you want one failure per 10,000 demands. So if '- 21 I look at the experience in 1984 with the Westinghouse 22 plants, you said there were 130 demands. 23 There is one system level failure. I presume 24 that 10 to the minus 4 reliability, that's a system number. 25 MR. THADANI: Mr. Ward, Ashok Thadani. There are ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800 336 6646
-- - . ,._. ~ _ - ..._ ._. ,,, _ .. ,. . _ .. _ _ . . . - , - . _ _ _
2550 03 05 32 F^N 1 two elements. Number one certainly is what you're V DAV/bc 2 suggesting, one system level failure per 130 demands. I 3 don' t know exactly what the real number of demands was 4 because, in reality, the systems are tested as well. And , 5 that would be construed as a demand if the tests are done 6 properly. 7 Number two, the probabilistic techniques also 8 followed in recovery factors. They tried to make a 9 determination as to whether those flaws were recoverable or 10 not. Appropriate credit is given for recovery aspects. 11 MR. WARD: That's in the PRA, but I'm not sure if 12 it's in the standard review plan. 3 s_) 13 MR. THED NI: Oh, yes. 14 MR. WARD: Is that number as given in the
- 15 standard review plan intended for recovery?
16 MR. THEDANI: Yes, and it is done that way. The 17 calculations are done that way. There will be somewhat of a 18 discussion later on about that. 19 MR. WARD: Okay. 20 MR. MICHELSON: When the system is tested 21 normally, is it tested under flow conditions or is it just a 22 bypass from the pump? 23 MR. WERMIEL: Generally, when the system is 24 tested, it's a test of a single train, a single pump in 25 recire. ACE-FEDERAL REPORTERS, INC. 202 347 3:00 800-336 6646 sation.;ia coverase
2550 03 06 33 1 MR. MICHELSON: It's generally a very small [G^TDAV/bc 2 recirculation line. 3 MR. WERMIEL: Some plants, yes; some plants, no. 4 Some plants have full flow recirculation lines and can < 5 simulate closer to an actual demand on the system. 6 MR. MICHELSON: You're saying it's probably a 7 pretty fair test of the pump complex, not necessarily the 8 valving? 9 MR. WERMIEL: That's correct. I don' t know of 10 any plants on test pump water that's been generated. 11 MR. MICHELSON: I'm acquainted with some that you 12 don't get full flow on on bypass. () 13 MR. WERMIEL: That's correct. 14 MR. WARD: Let me continue with my simple-15 minded analysis here. Let's set aside the testing failures 16 because I'm not sure you have testing demands up there. 17 MR. DENNIG: I don't have testing demands. 18 MR. WARD: These are both operational failures 19 and operational demands. 20 MR. DENNIG: Some of these are testing failures. 21 The demand stuff I did was just on actual demands. Some of 22 these are testing failures. The one that you picked on 23 Westinghouse wasn't. 24 MR. WARD: Okay. Let's just assume then that's 25 again comparing with the standard review plan reliability ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336 66 4
2550 03 07 34 1 of 10 to the minus 4. What we're saying here, the actual ('/)DAV/bc s. 2 failure rate was 10 to the minus 2nd. So if these systems 3 indeed meet the requirements of the standard review plan, 4 that means that recovery would have to be called out in 99 5 out of 100 failures to start. 6 Then, in Combustion, there weren't any system 7 failures. In Babcock and Wilcox, there was one failure out 8 of three demands. 9 MR. DENNIG: Which I tried to pitch as a lower 10 bound on the number of demands. 11 MR. WARD: Now, I guess, in a PRA, if it was done 12 right, you'd credit the fact that there are fewer demands. O (._) 13 But I don't know that the standard review plan does that or 14 not. We'll find out about that. 15 But this means that if the B&W systems meet 16 anything like the standard review plan, that recovery has to 17 be credited 99.9 percent of the time, or something like 18 that. 19 MR. DENNIG: I wouldn't lean too heavily on the 20 B&W stuff here. That's where things get a little shaky as 21 far as our knowledge. 22 MR. WARD: We're trying to develop some kind of , 23 understanding of what the real performance of these systems 24 is compared with what the requirements are, and compared 25 with what the probabilistic risk assessments are claiming t ACE. FEDERAL REPORTERS, INC. 202 347 3700 Nationwide Coverage 800-336-6646
2550 03 08 35 1 for them. And it's a murky picture and I agree it's ()DAV/bc 2 difficult to see through the murk, but let's keep trying. 3 MR. EBOERSOLE: Dave, may I ask a question? 4 There's another aspect of this. When you said 5 Babcock and Wilcox is murky. 6 MR. WARD: No, I was misquoted. 7 MR. EBOERSOLE: Well, he said it was murky. 8 MR. WARD: I said the whole picture seems to be 9 murky. 10 MR. EBOERSOLE: Babcock and Wilcox' system 11 operate with virtually dry boilers. They need water in a 12 hurry at the other end of the spectrum. Combustion 13 Engineering uses great big boilers with all sorts of water 14 standing. I think Westinghouse is somewhere inbetween. 15 How do you fold in the degree of urgency of 16 beginning feedwater? 17 MR. WARD: Somehow, that seems to be discounted, 18 Jessie. We look at the Westinghouse and C.E. numbers he 19 showed us and there's two or three demands per reactor 20 year. In the B&W plants, there's only half the demand. 21 MR. EBOERSOLE: The reason for that of ccirse is 22 B&W better damned well be good because they can' t a?tord an 23 outage. If they have one for the long haul, they're in 24 trouble. 1 25 MR. WARD: But I'm just saying that they are. If ACE-FEDERAL REPORTERS, INC. 202-347 3700 Nationwide Coverage 800-336-6646
2550 03 09 36
- ^NDAV/bc 1 we take these data at face value.
b 2 MR. EBOERSOLE: I guess Combustion Engineering, 3 like Palo Verde, with all the unused boilers they have, they 4 can stand a substantial time of outage before they're in 5 trouble; whereas, B&W can't stand anything at all. 6 MR. DENNIG: Mr. Ebersole, at least in the world 7 of reliability studies, people pay attention to time, to 8 dryout. B&W plants typically, that's in the range of five 9 minutes or less depending on what transient we're talking 10 about. The credit for recovery is much less numerically 11 than that for Westinghouse and Combustion Plants. 12 MR. EBOERSOLE: So that is credited then? () 13 MR. Thadani: That is folded in the analysis. 14 MR. DENNIG: For whatever it's worth, the B&W 15 plants do not trip very much either. 16 MR. EBOERSOLE: They'd better not. 17 MR. DENNIG: That concludes what I have. 18 MR. EBOERSOLE: Maybe that aspect of th8e B&W 19 design could be profitability used by Westinghouse. 20 MR. MICHELSON: Can the staff explain to us later 21 if they have any plans to improve the level of information 21 that's going to become available in the future on auxilliary 23 feedwater reliability? 24 MR. WERMIEL: We're going to be addressing that, () 25 yes. ACE. FEDERAL REPORTERS, INC. 202 347 3700 Nationwide Coverage 800-336 6646
'2550 03 10 37 DAV/bc 1 MR. MICHELSON: Thank you.
2 ML. DAVIS: Dave, I have a question. I 3 understand, at the Institute for Nuclear Power Operations, 4 they have or are about to complete a rather exhaustive study l 5 on auxilliary feedwater reliability. 6 Their data was not constrained by whether they 7 were LER reportable events or not. Are you aware of the 8 results of that? Can you say anything about what that study . 9 has indicated? 10 MR. DENNIG: Yes, we are aware of that study. I J 11 think its publication date was in October. It covers 1981 12 through 1984, or 1980 through 1984.
) 13 As far.as sources of information, the one thing 14 that they claim that they. did do was, af ter compiling 15 information from the available sources provided by the 1
16 licensees for validation and glancing through one of the 1. 17 appendices very quickly, I did not see anything in there 18 that wasn't picked up in an LER or very much beyond what 19 comes out of LER.
- . 20 So I'm not sure how much to weigh the value of 21 going back to the licensees as opposed to what we know from 22 that mechanism. We probably ought to look at it closer, but l 23 I'm not sure we're that bad off.
j 24 But, yes, that study has just been issued. It l' ( 25 might be beneficial for me to talk with them. i ACE-FEDERAL REPORTERS, INC. 800 336 6646 _ __ _202 _ _, _-347-3700 Nationwide Coverase
2550 03 11 38 1 MR. WARD: Is that a public document? {}DAV/bc 2 MR. DENNIG: No, it's in limited distribution. 3 MR. WARD: But you've seen it? 4 MR. DENNIG: Yes. 5 MR. WARD: Have you come to any...I mean, there 6 are some sorts of tentative, vague, general conclusions one 7 could reach from what you just told us. From studying the 8 INPO document, would you come to markedly dif ferent 9 conclusions? 10 MR. DENNIG: To be honest, I didn't read it with 11 this discussion in mind. I hate to mislead you by just 12 trying to recall what I saw. O(_/ 13 MR. WARD: If you don't know, that's all right. 14 MR. HERNON: Mr. Ward, Ron Hernon with the 15 Staff. Mr. Michelson, would you please repeat your last 16 question? I'm not sure we understood it. 17 MR. MICHELSON: You mean the question of the 18l future availability of information? 19 MR. HERNON: Are you talking about the quality of 20 the LER's that are coming out? 21 MR. MICHELSON: No, I was merely interested in 22 the quality of the reliability data. 23 MR. WERMIEL: I understood the question. 24 MR. WARD: I think his point is here is an O) (_ 25 extremely important question about the reliability of ACE-FEDERAL REPORTERS, INC. 202 347 3700 Nationwide Coverage 800 336-6646
1 l 2550 03 12 39 DAV/bc 1 plants. One of the most important systems in the plant.
-2 And our system of quantifying operating experience doesn't 3 seem to be giving us anything.
4 MR. HERNON: My perspective is, you know, that , 5 the reporting requirements are probably less stringent than 6 they were before the new LER rule as far as the information 7 we're getting. It's certainly important to have the i 8 operating history, but I think by the end of the afternoon, 9 it will be apparent to you that our main thrust has been
! 10 reliability of the system itself as a result of PRA 11 studies, and making sure that gets folded back into what's 12 really happening.
O 13 1 ehink 1 hear that as one ee the concerns. 14 15 16 . 17 18 l l 19 20 21 22 23 24 25 ACE FEDERAL REPORTERS, INC. 202 347 3700 Nationwide Coverage 800 33H6M
2550 04 01 40 T"NDAV/bc 1 MR. WARD: We're trying to find out what's really \_J 2 happening. I don't care what a PRA tells me or what are the 3 requirements if we don't have something to make sure of 4 what's really happening in the plants. Neither of those two 5 things mean anything. 6 MR. DENNIG: One thing, auxilliary feedwater, 7 emergency feedwater, is a system within the scope of NPRDS, 8 so all the component problems, component failures, are 9 reportable. NPRDS doesn't have any mechanism for demand 10 information other than guestimates. There is no real time 11 or actual tracking of usage of the system. 12 But the failure information that used to come in () 13 in LER's is covered by NPRDS, which was the way it was 14 supposed to work. 15 MR. MICHELSON: Have you actually gone into NPRDS 16 during this study to see what kind and quality of 17 information is actually being deposited in the system? 18 MR. DEMNIG: We do that, as you know, but not in 19 connection with this. 20 MR. MICHELSON: Did you as a part of this work? 21 MR. DENNIG: No. 22 MR. MICHELSON: You didn't use NPRDS? 23 MR. DENNIG: No, I did not. 24 MR. WARD: That sure seems to be going a long way 25 around in trying to construct. I mean, here, you've got a ACE FEDERAL REPORTERS, INC. 202 347 3700 Nationwide Coverage 800 336 6646
1 2550 04 02 41 1 nicely defined system, the aux feed system, and trying to
)DAV/bc 2 construct the performance and reliability of that system 3 from NPRDS component reliability data.
4 MR. DENNIG:' It seems that way, but let me put my 5 last slide up. Somebody else brought up INPO. This gets 6 into something that they're doing, the approach that they're 7 taking. , 8 (Slide.) 9 System level failures are practically non-10 existent. They don' t go 'that high. So if you want to come 11 up with some kind of an estimate of the performance of that 12 system, the fallback is, you know, the original reason for () 13' doing fault trees, if I don't have any observations high up 14 here, I go down to the lower level. That's the fallback. 15 And, in fact, I believe the auxilliary feedwater 16 system is one of the systems that INPO has been pitching as 17 part of their performance tracking system, getting each 18 licensee to calculate based on component unavailabilities an 19 estimate of his system unavailability. 20 But they're taking that tack again because of the 21 lack of system level failure information. You have most of 22 the people sending in nothing and saying, well, we've never 23 failed the system. So they must have a 100 percent system. 24 MR. WARD: I accept that. That's a good point. ( 25 One is a small number. ACE FEDERAL REPORTERS, INC. 202 347 3700 Nationwide Coverage 800 336 6646
j
,%- i
,c.
A 2550 014 03 42 ) 1 Jessie, excuse me. (}DAV/bc
~2 MR. EBOERSOLE: I was just going to say I was
- 3 thinking on this matter of things being engineered ,
4 safeguards or not. There's a related set of pieces of 5 equipment that make the steam generator work. Of course, .. 6 that's the PORV's.. They're not safety grade either. 7 Neither are their block valves. l
- s 8 One can imagine a situation where there's plenty
! -9 of secondary water. But you can' t maintain pressurization 10 unless in a delta T to take the primary heat out to the 11 secondary. So the system is stalled from a heat pull
'12 standpoint.
() 13 In this condition, do they report the PORV , 14 sticking open and the counterpart block valve failings, 15 since they're not safety grade? There's no tech specs on 16 them. 17 MR. DENNIG: This is in the primary side? 18 MR. EBOERSOLE: Primary side. They're not on the 19 secondary side either. f s 20
- MR. DENNIG: The PORV is covered by NPRDS for 21 what that's worth. In a trip sequence, the PORV opens and 22 hangs up, or opens at all, we would expect that we'would be i 23 told about that.
24 That's a significant event as part of that I A That's what the requirements require. The
\~/ 25 sequence.
i i
! ACE. FEDERAL REPORTERS, INC.
202 347 3700 Nationwide Coverage 800 33H646
2550 04 04 43 1 performance in that area detailing the sequence of events
~ )DAV/bc 2 post-trip, our experience has not been good.
3 MR. WARD: Okay. Jerry. 4 (Slide.) 5 MR. WERMIEL: My name is Jerry Wemiel. I'm 6 Section Leader in the Plant Electrical Instrumentation and 7 Control Systems Branch of the new PWA Division B of the 8 NRR. That's the B&W and CE division. 9 MR. WARD: You remembered that one without even 10 writing it down. 11 (Laughter.) 12 MR. WERMIEL: I got the e and the i confused. We , () 13 call it " pieces" incidentally, "the pieces branch". 14 I've been asked to speak I guess about how the 15 staff reviewed the aux feed system criteria governing the 16' design of an aux feed system has evolved. 17 It has been an evolutionary thing and where we 18 are today basically with that, as you can see from the first ^ 19 bullet, the criteria initially governing aux feed systems 20 was at best nebulous before the advent of the standard 21 review plan. I 22 MR. EBOERSOLE: What does " good engineering 23 practice" mean? 24 MR. WERMIEL: What it generally specified, as I 25 understand it, was B-31-1 piping, quality to some extent but ACE FEDERAL REPORTERS, INC. 202 347-3700 Nationwide Coverage 80433M646
l l 2550 04 05 44 1 not necessarily Appendix B. An engineered pump rather than
.{)DAV/bc 2 something that you would necessarily buy off the shelf.
l 3 In other words, something that would do the job 4 it was intended to do but without the intent behind an ESF l 5 or.a SECY-related system essentially. {
- 6 When the-standard review plan came out in 1975 !
l 7 and the plants were reviewed against that, they had been i i 8 providing what could be called engineering safety features, 9 ESF, or what I like to call a safety-related system. That 10 is where we reviewed it, specifically identified the need i
.11 for the system to be seismically qualified, the need for
{ i 12 redundancy, the need for tech specs, the need to assure its I l' i () 13 design capability, things like that. The need for quality, i 14 incidentally. j 15 Again, that did not occur until 1975. I 16 MR. WARD: Jerry, safety-related and ESF are not l 3 17 the same thing, I don't believe. Or does that distinction ' i I 18 make any difference to you? i 19 MR. WERMIEL: Not in the context of my l' discussion, no. 20 Safety-related, to me, as defined by NRR, l 21 in my recollection, is granded in 10 CFR Part 100. Part 100 1 22 again, at least initially, was geared around the large r ! 23 Since that time, I think we have expanded our LOCA. { 24 thinking on what is safety-related and, for that reason, () 25 have expanded its definition to include things like aux 4 ACE FEDERAL REPORTERS, INC. 80(k33 H 646 _ _ ..._ _ _ _ ,_. ,._ __. _ ... _ _ _202 347
,,_3700. . _ _ _ . _ Nationwide Coverase
_ . _ , _ _ . _ , _ _ _ . _ _ _ , _ . _ _ _ _ _ _ _ . . ~ . _ . . _ _
2550 04 06 45 1 feed. ()DAV/bc 2 MR. WARD: So you' re really going with the 3 definition of aux feed systems as being safety-related. 4 MR. WERMIEL: I'm trying to make it comparable to 5 what we would classify, say, as a safety injection system or 6 service water, anything required to safely shut the plant 7 down following an accident, or mitigate the consequences of 8 that accident. 9 MR. EBOERSOLE: How do you distinguish between 10 safety-related and safety grade in a physical context? 11 MR. WERMIEL: I don't think there's any 12 difference. Safety-related, safety grade are (~ ( >) 13 interchangeable word's. I don' t happen to like the . word 14 " safety grade". I like the word " safety-related" more 15 because it's more easily definable in the documentation I've 16 seen. 17 Safety grade is not as easy to define. 18 After the TMI-II accident, it became apparent to 19 the staff, and that was in 1979, that additional focus 20 needed to be made on the aux feed system, and what we 21 actually had, what was out there, what it was doing. In 22 other words, what was really existing in the industry at 23 that time. 24 That task was undertaken by the Bulletins and 1 25 Orders Task Force. What was done was this task force in a ACE FEDERAL REPORTERS, INC. 202 347 3700 Nationwide Coverase 800 3J6-6646
2550 04 07 46 /~N DAV/bc 1 very short time period, as a matter of fact, put together a \-) 2 deterministic and a probabilistic review of the aux feed 3 systems in those plants that had operating licenses at the 4 time'of the TMI-II accident. 5 The deterministic review was essentially a quick 6 comparison of the systems as defined by those utilities 7 against the standard review plan. 8 The probabilistic evaluation was a stylized, 9 rather quick fault tree to try to determine what the 10 availability of the aux feed system would be on demand, 11 ' without a particularly detailed look into support systems, 12 common cause, or things like that. O As I recall, there were 10 of (,) 13 MR. EBOERSOLE: 14 them that had to be nonseismically competent. Is that 15 correct? 16 MR. WERMIEL: I think there were more than that. 17 I'm going to get to the seismic aspect; that's on the last 18 page. But I believe there were more than that. Certainly, 19 seismic was a problem. 20 The main focus, incidentally, of the 21 probabilistic review was not to come up with an 22 industrywide, numerical unavailability or goal, say, for the 23 system. It was primarily to identify the major contributors 24 to unavailability and to develop a range of availability of () 25 systems for comparison purposes -- how does this ACE FEDERAL REPORTERS, INC. 202 347 3700 Nationwide Coverage 800-336 6646
'2550 04 08 47 f'TDAV/bc 1 Westinghouse plant compare to this one? Why is there a V 2 difference? What are the major vulnerabilities? What can 3 we do about something like that? 4 The results of those efforts were published in 5 NUREG's 06-11 and 06-35 for the Westinghouse and Combustion 6 Engineering plants respectively. 7 At this time, the B&W plants were being treated 8 differently. They were under shutdown orders. A different 9 set of people had reviewed the aux feed systems of those 10 plants prior to the shutdown orders being lifted. And, 11 subsequent to that, the staff asked for reliability studies, 12 numerical studies of those systems, and received it in the () 13 form of a topical report from B&W, No. B&W 15-84. That 14 study was reviewed by the staff. 15 MR. WARD: Jerry, it was reviewed. Was there an 16 SER. issued? 17 MR. WERMIEL: There was a document developed for 18 internal use. It was never published for external use like 19 the NUREG's were on the Westinghouse and C.E. plants. It 20 was used in the course of subsequent reviews under 21 II.E.1.1. and II.E.1.2. 22 MR. WARD: But is there an implication that the 23 staff accepted the B&W study? 24 MR. WERMIEL: We argued, as a matter of fact, 25 with the utilities during the II.E.1.1 reviews about the ACE. FEDERAL REPORTERS, INC. 202 347 3700 Nationwide Coverage 800 336 4646
l 2550 04 09 48 DAV/bc 1 numbers, and the results of those studies as they were
- 2 presented. So, no, there was not a tacit acceptance.
3 MR. EBOERSOLE: The last bullet says there was. 4 MR. WERMIEL: Let me get to what that bullet is 5 saying. All plants were reviewed against II.E.1.1 and 6 II.E.1.2 and trying to be acceptable. The II.E.1.1 and 7 II.E.1.2 specified a deterministic criteria only; there was J 8 never any review done under those TMI items. The need to ) 9 comply with an unavailability goal. 10 MR. EBOERSOLE: May I ask a question at this time 11 about the standard review plan? Would it be available to 12 the decay heat removal system, like Salem's and aux 13 feedwater like Davis-Besse? 14 MR. WERMIEL: Yes. J 15 MR. EBOERSOLE: There seems to be a reluctance on 16 the part of the staff, I would presume, on the grounds of 17 its being too proscriptive to mandate diversity. Is this i 18 true? 19 MR. WERMIEL: Diversity of aux feed. 20 MR. EBOERSOLE: Or reactor shutdown. 21 MR. WERMIEL: As in the standard review plan. 22 MR. EBOERSOLE: How did Davis-Besse escape having 23 it? 24 MR. WERMIEL: Davis-Besse was not reviewed 1 I 25 against the standard review plan. They received their l l i ACE. FEDERAL REPORTERS, INC, 202 347 3700 Nationwide Coverage 800 33H646
2550 04 10 49 1 license prior to that review. (])DAV/bc 2 MR. EBOERSOLE: I'm talking about in the 3 backview, which you took here. 4 MR. WERMIEL: There was internal staff concern 5 about diversity at Davis-Besse and, as a matter of fact, 6 prior to their event, there was a license condition on them 7 to backfit a motor-driven pump. 8 MR. EBOERSOLE: When? 9 MR. WERMIEL: I believe it was in January of that 10 year the license condition went in. So the staff had 11 already recognized a deficiency, shall we say, in 12 Davis-Besse. 13 MR. EBOERSOLE: Is there a comparable one at 14 Turkey Point today? 15 MR. WERMIEL: Turkey Point has a motor-driven 16 pump in each of its two units. In addition, Turkey Point 17 has committed to tech spec that motor-driven pump. So the 18 staff is very pleased with the upgrades Turkey Point has 19 made and their volunteering that tech spec. 20 MR. RUBINSTEIN: Les Rubinstein of the Staff. 21 You're touching on a subtlety in the staff's 22 review which NUREG 07-37 recommended guidelines. And when 23 Jerry said in response to your question on B&W plants did 24 the staf f accept them, yes, they did but with the full i O>
\- 25 knowledge that we would have in preparation in future time ACE-FEDERAL REPORTERS, INC.
[_ 202 347 3700 Nationwide Coverage 800-336 6646
2550 04 11 50 r~'TDAV/bc 1 additional requirements which dealt with some of those kinds V 2 of points, and would go through the process. And, for 3 example, in terms of power diversity, there were a number of 4 CRGR packages. 5 MR. EBOERSOLE: This is apart from any PRA 6 requirements? It's just deterministic? 7 MR. WERMIEL: That's correct, Jessie. Let me 8 point out that we indicated to a number of plants after 9 completion of the review on the II.E.1.1 and II.E.1.2 that 10 we may be coming back to them because we held additional 11 concerns in various areas. And although, at that point, the 12 ball so to speak was dropped, staff continued its effort to () 13 get to that point. 14 And I'm getting to that on the next slide. 15 MR. EBOERSOLE: Are you going to pay particular 16 attention to the aux feed system at Paloverde in particular? 17 You know, it's the one real issue. 1 18 MR. WERMIEL: We paid attention to the aux feed 19 system at Paloverde. 20 (Slide.) 21 To answer the question about seismic 22 qualification, it was recognized that many plants, many of 23 the older plants did not have seismically qualified aux 24 feedwater systems, as the standard review plan would define () 25 them. ACE. FEDERAL REPORTERS, INC. 202 347 3700 Nationwide Coverage 800-336 M46
i 1 f , 2550.04 12 51 1
- 1 Generic letter 81-14 was issued to ask those
{)DAV/bc 2 plants to upgrade their system to withstand, functionally ! 3 withstand an SSE, and all those plants had been reviewed, 4 with the single exception that we still have Oconee under. 5 consideration. 6 Getting to your point about _Paloverde, Paloverde 7 and plants of that vintage are what we would call the latest 8 standard review plan plants. They' re required, or they must 9 have satisfied the criteria of Section 10.4.9 for AFW 10 unavailability. That's 10 to the minus 4, 10 to the minus 5
; 11. criteria.
12 We asked that those plants perform a reliability () 13 study. They have all done that. We' asked that they utilize 14 an approach comparable to that in 0611 and 0635 so we could 15 again make the comparison that we were anxious to make, and
- 16 understand where-they ranked.
- 17 There were 12 of these plants total. By
! 18 " plants", I'm speaking in some cases of multiple units. And 19 I provided a listing of those in the back which, based on e i l 20 our review of their reliability studies, have shown or have 21 demonstrated compliance with the reliability goal. And that i 22 list is this one here. J 23 l 24 ( 25 T ' ACE. FEDERAL REPORTERS, INC. 202 3M-1W Nationwide Coverage 800 336-6646 ,
. ~ . . . - - . - - -
2550 05 01 52 f~lDAVbur 1 (Slide.)
/
2 MR. EBERSOLE: I gather then that all other 3 plants have not satisfied the SEW? 4 MR. WERMIEL: That is the logical question, but 5 that is not the case. If you go to 611 and 635, despite 6 their old date, you will note a number of plants in there 7 that satisfy the goal. 8 It is also our judgment that based on the 9 upgrades in many of these plants, additional operating 10 plants have satisfied the reliability goals. 11 However, there is a list of 11 plants that the 12 staff hau under consideration for additional upgrade, f') (m/ 13 MR. EBERSOLE: Do you have that list? 14 MR. WERMIEL: Yes, I do. I didn't make a slide 15 of it, but I can give you that list. 16 MR. MICHELSON: Before you leave the present 17 list, as I recall, Bob Dennig cited Callaway as the one with 18 21 failures on his slide. Admittedly, it was the startup 19 period. 20 MR. DENNIG: Those were challenges. 21 MR. WARD: That doesn't have anything to do with 22 this. 23 MR. WERMIEL: Those were challenges to the 24 system, and also remember that Callaway in 1984, which the 25 data represented, was in startup. ACE-FEDERAL REPORTERS, INC. 202-347 3700 Nationwide Coverage 800 336-6646
2550 05 02 53 1 MR. MICHELSON: Okay, those were just the {}DAVbur 2 challenges to the system. I stand corrected. 3 Thank you. 4 MR. WERMIEL: The 11 plants at the time we 5 finished the II.E.1.1 and II.E.1.2 reviews where we had 6 additional concerns are the following: 7 Arkansas Nuclear One Units 1 and 2; Crystal 8 River; Rancho Seco; Fort Calhoun; Prairie Island 1 and 2; 9 Maine Yankee; San Onofre 1; Davis-Besse; Haddam Neck; and 10 Turkey Point 3 and 4. 11 The first six plants -- let's start with the 12 latter five. Maine Yankee, San Onofre 1, Davis-Besse, O)
\m 13 Haddam Neck, Turkey Point 3 and 4 have fairly recently 14 committed to upgrades or are going to be asked through arm 15 waving or actual arm twisting to make the necessary upgrades 16 to, we believe, satisfy us that they would meet the goal of 17 10 to the minus 3.
18 The first six, Arkansas Nuclear One Units 1 and 19 2, Crystal River, Rancho Seco, and Fort Calhoun and Prairie 20 Island 1 and 2, we still have concerns about. We recently 21 met with all these utilities and asked them to address aux 22 feed reliability, asked them to address feedwater challenges 23 and generally bring us up to date on what the conditions 24 were in those plants. 25 We got a good understanding of where we stand ACE-FEDERAL REPORTERS, INC.
- 02-347-3700 Nationwide Coverage 800 336-6646
2550 05 03 54 ('TDAVbur 1 with them, and as was already alluded to, we have under G 2 consideration the need for additional action through the 3 CRGR. 4 MR. EBERSOLE: Does that mean they will get the 5 PRA treatment, or will it just be deterministic? 6 MR. WERMIEL: We don't know. At least I don't 7 know. 8 (Slide.) 9 MR. EBERSOLE: Does the CRGR operate without PRAs 10 to a great extent -- or to what extent? 11 MR. WERMIEL: My only experience with CRGR has 12 been fairly limited, and every time I have dealt with them (3., \_/ 13 they have relied on cost / benefit, which to a large extent 14 relies on probabilistic risk assessment. 15 MR. WARD: Jerry, could I ask you a couple before 16 you go on? 17 In the first item up there, does your view of the 18 three standard review plants against the seismic criteria -- 19 were those plants, with the exception of Oconee, I guess, 20 which is still under review -- they were all found 21 acceptable? Was this before any backfits or were just the 22 systems as there found acceptable? 23 MR. WERMIEL: No. In quite a number of cases 24 backfit", were necessary. In other cases, additional l 3 l 25 analyses were needed to confirm seismic resistance of ACE-FEDERAL REPORTERS, INC. 202-347-3700 Na:ionwide Coserage 80 4 336-6646
2550 05 04 55 ()DAvbur 1 certain structures and components. But backfits did go into 2 place in a number of plants, with additional constraints in 3 some cases. 4 As a matter of fact, some planto have committed 5 to additional tanks, seismically qualified kinds of storage 6 tanks, some additional valves in a number of plants or 7 replacement of valves, valves that were not qualified with 8 valves that were. 9 So there were backfits. 10 MR. WARD: Okay. 11 Then a related question, I think. If something 12 is safety grade that has to be seismically resistant, then 13 also the other big requirement is that the system should be 14 single failure resistant. You haven't said anything 15 specific about that. 16 Were all these older plants found already to be 17 single failure resistant, or what is the story on those? 18 MR. WERMIEL: What 81-14 specified -- I guess I 19 should have gone into that. I didn't realize there would be 20 so much interest in that -- 81-14 asked that the plants 21 demonstrate capability to safely shut the plant down with 22 the aux feed system following an SSE or with some other 23 qualified, acceptable alternative decay heat removal 24 system. O
\~#
25 In so doing, it asked that they would meet the t
! ACE-FEDERAL REPORTERS, INC.
202-347-3700 Nationwide Coverage 800-33MM6
2550 05 05 56 1 requirements of GDC-2 and GDC-34. ()DAVbur 2 GDC-34 specifies that you be able to withstand a 3 single failure. 4 So the review under 81-14 confirmed the 5 capability to shut down with aux feed following an SSE and a 6 concurrent single act of failure. 7 MR. EBERSOLE: Since these older plants were 8 built, with even a minimum of records for the safety grade 9 systems in the context of construction, weld records, et 10 cetera, what did you do with the difficult problem of 11 finding the history of fabrication and assembly and 12 installation of all these nonsafety grade systems? What O L/ 13 recipe did you use, and why is it not applicable to other 14 plants that don't have records? 15 MR. WERMIEL: We asked where the recipe, as you 16 call it, or whether the qualification documentation wasn' t 17 suitable, we asked for additional analysis, new analysis, 18 seismic analysis of the system. 19 MR. EBERSOLE: What did you do, for instance, 20 about the quality of welds, the records of the welders, et 21 cetera, et cetera, since they were presumably nonexistent? 22 MR. WERMIEL: I don't recall the specifics of 23 things like welder qualification. a ij MR. EBERSOLE: Why don' t we find out what recipe On \/ 25 you did you to qualify these -- I should presume -- poor ACE-FEDERAL REPORTERS, INC. E-347-3700 Nationwide Coverage 800-336 6646
2550 05 06 57 1 systems with poor records of fabrication and installation (])DAVbur 2 and find out what the difference in rationale was in 3 qualifying those plants versus qualifying some new plants 4 that don't have records today? 5 You know, that is one of the flaps we always 6 have. 7 MR. WERMIEL: You are talking about the OA flap? 8 MR. EBERSOLE: How do you escape the OA flap? 9 What is the cookbook you used? 10 Because it might be useful if it is good. 11 MR. WERMIEL: Again speaking from what I know, I 12 recall in a number of cases where reanalysis of the piping 13 configuration was necessary, but I don't know how that 14 relates to the welds within the system. 15 MR..EBERSOLE: Or the metallurgy? 16 MR. WARD: Are those systems now on operational 0 17 lists? Are they all treated as O list items as far as tech 18 specs? 19 MR. WERMIEL: All the systems are tech spec now. 20 All aux feed systems have tech specs that are fairly 21 consistent now. 22 One of the major items of II.E.1.1 was to get 23 comparable tech specs from plant to plant. 24 As far as 0 listing for the system, I am just not ('l x-T 25 familiar with that. l l 1 l ACE-FEDERAL REPORTERS, INC. ll02-347-3700 Nationwide Coverage 80 4 336-6646 l
2550 05 07 58 . 1 MR. MICHELSON: Does your reply then mean that (JDAVbur 2 they now control the quality during modification, 3 maintenance, et cetera? Are these auxiliary feedwater 4 systems controlled just like systems that are classified as 5 engineered safety features? 6 MR. WERMIEL: I would assume so, but I honestly 7 don't know. I am not that familiar with the modification. 8 MR. MICHELSON: Covering by tech specs doesn' t 9 necessarily control, prolong the quality or make sure the 10 quality is protected as the quality might be. 11 MR. WERMIEL: No, but there is a disadvantage to 12 the operation of the plant if you are not controlling G k/ 13 quality, in that if the system happens to be unavailable tco 14 frequently you may enter the action statement and force 15 yourself to shut down. 16 So there is an inherent need, I would think, from 17 the operational staff of the plant to want to do quality 18 work and control that. 19 MR. WARD: But I am not sure -- 20 MR. WERMIEL: To make that analogy, though, 21 because it is a tech spec system it is on the O list, which 22 is what I think you are trying to drive at, Mr. Ward, I 23 don' t believe you can make that direct comparison. 24 DR. CATTON: But you could set the tech spec so D
'~/ 25 loosely that it really doesn' t matter.
' ACE-FEDERAL REPORTERS, INC.
202 347-3700 Nationwide Coverage 80433MM6
2550 05 08 59 1 MR. WERMIEL: The tech specs are not loose on aux [V~'T DAVbu r 2 feed in that respect. The operability of the system is 3 governed pretty stringently. 4 DR. CATTON: Is there a criterion for the tech 5 specs? 6 MR. WERMIEL: Yes. Generic No. 83-7 went out 7 which provided generic guidance on what we want in the way 8 of tech specs on these plants. My recollection is that that 9 review has been completed on all the plants. We have very 10 comparable tech specs now, even in the oldest plants. 11 MR. WARD: Okay. See, what we are trying to find 12 out -- you said these older plants have been reviewed, you 13 have sort of tried to backfit the safety grade requirements 14 of the older plants, and let's say there is three main 15 parts, and let's say you require seismic resistance -- you 16 told us about that -- and single failure resistance -- you 17 told us about that. 18 The third part is the OA. Mr. Ebersole pointed 19 out that it is hard to backfit the original OA construction 20 requirements. There is some question about that. But there 21 are ongoing in-service inspection requirements -- 22 MR. WERMIEL: Yes. 23 MR. WARD: -- for O'd systems. 24 MR. WERMIEL: You raised a point. Section 11 b> N 25 does govern, I guess, ISI and IST for the aux feed system. ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800 336-6646
2550 05 09 60 1 It is included. ()DAVbur 2 The staff has -- although I am not specifically 3 familiar with the details of it, the staff has under review 4 the Section 11 ISI, IST programs, for all these programs. 5 What is specifically included in those programs I don't 6 know, but the aux feed system is covered by those programs. 7 MR. WARD: Could we find out? I can understand 8 why you might not have the answer right off the top of your 9 head, but could we get an answer to the question of whether 10 these aux feed systems in the older plants are now treated 11 as safety grade systems from the standpoint of operation and 12 QA? 13 HR. WERMIEL: There are probably people within 14 the staff who could answer that question. I am just not 15 equipped to. 16 MR. WARD: Maybe we can get that answer in the 17 future. 18 MR. HERNON: We will get that answer for you. 19 MR. WARD: Thank you. 20 MR. MICHELSON: Did you look into the 21 environmental qualification of the equipment associated with 22 auxiliary feedwater, and what did you conclude? 23 MR. WERMIEL: Aux feed systems were covered under 24 50-49. It was not part of this review. That was done by a
) 25 different group of people. But in those cases where the j
i ACE-FEDERAL REPORTERS, INC.
- 02-347-3700 Nationwide Coverage 800-336-6646
l l l l 2550 05 10 61 TiDAVbur 1 aux feed system was exposed to a harsh environment, the U 2 system was either qualified -- 3 MR. MICHELSON: I am trying to struggle for a 4 moment with this concept of being so-called nonsafety grade 5 or non-ESF, or whatever you call it. I am struggling now 6 how the environmental qualification people dealt with this 7 issue. If it is non-ESF, it probably doesn't have to be 8 environmentally qualified. So they could kind of ignore 9 it. 10 But did somebody tell them you can't ignore 11 auxliary feedwater even if it may not be called safety grade 12 or safety related or something? (~s (,) 13 MR. WERMIEL: They were told that, yes. 14 MR. MICHELSON: And they reviewed it as though it 15 did have to perform an important safety function, and they 16 somehow fortuitously, even though these systems weren't ever 17 designed to be safety grade, they turned out to be 18 environmentally qualified. 19 Is that the case? 20 MR. WERMIEL: I don't know the answer. It only 21 needs to be qualified to a harsh environment if it is 22 exposed to it. 23 MR. MICHELSON: It is a pretty good opportunity 24 for that harsh environment if the auxiliary feedwater steam 25 line breaks, for instance, and gets both the electrical, ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336-6646
l 1 l 2550 05 11 62 1 which is often located in the same room with the steam. ()DAVbur 2 MR. WERMIEL: You have to remember the criteria 3 governing breaks in that steam line. It is not normally 4 pressurized. 5 MR. MICHELSON: It depends on the utility whether 6, it is normally pressurized or not. 7 MR. WERMIEL: That is correct, and if it is and 8 it breaks and it exposes all the system to a harsh 9 environment, my understanding is that it is qualified. 10 MR. MICHELSON: I am not so much worried about 11 that as of course also exposing other equipment. But it was 12 found that it was qualified, and I am not sure what you 13 meant by -- now by this harsh environment part. 14 You mean it was found to be qualified for harsh 15 environments? 16 MR. WERMIEL: It may have been, or it may have 17 been that they had to make a modification to qualify it. 18 MR. MICHELSON: But they are all now qualified 19 for harsh environments; is that what you are saying? 20 MR. WERMIEL: No, I am not saying that. I am 21 saying my understanding of the 50-49 rule would have said if 22 the aux feed system is exposed to a harsh environment it is 23 necessary to shut the plant down to mitigate that harsh 24 environment, and then it is either qualified or shown not to O 25 be necessary. ACE-FEDERAL REPORTERS, INC. I 202-347 3700 Nationwide Coverage 800 336 6646 _
2550 05 12 63 DAVbur 1 MR. MICHELSON: So they have either shown that 2 they don't need it anyway in the situation or it has been 3 qualified, whether or not it was considered safety related 4 to begin with? 5 MR. WERMIEL: That is correct. 6 MR. MICH'ELSON: Thank you. 7 MR. EBERSOLE: There is a subtlety in this 8 business. Qualification of some of this electrical 9 apparatus has been claimed on the basis of saturating it in 10 a steam environment but having it initially warm so that 11 surface condensation does not take place on electrical 12 contact. Thus, short-circuiting to ground doesn' t occur. /% ( )g 13 There are some neat escape routes if you get that warmed up 14 first. 15 Do you happen to know how rigorous and how 16 thoroughly this was done if you were to bathe all this 17 equipment in a Turkish bath? 18 MR. WERMIEL: I am not, no. I assume our 19 equipment qualification people could address something like 20 that. I am not equipped to answer that. 21 MR. EBERSOLE: I am dismayed to find a lot of 22 completely open equipment like you have in any factory 23 subjected to this hypothetical Turkish bath. 24 MR. DAVIS: I have a quick question. Do you ( 25 get in on the changes if a utility makes a modification ACE-FEDERAL REPORTERS, INC. 3)2-347-3700 Nationwide Coverage 800 336-6646
2550 05 13 64 1 to its aux feed system which was a voluntary change, ([)DAVbur 2 which may or may not be related to safety? 3 MR. WERMIEL: Not necessarily. You can make changes 4 to anything in the plant by 50-59, and not have to notify NRR, 5 50-59 allows modifications at any time, provided certain 6 criteria are satisfied. And then I believe those are collected 7 and notification to the region is made. 8 MR. DAVIS: That concerns me a little bit. I know of 9 a case where a plant increased its trip level to improve its 10 reliability but made it operate outside its design basis. 11 I wonder if this kind of thing gets picked up. 12 MR. WERMIEL: If that trip level is something h') 13 incorporated into the technical specifications, the change 14 cannot be made. Then NRR would be involved in the review of 15 it. 16 One of the criteria for 50-59 indicates that the 17 change could not affect the license or tech specs. 18 MR. DAVIS: In this particular case it was an 19 overspeed trip on the diesel driven pump, which I don' t 20 think would be in the tech spec. 21 MR. WERMIEL: I think you are probably right. I 22 think a change like that can be made under 50-59. 23 24 )
<n :
(/ 25 ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336 4646
65 (}00601 1 DAVbw 1 MR. WARD: Thanks, Jerry. 2 Why don't we take a short break. Let's take a 3 10-minute break at this time. 4 (Recess.) 5 MR. WARD: Our next speaker is Mr. Frahm. 6 - (Slide.) 7 MR. FRAHM: I'm Ron Frahm, from the Division of 8 Safety. I'm Section Leader in the Reliability and Risk ' 9 Assessment Branch, which is now changed in a new 10 organization into a Section Leader in Safety Program and 11 Evaluation Branch, the Division of Safety and Review (> \ 12 Oversight. 13 MR. WARD: That's your old title. 14 MR. FRAHM: That's my old title. I was handed 15 this assignment before we reorganized. 16 (Slide.) 17 Then what is on the agenda. To quantify these 18 trees we used the data as specified in 0611 and 0636, and 19 the Staff, assisted by Brookhaven National Laboratories and 20 Sandia National Laboratories reviewed about 17 plants and 21 provided our results to Jerry Wermeil and his group. The 22 auxiliary feedwater system, as analyzed in this document, 23 includes the hardware from the water source to the nozzle on A 2 24 the stpam generator, and the analysis did not include high 25 energy line break or external events.
. ACE-FEDERAL REPORTERS, INC.
Nationwide Coverage 800 336-6646
- - #393#_ _ _ _ . _ _ _ _ _
2550 06 02 66 . 1 The review by the Staff generally identified the ([])DAVbw 2 dominant contributors for each initiator. Basically, these 3 were maintenance, hardward failures of pumps, valves, 4 involvements with the actuation logic. We pointed out the 5 single and/or common mode failures. 6 I might point out that the 611 results are point 7 estimates and have very large uncertainty bounds and that 8 the staff review discussed improvements that could be made 9 to increase the availability and reli1 ability of the 10 auxiliary feedwater system. 11 (Slide.) 12 The Staff reviewed, I think, around 17 LWRs.
'd 13 There were two train systems, such as ANO 1, Crystal River, 14 Davis-Besse and also three train auxiliary feedwater 15 systems, such as Catawba, Seabrook, Midland, Waterford. The 16 two-train unavailability was generally in the range for loss 17 of main feedwater of about 10 to the 3, 10 to the minus 4.
18 Similar for the loss of offsite power. The loss of AC was 19 about 10 to the minus 1 to 10 to the minus 2. We found in 20 the three-train system, loss of main feedwater availability 21 was 10 to the minus 4 to 10 to the minus 5. The loss of 22 offsite power was 10 to the minus 4 to 10 to the minus 5 23 again. 24 The loss of AC was about 10 to the minus 1, 10 to U 25 the minus 2. ACE-FEDERAL REPORTERS, INC. 202-347 3700 Nationwide Coverage _ 800 33MM6
l 2550 06 03 67 1 MR. MICHELSON: Is there some historical reason ()DAVbw 2 why the B&W reactors had the two-train auxiliary feedwater? 3 Is there some rationale, something unique about them? 4 MR. WERMIEL: This is Jerry Wermiel again, with 5 the Staff. 6 We were not able to identify anything, 7 historically or otherwise that would indicate that. 8 Westinghouse, we were able to identify, had an interface 9 among its utility users to specify, generally, that they 10 provide three pumps, but again, that's just an interface, 11 and just a gci3ral criteria in there, because you will find, 12 prior to the TMI accidents, there were Westinghouse plants /"T \d 13 with just two pumps. Even today, there is still a 14 Westinghouse plant with two pumps. So that plant does 15 satisfy the reliability criteria. 16 MR. MICHELSON: It says it's two-train. Is it 17 necessarily one electric, one steam, or sometimes two 18 electrics, or a mixed bag of two steams, or what? It could 19 be anything. 20 MR. WERHIEL: It's always diversity. The only 21 plants that just have steam-driven plants until recently 22 were Turkey Point and Davis-Besse. All plants have 23 diversity now. Electric and steam. In some case, they're 24 electric and direct diesel. 25 MR. MICHELSON: On the slide, the two-train ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336-6646
2550 06 04 68 I system included Davis-Besse. They were older vintage, 'I ()DAVbw 2 assume. So this was a mixed bag of electric and steam, 3 without any clear rationale. 4 MR. THADANI: That is correct. Davis-Besse was 5 one of the plants looked at that did not have diverstiy. 6 MR. MICHELSON: Are these all being fixed now? 7 Are there still two-train systems that haven't been agreed 8 to? 9 MR. WERMIEL: Yes, there are. That list that I 10 read off during my presentation were basically two-train 11 plants. 12 MR. RUBINSTEIN: However, all have in place power (Jh s 13 diversity, all plants. 14 MR. MICHELSON: What does that mean -- one steam, 15 one electric? 16 MR. RUBINSTEIN: Yes. 17 MR. MICHELSON: Crystal River, was it two 18 ' electric? 19 MR. WERMIEL: No. Crystal River has a turbine 20 and a motor. 21 MR. MICHELSON: It was always that way? 22 MR. WERMIEL: Yes. You can go back far enough in 23 any of these plants and find cases where they may have had a 24 different configuration than the subsequent years added O 25 pumps. ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 300 336-6646 _
- 2550 06 05 69
()lDAVbw 1 MR. DAVIS: Just to help me a little bit, Ron, 2 when you say three train, does that, by definition mean any 3 single train can provide sufficient capacity for decay heat 4 removal? 5 MR. FRAHM: Yes. 4 6 MR. DAVIS: Some of these three-train systems are 7 called 50 percent capacity on the motor-driven pumps, but 8 actually, they have enough -- 9 MR. FRAHM: Right. The first thing you said. 10 100 percent. 11 MR. WARD: Ron, would you go back to the previous 12 slide. I need a little more explanation of what the numbers 13 are. That's the unavailability of the aux feed system. 14 Given each of those initiating events? 15 MR. FRAHM: Right. The probability of failure on 16 demand, given that event. 17 MR. WARD: How do you explain why it's different 18 for different events? 19 MR. FRAHM: Well, okay. You can have a loss of 20 main feedwater, for instance. You still have your on-site 21 AC. So generally, you would have your electric-driven pumps 22 and your steam-driven pumps. You have a loss of off-site 23 power. Now you're going to have your failures in your 24 system, plus you're going to be relying on a diesel O 25 generator. m ACE-FEDERAL REPORTERS, INC. 202-347 3700 Nationwide Coverage 800-33MM6
i
~2550 06 06 70 1
1 MR. WARD: Or the steam. ( )DAVbw 2 MR. FRAHM: Or the steam-driven. In a loss of 3 all AC, you have failures above, plus you have your hardware 4 failures inm your turbine-driven system. 5 MR. WARD: Do assumptions about recovering come 6 into these numbers? 7 MR. FRAHM: Yes. These have recovery factors; 8 yes. 9 MR. WARD: Those are dependent on the details of 10 the scenario, supposedly. 11 MR. FRAHM: They' re dependent on the details of 01 12 the scenario; they're dependent on how much time is 13 available to recover before dry out. l 14 MR. WARD: Are they dependent on any information 15 for the specific plan about the operator training and 4 , 16 procedures in place at that plant or the design of the 17 control rooms at those plants? 18 MR. FRAHM: In-the PRA, would be on the 611 19 review. I would say they didn' t go in and look at all the 20 procedures. It's more generic. I would say that the 21 recovery factors, if you will, were more under oriented, not 22 specific plant oriented. 23 MR. DAVIS: Ron, one issue that's come up in the 24 past is whether or not these systems can be controlled on 25 loss of DC power as well as loss of AC. ACE-FEDERAL REPORTERS, INC.
. . . - . . _ _ _ 513m?" M*a.w c m_
p35**, _ _ . _ , _ .
2550 06 07 71 1 Is that considered in this evaluation, or that it (])DAVbw 2 considers what to do of all electrical power systems failed? 3 We've heard some utilities claim they could 4 control the system on loss of DC. I don't think some agree 5 with that. 6 MR. FRAHM: Only the turbine-driven should be 7 controlled with DC and have no AC dependency. 8 MR. DAVIS: I understand that, but your battery 9 life is maybe two to four hours, maybe six hours. When do 10 you assume the system fails? 11 MR. FRAHM: I would think you'd lose 12 control; yes. p/ s- 13 . MR. DAVIS: There've been some claims that they 14 can be controlled manually. 15 MR. THADANI: Peter, generally most of the 16 studies assume the system fails, although, as you point out, 17 there is some potential for recovery through manual 18 actions. That typically is not considered in the PRAs. A 19 lot of the plants recently have indicated that the available 20 time is way beyond the two to four hours that you 21 mentioned. 22 MR. MICHELSON: What available time? 23 MR. THADANI: Time before batteries are depleted 24 sufficiently that you cannot perform certain key functions. 25 MR. MICHELSON: There may be other parameters ACE-FEDERAL REPORTERS, INC. l 202-347-3700 _ Narionwide Coverage 800 33MM6
2550 06 08 72 I 1 catching up with you long before the batteries, though. (JDAVbw 2 MR. THADANI: I agree. The room temperature, for 3 example, could be critical. 4 MR. EBERSOLE: I believe Beaver Valley claimed no 5 DC need, although I don' t know what they did for 6 instrumentaiton to determine what they were doing, flying 7 blind. 8 MR. THADANI: These analyses do not include 9 consideration of loss of DC. There are a lot of limitations 10 to these analyses, and they will be discussed later on. 11 MR. EBERSOLE: These numbers here. Is it 12 possible to crudely translate them into the lower ( 13 probability core melt accident, due to this cause? 14 MR. FRAHM: Yes, you could. If losing feedwater 15 leads to the core melt, then you could take initiator 16 frequency and multiple it. 17 MR. EBERSOLE: I know, but it doesn' t always. 18 MR. FRAHM: You have recovery. You have feed and 19 bleed. You have low pressure systems. 20 MR. EBERSOLE: So there's much more probability 21 that these will result in core melt, not much lower. I 22 don't know where it is. Is it a factor of 10 or 1007 23 MR. THADANI: Mr. Ebersole, recently we looked 24 at, I think it was 10 plants. They ranged, in terms of 25 their core melt frequency, from somewhere around 10 to the ACE-FEDERAL REPORTERS, INC. ' 202-347-3700 Nationwide Coverage 800 33W l
2550 06 09 73 1 minus 3 to well below 10 to the minus 4, and I think 10 to ()DAVbw 2 the minus 5. 3 Typically, plants in the range of 10 to the minus 4 3 or 10 to the minus 4 core melt frequency, were those where 5 the aux feed availability was in the low range, which is 6 around 10 to the minus 3 or even somewhat worse, in that 7 they have no feed and bleed capability, or they have 8 questionable feed and bleed capability. 9 The analyses they would assume, no feed and bleed 10 capability. 11 If I recall, 10 plants were looked at. 12 Davis-Desse turned out to be the worst one in the analyses. 13 MR. EBERSOLE: Is this considered to be one of the major contributors to core melt in a PWR7 14l 15 MR. THADANI: Typically, if you look at 16 plant-specific PRAs, this sequence was, I think, about a 10 17 percent contributor. It is lower than most of the PRAs, 18 because certainly no credit was given for feed and bleed. 19 Whereas most of the recent PRAs assumed feed and bleed, 20 because of the training, and so on. 21 MR. EBERSOLE: Right. When they give credit for 22 feed and bleed, do they acknowledge the f act that the bleed 23 mechanism is degenerative and that the PORVs are not l 24 environmentally qualified for the environment they create 25 in the containment. That is, they die in a closed position. ACE-FEDERAL REPORTERS, INC. l 202 347-3700 Nationwide Coverage 800 336-6646 )
2550 06 10 74 ()DAVbw 1 MR. THADANI: PORVs -- environmental effects 2 resulting in closure of the PORV, I don't think is treated. 3 I'm not really quite sure right now that that is the 4 situation. That may be the case. Typically, the fault 5 trees that people have doce indicate about 1 percent chance 6 that the PORV will not open on demand. 7 MR. EBERSOLE: If it does cpen, it creates that 8 environment that hypothetically kills it later and then 9 closes it. 10 MR. THADANI: I guess I'm not aware of the 11 conditions that would cause that. 12 MR. EBERSOLE: Oh, well. The surge tank is 13 blown. Discharge takes place in the containment, and the 14 open secondaries and nonqualified character of the PORV 15 causes it to die. 16 MR. THADANI: That's the part I'm not sure 17 about. 18 .... FRAHM: The surge tank decides to take a 19 certain amount of openings and closings. I think what 20 you're saying is, the structures, then, I would tend to 21 agree with you, about what you're saying. 22 MR. WARD: The surge tank is not capable of 23 removing decay heat. 24 MR. FRAHM: No, but it keeps it contained. O 25 MR. WARD: Not if you're in a real feed and ACE-FEDERAL REPORTERS, INC. 202 347-3700 Nationwide Coverage , 800-336 6646 __ _ ._
2550 06 11 , 75 1 bleed mode. ()DAVbw 2 MR. EBERSOLE: It has to go. It just blows. The 3 diaphram blows. 4 MR. THADANI: That's designed for only 100 5 pounds. I'll blow pretty fast. 6 MR. WARD: You're saying that you don't know 7 whether you agree with Jesse, but that at any rate, 8 apparently the PRAs that are done assume what Jesse says 9 will happen or won't happen. 10 MR. THADANI: That is correct. At least that's 11 my understanding. And whether that's based on looking at 12 specific information or not, I don't know. (} 13 MR. EBERSOLE: Mr. Thadani, how can they 14' legitimately do that? TMI used secondaries to get the heat 15, out. 16 MR. THADANI: I think, Jesse, there is a fair 17 amount of experience. I can't give you the definitive 18 response to that, but I think, unfortunately, we've had a 19 number of instances where the environment in containment has 20 certainly been pretty -- the temperature is hot and people 21 have been able to keep the PORV alive. 22 MR. EBERSOLE: It's got some margin, I guess. 23 The question is, how much. 24 MR. THADANI: A PRA is nothing more than trying J 25 to make judgments. Solid information is not necessarily ACE-FEDERAL REPORTERS, INC. l 202-347-3700 Nationwide Coserage __ _ 80 4 336-6646
2550 06 12 76 1 available on every piece. There's a lot of subjectivity {}DAVbw 2 that goes into these analyses. One has to be careful. Look 3 at results. If you have questions, push, that you can see 4 the common cause failures. 5 It's like any other analysis. It has its 6 limitations. 7 MR. DAVIS: Jesse, it's my impression in the 8 couple of plants I have looked at that the quench tank is 9 located a long way from the PORV. 10 MR. EBERSOLE': It's at the bottom of the 11 building; isn' tit? 12 MR. DAVIS: Yes, and it's a tortuous path for the bx/ 13 steam to get back to the FORV. 14 MR. EBERSOLE: But it's in the nature path and
- 15 going up to where it is.
16 MR. DAVIS: All I'm saying is, it's going to take 17 a while before the PORV sees any adverse environment. 18 DR. CATTON: Sometimes it's a closed room too. 19 If you haven't got any open doorways. 20 MR. EBERSOLE: It could be; yes. 21 (Slide.) 22 MR. FRAHM: The next item is to compare studies 23 with the precursor study. And what the precursor study did 24 was to review LERs to identify and categorize the precursors 25 to potential core damage accidents. The process was, they ACE-FEDERAL REPORTERS, INC. 202-347 3700 Nationwide Coserase 800-336 6646
2550 06 13 77 1 looked at the LERs. They reviewed the accident sequence. ()DAVbw 2 They reviewed the system design and the plant accident 3 analysin to determine which systems are required to function 4 for this precursor. 5 And I believe in the study they reviewed about 6l 8000 LERs in going through this screening criteria. They 7 looked at about 400. They looked at the system design, and 8 then they decided about 60 of them were actual precursors to 9 core melt. 10 The way the process ensued was, you estimated the 11 average frequency and the failure probability for initiating 12 events and function failures. Then the initiating frequency r~ (>) 13 and function failure estimates were used in conjunction with 14 standard event trees to estimate the conditional core damage 15 probability. 16 This conditional probability gave you a 17 benchmark, so you could rank the precursor. You could 18 identify the number of it at the dominant sequences. You 19 could rank the safety functions, and you could estimate the 20 industry average core melt frequency. 21 (Slide.) 22 The results of the study showed that coupling 23 failures are still being observed after the first. There 24 were two studies, one from '69 to '79 and one from '80 to O 25 '81. And these coupling f ailures were primarily caused by ACE-FEDERAL REPORTERS, INC. I 202-347-3700 Nationside Coverage 800-336 6646
2550 06 14 78 O oive- 1 etectric 1 e 1e - 2 In the 1980 to '81 time frame, the number of PWR 3 initiating events and function failures was less than'in the 4 '69 to '79 precursor study. 5 6 7 8 9 10 11 12 0 13
- 14 15 16 17 18 19 20 21 22 23 24 O 25 ACE-FEDERAL REPORTERS, INC.
E 347-)?Q0 Netionwidefoverase Cih0366646 j
l l 2550 07 01 79 1 This was probably due to a multitude of reasons, (])DAV/bc 2 one of them that they considered recovery such as feed and 3 bleed. They removed the strainers from the suctions. They , 4 found you could manually operate the system even though you 5 didn't auto-initiate. , 6 From the study, it was found that the PWR's would , 7 give additional risk reduction from feed and bleed. And on 8 BWR's, it was for long-term cooling. The dominant -- 9 MR. WARD: I don't understand what you mean by l 10 that, " additional risk reduction for BWR's in long-term { 11 cooling". , 12 MR. FRAHN: What's a good way to say it? The 1 r~s A-) 13 events on BWR's are basically transients. For core belt 4 14 scenarios, they are transients with the long-term cooling 15 function failed. On PWR's associated with auxilliary 16 feedwater failures that contribute to risk, you can take
. 1 ; 17 credit for feed and bleed. You reduce that risk. That's- !
l 18 basically it. 19 The dominant sequences on the PWR's that the 20 study-showed were the small LOCA with the recirculation 21 failure. DC bus failure with no restoration. And 22 auxilliary feedwater failure and a loss of feedwater and no
. t 23 feed and bleed capability. ;
24 On a BWR, you had transients. Most transients on O .25 BWR's end up loss of feedwater and you fail long-term core d ACE. FEDERAL REPORTERS, INC.
- 22-347-3700 Nationwide Coverage 800-33H646
2550 07 02 80 1 cooling such as suppression pool cooling, loss of feedwater (()DAV/bc 2 with the high pressure core injection and RC/IC, which is 3 what you were trying to say in the presentation before, was 4 the auxilliary feedwater on the boil and loss of feedwater 5 with the scram and standby liquid control system. 6 The study showed that the unavailability was 7 approximately 10 to the minus 3. And that if you look at 8 the events for the auxilliary feedwater, you find that most 9 of them are recoverable. 10 MR. WARD: What does the 10 to the minus 3 mean? 11 MR. FRAHN: That's the unavailability. 12 MR. WARD: Is that crediting recovery or before O- 13 recovery? 14 MR. THADANI: That is before recovery. If you 15 look at the data, there were X-number of failures and 16 Y-challenges. That's where 10 to the minus 3 comes from. 17 And when you look at the data further, you realize'that a 18 number of those failures corrective action could have been 19 taken and was taken in fact in some cases. 20 That would be the recovery factor one would fold 21 in. INPO qualified that, qualified that in that their l 1 22 average came out 2 times 10 to the minus 4. There would I I 23 have been individual failures that have occurred and
. 24 . concluded, I think, that with the exceptions of one or two A 'J 25 failures that there was a likelihood of successful recovery.
ACE FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-33 6 6646
2550 07 03 81 1 I estimate that if we had done it the way INPO ['s)DAV/bc u 2 did, we probably would have been on the safe borders. What 3 we did instead was we looked at individual values 4 separately. 5 MR. EBOERSOLE: So you pick up about a factor of 6 10. 7 MR. THADANI: I think it varies. If you look at 8 historical data, you probably get a f actor of about 5 to 10, 9 but if you look at PRA's, they'll tell you a f actor of 2 to 10 10, in some cases, more. But, generally, a factor of 2 to 11 10. 12 Typically, you find for B&W designs, you get less ( 13 of a recovery factor than you do for other designs. But 14 it's in that range, I think. 15 MR. EBOERSOLE: Now, consistent with the demand 16 frequency, what does that come out in the way of -- 17 MR. FRAHN: Core melts? 18 MR. EBOERSOLE: Yes. 19 MR. FRAHN: I would estimate the '80 to '81 20 timeframe. It would have been 2 times 10 to the minus 4; 21 for the '69 to '79, it would have been about 2 times 10 to 22 the minus 3. 23 MR. THADANI: Those estimates, I think, let's be 24 very careful. What Ron is telling you is the '69 to '79 25 overall core melt frequency in the precurser study, that ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336-6646
2550 07 04 82 1 does not relate to this scenario only. In the precurser (~)SDAV/bc 2 study, a number of other events occurred, as you know, in 3 the '69 '79 period. 4 If you look at this issue with the recovery, I 5 would expect it would be certainly substantially below 10 to 6 the minus 4, and may in fact be below 10 to the minus 5. 7 MR. WARD: Now, if I go back and take it face 8 value, the data that Mr. Dennig presented earlier this 9 afternoon, those numbers from 1984 are substantially 10 different. That would indicate unavailabilities much higher 11 than 10 to the minus 4. How do you explain that? 12 MR. FRAHN: I don't think so. I think the number ( 13 of demands that we had in the time period, I would say about 14 6,000, is probably about the same thing that Mr. Dennig had 15 for his year, his 1984 year. I think it's the same. 16 MR. WARD: No, he showed one failure in about 130 17 demands. 18 MR. FRAHN: And we're showing maybe six failures 19 in 5,000 demands. 20 MR. MICHELSON: Where do you get your numbers for 21 demand, as 5,000 or 6,000 or whatever? 22 MR. THADANI: I think that, typically, in these 23 reliability studies, an assumption is made in terms of 24 monthly testing. There's another assumption made that the b_-) s 25 tests are perfect, that if you have a fault, that's ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336-6M6
2550 07 05 83 1 identified, that fault. (])DAv/bc 2 Another assumption in these studies, if that were 3 in f act the case, certainly these symptoms are tested on a 4 mnothly basis -- I think they are. And you have real 5 challenges and you have tests. And if you pool that data and 6 look at the experience. 7 And we haven't done that for '84. This is the 8 first I've heard of '84 experience. We're sort of behind 9 time, I guess. I'm not convinced that you come up with 10 significantly different estimates. 11 MR. WARD: We just saw some numbers. We.saw 130 12 demands and one failure. 13 MR. THADANI: But, as I pointed out, the real 14 demands, the number may be much larger than 130. 15 MR. WARD: If you include testing. But let's say 16 I want to throw out testing, I don' t really care. 17 MR. THADANI: Let's make another assumption. 18 Sure, if you tell me,'then, obviously, I could say my tests 19 do nothing for me. That's possible. Then you would be 20 correct. One failure, 130 demands would be absolutely 21 correct. 22 What I'm saying, what's done in these 23 calculations, credit is given for testing. It is assumed 24 the tests will detect faults.
- 25 MR. WARD
- Once you get a body of operating i
ACE-FEDERAL REPORTERS, INC.
. , _ . _ . . _ 202 _347-3700 Nationwide Coverage 800-336-6646
2550-07 84 1 experience that's sufficiently large, it seems to me that (])DAV/bc 2 that's what you ought to use in the PRA rather than 3 testing. It's certainly preferable. It's certainly more 4 applicable. 5 MR. THADANI: If the precurser experience, '69 6 through '79, had been significantly different from what it 7 was, I would completely agree with what you say. It would 8 have certainly raised our consciousness, I would say, if 9 they would come in with 10 to the minus 1 to 10 to the minus 10 2. We would have known there must be something seriously 11 wrong with what we were doing. 12 MR. WARD: I guess what I'm saying is that maybe 13 we ought to be alarmed by the 1984 data. 14 MR. DAVIS: It's hard to draw any statistical 15 significance with one failure out of 130. I wouldn't be 16 alarmed with that data just by itself. You know, if you had 17 1,000 tests and 10 failures, then you start to get 18 statistically significant numbers. , 19 Is the only failure we're talking about the 20 Trojan one? Which wasn' t really a f ailure because they had 21 the third train to operate it. And, in fact, that train is 22 now in operation and has been for some years. 23 So you really can' t call that a failure. And, in 24 fact, I wouldn't.
-- 25 MR. EDISON: Dave, I'm told in the Trojan case ACE-FEDERAL REPORTERS, INC.
202-347 3700 Nationwide Coverage 800-336-6646
2550 07 07 85 1 that even the trains that were not immediately available (~)TDAV/bc 2 were made available before steam generator dryout. So the 3 operator action was there. 4 In fact, I'm not aware -- I can't really think -- 5 of all the events I've ever looked at in the PRA data so 6 far, I can't think of a case where an entire aux feed system 7 failed and the operators couldn't get it back in time. 8 , MR. WARD: It's a good thing because you ought to 9 have it at least once in 10,000 years. 10 MR. EDISON: In every case I can think of where 11 the whole system went down, the operators were able to get 12 it back. And I kind of think that the credit taken for (~') \- 13 operator actions is probably understated. I think the 14 operators, there's a much higher probability that they will 15 recover an auxilliary feedwater system. 16 MR. WARD: They sure did at Davis-Besse. 17 MR. EDISON: That's right, and they had a very 18 difficult situation to work with. 19 MR. THADANI: I think, while Gordon may well be 20 correct on that point, I think we ought to point out that 21 this 1 in 10,000, it really can' t be a hard estimate. Just 22 keep in mind the number of things that are not considered in 23 the analyses from the point of the large uncertainties just 24 in the data base. External events, fires, floods are not h ! (~J N 25 included in the analysis, i ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336-6646
_2550 07_08 86 1 We have not been able to do a good job of {}DAV/bc 2 qualifying common cause failures. We may be underestimating 3 the unreliability of the system. 4 Gordon is correct that the recovery factors in 5 fact may be larger. But it was for that purpose that we're 6 always talking in terms of ranges. We think we're somewhere 7 near, but not necessarily 1 in 10,000. It's important to me 8 that we do keep that in mind. We're not really convinced 9 that a system comes through with an analysis done for these 10 techniques with the data base we suggest. But, in fact, 11 that is where that system is. 12 The real issue was to identify vulnerabilities 13 through this approach. If you recall the review process, 14 there's two elements in it -- the so-called deterministic 15 review process, and then there's the reliability 16 asse ssn.e nt. , 17 The two together, I think, ought to give people 18 some confidence on this experience. 19 MR. MICHELSON: A little earlier, you talked 20 about 6,000 demands. How did you arrive at 6,00 demands? I 21 assume, per year on auxilliary feedwater. You included all 22 the tests, admittedly. How do you arrive at 6,000? Or, did 23 I misunderstand what you said? 24 MR. WARD: That was in 10 years. : L'3 J 25 MR. MICHELSON: Oh, that was over 10 years. ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336-6646
2550 07 09 87 1 MR. FRAHN: It was a 10-year period. f)DAV/bc 2 MR. MICHELSON: It's still a rather large number, 3 but a little more imaginable. Okay, that was for the 10 4 years. Is that correct? 5 MR. FRAHN: Actually, it was '69 to '81 and 6 includes tests -- 7' MR. MICHELSON: Over that entire period of time 8 there were 6,000 demands. Okay. 9 That's a little more realistic. 10 MR. THADANI: If you just look at the '84 11 experience, 130 plus I would say about another 500 or so to 12 test. It can't be much above a thousand. That probably 13 would'be the maximum. 14 MR. MICHELNON: Yes, for that year. 15 MR. WARD: Okay, let's see. You explained away 16 the system failure at Trojan in 1984. What was the one in 17 the B&W plant? That was allegedly one system failure? Was 18 that Oconee? Is Mr. Dennig still here? 19 MR. WARMIEL: He knew we were coming after him. 20 (Laughter.) 21 MR. WARD: Does anybody remember what that was? 22 MR. FRAHN: I have one listed on the precurser 23 study in 1977 on Davis-Besse. 24 MR. WARD: No, this was his report on '84 25 operating problems. , 1 ACE-FEDERAL REPORTERS, INC. l 202-347-3700 Nationwide Coverage 800-336-6646 l
2550 07 10 88 an ea^a"= ' ao# e aeve it-O o^v/ec 1 2 MR. WARD: He showed one system failure on demand 3 in the B&W design. 4 MR. FRAHN: Jerry, do you know that? 5 MR. WARMIEL: All I can remember, Mr. Ward, was 6 that Bob said something about some valves not working and 7 the operators have to recover the system. I don't remember
- the specifics of what the scenario was.
8 9 MR. WARD: Okay, thank you very much. 10 MR. FRAHN: Let me make a comment. In the agenda 11 for Karl Fleming, there's a staff presentation. That's from 12 the NRR staff. If you want to make that correction -- not (~)
'> 13 PL&G. On the staff comment on Fleming's paper, it's not 14 me.
15 MR. WARD: All right. Mr. Fleming. 16 (Slide.) 17 MR. FLEMING: Good afternoon. My name is Karl 18 Fleming, Senior Consultant with Pickard, Lowe and Garrick. 19 As I understand it, at some previous ACRS meetings there 20 was some interest and possibly some controversy associated 21 with the paper that I presented in Brussells last August. 22 I've been asked to come and kind of give this presentation 23 again with the objective of trying to promote the greater 24 understanding of the influence of common cause events as O 25 they affect aux feedwater system reliability, possibly to ACE-FEDERAL REPORTERS, INC. 202-347-3700.. Nationwide Covergp . 800-336-6646
2550 07 11 89 1 try and clarify what I think are some misconceptions about ()DAV/bc-2 that subject, which I've heard a lot of comments made 3 today. 4 (Slide.) 5 Briefly, what I chose to talk about here to 6 follow on with the paper is to first go over some common 7 cause analysis procedures that are being developed in a 8 project sponsored by the Electric Power Research Institute. 9 This project is aimed at trying to eliminate some of the 10 confusion and inconsistency that you will find if you 11 examine some of the recently published PRA's, which range in 12 treatment of common cause to no inclusion of those events fh 13
~
whatsoever to some kind of comprehensive coverage. 14 And to the extent that this subject has a great 15 influence on the results of PRA, I think it also has a big 16 influence on the decision-making regarding the use of i 17 redundancy and diversity as a means of achieving high 18 reliability. 19 So I'd like to go over some of the procedures 20 we've come up with for how we recommend PRA's should be i 21 included in these events. And that, in the Brussells paper, 22 we happened to pick a very typical three-train auxilliary 23 feedwater system, very typical of some of the Westinghouse 24 plants, and we performed a rather comprehensive but generic 1 25 analysis of that three-train system. ACE-FEDERAL REPORTERS, INC.
.. . _ ____ 202 347-3700 _ _ _ _ , Nationwide Coverage __ ____ _ _ 800 336-6646 _ _ _ ,___,
. . . - . -- .~ . . - . ._ .
1 2550 07 12 90 1 Since it included a complete examination of the (])DAV/bc
'2 data base to the extent that we are capable of doing that, 3 we were able to draw some conclusions and add some insights
- 4 about the roll of common cause events-and the impact they 5 have on the numerical values of system reliability.
6 We also thought it would be appropriate to take a 7 new look at some of the old issues, like the role of 8 redundancy and diversity in system design. 9 And I think the conclusions we reached in that 10 paper along those lines may require a little bit of 11 clarification.- i 12 Following that, I've been asked to comment on 13 what's happening over in the European area in this , 14 particular. area. I'm not an expert on European design of 15- auxilliary feedwater systems, but I have been associated 16 with a benchmark exercise that 10 teams from Europe and the 17 U.S. are analyzing a German four-train auxilliary feedwater
~
18 system. I have some preliminary results to discuss with you 19 which may have some bearing on some of these points.
-20 That's kind of the outline of my talk. If that's 21 acceptable, I'll just proceed.
i 22 23 24 l 25 } ACE-FEDERAL REPORTERS, INC. 202 347-3700 Nationwide Coverage 800 336 66 4
2550 08 01 91 1 (Slide.) O)DAVbur \_ 2 I have been working on dependent events for about 3 10 years. A lot of people ask me how I can stay interested 4 in such an esoteric subject ter such a long time. 5 I think the thing that kind of motivates me to 6 continue working in this area is it seems to me that the 7 industry has been asking me to accept -- and I am talking 8 about the industry, the regulators, everybody -- the whole 9 ball of wax has been asking me to accept two mutually 10 exclusive propositions. 11 The first is they seem to be saying, well, we 12 don't know how to define it, to model it, to quantify it, or 13 'to know what causes it. I am talking about common cause 14 failures here. 15 But despite that lack of consensus on those 16 points on how to do those things, there seems to be a warm 17 feeling that we know how to defend against it. I think we 18 are making a lot of progress in taking care of Proposition 19 A, but I don't think we have reached the situation with 20 Proposition B. That was the purpose of our paper, to try to 21 promote that kind of understanding. 22 MR. EBERSOLE: May I ask a question at this time? 23 I know a gentleman who says that unless you know A you don' t 24 possibly know B.
' 25 MR. FLEMING: That is right. That is the point ACE FEDERAL REPORTERS, INC.
202-347-3700 Nationwide Coverage 800 336-6646
2550 08 02 92
, 1 I am trying to make.
}DAVbur 2 MR. EBERSOLE: The next thing is: what is this 3 thing called diversity unless you know what unity you have 4 diverged from?
5 MR. FLEMING: I hope to provide a workable 6 definition of that in my talk. 7 The point I am trying to make is that I want to 8 try to negate Proposition A here so we can get on with 9 Proposition B because obviously they are mutually 10 exclusive. - 11 (Slide.) 12 In our curren: efforts we are looking at a
' 13 dependent events analysit in the broad sense, and we are 14 looking at two different levels, the plant level, where we 15 concern ourselves with earthquakes, fires, floods, 16 intersystem dependencies and things like that, and the 17 system level, where we are looking at what had been 18 variously referred to as common cause events, common mode 19 faults.
20 In coming up with system level procedures, we 21 went back and basically listed the procedures of the PRA 22 systems analysis and tried to identify the key points in l 23 that analysis that are very important for a common cause 1 24 analysis. l 25 What you will see here is a fairly well-known i ACE-FEDERAL REPORTERS, INC. 202 347 3700 Nationwide Coverage 800-336-6646
2550 08 03 93 1 1 approach, a very systematic approach to a systems analysis. (])DAVbur 2 You have to start off by knowing something about the system 3 you are analyzing, and while that may seem somewhat obvious, 4 the failure to address that point has been the basis for 4 5 some unsuccessful reliability evaluations. 6 Then there is the logic model development. Then 7 there's certain logic model techniques -- fault trees seem 8 to be very popular -- reliability analysis, goal, methods. 9 After the logic model has been developed, most of 10 the procedures required some kind of Boolean analysis to be 11 done, followed by the development of an algebraic model to 12 get the probability number, then some effort to estimate the ( 13 parameters, look at the data base, get the parameters 14 estimated, propagate those parameters through the system 15 model, and come up with a system quantification, and then 16 try to interpret the results. 17 One of the somewhat surprising things we found 18 out in our work on dependent events procedures was that 19 every single one of these steps has critical facets that are 20 very important for competent common cause analysis. This is 21 in contrast with a lot of the common cause analyses that 22 have been published thus f ar, which tend to go in at Step 4, 23 no earlier Step 4, to introduce some different algebraic 24 formulas to calculate the reliability in light of common 25 cause failures. 4 ACE-FEDERAL REPORTERS, INC. 202 347-3700 Nationwide Coverase 2 336 4646
2550 08 04 94 1 What we found is that there are some pitfalls in {)DAVbur 2 doing this. Those pitfalls have resulted in some under and 3 over accounting of system failure modes. 4 I would like to illustrate some of those points 5 in the next sequence of slides. 6 (Slide.) 7 The system that we decide to use as an example is 8 a very typical three-train system. It has two motor driven 9 pumps, a turbine driven pump, and to make this problem 10 challenging for the system reliability analyst we used a 11 rather conservative set of success criteria, in that we 12 required flow to at least two out of the four steam O() 13 generators. So the success criteria we chose for our 14 analysis was flow from any one of the three pumps and into 15 at least two of the four steam generators from any of those 16 configurations. 17 of course, success also required adequate supply 18 of water from the supply tank and a common suction valve. 19 That was the basic example system that we looked 20 at. 21 Because we are looking at system level 22 procedures, we are going to concern ourselves with what was 23 described in the last presentation as a loss of main 24 feedwater event or, stated another way, an event where all ( 25 the boundary conditions, all the support systems are assumed ACE FEDERAL REPORTERS, INC. 202-347 3700 Nationwide Coverage 80 4336-6646
2550 08 05 95 1 to be available. ('}DAVbur 2 MR. DA IS: Excuse me a second. This is a minor 3 point. 4 In your ; per you assumed those four discharge 5 valves were normally ?osed, is that right? 6 MR. FLEMING: That is right. 7 MR. DAVIS: The normal valve convention could be 8 blacked in on these? 9 MR. FLEMING: That is right. These are normally 10 closed valves on the analysis. That also coincides with the 11 design of some of the plants. 12 MR. DAVIS: Some but not all? O (._) 13 MR. FLEMING: That is right. And of course some 14 of the plants also use different types of valves. 15 So the next step is to construct your reliability 16 model. 17 (Slide.) 18 one can use fault trees, reliability block 19 diagrams. I chose reliability block diagrams here because 20 you can visualize the system logic more conveniently than 21 you could in a fault tree. But they are basically 22 equivalent. 23 MR. EBERSOLE: May I ask a question here? 24 I notice you use the models there that had a O)
\- 25 single source, the tank and a pipe?
ACE FEDERAL REPORTERS, INC. 202 347 3700 Nationwide Coverage 800 336-6646
\
2550 08 06 96 1 MR. FLEMING: Right. ()DAVbur 2 MR. EBERSOLE: I know in the seismic challenge 3 case you can always argue that if you do it well with one 4 pipe it is probably better off with two. 5 What is your rationale? 6 MR. FLEMING: I just selected this particular 7 example system. In some of the permutations on this that I 8 am going to get into later on, I am going to investigate the 9 effect of having separate water supplies. 10 MR. EBERSOLE: See, that is the subject of the 11 old overall syndrome. You know, it was dropped into the 12 water tank. 13 MR. FLEMING: Right. Well, the analysis I am 14 going to do first is going to assume that we require a 15 condensation tank. I am going to discuss the implications l l 16 of having separate water supplies, which is a very important 17 point. 18 In a common cause analysis, what is important to 19 this stuff is that we have to make some decisions about what 20 kinds of groups of components we are going to admit to a 21 common cause model. This is a very critical assumption that 22 can't be avoided because there is simply no general way to 23 even write down all the combinations of components that 24 could be involved in the common cause event. There's too 25 many components. We have to use insights from the ACE-FEDERAL REPORTERS, INC. 202 347 3700 Nationwide Coverase 80 4 336-6646
Q 0 08 07 97 k/ 1 DAVbur 1 operational data and physical arguments to decide which 2 groups of components we are going to group together. 3 In looking at that for the pumps, we noted that 4 in most of these designs, while we have diverse drives, the 5 pumps are nominally very similar. So in this analysis we 6 are treating all three pumps, the mechanical part of the 7 pump, as identical and subject to common cause events of all 8 combinations. We are separating the motor drives so we can 9 give credit to the diversity only at the driver level of the 10 pump. 11 DR. CATTON: But the mechanical part of the pump A () 12 is usually reliable? 13 MR. FLEMING: And we are going to reflect that by 14 assigning appropriate failure rates which reflect that 15 reliability. 16 The issue here is really component diversity. We 17 felt it would be inappropriate to give full credit for 18 diversity across the entire pump. 19 DR. CATTON: I just wonder how I would have 20 diversity of power. 21 MR. FLEMING: Maybe you can't achieve that, but 22 the subject here is to try to the model the system the way 23 it really is. So we modeled the drives and pumps , 24 separately. 25 DR. CATTON: So when you model the pumps, what do ACE-FEDERAL REPORTERS, INC, 202 347 3700 Nationwide Coverase 800 336-6646
2550 08 08 98 1 you include as failures? (U~)DAVbur 2 MR. PLEMING: Failures of the mechanical pumps. 3 The packing is put in too tightly around the pump. The 4 bolts are loose on the pump. Things like that. 5 DR. CATTON: Loose bolts wouldn't be loose bolts 6 on another. 7 MR. FLEMING: We will let the data tell that for 8 us that we find -- and we have in fact found motor operated 9 valves -- we have found loose bolts on multiple valves at 10 the same time. 11 The whole philosophy, by the way, of this 12 particular approach is that we are going to do the best job (n_) 13 we can of pulling in all the data that we are seeing into 14 the PRA model. 15 The problem of past PRAs is that the common cause 16 events didn't fit the models. The mo ? ale didn' t allow for 17 yeommon cause events, and therefore there was no way to fit 18 them in, no real logical way. 19 What we are going to talk about here is how to 20 extend the model a little bit so all the common cause events 21 fit. 22 MR. EBERSOLE: What do you do about the mechanic 23 who thinks he is told to tighten all the seals at one point 24 in time and he goes and tightens them all too tight? Do you O) (_ 25 invoke a time spread of maintenance in this system? ACE-FEDERAL REPORTERS, INC. 202-347 3700 Nationwide coverase 800 33MM6
]
, 2550-08 09 99 1 You remember the whole thing on the airplane that
.()DAVbur l- 2 took off to Nassau.
3 MR. FLEMING: We would classify that as a common 4 cause event. 5 MR. EBERSOLE: Do you put up a protective 6 mechanism against it to preclude his touching but one pump 7 at a time per week? l 8 MR. FLEMING: ' I definitely will get into that,
- 9 but I would like to first start out by trying to get a l
10 handle on what is out there. Then we will talk about L 11 defenses. 12 MR. EBERSOLE: All right. 13 MR. FLEMING: To summarize, the grouping
~
F 14 assumptions were made here. The two -- four valves are 15 identical and subject to common cause modeling, the two 16 motor drives and the three pkumps. We will not consider l 17 common cause events, looking at, let's say, a valve and a 18 pump. We are just not going to admit those into our movel, 19 and we have fairly good insights from the data base to 20 justify that assumption. l 21 (Slide.) 22 Now, if you are going to address things like how 23 effective is redundancy as a defense against common cause 24 failures -- in other words, can you put enough redundancy in 25 just to overcome the problem -- the model has to be able to ACE. FEDERAL REPORTERS, INC. 202 347-3700 Nationwide Coverage 800 336 MW6 L
2550 08 10 100 F'SDAVbur 1 distinguish between different kinds of common cause events, V 2 of different severities. 3 There was a very simple model invented about 10 4 years ago called the beta f actor model, which basically said 5 .that you either had a common cause event or you didn't and 6 if you did have one, you modeled it as affecting all the 7 components in that group. That model doesn't allow you to 8 investigate this question: what is the impact of u 9 redundancy? 10 We found that in order to address questions like 11 that one has to go back into the fault trees. This happens 12 to be a fault tree for one of the valves, one of the four
) . 13 valves in the group, and considered not only the independent 14 failure, which is normally considered in a standard 15 noncommon cause analysis, but basically identified all the 16 different combinations of events that involve the common 17 cause failure of either two, three, or all four valves.
18 Now, because of the fact that each of these 19 common cause events shows up in other portions of the tree, 20 these common cause events actually complicate the Boolean 21 analysis, and this is the point that has not been emphasized 22 very much in previous work. 23 (Slide.) 24 To give you an idea of what the impact of that 25 is, if you are just doing an independent events analysis on ACE-FEDERAL REPORTERS, INC. 202 347 3700 Nationwide Coverage 800 336-M16
1 l 2550 08 11 101 1 the system it will have 29 cutsets. {}DAVbur 2 As indicated on this slide, you have a single 3 order cutset, your common suction path, your tank, and you 4 have a whole bunch of third order cutsets reflecting the 5 high degree of reliability of the systems, one out of the 6 three systems. It is not surprising that you end up with 7 primarily third order cutsets. You have all the 8 combinations of motors, motor and turbine drivers, and two 9 pumps and valve combinations, and so on. 10 When you go back in and put your common cause 11 events in the model -- 12 (slide.) () 13 -- you find there is a proliferation of cutsets. , 14 on the left side of this column I have organized 15 the 29 cutsets that come out of the independent events 16 analysis, and I have this whole proliferation of cutsets 17 involved in all the dependent events introduced in the 18 model. 19 If one doesn't go back and put these events into 20 the fault trees -- and just about all fault tree analyses 21 have not done this -- then this kind of analysis has to be 22 done in your head when you are writing down the formulas, 23 and we found from our practical experiences it is very 24 difficult for the most clever, well-trained applied n k_) 25 probability people to be able to avoid missing cutsets and ACE FEDERAL REPORTERS, INC. 202 347 3700 Nationwide Coverase 800 336 4646
2550 08 12 102 f')DAVbur 1 double counting cutsets unless they go through this kind of v 2 approach. 3 MR. WARD: Karl, even this 100, I guess -- the l 4 way you set the problem up, you have eliminated, I guess, a 5 lot of possible cutsets? 6 MR. FLEMING: These are the minimal cutsets. 7 These are the ones you would look to if you wanted to 8 estimate the system unavailability by summing the cutset 9 unavailabilities, which is, you know, the usual or proximate 10 approach that is used. 11 MR. WARD: I mean, you have got an example here 12 going from 29 to 100, but the way you set this problem up t> (_) 13 you didn' t admit certain common cause interactions. 14 MR. FLEMING: And that would have driven the 15 l number of cutsets up even higher if I had admitted those. 16 Now, we have done some notation here to keep them straight 17 because in independent events analyses all the cutsets 18 involve combinations of components. 19 Now, we are talking about combinations of common 20 cause events, any of which can fail, combinations of 21 components in and of itself. So we introduced this 22 superscript-subscript approach. 23 The subscript indicates you are talking about a 24 i single cause here, 4V-sub-3, four cutsets involving a single O)
\- 25 cause affecting three valves.
ACE FEDERAL REPORTERS, INC. 202-347 3700 Nationwide Coverage 800 336 6646
2550 08 13 103 DAVbur 1 Then the experiments just are a shorthand 2 notation for a second order cutset, 15V-2, to the second 3 power, 15 cutsets, each involving two causes, each affecting 4 two valves themselves. 5 This is the kind of complexity you get into when 6 you want to address these prob 1 ems, but since operating 7 experience -- and the results I am going to show you -- 8 indicate that these kind of events dominate the results, 9 there is no excuse now to introduce this complexity into the 10 model. It doesn't make sense to do a rigorous analysis of 11 independent events and slap on a 10 percent beta factor and 12 call that a final result. O 13 14 15 16 17 18 19 20 21 22 23 24 25 ACE. FEDERAL REPORTERS, INC. 202 347 3700 Nationwide Coverase 800 336-6646
2550 09 01 104 1 MR. EBERSOLE: Would you go through what you said {}DAVbw 2 about the 4V3. 3 MR. FLEMING: Four cut sets, each involving a 4 common cause event that takes up three valves. Okay? 5 It's a companion to this guy over here. Here's 6 three of the cut sets, each wiping out a single valve. Each 7 cause affecting a single valve, and you have to combine 8 three of them to get the end result. 9 Here's a common cause. One of its common cause 10 companions. You can have a common cause event and wipe out 11 all three. These are four single order cut sets. There are 12 also combinations where a common cause can take out two
) 13 valves,.and an independent cause can combine with the two, 14 affect another valve. So 12V2, V1, for example, means 12 15 cut sets, each involving two causes. One cause takes up two 16 valves, the other cause takes out one valve.
17 So this is sort of an unavoidable complexity you 18 have to get into when you're talking about this 19 quasi-general common cause model. 20 The reason I've bringing this point out is, if 21 this step isn't at least conceptually performed in an 22 analysis, then the reviewer should be suspicious that the 23 Boolean bookkeeping didn't add up properly. 24 I would venture to say that if you haven' t gone 25 through this kind of a process, chances are very high for ACE. FEDERAL REPORTERS, INC. ; 202 347 3700 Nationwide Coverage 800 336-M46 i
2550 09 02 105 7' 1 problems. C}DAVbw 2 MR. DAVIS: Pardon me. I have a question on 3 that. I heard what you're saying, and I think I agree with 4 you; however, when I look at the results, and maybe I'm 5 getting ahead, over 90 percent of the unreliability of the 6 system is dominated by the first two common cause failures, 7 which you would, just by looking at the system, by 8 inspection, you would be suspicious those would be the 9 problems. 10 In other words, these cause terms don't really 11 contribute to the failure of the system. 12 MR. FLEMING: I'm going to let that be a result () 13 rather than an a priori assumption. My problem is that in 14 previous models, that kind of thinking was built in as an a 15 priori assumption. I'm going to let the results tell me 16 that. 17 Also, I'd like to be able to have a model general 18 enough, so that when I get into defenses and try to whittle 19 these problems down, that the model can tell me what my 20 benefits are. 21 So I agree with what you're saying, but I just , 22 want to keep -- 23 MR. DAVIS: Your case would have been better 24 made, if you'd picked a system where the top two weren't () 25 over 90 percent of the contribution, it seems to me. i ACE. FEDERAL REPORTERS, INC. 202 347 3700 Nationwide Coverase 800-336 6646
2550 09.03 106 1 MR. FLEMING: I think that happens to be the
}DAVbw 2 results of one particular systems analysis,.and I hate to 5
3 try to generalize that to all cases. 4 MR. DAVIS: Thank you. 5 MR. FLEMING: This is a procedure we apply to all 6 the system, not just to aux feed. 7 (Slide.) 8 The other thing that we're trying to get rid of, 9 and I've heard a lot of comments made this morning, there's 10 a lot of suspicion that PRAs aren't accounting for what's 11 been happening in the experience base. I think-there's an 12 element of truth to that.- The procedures that we're ( 13 recommending ask for as thorough a job as possible to be 14 done to evaluate each event in the data base, common cause 15 or-independent on an event-by-event basis, especially if it 16 happens to be common cause events. And carefully think 17 about the impact of each event on his model. 18 When we do that, for example, this happens to be 19 an event at point B. This was one of those strainer 20 problems that affected one pump, and when they went in, 21 checked the situation with the other strainers. According 22 to the report, there were similar strainers in three other 23 pumps. 24 In fact, these were not even on the same unit.
) 25 There were two units involved here. We made use of a
, ACE FEDERAL REPORTERS, INC.
202 347 3700 Nationwide Covernee 800 33H646 -
. - . _= -_ _ . . _ _ _ _ _ - . '2550 09 04 107 4
I classification system which was developed by another
.()DAVbw 2 contractor for EPRI, very similar to a system that's been l 3 developed from NRC programs, although not identical, trying 4 to map out the relationships between the causes and the 5 impacts of those causes on components.
6 DR. CATTON: So you can consider the strainer 7 part of the pump. 8 MR. FLEMING: That's right. It just reflects the 9 ,, level of detail at which I decided to develop my reliability 10 model. One could opt to identify that as a separate 11 component, and that would be fine, but based on the way we 12 modeled the system, the key is to make the data analysis 13 compatible with the assumptions being modeled. 14 DR. CATTON: I thin I would have made the 15 strainer separate. 16 MR. FLEMING: It's common in most of the PRAs, I 17 think, to include that as pumps, but that's an arbitrary 18 decision. 19 MR. DAVIS: The problem with including the 20 strainer is that some systems don't have strainers as part i 21 of the pump.
, 22 MR. FLEMING: That's not my problem, because this 23 procedure requires the analyst to think about the 24 applicability of each event to a system. That's what this 25 example was intended to show.
ACE FEDERAL REPORTERS, INC. 202 347 3700 Nationwide Coverage 800 336 6646
2550 09 05 108 1 First of all, there was another point here I was {}DAVbw 2 trying to show. Data is not black and white, you know. The 3 classifical statistical people will tell you, well, we'll 4 -wait until we have enough data, and it's all going to be 5 done by statistics. 6 Well, I think, as you know, it's very difficult 7 to interpret what happened at the event, from an event 8 report. It was not clear in this case whether all four 9 pumps had, in fact, failed. It wasn't clear that they had 10 not all failed. We have to treat this fuzziness in our 11 data. The way we do this is rather than force this fuzzy 12 event into a black and white categorization scheme, we () 13 assign, you know, we incorporate the fuzziness into our 14 analysis, by basically identifying an impact vector 15 associated with that event and estimating subjectively based 16 on all the information we have, the probability that that 17 event affect how many different components. 18 So that for the Point Beach plant in this kind of 19 a situation, we would say there's a 90 percent chance, based 20 on our judgment that this event affected one and only one 21 pump. The other ones are just in a potential state. There 22 is a 10 percent chance that it affected all four. One 23 interpretation is that if such an event happened ten times, 24 on the average, we might expect on one of these events, it n (_) 25 to affect all four. This event is telling us something. ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336 4 646
2550 09 06 109 1 We don't want to pretend like we only affected
}DAVbw 2 one.
3 That's one aspect of this procedure. The other 4 aspect is, that if you know that your plant doesn't have 5 strainers or it took out its strainers, and you have 6 confirmed that in your analysis, then you can throw the 7 event out as not being applicable. 8 That's, I think, a legitimate judgment of 9 screening for data that must be taken into account. 10 We've also classified this data to be compatible 11 with this binomial failure rate by Bill Masley and Corey 12 Atwood. That's one of the things I address in the paper in () 13 a few seconds. 14 We've done that for each of these sets of 15 components in our analysis. 16 (Slide.) 17 This just happens to be the first page of the 18 data we found for auxiliary feedwater pumps. What we do 19 here is that we, first, after summarizing the event, we 20 apply our impact vector, based on our understanding of what 21 happened at that plant. Then we come up with a different 22 impact vector for the plant we're doing the analysis of. 23 This happens to be -- this is not the same 24 analysis that was done for the Brussels paper, but the ( 25 Brussels paper has its own data in there. I didn't happen ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336-6646
- - . - ~
2550 09 07 110 1 to have a slide for that. (])DAVbw 2 This happens to be for the four-train European 3 system that we're going to tell you about later on. 4 MR. WARD: Carl, these impact vectors are 5 ju'dgment numbers? 6 MR. FLEMING: In many cases, it's just a question 7 of mapping, you know, the event into the model. For 8 example, at Zion, it was known that this event affected two 9 pumps, and if we were doing an analysis of Zion, the impact 10 vector would reflect that. i 11 MR. WARD: So if it's 0 or 1, it's pretty clear, 12 but when it's .9 -- i 13 MR. FLEMING: That basically reflects uncertainty 14 or the knowledge of the analyst. It just reflects the fact 15 that a deterministic resolution of what happened could not 16 be made. There's three sort of conditions that give rise to 17 this.- One is, the report wasn't clear on what happened. 18 That's pretty common. The second one was, the components, 19 we modeled them in PRA as being successful or fail. We 20 observe some intermediate states. 21 One is called degraded, one means incipient. 22 Degraded means there's a noticeable reduction in the 23 performance. 24 MR. WARD: For that type of thing, you could 25 refine the model, theoretically, I guess., ACE-FEDERAL REPORTERS, INC. ) 202-347-3700 Nationwide Coverage 800-336-6646 _
I 2550 09 08 111 DAVbw 1 MR. FLEMING: Right. So in each of those three 2 situations, these numbers are non0, 1, nonbinary. They 1 3 reflect the judgment of the analysis team which, by the 93;', 4 is a judgment that has to be made anyway. 5 It's just that we're going with numbers. If we 6 didn't do it with numbers, it would be varied by either its 7 inclusion or exclusion of the analysis in some innocuous 8 way, a seemingly innocuous way. 9 The upshot here -- I don't want to get bogged 10 down in the details, but as far as the common cause events 11 are concerned, there's few enough events that the analyst 12 should be able to devote a few percent of his resources to () 13 do a careful event-by-event evaluation and interpret that 14 event on how it impacts his model. 15 This is the way we have chosen to do it. 16 There are questions that have to be addressed 17 anyway. 18 (Slide.) 19 This happens to be the second page of the data. 20 We were able to find 10 events in a data search that roughly 21 included 10 years of data in the 1970s, ending at about 22 1981. We found, looking through, basically, LERs, an 23 LER-based system called nuclear power experience. 24 We found 10 events involving multiple problems in () 25 the emergency feedwater system. This was just for the l l ACE-FEDERAL REPORTERS, INC.
2550 09 09 112 1 emergency feedwater pumps. {}DAVbw 2 We also looked at data for valves, diesel 3 generators, and so on, and all the data that is relevant to 4 this analysis has been followed. 5 (Slide.) 6 At some point in time, this all has to be fed 7 into parameter estimation. This is a little work sheet that 8 shows -- this happens to be again for this German problem 9 I'll tell you about later. This is an analysis for a 10 diesel-drived pump or a system of diesel-driven pumps. It 11 reflects the totals of all those impact vectors, basically, 12 the expected value on the frequency distribution of all that () 13 data, in terms of what kind of impact the event has on a 14 number of components. And the reason, again, we have these 15 fractions, these .ls, and so on, these events are then 16 folded into estimators for parameters. 17 This happens to be parameters for an extension of 18 the beta factor. It shows for a diesel-driven pump, we have 19 a beta factor of .08, a gamma factor, which is, you know, 20 given a common cause event has occurred, what's the initial 21 probability that three or more components are involved. 22 That was .82, and for a four-train system, we 23 also need a delta factor. The probability, given a common 24 cause event, it affected more than three, and given the i 25 further probability, it could affect all four. These ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336-6646
2550 09 10 113 1 numbers tend to be quite high. That's just to illustrate (}DAVbw 2 how the event-by-event screening should get traced into the 3 calculation of the parameters. 4 (Slide.) 5 We do our best to quantify uncertainties. This 6 happens to be out of the Brussels paper. It shows an 7 uncertainty distribution for the beta factor and the gamma 8 factor for emergency feedwater pumps. And as you can see, 9 relative to the two factors, the beta factor distributions 10 are rather well defined. The entire distribution is within 11 a range of 0 to about 30 percent for the beta factor. 12 One of the reasons why this is rather () 13 well-defined here is sort of the confidence levels on 14 parameters, you know, are affected by the number of each 15 kind of event that's fed into the model. In the case of 16 beta factors, it's a function of not only the number of 17 common cause events. It's also the number of independent 18 events. Since number of independent events is rather large, 19 we have relatively good confidence in what the beta factor 20 is. 21 On the other factor, for this gamma factor which 22 is, you know, given that two pumps have failed, what's the 23 condition like, when all three pumps have failed in the 24 model? There's very little data for that, because you're 25 basically only relying on common cause events for that ; I ACE-FEDERAL REPORTERS, INC. 202 347-3700 Nationwide Coverage 800-336-6646 l
2550 09 11 114 1 parameter. And as you can see, it's all over the map from 0 (}DAVbw 2 to 1 with a mean value of .62. 3 The point I'm trying to make here is that all 4 these parameters have uncertainty, and to be able to make 5 numerical statements of confidence have no effect whatsoever 6 on the contemplated results. 7 We recommend very strongly, you should try to 8 quantify as many uncertainties as possible. 9 (Slide.) 10 This shows the way in which we organize our 11 results for determining dominant contributors. We look at 12 the breakdown in two dimensions. 2 n(_/ 13 First of all, across the bottom, we look at the 14 contributions in terms of what the initial alignments were 15 at the time of the event. The three alignments we happened 16 to pick for this example problem wre the normal alignment, 17 the alignment with the motor-driven pump train in 18 maintenance and the one with the turbine driven pump train 19 in maintenance. 20 In this particular example, we assumed the design 21 characteristics of a test override function, which enable us 22 to neglect the testing alignment as a conservative 23 assumption in this case, but one would normally also have 24 testing alignments, as well as in a complete PRA, alignments 25 for degraded support systems, like loss off off-site power, ACE FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336-6646
4 2550 09 12 115 1 loss of all AC power, and so on. l{}DAVbw 2 This happens to be the focus for just this one 3 set of battery conditions. 4 Then for each one of the alignments, you can'see 5 the normal alignment in this case dominated. It was a 6 couple orders of magnitude greater. 8 times 10 to the minus 7 4 was the point estimate system unavailability we had for 8 this three-train system. This shows the contributors, in 9 terms of the cut set groups. Common cause events involved 10 in all three pumps is the first-ranking contributor. Common 11 cause events involving all four valves was next, and you had 4 12 to go pretty far down the list before you would come in to () 13 the area where cut sets involved purely independent events 14 coming into play. 15 As you can see here, we could have neglected 16 common cause events, independent events, entirely in this 17 analysis, and we wouldn' t have been offered very much. A 18 fraction of the common cause events is very high. 19 As you can see, the breakdown is a little bit 20 different in each category, but these results are very 21 typical and bring out what Pete was saying earlier. After 22 all that trouble we've gone through to model all these l 23 various event combinations, these, what we call global 24 common cause events, seem to dominate this typical generic l ( 25 analysis that we' re into right now. 1 ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-33H646
~
2550 09 13 116 1 (Slide.) (])DAVbw 2 We also looked at those several different 3 parametric models out there, you know. After you've gone 4 down to the point of needing an algebraic formula to 5 calculate the unavailability, there's different models that 6 have been proposed, and we looked at three in the Brussels 7 paper. 8 One is called just the basic parameter model. 9 This is very similar to some work down by Marshall and Wolfe
~
10 back in the '60s. As I said, that would probably be the 11 reference for that model. 12 The multiple Greek letter model, which is a i ( 13 recent extension of the beta factor technique and the 14 binomial failure rate model, the one that's.been improved, 15 there's two different binomial failure rate models that have 16 been talked about. One of them has what's called lethal 17 shocks, included for common cause events that effect all 18 four valves in a nonbinomial way. 19 That's the one that's used here. We took cur 20 best shot to come up with a consistent interpretation of the 21 data base, to feed each one of the models, and we found that 22 just by using the different models, there wasn't a very, 23 very large amount of variation in our final results. 24 That's one of the conclusions of our study, that t}
\
25 some of these more fundamental things, like incorporating ACE-FEDERAL REPORTERS, INC.
- 02-347-3700 Nationwide Coverage 800-336-6646
i 2550 09 14 117 DAVbw 1 the common cause events into your cut sets and making sure 2 that the bookkeeping is done correctly, and the judgments 3 you make on interpreting the data and the judgments you make 4 on improving your components are far more critical than 5 whether you pick one model or the other, as far as those 6 three different models. 7 8 9 10 11 12 . (J
- 13 14 15 16 17 18 19 20 21 22 23 24 O 25 ACE-FEDERAL REPORTERS, INC.
202 PS7-WC0 Nationwide Coverage 800-336-6646
i 2550 10 01 118 1 (Slide.)
.()DAV/bc 2 I think of maybe a little more interest to this 3 particular meeting is that we went back and played some 4 games with the system. We assumed the system was designed 5 differently. We did these three cases. I repeated the case 6 we did on our base case. This was the two motor-driven and i 7 one turbine-driven pump train system.
8 We looked at one where all three trains of the 9 plant or of the system were motor-driven. And one where we 10 only had a two-train motor-driven system. 11 For each one of these, we went back to the data 12 base and reexamined the data in light of the new system and N/ 13 corrected for things like the size of the system and the 14 number of components to be affected. 15 So we fixed the interpretation of the data in the 16 most consistent way. We found that there wasn't a whole lot 17 of variation across these three particular configurations. 18 The two-train system was 1.1 X 10 to the minus 3 on the high
- 19 side, and the slightly diverse system was 8.2 X 10 to the 20 minus 4.
21 So that, by looking at these two, we can see the 22 benefits of diversity. Four of these events where all 23 boundary conditions were available. That's a very important 24 qualification. -As long as you're looking at systems that 25 don't take out electric power, then there's a very, very ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336-6646
2550 10 02 119 7'NDAV/bc 1 small benefit here because of the diversity. O 2 The main reason for this is very clear when you 3 go back to look at the data base that all three of these 4 pumps were headed for the common suction path. Had one gone 5 back and assumed that three separate water supplies for each 6 one of these pump trains and more physically separated 7 loops, you would have seen a much bigger difference between 8 these two. In fact, across all three of these, that there 9 were a fair number of these events. The fact that they were 10 tied together to a common water source was the key to why 11 the common cause event had occurred. 12 MR. EBOERSOLE: What were the internal components () 13 of that failure? The suction piping failing? Or was it 14 stoppage of the intake due to the overall syndrome? 15 MR. FLEMING: The events that we had in there 16 that I showed on the previous slide were things like steam-17 binding of the pumps. There were common points where air or 18 steam could find its way back into the multiple pumps. 19 There were tight-packing events; each one of 20 these events, when you look at it by itself, looks like a 21 nonrepetitive off-the-wall kind of thing. But, 22 collectively, they represent as a class of events that seems 23 to happen with a regular pattern as far as their frequency. 24 That's one of the motivations behind the
) 25 parametric model.
ACE-FEDERAL REPORTERS, INC. _ : 2p_37m sfon-9fo==sq _ 93m -
2550 10 03 120 1 MR. EBOERSOLE: Just as an outgrowth of this, (~')DAV/bc v 2 does this suggest that a conservatism should be commonly 3 bounded, multiple sections as well as multiple discharges? 4 MR. FLEMING: I think that's to be considered, 5 yes. Another point to bring out, I heard a lot of comments 6 this morning and I know this has been a standard approach. 7 The key parameter that came around from this morning's 8 discussion -- I'm sorry, earlier this afternoon -- was how 9 many pumps the plant has. 10 When you look at these results, it's not clear 11 that that's the key to achieving high reliability, because 12 what you find here is that these global common cause events -/~T are the ones that are killing 'you. (_/ 13 14 And just by going from two to three pumps or from 15 three to four, for all that matter, when you look at these 16 individual events, they don' t seem to respect redundancy 17 very much. 18 A very small proportion of these common cause 19 events that we've looked at and the work that I've done on 20 the PRA's, I've looked at about 400-500 of these common 21 cause events and examined each one of them. It's very 22 difficult to see how all but a small fraction of these can 23 be influenced to any great event just by stacking on more 24 redundancy, because a lot of them have to do with human-( 25 related problems. ACE-FEDERAL REPORTERS, INC.
- 2p7-3m smion ia.govuase y33m,
._ _ _ . -- . =.
2550 10 04 121 1 The design function is sort of a common point. {)DAV/bc 2 The writing of the maintenance procedures is a single act 3 that gets repeated on all fronts. All the functions that we 4 ascribe in the industry are given to people and they say, 5 You take this system, you take that system. If you have 6 some misunderstanding or problem with the computer model, or 7 whatever, it's going to find its way into all four event 8 trains. 9 So I think that's one of the important -- it sort 10 of blends into some of the conclusions. 11 (Slide.) 12 There's two types of conclusions we reached in () 13 our paper. One is about methodology, and I think we have 14 demonstrated that there is a more systematic way than has . 15 been done in the past to treating these problems. A lot of 16 it is just based on a natural extension of the basic , 17 principles of fault tree analysis. The choice of parametric 18 models is not really that critical. 19 There's many papers being written at PRA and 20 reliability conferences doing all these comparisons about 21 using this model or that model. We're finding the choice of 22 the parametric model is not as critical as some of the other 23 uncertainties listed below here. ] 24 There is a lot of data available. It has taken l 25 quite a lot of resources to convert the data into useful l l ACE-FEDERAL REPORTERS, INC. i 202 347-3700 Nationwide Coverage 800 336 6646
-2550 10 05 122 1 information for reliability engineers. Atwood has
[G^TDAV/bc 2 classified a lot of data for common cause models. And, in 3 our EPRI-sponsored work, we have taken another crack at 4 classifying this information. 5 I think some of the ongoing NRC programs are 6 going to provide even more volume of event data to tap 7 into. But it needs to be analyzed. It needs to be pooled 8 into the PRA analysis process. There shouldn' t just be a 9 list of parameter values that are lifted from some table and 10 some report and stuck into the analysis; there's still some 11 very important judgments and uncertainties that I think 12 drive the results. . (.s)\ 13 One is how you define these component groups. 14 We're involving some criteria for how you define these. But 15 they're not all that completely defined here. 16 The assessment of impact vectors we're trying to 17 develop some rules so we can evaluate events consistently 18 because this 'oes require a lot of judgment, and this is 19 something we're working on right now. 20 And there's still a sparsity of data for these 21 higher order parameters that we've been interested in in the 22 model. But I think we've reached a point where realistic 23 reliability predictions no longer hinge on unproven 24 assumptions about independent events. () 25 And I hope that we can see a rapid end to ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-33MM6
. .m . _ .. - _ _ . __ _ _ __ _
2550 10 06 123 1 analyses that simply assume that all the events in the model {)DAV/bc 2 have been independent. 3 MR. EBOERSOLE: Could you venture an opinion 4 about the accuracy, therefore, and reliability of the 5 current PRA's?
- 6 MR. FLEMING: Oh, yes, I think there's a wide 2
7 spectrum. Even if you take the PRA's that have been 8 published in the last two years, you have a couple of 9 examples there where essentially no common cause analysis 10 was done at the system level. 11 MR. EBOERSOLE: What about Indian Point? l 12 MR. FLEMING: I think that's probably somewhere-l (~T I think the IREP and Oconee PRA's, for (_/ 13 in the transition. 14 example, did not do any common cause analysis as I defined 15 it. 16 I think the most recent PRA's, for example, the 17 one on Seabrook -- I'm biased on that one. I was the 18 project manager. But, you know, in the Midland PRA, I think 19 they had a very thorough common cause analysis there. I 20 think Indian Point was in the transition. There was a 21 concerted effort to treat common cause in there, but I think i 22 it was not as complete as we would do it today with the 23 Lanefit of what we've learned. 24 MR. EBOERSOLE: Can you make a general ( 25 observation about the degree of error by not incorporating ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336-6646 _ _. _ _ . _ _ ~ . _ _ _ _ _ , _ _ __ . . , _ . _ _ _ . _ _ - _ _ _ _ _ _ . _ _ _ _ _ _ _ . _ _ _ _ _ _ _ , _ -
'2550 10 07 124 l 1 common cause? (}DAV/bc 2 MR. FLEMING: I think, without a doubt, depending 1 3 on what system you're talking about, you're going to l 4 consistently underestimate system reliability of redundant 5 systems. It has to be redundant systems. A single failure 6 system is a different matter, but redundant systems could be 7 underestimated by one to three orders of magnitude easily. 8 There's probably examples. There have been 9 auxilliary feedwater analyses done at or below 10 to the 10 minus 6. I think the three systems, the chief reason for 11 that has been the omission of common cause events. 12 MR. DAVIS: Excuse me, Karl. It's my () 13 recollection that, for'Seabrook, the auxilliary feedwater 14 system reliability was 7 times 10 to the minus 6. I thought 15 you used that as an example of one that was well done. 16 MR. FLEMING: I'll address that. That was not 17 the result of the auxilliary feedwater system. What I call 18 the auxilliary feedwater system. And Seabrook only has two 19 trains. The numbers we got for that were in the vicinity of 20 three times 10 to the minus 4 for the two-train system; and 21 the lower number is the number you get when you throw in the 22 startup shutdown pumps, which is sort of like the third 23 train, which I think there were a lot of arguments to 24 support the independent assumption because it's a totally b) s_ 25 separate system. ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336 6646
2550 10 08 125 1 If you look at that number and you're kind of ("/3DAV/bc s. 2 getting in to my first conclusion, based on the analysis 3 we've done in the paper, I would say that a typical order of 4 magnitude estimate for auxilliary feedwater system 5 reliability based on everything we know about common cause 6 is on the order of 10 to the minus 3 per demand. 7 And based on plant to plant variations that are 8 out there, before I gave this talk, I talked with some of 9 our most experienced systems analysts and people who 10 actually do this sort of work back in their shop. And I 11 asked each of them, you know, we've done probably 15 12 auxilliary feedwater system studies using techniques () 13 comparable to the ones I've shown to you here today. 14 And based on those evaluations plus what we think 15 we would get if we would analyze Davis-Besse, which we 16 haven't, and all the other plants out there, we think that 17 the very, very widest you could stretch the range of results 18 for plant to plant variability would be 10 to the minus 4 to 19 10 to the minus 2. 20 Ten to the minus 4 would represent probably an 21 ultra lower bound that 100 percent of the plants would fall 22 above. And you could see numbers as high as 10 to the minus 23 2 per demand based on the kind of analyses we've been 24 through here. i ( 25 In the case of Seabrook with the two-train ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336-6646
2550 10 09 126 flDAV/bc V 1 system, the numbers were in the vicinity of 3 times 10 to 2 the minus 4. The main reasons why those numbers depart from 3 this number stems from the specific event by event screening 4 that was done at that particular plant. 5 And you would have to go back and do an event by 6 event comparison to figure out just exactly why it was 7 lower. 8 MR. EBOERSOLE: What would your method of 9 analysis have done to the two-train circuit breaker systems 10 for reactor scram such as we had at Salem? 11 MR. FLEMING: I'm glad you asked that. In 12 November of 1982, we had done our preliminary reactor scram O( / 13 analysis using these techniques in the Salem reactor trip 14 system, which was pretty similar to the one at Salem. 15 MR. WARD: You said "of Salem". 16 MR. FLEMING: We were analyzing Seabrook. I'm 17 sorry. We were analyzing the Seabrook plant in the Seabrook 18 PRA about three or four months before the Salem events 19 occurred. We were discussing our results with the Seabrook 20 folks to see whether those results were reasonable based 21 on--I can't remember what the exact number was, but it was 22 between 10 to the minus 4 and 10 to the minus 3 per demand. 23 Close to 10 to the minus 3 per demand was the number we got 24 for that system without recovery, without having the scram 25 included. ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336-6646
2550 10 10 127 1 When you multiplied that times the number of {)DAV/bc 2 Westinghouse reactor years experience -- in fact, our 3 clients did that and said, well, gee, Karl, if your analysis 4 is correct, we should have seen one of these. 5 MR. EBOERSOLE: So it was just about on time. 6 MR. FLEMING: As a matter of fact, the dominant 7 cause of system unavailability identified in our analysis 8 was common cause failure of the reactor trip breakers, 9 because we had seen some events in the data base. We found 10 something like 50 or 60 LER events involving reactor 11 trip breaker problems. And we found a couple that we 12 classified as common cause problems. And that gave us a ('\ \J 13 beta f actor which, when multiplied by the f ailure rate, 14 indicated a very high likelihood. 15 MR. EBOERSOLE: What about the boiler with its 16 common dump boiling? 17 MR. FLEMING: I can't speak to that because, for 18 some reason, they won' t let me touch those boilers. 19 MR. EBOERSOLE: Oh, they don't? 20 MR. FLEMING: Well, that was a joke. 21 (Laughter.) I 22 MR. FLEMING: Just by circumstances, I've only 23 had the opportunity to look at the pressurized water 24 reactors. But, in principle, we try to apply these same 25 techniques to each system, mechanical, electrical or ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336-6646
2550 10 11 128 1 otherwise.
}DAV/bc 2 MR. WARD: Karl, a question. Your first item up 3 there, you talk about a two-train system. You mean two 4 diverse trains?
5 MR. FLEMING: No. The example I showed in the 6 previous slide was two motor-driven pumps only. That got a 7 number just a little bit greater than 10 to the minus 3. 8 Okay? So, without diversity, two motor-driven pump trains, 9 you know, you ought to be able to get pretty close to 10 to 10 the minus 3. I think two steam-driven would be an 11 underestimate. 12 But the ones that we studied in the paper seemed (~) 13 to. indicate that 10 to the minus 3 was a typical range. (_/ I 14 hope in the paper I have adequately qualified this. But I 15 certainly wouldn't want to overstate, you know, that all 16 plants are 10 to the minus 3. I think there might have been 17 some misunderstanding that'was caused by that. 18 Like I said, I think there's probably a 2 order 19 of magnitude spread to take into account plant variability, 20 but 10 to the minus 3 is probably a good sort of medium 21 central value for most of the plants we've looked at. 22 MR. DAVIS: Karl, excuse me. It wasn't clear to 23 me in your paper whether you considered recovery. I guess I 24 have concluded that you have not considered it. 25 MR. FLEMING: I'm sorry. .There's no recovery in ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336-6646
2550 10 12 129
^
1 these numbers whatsoever. [s_>/DAV/bc 2 MR. DAVIS: So they wouldn't be expected to be I I 3 lower? 4 MR. FLEMING: Absolutely. I think, for that 5 reason, I think the numbers coming out of here seem to be 6 pretty consistent with the numbers that I heard in the 7 previous presentations. 8 (Slide.) 9 With recovery, it included substantial 10 reductions. But I'have a comment about that, too. I would a 11 be very careful about setting reliability targets for 12 systems and including recovery factors in those because I () 13 don' t regard recovery as a system characteristic. I think 14 it's more of a plant characteristic. 15 Whether you can justify a factor of 10 versus a 16 factor of 2 recovery for an auxilliary feedwater system may 17 have a lot to do with a lot of things beyond just steam 18 generator level inventory. 19 So you're really assessing the entire plant. I 20 think there are pitfalls. It also invites the systems 21 analysts to vary recovery in the systems analysis without 22 looking at the plantwide implications. 23 Now, in looking at these results or 24 sensitivities, the main benefit of having the steam-driven 25 pump in the plant is -- ACE-FEDERAL REPORTERS, INC. 202-347 3700 Nationwide Coverage 800-33 9 646
2550 10 13 130 Co^v/8c 1 "a ra^o^"r> n= wera v1 exe e co e=t2 2 MR. WARD: Yes. 3 MR. THADANI: At least to clarify in terms of 4 reliability studies, we agree with you that recovery should 5 not be folded in, in an analysis done that way. But the 6 reliability studies do it both ways. It's done without 7 recovery and then with recovery. 8 MR. FLEMING: That's good. 9 10 11 12 13 14 15 16 17 18 19 20 , 21 22 23 24 25 ACE FEDERAL REPORTERS, INC. 202-347-3700 ___ _ _ __ Nationwide Coverage _ _ 800-336-6646 ___ _
2550 11 01 131
;(]) DAVbur 1 In looking at this question of the steam driven 2 pump, it seems that the primary benefit of having a steam 3 driven pump is that it provides the capability of operating 4 without electricity, at least in principle, at least without 5 AC power.
6l That is a definite plus, and that would come out 7 of a full-scale PRA study. 8 As far as looking at system level common cause 9 failures, if you would convert from steam to all electric 10 and not have that diversity, you would get about the same 11 answer if you assume that electric power was available. 12 So you know, the reason why that might seem
,(--) 13 obvious, just because we have something diverse in there 14 doesn't provide you some kind of mystic benefits against 15 common cause failures. It only provides you from that very 16 specific defense against the situation where we don't have 17 electric power.
18 MR. EBERSOLE: What happens when you include 19 steam? 20 You develop a dedicated diesel generator carrying 21 its own pump. It is electric, but it is not connected to 22 the grid. i 23 MR. FLEMING: That is in fact the system we 24 analyzed in this benchmark which I am about to tell you 25 about. ACE-FEDERAL REPORTERS, INC. 202 347-3700 Nationwide Coverage 800-336 6644
2550 11 02 132
- {}DAVbur 1 I think af ter going through the sensitivity 2 studies and having the benefit of not having to apologize 3 about the analysis, not including common cause failures, and 4 looking at the nature of the results, there is a cause to 5 sort of rethink the use of diversity and even redundancy as 6 a defense against common cause failures.
7 The results are showing us that the redundancy in 8 and of itself doesn't seem to be verp effective, and 9 diversity also has to be thought out very carefully because 10 I think just because you have -- like I said in the steam 11 driven example -- just because you have some differences in 12 your redundant trains, unless you have thought your way 13 through to how the specific common cause events you saw in 14 the data base would have acted differently in light of that 15 kind of diversity, it just doesn't follow to me that making 16 things different is going to make it actually better. I 17 think there is a need to rethink this. 18 In the case of the auxiliary feedwater system, 19 the idea of having diverse drive in there, maybe it would 20 have been more effective if the trains had been more 21 independent. But, see, that is the key. What we are really 22 trying to achieve here through the use of redundancy is 23 independence. 24 Diversity is not an end in itself. Diversity is 25 a technique or a theory about how to achieve independence. ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-33 4 646
2550 11 03 133 ( )DAVbur 1 I think it is very important to keep those 2 concepts in that kind of perspective because I think that a 3 lot of people -- they say, well, I have got diversity in my 4 system, I throw in some steam instead of electric or diesel, 5 and I have met some kind of diversity requirement, and 6 therefore it is going to be better. 7 I don't think it necessarily follows from that. 8 You ought to think about how to achieve independence. While 9 I think there is something to be said for diversity, I don't 10 think that it has had the kind of impact on performance as 11 many would have expected. 12 I just think we need to rethink that a little ( ) 13 bit. I am not saying it is not a bad idea. 14 That is pretty much the conclusions of this 15 Brussels paper. 16 If you would like, I can go on and talk about 17 this European exercise. 18 MR. WARD: Go ahead. 19 (Slide.) 20 MR. FLEMING: The Common Market countries in 21 Europe have been in a sort of evolutionary way developing a 22 sort of consensus of procedures to do PRAs. They have not 23 gone aggressively into performing big full-scope level PRAs,
-, 24 as is frequently done in the U.S. The approach they are
()' ' ' taking is they are getting all the countries together and 25 ACE-FEDERAL REPORTERS, INC. enewm sanonwide covenae emu 6m
-2550 11 04 134 1 trying to work'on small problems and develop a consensus (])DAVbur 2 approach on pieces of the pie and gradually build up to some 3 kind of a consensus approach. 1 4 Earlier they had done a reliability study. They 5 had picked a system, and they asked each of the teams who 6 participated -- I am not sure exactly how many participated 7 in that exercise -- to perform an independent events 8 reliability study on the system, and they had a sequence of 9 meetings to try to figure out why they were getting 10 different results. And they tried to keep normalizing to 11 evolve a more consensus approach. 12 This project had been completed sometime last 13 year, and recently, this year, 1985, they started an 14 extension of that to address common cause events. PL&G 15 became involved in that through the sponsorship of EPRI and' 16 NRC to provide another team to also have a chance to test 17 our procedures that we have been developing, and talked 18 about in the Brussels paper, and also try to work with them 19 to try to develop some kind of consensus approach. 20 So what was done is there was basically a 21 six-train auxiliary feedwater system that was selected for 22 the example. What this is in actuality is a four-train 23 dedicated diesel driven pump type auxiliary feedwater system 24 that has been combined with a separate two-train 25 startup/ shutdown motor driven pump system in a fault tree ACE-FEDERAL REPORTERS, INC. 202 347-3700 Nationwide Coverage 800-336-6646
2550 11 05 135 1 analysis, where all six pumps are postulated to fail. (])DAVbur 2 These ten teams went to this plant. It is a 3 brand new KWU plant at Grohnde in Germany, on the Grohnde 4 River. It had just started commercial operation earlier
-5 this year. It is a typical four-train German design that 6 meets all of their current safety requirements with respect 7 to aircraft crash, seismic events, fourfold level I 8 redundancy, and so on.
9 Each of us visited the plant and has performed a 10 preliminary analysis of the system -- of this collection of 11 systems, if you will, and we have had one meeting to discuss 12 results, and we are in the process right now of doing some (~ 13 adjustments and trying to normalize our differences, and 14 there will be a finalization of this in March next year.
- -15 Basically, what has happened is that the joint 4 16 research center at Ispra is coordinating all this. There is 1
17 ten teams, one from the U.S. There's parallel efforts at 4 18 EPRI and NRC to develop procedures, and we are going to test . 19 these out. 20 As I mentioned, it is a KWU plant, six-train 21 system. The independent failure analysis was fixed. Each 22 team was given a fault tree, a set of independent component 23 failure rates, a statement of the boundaries of the problem, 24 and a lot of information about how the system was designed, 25 operated and maintained. ACE-FEDERAL REPORTERS, INC. l 202-347-3700 Nationwide Coverage 800-336 6646
i , 2550 11 06 136 1 There's two phases to the analysis.and, as I ()DAVbur 2 mentioned, will be finished in March 1986. L 3 (Slide.) 4 Based on the first phase of the analysis, each of 5 the ten teams submitted a report. The analysis of those 6 reporcs is still.in development right now. But you can see 7 by the dif ferent approaches -- each of the teams are i 8 identified here on the left -- took to the qualitative and 9 quantitative phases of the analysis. 10 In the U.S. contribution we basically went 11 through the process I showed to you in the previous slide. 12 Each other team used whatever process they felt was ! 13 appropriate. 14 They basically seemed to distinguish themselves 15 by whatever factors they used to approach the qualitative 16 factors. That is everything leading up to parameter 17 estimation, and the different models they used -- algebraic 18 models and parametric models -- they used to quantitate
- 19 common cause events where there is a little bit more 20 similarity.
21 In the quantitative analysis, some teams used the 22 simple beta factor model, its extension the multiple Greek 23 letter model, the Marshall-Olkin technique, which is very H24 similar to that basic parameter model we mentioned in
.( 25 Russell's paper, as well as the binomial failure rate 1
ACE-FEDERAL REPORTERS, INC. l Nationwide Coverage 800-336-6646 l
. _-- _ _ _ . _ . _. _ M*M-3M ._
2550 11 07 137 1 method. ()DAVbur.
~
2 So those are the various techniques that are used 3 for one out of.six needed for success, to calibrate your 4 thinking. ' 5 (Slide.) 6 It is not the same kind of numbers I showed you 7 before. This shows the kind of spread we got on point 8 estimates that were made by each of the teams. In each 9 case, people did at least two separate analyses, which 4 10 should be regarded more as a limited sensitivity study as 11 opposed to a formal uncertainty propagation. 12 This dotted line indicates the results of the 13 independent analysis' that everybody was given to start .with 14 for somewhere in the vicinity of 10 to the minus 8th to 10 15 to the minus 7th for any of these six pump trains to be 16 unavailable -- all of those to be unavailable. 17 As you can see, this is the kind of spread that 18 the teams were getting, a three orders of magnitude spread 19 on those. But based on the results that were presented at 20 the meeting and the amount of interchange that was taking 21 place, I would just offer my own personal judgment that when 22 the second round of analyses are completed, I think we will
-23 find a much tighter spread in the results, between 10 to the 24 minus 5 and 10 to the minus 4.
25 When you break this down and break off the piece l l ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336-6646
2550 11 08 138 1 that looks like the auxiliary feedwater system, the (])DAVbur 2 four-train auxiliary feedwater system, our U.S. analysis 3 analyzed that system at between 10 to the minus 3 and 10 to 4 the minus 2. It was actually higher, or more unfavorable, 5 than the three-train system that we had found in Russell's 6 paper. 7 So the four-train system actually was worse than 8 the three-train U.S. system. The reason for that was that 9 while we were able to identify these benefits of the train 10 separation -- and there were lots of events that were not 11 classified as being very important, physically separated 12 events, such as the common section path, and so on, their .Q component selection of choosing diesel generators to drive (_/ 13 14 the pumps -- we applied electric power-diesel generator data i 15 to that problem, which is the only data we had. 16 That data indicated the failure rates of diesel 17 generators are like an order of magnitude higher than the 18 motors, or more. Since the failure rate went up by a very 19 large factor, the reduction in the common cause factors was 20 swamped out by the component structure. 21 I think we would have seen a much different kind 22 of number had we looked at four motor driven pump trains 23 that were physically separated. I would have expected to 24 see numbers significantly less than 10 to the minus 3. l 25 DR. CATTON: On that diagram that you have, ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336-6646
l
'2550 11 09 139 l 1 France and the U.S. both used the same technique, yet there
(])DAVbur 2 is about the biggest spread between the two. 3 MR. FLEMING: Right. The reason for that is that 4 only the U.S. team actually analyzed event data to go in the 5 analysis. All the other teams that used the parametric 6 model either assumed parameters for that model or were l, 7 quoted a parameter from some other study that was probably 8 not even appropriate for that system. 9 As a matter of fact, for that reason one of the ! 10 assignments to the ten teams in Phase 2 is to have all ten 11 teams go back to the same U.S. data base and go through that 12 evaluation process so we can focus on what kind of 13 consistency we can get among the teams, and we want to see 14 if that will affect the process. j 15 But that is the major reason. The model in and 16 of itself is not that important, as much as all the thought 17 that goes into feeding the information into the model. That 18 is where the differences came into play. ! 19 DR. CATTON: So the fact that Denmark and Italy 20 are the same is not surprising. They used exactly the same 21 information. l 22 MR. FLEMING: That is right. 23 DR. CATTON: The others are model differences? 24 MR. FLEMING: Model differences and other kinds 25 of judgments that went into the analysis, like the selection ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 80 4 336-6646
2550 11 10 140 1 of common cause groups. ()DAVbur 1 l 2 For example, the Swedish team used the mutliple 3 Greek letter model. They modeled the whole train of 4 auxiliary feedwater as a single component. They had one set 5 of beta, gamma, and delta factors for the whole train of 6 equipment items that needed to take place; whereas, in the 7 U.S. design we followed the approach in the paper. We had a 8 separate model for the diesels, the pumps, the demineralizer 9 pumps, the valves, and so on. Each one had a separate 10 model. 11 And then depending upon how you feed your 12 parameters on that model, it might have some bearing on the O k/ 13 Sinal results. 14 A comment on the design of the German plants is 15 that while this particular analysis was confined to system 16 level considerations, the thing that impressed me about the 17 German design was the emergency feedwater system was almost 18 self-contained as far as support systems were concerned. It 19 had its own component cooling water pump, which sucked off 20 the water supply that was dedicated to that train. There 21 was a generator on the diesel to provide electric power in 22 the event that the station diesels did not provide power. 23 So there was not a lot of dependence on the 24 service water- pump on cooling water type of support systems I
' 25 like you will find in some U.S. designs, and I think that ACE-FEDERAL REPORTERS, INC.
202-347-3700 Nationwide Coverage 80 4 336-6646
2550 11 11 141 1 whenever a full scope PRA is done on plants like this, these (])DAVbur 2 kinds of benefits will be quantified better than we have 3 been able to do in this study. 4 That concludes everything I had to present. 5 Any further questions? 6 MR. WARD: Let's see, Karl, do these numbers 7 credit recovery actions? 8 MR. FLEMING: No, there is no recovery actions. 9 It is just a Boolean analysis to keep the scope of the 10 analysis fixed. 11 MR. WARD: Let's go back to the other topic. 12 Your conclusions about a two- or three-train system as a
,Q 's) 13 typical system might have an unavailability of 10 to the 14 minus 3, and you agree if recovery was credited that could 15 become 10 to the minus 4 perhaps.
16 MR. FLEMING: I don't think that is unreasonable 17 to expect, a recovery factor like that. Again, I want to 18 make sure that that is tied to some kind of plant level 19 analysis. 20 MR. WARD: I.got sort of a disconnect there 21 because the staff is claiming that most of the plants they 22 have looked at can just about meet this standard review plan 23 number on unavailability with recovery included, 10 to the 24 minus 4, but their methods of analysis didn't really O 25 treat -- I don' t think they did -- didn' t treat common cause ACE-FEDERAL REPORTERS, INC. 202-347 3700 Nationwide Coverage 800-336-6646
1 2550 11 12- 142 1 ~ to the extent yours did.
. ()DAVbur 2 MR. FLEMING: There was some analysis of common 3 cause, but I don't think it was the same approach that was ; 4 indicated here. I think we will hear about that in the next 5 talk.
i 4 6 But you know, the possible things that could give 7 rise to differences are the data that was used -- for 8 example, I know the failure rates assigned to these valves 4 9 in the common suction path are administratively monitored. 10 I think the failure rates that we have in our data base for 11 those contributors are much lower than the failure rates 12 assumed in the NRC analysis. 13 So the failure rates could give rise to the 14 differences. Whatever differences there are in common cause 15 treatment can cause differences, and how you interface 16 everything in the logic model could cause differences. 17 There could be lots of areas for differences. 2 18 On the surface it sounds like by putting recovery 19 on top of this kind of analysis it would not be unreasonable 20 to end up with plants under the 10 to the minus 4 area, but 21 I would have my doubts as to whether all the plants were in 4 22 the 10 to the minus 4 area. That is sort of my gut 23 reaction. 4 24 ($) 25 i 1 ACE-FEDERAL REPORTERS, INC.
. .._..__ ___ 202-347-3700_ _ ._ Nationwide Coverage __ _ 800-336-6646 , _ _ _ _ _
~
2550 12 01 143
)
(,s)DAV/bc 1 MR. WARD: Any other questions? l 2 MR. DAVIS: I have a quick one, Karl. I need 3 some guidance on how to handle the data on these problems. 4 I took a look at your paper and decided to do an independent 5 assessment of the common cause analysis of the discharge 6 valves failing to open. 7 I used the beta factor model. One of the 8 problems with the beta factor model has, and I think all 9 th3se common cause factor models have this same problem, 10 they need as input the independent failure rate plus some 11 measure of the common cause contribution. And in the beta 12 factor model, those two numbers are multiplied together. fs
\'-
13 MR. FLEMING: Almost. 14 MR. DAVIS: The point is that you really compound 15 any variations in both of these parameters when you apply 16 these models. Just on the valves alone, in the literature, 17 I found variations in the independent valve failure rates 18 and variations in the beta factor that would cause two 19 orders of magnitude variation in the common cause 20 contribution of the four valves failing. 21 And I can tell you where all these numbers come 22 from, but that's not the point. 23 MR. FLEMING: It doesn' t surprise me. 24 MR. DAVIS: They're in the literature. And, in 25 your example, that was the dominant contributor; almost ACE-FEDERAL REPORTERS, INC. STR-207-3700 Nationwide Covercn3 800-336-6646
2550 12 02 144 (]jDAV/bc 1 half was because of those four valves failing. 2 This is troublesome to me because I can make the 3 number anything I want by selecting the data from these 4 sources. 5 MR. FLEMING: I know exactly what you're saying. 6 I:have taken a lot of grief personally because people have 7 lifted numbers that I have generated for specific 8 applications, literally lifted them and plugged them into 9 some kind of model. 10 That's the very reason why we urge very strongly 11 that it be placed on the responsibility of the systems 12 analyst to reconcile a document, his intrepretation of each 13 one of these events and how it does or not apply, and the 4 14 . reasons why, and put that on the responsibility of the 15 industry. ~ 16 I would not recommend that anybody lift a 17 numerical value beta factor and plug it into a model, to do 18 anything more than maybe a private sensitivity study, or 19 whatever. 20 MR. DAVIS: But you can't always get your hands 21 on the data. The Seabrook data base, for example, is 22 proprietary. 23 MR. FLEMING: All of the events that went into 24 the Seabrook report are available to the public in every , 25 EPRI-sponsored document; I can provide you with references s ACE-FEDERAL REPORTERS, INC. 202 347-3700 Nationwide Coverage 800-336-6646
2550 12 03 145 ( )DAV/bc 1 to that. The NRC has it. We can get copies to anybody who 2 needs it. 3 But all the Seabrook events that went into the 4 Seabrook PRA came from 2,300 LER's that were searched and 5 evaluated. We came up with something like 425 dependent 6 events, and we screened those and we screened out functional 7 dependencies, and things like that. But every one of those 8 dependent events is documented. 9 There's a nice little cause and effect logic 10 diagram in this EPRI report, which is one of the data bases 11 that we have at our disposal. There's no reason why. It 12 doesn't take very long for an analyst to take those events ( ) 13 that belong to the component group in his system and do a 14 thoughtful evaluation of each event. 15 For example, there's only 22 diesel generator 16 events. You know, you can. There's a limit as to how much 17 insight you can get from those 22 reports. You read them. 18 You either understand them or you don't. You go back over 19 them a second time. It doesn' t really take a lot of 20 manhours to ask the systems analyst to take those, document 21 his impact for those events and the reasons why. He threw 22 it out, included it, or weighted it dif ferently, or 23 whatever. I think that's the secret to that problem, is to 24 put the responsibility of documentation on the analyst and (7,) 25 don't allow the analyst to lift beta factors or failure i l l ACE-FEDERAL REPORTERS, INC. ' 202-349 3900 Pat %;rfthwrage (NASMc"$
2550 12 04 146 . ()DAV/bc 1 rates. 2 The other problem you alluded to, and that is 3 that we've gone to the process of careful event by event 4 type screening for these common cause factors. It's 5 unfortunate that we haven't been able to do a comparable 6 level of effort for the failure rates. 7 There's only a few components that I've ever seen 8 supported by a careful event by event screening of the 9 data. Most of our failure rates are based on judgment. 10 They're based on IEEE-500 and WASH-1400 and other 11 synthesized distributions. 12 Unfortunately, we don't.have as much confidence 13 in what's behind those numbers as we now have I think on the 14 common cause factors. But whenever you can consistently 15 screen all the events and all the analysis, that should be 16 done. 17 But the resources to handle the independent 18 events are like an order of magnitude greater; that's the 19 problem. They might be on the order of hundreds of common 20 case events and there'll be thousands of independent events 21 that have to be evaluated. 22- MR. EBOERSOLE: What comments could you make on 23 the merits of the bleed / feed adjunct to the problem of 24 cooldown? O 25 MR. FLEMING: Well, I listened to the comments ACE-FEDERAL REPORTERS, INC. K@ik347 3700 Nationwide Covers 800 336-6646
2550 12 05 147 1 earlier about bleed and feed. I'm not an expert on that -()DAV/bc 2 subject, but I do know that in the PRA's that we've done, we 3 go through a process of asking our utility clients to 4 provide some information to support the capability of the 5 PORV's to sustain that environment. 6 In some cases, we have not been able to get such 7 documentation and that capability has not been in the PRA. 8 In other cases where our analysts are satisfied that 9 something like 24 hours worth of cooling can be maintained 10 in that mode, then they take both. 11 I can't really speak to what the specific 12 criteria are. But, again, some of the other comments I 13 heard about the PRA today is that I think we have to 14 distinguish between what may be regarded as sort of tre 15 collective practice of a given group of analyses and che 16 responsibilities of the analyzers. 17 I think the PRA's, like anything else done in 18 supportive reactor safety and engineering, is an analytical 19 activity that should be documented and it's subject to the 20 same principles of documentation as a stress calculation, or 21 whatever. 22 I don't think that just because we put a PRA 23 label on it gives these people an escape clause not to have 24 to either state what their assumptions were or provide, you O-x- 25 know, the backup calculation to support it. ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 804336-646
2550 12 06 148 1 MR. MICHELSON: In considering the possible 5 ()DAV/bc ! 2 contribution to risk, say, from a seismic disturbance, how .! . 3 do you handle the failure of the nonseismically qualified l 4 equipment in terms of what it might do to the ability of the f_ 5 . seismic equipment to function? It's a potential common mode ! 6 challenge. [ 7 For instance, if the fire protection system would 8 ' actuate as a consequence of a seismic event, it will spray ! 9 several trains, several different systems, and so forth. i. 10 How-do you come to grips with that kind of a question? 11 MR. FLEMING: That's a very good question. In f
- 12 fact, I recall that specific scenario mentioned at the
( 13 Seabrook ACRS meetings that preceded the low power letter. 14 :In fact, I have to admit, when that particular scenario -- .l 15 the earthquake taking out the nonseismically qualified 2 l 16 sprays on top of these generators, that, in fact,'was not j 17 identified in-the PRA at that particular point in time. i. 18 of course, it caused us to go back and take a l 19 look at it in that specific instance. It was determined, or 20 it was determined after the fact that that system was not 21 normally energized. It was normally valved out of service. 22 So we calculated and retrospectively put that back in the 23 model. 24 And it didn't seem to be important. But that's a 25 real problem. It stems from the fact that the PRA analysts ACE-FEDERAL REPORTERS, INC. 202-347 3700 Nationwide Coverage 800 336-6646
2550 12 07 149 (_jDAV/bc 1 have to base their analysis on their level of information 2 and knowledge about the plant. I think the PRA's have been 3 very successful in being able to get the basic functional 4 characteristics of the plant modeled. 5 There's pretty good accountability of what the 6 intersystem dependencies are, what supports what and 7 accounting for all the components, and things like that. 8 The only recommendation I have is that I don't feel that 9 PRA's in general have spent enough time looking at the data 10 in a qualitative way. 11 There's no reason why some kind of a checklist 12 approach couldn't be taken to at least make sure that you I) 13 have accounted for what you have observed. And what ad hoc 14 approaches have theorized in meetings such as this. 15 But that's all I would have to say. 16 MR. MICHELSON: I'm not sure you answered my 17 question. If it did, it went by a little too fast. You say 18 of course that the analyst is supposed to model. I guess 19 what you're saying is the analyst is really supposed to 20 model the nonseismically qualified system to the extent that 21 he can ascertain if there are interaction capabilities. 22 MR. FLEMING: Absolutely. 23 MR. MICHELSON: Is this commonly done?
,, 24 MR. FLEMING: I think it is. I think, in the
( I 25 current PRA's that we're doing now, we are not just ACE-FEDERAL REPORTERS, INC. 202 349 3700 NatwirNhfavTage CDM)RMS$$ 4
2550 12 08 150 1 confining our seismic analysis to seismically qualified ([)DAV/bc 2 components. And what that translates into, it basically 3 translates into not having as warm a feeling about the 4 fragility curves that you're using. 5 Fragility curves are based more on generic data 6 and they can't really link the fragility curve calculation 7 into the safety factors built into the design process. 8 MR. MICHELSON: These are all good words. I 9 think I agree with you. 10 MR. FLEMING: I guess what I'm saying is that we 11 include them and we end up with larger uncertainties. 12 MR. MICHELSON: Well, how do you come to grips 13 with, for instance, relay and instrument contact chatter in 14 nonqualified systems where you may have rather limited 15 experience with such devices, if any? Since they weren't 16 normally seismically qualified anyhow? 17 How do you speculate in doing this modeling, how 18 these kinds of systems are going to behave? Or, do you make 19 all worst case assumptions? 20 MR. FLEMING: This is a little bit out of my 21 field. I'll address it as much as I can. In the relay and 22 contact chatter area, the current work we're doing, we're 23 going through some kind of process to classify these 24 components as to what their physical characteristics are. O 25 Are they normally energized? No rmally ACE-FEDERAL REPORTERS, l' '.t 202 347 3700 Nationwide Coverage J 336-6646 ;
2550 12 09 151 1 de-energized? We make basically global assumptions. If ()DAV/bc 2 they' re one type, they will fail in a certain way. If 3 they're another type and energized, they'll perform 4 differently. 5 We do assume that this chatter phenomenon will 6 occur and model that into our plant in what we think is a 7 conservative way. 8 But the real problem there is it's very difficult 9 to cope with the number of possible states that one could 10 hypothesize. And I can't state with great confidence that 11 we're adequately addressing the issue right now. We have 12 thought about it and are trying to take some reasonable
'O- \- 13 approaches to take into account that relay chatter 14 phenomenon.
15 I assume that relay chatter will in fact occur 16 and we'll try to map that into the behavior on the plant 17 based on the characteristics of the relays. 18 MR. MICHELSON: A more complex issue arises when 19 you allow ventilation systems to fail during seismic ever,ts, 20 which a nonqualified might very well do, particularly fans. 21 And then you start worrying about the solid state control 22 systems that might be thereby affected due to elevated 23 temperatures, and then how they all feed back. 24 And it gets pretty wild after a while. 25 MR. FLEMING: It is wild. It's very difficult ACE-FEDERAL REPORTERS, INC. 202-347 3700 Nationwide Coverage 800-33HM6
2550 12 10 152 ()DAV/bc 1 what we're trying to tackle in these PRA's. 2 MR. MICHELSON: You do attempt to some extent to 3 address such issues from what you're saying, I believe. 4 MR. FLEMING: We are attempting to tackle those. 5 In fact, the room heatup question in general, including 6 those with and without earthquakes, I think is one of the 7 most challenging problems we're facing in our current 8 PRA's. There are three or four inhouse PRA's where your 9 final core melt frequency results might be anywhere from 10 10 to the minus 2 to 10 to the minus 4, depending on how you 11 treat the behavior of the equipment in the degraded 12 environment. O k/ 13 MR. MICHELSON: I understand, in some cases on 14 solid state controls, it's unpredictable, it could go either 15 way. 16 MR. FLEMING: It's very dif ficult to figure out 17 what the failure mode will be. We are addressing those 18 questions and we'll have to get some actual analyses out on 19 the street and get them reviewed to see how well we're 20 going. 21 MR. WARD: Okay, Mr. Fleming, we appreciate your 22 talk and your responses. Let's go to the next speaker now, 23 who is going to be someone from the staff. 24 MR. EL-BASSIONI: My name ic El-Bassioni. I am a
) 25 Senior Reliability and Risk Analyst of the Reliability and i
ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336 6646
2550 12 11 153 LI^hDAV/bc 1 Risk Assessment Branch, in the Division of Safety Technology
\_/
2 of NRR. 3 (Slide.) 4 I'll start by talking about the highlights of the 5 report co-authored by Karl. I hope I quoted him right and 6 he'll speak up if I've misquoted any of his conclusions. 7 The first one that Karl and his co-author 8 recognized, that the treatment of common cause failures in 9 published PRA's are inconsistent and nonsystematic. 10 Different methods are used, different boundary conditions, 11 and usually we get different conclusions because also of 12 different data that were used.
) 13 His report has claimed that random independent 14 failures contributed less than 1 percent of the overall 15 system unavailability. For a two-motor-driven train, if we 16 add a third redundant motor-driven train, we're going to 17 have an improvement of about 1.5.
18 And in case that third train is substituted by a 19 diverse turbine-driven train, this factor of 1.5 will 20 increase to about 1.7, which means that the net effect of 21 diversity is about 10 percent increased from the case where 22 we had just pure redundancy. 23 And the last one is that for a typical 24 three-train auxilliary feedwater system, we get a typical 25 value for unavailability of one 10 to the minus 3 per ACE-FEDERAL REPORTERS, INC. 202 347 3700 Nationwide Coverage 800 336-6M6
2550 12 12 154 , -Oo^vede 1 ae =a-2 3 4 5 6 7 8 9 10 11 12 G L' 13 14 15 16 17 18 19 20 21 22 23 24 25 ACE FEDERAL REPORTERS, INC. RiR)47 3700 Nasionwide Com 800 336 6646 l
I 2550 13 01 155 T~"s DAVbw 1 MR. WARD: Again, the last number is without any U 2 recovery? 3 DR. EL-BASSIONI: I'm coming to that. 4 (Slide.) 5 The methodology that is provided by Pickard, Lowe 6 and Garrick appears to be attractive, and it is systematic; 7 however, in our view, it has a number of limitations. The 8 first is that that report treated only common cause 9 failures, as far as similar components are concerned, but 10 when we get to common cause, the effects that would impact 11 dissimilar components, the methodology cannot be easily 12 extrapolated to include that, and if it is extrapolated to () 13 include the dissi allar components, it will be very cqmplex. 14 Carl has indicated also that failure dependency 15 experienced data is still sparse. As we have seen in his 16 impact vectors, those vectors are highly subjective. It 17 relies on the analyst's interpretation of the data and 18 whether the data is applicable to the particular system 19 under analysis or not. 20 MR. EBERSOLE: May I ask a question? 21 In particular, the first bullet, and to some 22 extent, the others, don't each of them indicate that he 23 underestimated the common cause failure potential? 24 DR. EL-BASSIONI: It could go both ways. When I 25 go to all of the limitations, some of them will contribute ACE FEDERAL REPORTERS, INC. 202 347 3700 Nationwide Coverase 800 336 6646
2550 13 02 156 ( ]DAVbw 1 this way and some others will contribute that way; however, 2 the main contributor, in our view, is the subjectivity in 3 the interpretation of the data. 4 The biggest contributor would be the definition 5 of the impact vectors. And that was seen in the regulatory 6 letter, when we get to estimate high water parameters, the 7 gamma and delta parameters. We have very large 8 uncertainties. 9 This might be where the largest contribution to 10 our effort is. 11 MR. EBERSOLE: What you're saying is, that in 12 itself is an influence on the common cause factors. p ' 13 DR. EL-BASSIONI: Yes. 14 MR. EBERSOLE: And there lies -- I once had a 15 fellow who asked me, and it's a common thing. He say, "How 16 do you want the answer to come out? I have such a range of 17 assumptions here I could put into it. They could go from 18 black to white." 19 That then brings up the common cause influence of 20 highest interests in the outcome. 21 DR. EL-BASSIONI: However, I want to give credit 22 to that report. 23 Carl has taken a very systematic view to 24 reviewing dependent data, experience data. There is some
,7 '- 25 difference between dependency data, dependency experience ACE-FEDERAL REPORTERS, INC.
20p47-1700 Nationwide Coverage 800 336-6646
2550 13 03 157 1 data and random independent failure data.
}DAVbw 2 In most cases, when we look at incidents that 3 involve dependent failures, usually we have some corrective 4 action taking place that follows that. So we cannot rely on 5 experience as much as we rely on independent failure data.
6 We have to emphasize good engineering judgment, 7 in terms of, is this piece of information applicable to the 8 system that we have, or is it not applicable? 4 9 MR. EBERSOLE: One of the cases we can't seem to 10 quite get away from is the Palo Verde case, where there is a 11 claim with a rather deficient aux feedwater system that 12 they've got 10 to the minus 4 per demand. O 13 I guess you're acquainted with that. They have (_/ . 14 no PORVs. 15 DR. EL-BASSIONI: In this case study also, they 16 did not model any of the support systems and recovery-was 17 not included in their model. Carl pointed out that recovery 18 is sequence-dependent. This is why it was not included in 19 the model; however, there are some very routine recovery 20 actions like, in case we have automatic initiation, 21 automatic actuation failure, the operator can initiate 22 manual actuation. . 23 MR. EBERSOLE: Would you follow Davis-Besse 24 recovery routing? O) (_ 25 DR. EL-BASSIONI: In my judgment that was a ACE-FEDERAL REPORTERS, INC. 202 347 3700 Nationwide Coverage 800-336-6646
I 2550 13 04 158 ['}DAVbw 1 routine.
\_/
2 MR. WARD: Would you expand a little bit on the 3 importance of leaving out the support systems in the aux 4 field study? 5 DR. EL-BASSIONI: What I was trying to point out, 6 out of the Pickard, Lowe and Garrick report was very sketchy 7 and whether they had included support systems or not, I 8 couldn't judge from the fault trees that they had in the 9 report. In some cases that I have seen, they looked at 10 auxiliary feedwater systems and assumed that all the support 11 systems are available. Some did not. Out of the report, ! 12 I couldn't make a judgment on whether they had included
! 13 that or not.
14 This points out one very important thing. Since 15 we are looking for a systematic methodology, we should have 16 a very well-defined boundary for the auxiliary feedwater 17 system, so when we say " auxiliary feedwater system," we'd 18 know what we're talking about. 19 MR. THADANI: Dave, let me give you a specific 20 example. 21 Let's take a plant with two diesel generators, t 22 two motor-driven pumps, and that's all it's got. The l 23 unavailability of the auxiliary feedwater system may, in 24 fact, now be limited by the unavailability of the diesel 25 generators. Now let me take three motor-driven pumps, ACE FEDERAL REPORTERS, INC. RBD3P Di@ 902afbh CB4EC"3
2550 13 05 159 1 three diesel generators, and let me employ Carl's [^}DAVbw V 2 methodology on common cause failures. 3 I may, in fact, conclude that three water-driven 4 trains in an aux feed system are not much better than two 5 motor-driven trains in an aux feed. Again, if use Carl's 6 approach, I say, let me replace the third motor-driven pump 7 by a turbine-driven pump, and using this approach, I might 8 then conclude that the turbine-driven aux feed train buys me 9 a lot more than a third multidriven train of aux feed. 10 The reason I come to a totally different 11 conclusion than the one that Carl came to in his analysis 12 is, by having included it in another support state, which is (') 13 availability of electric power or nonavailability of 14 electric power. That's very important, because I suspect -- 15 at least it's my own personal view that the unability of 16 diesels is probably going to show unavailability of two 17 motor-driven aux feed pumps, having taken care of certain 18 key vulnerabilities, especially in terms of nonrecoverable 19 thoughts. 20 That's really what Dr. El-Bassioni is saying, in 21 terms of support states, that one ought to carefully 22 consider those. But then analysis becomes very completed. 23 MR. WARD: That was my next question. If they 24 are considered, is it practical to consider this approach? () 25 MR. THADANI: That's exactly the question that ACE FEDERAL REPORTERS, INC. 202 347 3700 Nationwide Coverage 800 33H646
2550 13 06 160 T~'DAVbw 1 Adel is addressing in his next one or two slides on the
\_)
2 complexity of the analysis. 3 MR. WARD: Carl? 4 MR. FLEMING: I think right off the bat here, I 5 think it's worthwhile to distinguish between the limitations 6 of the methodology and the scope of the paper. I chose in 7 my paper to address a certain narrow aspect of what we have 8 to consider the PRA, and there is certainly nothing inherent 9 in the method that would preclude it from looking at support 10 states, 11 DR. EL-BASSIONI: I didn't say otherwise, Carl. 12 MR. FLEMING: I'll help you find the sentence in 13 the paper where it clearly states that this analysis is done 14 over the assumption that all boundary conditions are 15 available. 16 MR. WARD: Unless it makes it so complicated that 17 it's not a practical method of analysis, that's the 18 question. 19 MR. FLEMING: You see, the point is, there is no 20 real difficulty in PRAs in dealing with functional 21 dependencies. Everybody's doing a pretty good job of that, 22 so I didn't want to complicate the paper by addressing 23 that. 24 DR. EL-BASSIONI: The only thing that I spoke
~J 25 about is the state of the support system. We tend to ACE. FEDERAL REPORTERS, INC.
E!3D07 DED Stionwide C&GR~)_ _ _ _ _ _ _ 800 336-6646
l 2550 13 07 161 1 concentrate on the figure, which is 10 to the minus 3,
'{"}DAVbw s-2 without knowing what goes under that.
3 (Slide.) 1-
- 4. The next limitation is the increase of the number 5 of minimum cut sets by a factor of about 5, by including 6 these sub-basic events. I think this problem will be more 7 chronic once we go beyond similar components to dissimilar 8 components. This might not be a problem for a small-sized 9 system with a.small typical fault tree of 17 or 18 gates, 10 but when we get to a full-scope PRA, this might be a big 11 problem, and it might overburden the analysis.
12 My last thing is about methodology. It seems to r~ 1 (_)g 13 highlight quantitative aspects of common cause failure 14 rather than qualitative, and we emphasize qualitative 15 analysis to draw insights and look at vulnerabilities in the 16 design. 17 Carl mentioned something about two separate 18 approaches. One of them is called system familiarization 19 that he used, and the other one the Europeans use is the 20 FMEA, and I wish he would have talked more about that. 21 (Slide.) j 22 I want to say.that the Staff has always called 23 for a well-disciplined, consistent treatment of dependent 24 failures. Staff has several programs that provide () 25 improvement in the state of the art and common cause 1 i ACE-FEDERAL REPORTERS, INC. ' 202 _ _ _ _ _ , _ _ _ , _ _ _ _ . _ _ , ,__ ,__ __ _ _ _-347 3700 Nationwide Coverage 800 336 6646
2550 13 08 162
)DAVbw 1 failure, one of them in the systems interaction program, the 2 RMIEP program. There is a cooperative effort with EPRI, and 3 this effort, we are supposed to provide a procedures guide 4 for treatment of dependent failures. Carl Fleming is one of 5 the major authors or participants in that effort.
6 MR. EBERSOLE: As I recall, at the last 7 subcommittee meeting on subsystem interaction, I was 8 impressed with the low level of support and the budget. 9 How many people are working on that in the Staff? 10 I think it was two, wasn't it? 11 DR. EL-BASSIONI: I'll ask Ashok to answer this 12 question.
' - 13 MR. THADANI: I don't know the answer as to the 14 number of people right now. Certainly, the level of effort 15 has come down from what it was years ago. I think the Staff 16 has a proposal in hand to try to resolve the unresolved 17 safety issue, A-17. What Dr. El-Bassioni is addressing is 18 not in the context of a resolution of the USI, but rather 19 all the effort that has gone into trying to identify and 20 capture those interactions. The effort that was conducted 21 at Brookhaven, Lawrence Livermore Laboratories that I think 22 you're familiar with. The particular attention there was, 23 in terms of functional interactions.
24 MR. EBERSOLE: I was just commenting on the fact 25 that it says that they have the full support of the Staff. ACE-FEDERAL REPORTERS, INC. 202 149-1700 WatW@6retage 800 336-6M6
2550 13 09 163 1 MR. THADANI: I think this should be read as f~}DAVbw V 2 follows, that we're certainly in support in the PRA world of 3 trying to address all the common cause failures, to the best 4 of our ability. 5 Dr. El-Bassioni is pointing out various programs, 6 the outcome of which would help, in terms of methods to be 7 applied to identify these interactions, dependencies or 8 common cause failures, and in fact, if he were to go on, he 9 could tell you about some of the guides he's working on, 10 writing procedures and how to go about treating these common 11 cause failures. 12 MR. EBERSOLE: Mr. Thadani, that statement would rm (_) 13 hold water, it would be perfectly accurate, if there was 14 only one man working on system interaction, and he was 15 enthusiastically supportive of common cause failure 16 analysis. 17 That's all I'm saying. 18 DR. EL-BASSIONI: Sir, I just pointed out that 19 the call for careful, well-disciplined, consistent 20 treatment has the support of the Staff. We recognize that 21 this is a problem, as Carl pointed out, and we are working 22 on it. This is what I wanted to say. 23 MR. WARD: They're in favor of doing good PRAs. 24 MR. THADANI That's how it should be (/ 25 interpreted. ACE FEDERAL REPORTERS, INC. 202 347 3700 Nationwide Coverage 800 336-6646
2550 13 10 164 gAVbw 1 (Laughter.) 2 MR. MICHELSON: From time to time, the people in 3 the environmental qualification world find instruments and 4 controls, and so forth, don't really behave in adverse l 5 environments like they had thought they would behave. So l 6 they have to go back and make certain modifications and 7 fixes, and whatever, which then makes them behave properly. 8 Do you people go back now and pick up those 9 instruments that were not so modified, since they were not 10 in safety-related equipment and systems and think about 11 them, in terms of creating common cause problems for 12 balance of plant equipment, which is safety-related? It's a l k 13 similar question that I asked earlier, but another aspect of l 14 it. l 15 We seem to ignore the fact that these pieces of 16 equipment are known to fail under adverso conditions, but we 17 fixed it for those pieces that had to be fixed. 18 How do we pick that up on the rest of the world? 19 And how do we factor that back into possible system 20 interaction effects, and so forth? Do we really try to do 21 that, or do we just give lip service? 22 MR. THADANI: I think the toughest ones, 23 somewhere, at least at this stage, I think there is a very 24 limited amount of work done on the nonseismically qualified 25 equipment mounted in such a location, failing under seismic ACE-FEDERAL REPORTERS, INC. ___20W7_-0700_ ___ _ Nationwide @niqa 800-MCK"3
2550 13 11 165 DAVbw 1 events of a certain magnitude and the consequential failure 2 of some other systems, at least as far as I understand, that 3 is not done particularly well. In fact, it's probably done 4 very poorly today. 5 Another example might be fire in a specific 6 room. I think today, fire analyses may have large 7 uncertainties, but at least people seem to be taking into 8 account not~just fire growth, but also what temperatures the 9 rooms might get to, flame directions, and so on, the ability 10 of certain cables to withstand temperatures at certain 11 levels, and so on. 12 There seems to be some work being done in that (') 13 area. 14 MR. MICHELSON: But even in that area, they're 15 still focusing on assuring the protection of safety-related 16 equipment in the vicinity and ignoring the nonsafety-related 17 equipment, which is seeing the same fire environment which 18 can, in turn, cause unwanted actions. We just don't chase l 19 this potential for unwanted actions too well, because it's a 20 very difficult thing to chase. 21 22 23 24 l ('~N_) 25 ACE. FEDERAL REPORTERS, INC. 3)2-347-3700 Nationwide Coyerage 800 336-6646
2550 14 01 166 1 MR. RUBINSTEIN: I have two comments. The first ()DAVbur 2 is the identification of the vulnerability or deficiency. 3 In the deterministic world engineers can fix that. As to 4 whether or not they ultimately pick it up in the analysis, 5 that is preventive, or having originally been known to be 6 vulnerable is another story. 7 But one has to go to the philosophy on fire, 8 which is very similar to safeguards, which is to bring the 9 plant to a safe shutdown mode, and when one looks at fire in 10 these kind of dependent system vulnerabilities we ask the 11 ultimate question: will a sufficient set of instruments and 12 components survive which will allow you to get to safe O (- 13 shutdown? And that would assure a great degree of 14 reliability. 15 That doesn't assure that the balance of the plant 16 is going to survive. 17 MR. MICHELSON: Don't forget the basic assumption 18 in doing that analysis, if I understand it correctly, is 19 that you are not going to address the potential for unwanted 20 actions from all this other equipment. You just pick out 21 the set you need, make sure it is protected environmentally, 22 and so forth. But you assume it is not being adversely 23 interacted by the failure of other equipment in the fire 24 area that was not related. 25 MR. RUBINSTEIN: To a limited degree, we do look ACE-FEDERAL REPORTERS, INC. RTR WJ7-EG Nationwide Csnt~3 80433(H5646
2550 14 02 167 DAVbur 1 at independen'ce and associated circuits, particularly 2 through the electrical. 3 Jerry could probably expand on this. 4 MR. MICHELSON: I don't think we want a debate. 5 That isn't my point. 6 MR. RUBINSTEIN: I just want to say that I don't 7 want to leave it on the record that they are aspects that we 8 don't look at. 9 MR. WARD: Go ahead, Doctor. 10 (Slide.) 11 DR. EL-BASSIONI: My last conclusion that we have 12 is that if we take the numbers in the report literally and () 13 assume that it presents a typical system, then we think that 14 the impact of common cause failure, which is dominating the 15 . unavailability of the auxiliary feedwater system and was 16 giving credit of more than 99 percent contribution to the 17 unavailability, we do not agree with that and we think that 18 we can get more credit using diversity. 19 I think we had some discussions with Karl. Karl 20 agrees that with certain plant specific features that we 21 show independence between the trains. We can achieve 22 greater values compared to the values that were mentioned in 23 the report. 24 As Mr. Rubinstein has just indicated, we () 25 recognize that independence is the main factor for ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336-6646
2550 14 03 168 1 improvement of the auxiliary feedwater system rather than {)DAVbur 2 throwing blindly redundant trains or having diversity just 3 for the sake of diversity, and we won't allow things like 4 common suction valves like the one in the example. This S would be a very undesirable feature. 6 This concludes my comments. 7 MR. WARD: Okay. Thank you very much. 8 Karl? 9 MR. FLEMING: I wondered if I could just make a 10 couple of comments about some of the conclusions just to 11 maybe form somewhat of a rebuttal to some of the things you 12 have said.
) 13 I am very appreciative of getting this 14 feedback. I think it will have an impact on how we think 15 about these things, but there is a couple of points I want 16 to maka.
17 The concern you have about the impact vectors and 18 the subjective elements associated with that, I maintain 19 that that is an unavoidable situation that an analyst 20 faces. 21 I will further assert that all I have done is 22 that I have invented a diagram on which to display what is 23 going on in the analyst's head and trying to get away from 24 having those necessary subjective value judgments be buried 25 and how maybe Corey Atwood classified them as a lethal ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336-6646
2550 14 04 169 7^TDAVbur 1 shock. V 2 DR. EL-BASSIONI: Can I respond to that? 3 (Laughter.) 4 MR. WARD: Go ahead. 5 DR. EL-BASSIONI: All what you are saying is that 6 there is subjectivity there. You say it is unavoidable. 7 But implicitly we are introducing another element of 8 uncertainty, which is variability from one analyst to 9 another, unless we provide some general rules or criteria 10 that we have to follow, that we get to almost agreement on 11 the generalization of these impact vectors. One of the 12 elements was .9 and one was .1 and there is nothing in () 13 between. If it was my judgment, I would have a 14 distribution. 15 You see what I mean? Unless we have some 16 guidelines of how to generate this. This can be worked. 17 MR. WARD: But I don't think he really dealt with 18 yours. 19 MR. FLEMING: I still won't agree that I have 2' introduced this analyst variability. 21 MR. WARD: He says he is attempting to display 22 something that is inherent in anybody's analysis. 23 MR. FLEMING: It does not introduce an 24 uncertainty. After all, the analyst variability we have
) 25 right now is dominated by whether common cause events are ACE-FEDERAL REPORTERS, INC.
202-347-3700 Nationwide coverage 800-336 6646
I l l 2550 14 05 170 1 even included in the analysis. That is certainly an (])DAVbur 2 analyst's subjective assumption. l 3 All I am saying is it is an inherent uncertainty 4 associated with doing the analysis, and whether you put it 5 in the diagram or not I don't think is the question. 6 DR. EL-BASSIONI: Can I respond? 7 Implicit in that, if I play with these numbers 8 and instead of .9 I use .99 and instead of .4 I use .01, 9 then all of its impacts will not be shown and it will not be 10 as significant. 11 MR. FLEMING: We have done sensitivity studies on 12 that, and we have checked to see what kind of answers you \ 13 would get if you throw out all these subjective events and 14 assume they don't exist. It has very little impact on the 15 results because the vast majority of the impact vectors are 16 minor. 17 The other thing, I didn't see any real 18 engineering reason why you would expect -- why you believe 19 that the common cause failures have been overstated. But I 20 would expect if such reasons could be presented that they 21 could be boiled down to different interpretations of the 22 data, and I think that further could basically be resolved 23 in how well the analysts can document their analysis. 24 So I assert that it is not really a limitation of 25 the method. It is maybe an issue of whether the given ACE-FEDERAL REPORTERS, INC. 202-349-3700 R"ation* Coverase NC l
-2550 14 06 171 P'NDAVbur 1 interpretation of the data is correct or not.
(> 2 I do agree that we need better procedures for. - 3 coming up with these impact vectors. I think it is better 4 to get them out on the table. . 5 The business about the corrective actions, the 6 thought that common cause failures we have corrective 7 actions for with the implication that independent of that we 8 don't, I don't think that is the way plants are really run. 9 I think in any equipment failure some conscientious effort 10 is made to try to prevent the reoccurrence of that event 11 because if it is not a safety concern it is an economic 12 concern to continue having to procure additional equipment,
.() 13 repair equipment, have the tech specs shut down, and so on
- j. 14 and so forth. There is always an attempt, based on the 15 utilities I have been involved with, to recover from the 16 events, whether they be independent or common cause events.
17 As far as overburdening the analysis is 18 concerned, I.think that'the basis -- the baseline from which 19 we are judging the straw that broke the camel's back is 20 based on a burden of analysis which, in my view, are based 21 on the analysis of noncontributors. 22 So I think if there were some way to reduce the . 23 burden of all these independent events maybe we would have 24 more room in our budgets to have staff working on it. () 25 And as far as the comment on diversity, the
- ACE-FEDERAL REPORTERS, INC.
202-347-3700 Nationwide Coverage 800 336 4i646
-2550 14 07 172 1 conclusions I reached on diversity were based on, (])DAVbur 1 2 admittedly, a human's interpretation of the data. But it ' 3 was data from diverse systems that didn't really involve any 4 subjectivity in terms of postulating something that is not 5 out there. 6 And I think we should be able to resolve those 7 kinds of differences just by getting the individual events 8 out and discussing them. 9 That is all I have to say. 10 MR. WARD: Okay, thank you. 11 MR. RUBINSTEIN: My name is Les Rubinstein. I am 12 the project director of the project director to the 13 Westinghouse Division. I come to you under my own aegis as 14 Assistant Director for Core and Plant Systems. 15 Basically, I am going to briefly review three 16 items dealing with the staff's actions to upgrade the AFW 17 reliability. 18 The first one is where in NRR -- 19 MR. MICHELSON: Before you get started, are you 20 going to be the one that tells me about how you are going to 2:1 improve acquiring the reliability data, a question raised 22 much earlier today? 23 And I have patiently waited through all these 24 speeches and I haven't heard it yet. But the guys are fast 25 disappearing now. ACE-FEDERAL REPORTERS, INC. 202-M%3?co NCenase CiLN
2550 14 08 173 T'NDAVbur 1 MR. RUBINSTEIN: I wasn't privy to your O 2 question. But before they disappear, I was not going to 3 talk about changes in LER gathering or data acquisition. 4 MR. MICHELSON: I got the impression earlier 5 today that before the end of the day I was going to hear 6 what the staff thought about the quality of the reliability 7 data available and perhaps I was going to hear what they 8 were going to do about it. But maybe I just misread. 9 MR. RUBINSTEIN: Insofar as NRR, I can deal with 10 the latter right now. 11 MR. MICHELSON: Did I misread what I heard 12 earlier? (~s (_) 13 MR. WARD: Yes. We only -- you are really asking 14 what AEOD is going to do, and then you want to know what NRR 15 is going to demand that AEOD do. 16 MR. MICHELSON: When Dennig was giving his 17 presentation, we were bemoaning the problem that the data 18 was not all that good, he couldn't get information. We kind 19 of inquired as to, well, how is this going to be corrected 20 or what is the plan of action or what is going to happen. I 21 kind of got the answer, I thought, well, wait until later 22 today, we are going to hear all about it from the staff. 23 This is later today, and I havent heard a word 24 about what the staff is going to do, but I may have just (~)h s_ 25 thought I was supposed to hear it. ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800 33(H5646
2550 14 09 174 1 MR. RUBINSTEIN: Before you respond to that, let {}DAVbur 2 me say I would have talked more directly in the licensing 3 arena what we had in mind than I am currently contemplating 4 to do about upgrading the feedwater system. This would 5 encompass a little beyond perhaps an analysis. 6 MR. MICHELSON: That won't answer my question. 7 MR. RUBINSTEIN: I understand that. However, 8 what I tell you may transcend the question. 9 MR. THADANI: Les, I don't recall the specific 10 question, but I think I am personally not aware if there are 11 real problems with current reporting systems, whether we are 12 getting quality data or not. A (m) 13 In my communication with Research staff, I am led 14 to believe that the best source of information for PRAs 15 would probably come from IPRDS and that there is a 16 substantial amount of detail there. So you could actually 17 assign a cause and determine whether that was a legitimate 18 failure or not. 19 MR. MICHELSON: How many plants is that going to 20 be done on? 21 MR. THADANI: As I understand, it is a voluntary 22 program, and I think only a handful of plants are 23 participating, as I have been told. 24 MR. MICHELSON: Maybe for the full committee 25 meeting they could just give us a brief idea unless there is 1 ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-33H646 _
2550 14 10 175 -l'NDAVbur 1 a comment over here. V 2 MR. HERNON: I would like to comment. If I 3 recall, I asked you to repeat your question because I wasn't 4 sure where it was directing us in this area and what is 5 going _to be done to improve the quality of the LERs. 6 MR. MICHELSON: I didn't say LER because I didn't 7 mean just LER. 8 MR. HERNON: That is one source of data, is 9 actual operating experience. 10 The other thing that reliability data could mean 11 is some of these plants that we have no evidence would meet 12 our present SRP criteria -- you know, do we have the latest 13 information on those plants, because there are some hardware 14 improvements. After they do that, of course, they should go 15 back and review their reliability study. 16 This is new and better reliability data and new 17 and better systems. 18 MR. MICHELSON: Are they using their own data 19 or -- but I am looking for the real data. 20 MR. WARD: Carl, I got the impression that what 21 you are asking about was really kind of an AEOD question. 22 We are talking about aux feed systems here, and I guess we 23 have seemed to come to the conclusion early on or I got the 24 impression that the staff is struggling to get any useful 25 information on aux feed reliability out of the AEOD ACE-FEDERAL REPORTERS, INC. _- ..- _. _ ._ . , _ _202 347-3700 Nationwide Coverage _ _. 800 336 6646 _ _ ,
2550 14 11 176 T']DAVbur 1 analysis of LERs. v 2 MR. MICHELCON: And they are struggling with just l 3 LERs, which in the first place doesn't tell you the number 4 of demands, for instance. 5 MR. WARD: So it seems to me we have to 6 address -- that is another subject. 7 MR. MICHELSON: I asked the question of AEOD, and 8 I got the answer that staff was going to tell us later in 9 the day. Perhaps I was dreaming at the time. I thought I 10 heard the answer. 11 MR. HERNON: Danny did mention the fact that LER 12 performance and the quality of the material in the LERs has r) (/ 13 been factored into the SALP process. 14 MR. MICHELSON: He mentioned that. 15 MR. HERNON: That was the only thing that is 16 happening. 17 MR. MICHELSON: Apparently nothing additional is 18 done to try to improve the quality of your reliability 19 data. You know, you can do all kinds of calculations, but 20 if the base numbers aren't too good, then the answers aren't 21 too good. 22 I was wondering, is there anything going to be 23 done to improve it because Dennig -- I thought he was saying 24 that it isn' t too good, we don' t have good numbers, this is 25 the best I could do from LERs. ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336 6646_
2550 14 12 177 r 1 In my mind, I said, well, there must be a better
}DAVbur 2 way. Is the staff trying to figure out if there is a better I 3 way, and what are they doing about it?
4 MR. HERNON: I did have a specific discussion 5 with Jack Heltemes, and there is no intention at this time 6 to change the LER rule. 7 MR. MICHELSON: I suspect that is right. Maybe 8 the LER rule isn't the right way to tackle the problem 9 either. I was hoping that you would tell me the best way to 10 do this and what was being done. I wouldn't want to tell 11 you because I haven't given it much thought. 12 I was mostly looking to see is there something in () 13 the program trying to come up with better numbers because I 14 think they are very important numbers, so we can begin to 15 believe them a little. 16 MR. THADANI: That is really where I was headed, 17 and you are quite right.- Even with IPRDS there are 18 limitations, but we haven't got the results of the program 19 yet as to the number of participants. If they are 50 20 percent participants, if you will, there may be some level 21 of confidence it is not too bad. 22 The first word I got, which was quite sometime 23 ago, was that it was maybe about 10, 15 percent
-:24 - participation in this program. It may nave improved. At
( 25 the time, I was told it will probably get better. But I ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800
- - - . - - - . . _ . . . ._ _ _-3364646 __. .__
2550 14 13 178 don't the answer to that. gAVbur 1 2 We have a request out to Research. My own view 3 would be that if you really want to hear it directly you 4 ought to get Research staff here and ask them what they are 5 doing because we go to Research to give us bettmr data. 6 They are the ones. They participate, by the way, in IPRDS, 7 also, Research staff. 8 9 10 11 12 13 14 15 16 17 18 19 , 20 21 22 23 . 24 25 ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336-6646
2550 15 01 179 1 MR. MICHELSON: We're coming up to the program ggDAV/bc 2 budget next month, so I was hoping to hear whether this was 3 an area where we had a recommendation. Clearly, we've got 4 to have good numbers. We've got to have better numbers at 5 least than we have been dealing with. 6 So I was searching to see what was underway. 7 MR. WARD: I don't think this subcommittee or 8 this meeting is the right window on it. 9 MR. MICHELSON: It's the only place we hear about 10 it. We. won't hear about it in the research program plan. 11 They give you the one high-level big picture. This is lost 12 down there.
- () 13 MR. WARD
- We might see enough. If you think 14 there's a problem, you can recognize there's a problem. But 15 I think you've got to get a handle on that somewhere else.
16 MR. MICHELSON: I don't know where else, Dave. 17 MR. WARD: But we're talking about aux feed 18 systems. 19 MR. MICHELSON: That's all I'm asking as an 20 example, aux feed. 21 MR. WARD: But is it only an example of general. 22 MR. MICHELSON: It's a very important system. 23 It's a_very important number that we should have. Dennig 24 gave us the best of what he had. People didn't sound too 25 happy with it, and I was wondering what are we going to do ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800 336 6646
2550 15 02 180
; 1 to make it better.
{'DAV/bc 2 MR. WARD: Okay. But if we have the meeting on 3 scram breaker reliability, we're probably going to get the 4 same impression about the quality of the data from that. It 5 seems to be a problem, an evaluation of operational data. 6 MR. MICHELSON: I hope it's in better shape than 7 this one is. That one has a different function. It is a 8 safety-related function and it's been looked at much more 9 carefully over time. 10 MR. WARD: Well, we'd better go on. 11 MR. MICHELSON: I'm sorry to have interrupted. 12 MR. RUBINSTEIN: It's quite all right. I'm 13 coming at this from an entirely different aspect of your 14 concerns today. The licensing staff has had for quite a 15 while a number of considerations on how to upgrade the 16 AFWS. First of all, I'd like to just as a bookkeeping item 17 clearly identify in the transition that has gone from the 18 Division of Systems Integration and the branch reporting to 19 the Auxilliary Systems Branch to the Division ESRO, which is 20 the division on Safety Review and Oversight. And the 21 cognizant individual is Warren Minners, who is the chief of f, 22 the Reactor Safety Issues Branch. 23 I don't believe anything is going to fall through 24 the crack because we've been working both with Dennig and L I) s- 25 Minners in their old branches. They've been deeply involved 1 j , ACE-FEDERAL REPORTERS, INC. 202 347-3700 Nationwide Coverage 800 336 6646
2550 15 03 181 , T~3DAV/bc 1 in one of the aspects of the upgraded requirement. l V 2 The second thing is I'll talk a little about the 3 status of the CRGR package and then those considerations 4 which are prominent in our thinking on how we view the CRGR 5 package. And to do that, I'll need just a little time to go 6 back in history and to place in a different perspective 7 what's in the SRP. And then in the context that I keep 8 hearing it in the terms of what's in the SRP, Section 9 10-4-9. 10 The unavailability study, as Ashok said very well 11 before, was used as an enhancement, as Jerry said, 12 supplemented with the short and long-term guidelines of 0737 () 13 when we looked at the operating plants. 14 What it does is it nestles with the deterministic 15 analysis. In and of itself, it is not an absolutely 16 reliability analysis. It is a reliability analysis, as 17 Jerry said, which allows you to compare one Westinghouse 18 plant to another by the very nature of the data which it is 19 derived from. The WASH-1400 data base, and the rules of the 20 analysis and the methodologyit was designed to do that. 21 So when we talk in terms of low, medium and high 22 ranges, 10 to the minus 3, 10 to the minus 4, 10 to the 23 minus 5, one cannot take and put in it a frequency or a 24 challenge frequency and recovery numbers and come up with 25 some sort of a risk, because it excludes external events. ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800 336 4 646
2550 15 04 182 J'SDAV/bc 1 It doesn't deal with them at all. It deals with three G 2 rather limited initiating events which were prominent in the 3 TMI accident and, in and of itself, we used it to gain some 4 regularity on what I would describe in a minute or two on 5 our narrow view of the auxilliary feedwater system as 6 opposea to the broader view. 7 So with that as a preamble and building on what 8 Wermiel said, what we have is, af ter the TMI accident, we 9 have a set of analyses, which, clearly, we should have said 10 yes in the case of B&W, they were found to be acceptable 11 because they were guidelines and they were not put in 0737 12 as requirements. () 13 However, the staff recognized that there were 14 deficiencies in what was sitting out in the plants there at 15 that time, and we were to address them in what I'll call the 16 first CRGR package. 17 That was again trying to extend as a requirement 18 that the operating reactors which had not met the 19 unavailability numbers with the calculation as expressed in 20 06-11, for example, and say to them, okay, we've met with 21 you. You've told me you're going to give me automatic start 22 on 2E12, but you're sitting over here with two trains. 23 Maybe you ought to do a little more. Maybe you ought to do 24 a little more of this. () 25 And they said, Well, here's where I am. This is ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800 336-6646 ! 1
2550 15 05 183 1 my system as I so define it. Most reactors... pardon, most {}DAV/bc 2 ut ilities were responsive. It turned out that some honestly 3 felt that they had sufficiently reliable and well enough to 4 find and met all the regulations systems, that they didn't 5 want to do much work. And we're going to deal with that at 6 the CRGR package. 7 At that time, we put it out to other divisions 8 for review, and it became clear that it ought to be placed 9 in the context with A45 and that it needed a better 10 regulatory analysis. So we went back to the drawing board 11 and then came Davis-Besse. 12 We were under some pressure to develop a more () , 13 modern version of that. And we felt at the time that we 14 would deal with this in a narrow sense of the word. We 15 would deal with it isolating it, to say let us fix the 16 hardware of the auxilliary feedwater system. We won't deal 17 with it in the context of A45 and all these others. 18 The three things we had in what I will call the 19 narrow view version post-Davis-Besse were make all PWR's 20 demonstrate, using either the old 737 methodology and 21 specific data, and it had not become finalized through 22 analysis that they met the unavailability criteria of 10 to 23 the minus 4, 10 to the minus 5, require that they meet power 24 divergency criteria. 25 At the time, we wrote it immediately after Davis-ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Co-erage 800 336 6646
2550 15 06 184
,7~g DAV/bc 1 Besse. This was not true. Since then, they've fallen into V
2 line and, believe it or not, define your configuration 3 because, in dealing with some of the utilities, it became 4 clear -- and I'll give you an example in a moment -- that we 5 really didn't know the post-TMI configurations as they had 6 actually put them into the plants. 7 It was clear also that the analyses which were 8 done prior to those changes, some had included the changes 9 in the analyses and some had not. And some had voluntarily 10 gone much further, that we found out in subsequent 11 discussions, and had upgraded the startup feedwater pumps 12 and had done other things in upgrading the power or the () 13 auto-start capabilities of some of the trains. 14 So one of the things we required is: Tell us 15 what your feedwater system really is? 16 And we had one utility, which I'll try not to 17 embarrass, who had a turbine-driven pump and two electrical 18 pumps, and absolutely refused to accept that the 19 turbine-driven pump was 100 percent capacity, was part of 20 the feedwater system, the emergency feedwater system. They 21 said it was part of their AFW. ! 22 We said, Well, then you don't need the power ! 23 diversity requirement. They said, Well, we have the pump. ) 24 We said that the pump isn't tech spec in terms of () 25 availability. Anyway, we settled that. But I wanted to ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336-6646
2550 15 07 185 7\DAV/bc 1 give you a feel for the context of where we were. V 2 Well, a little while ago, we sent our CRGR 3 package to the divisions for review, and it came back that 4 it was clear that we were not ready. One thing, the 5 regulatory analysis. And I think you saw from Fleming's 6 discussion and from many others' discussions with the staff, 7 the benefit probably wouldn't cut it to get a third train in 8 CRGR's. We had it constituted. Minners and Harold 9 Vandermolen went back to work on that, and they've done some 10 excellent work on that. That was coming along. 11 Some of the comments and some of the factors 12 which I'm going to call the broadened view really dealt with () 13 the issue: 14 Can you deal with the feedwater system in this 15 narrow view? And some of the comments today are very 16 pertinent to this. Or, do you deal with the feedwater 17 system in what I'll call the broadened view? 18 By that, I mean many of the owners' groups, and 19 particularly B&W, have taken very strong steps to stop trips 20 and are looking at the challenges from the loss of main 21 feedwater. Our original CRGR package did not take this kind 22 of thing into account. 23 Then, from the other end of the train came strong 24 staff objections, which said: 25 How can you look narrowly at the feedwater system l ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800 336 4 646 i
2550 15 08 186 1 without taking into account the benefits of an appropriate {~)/DAV/bc ~-. 2 bleed and feed configuration and what it can do for you in 3 decay heat removal? 4 We said, that is true, that is something that 5 can't be done immediately. 6 So we got a comment that said, Gee, you've got to 7 make it compatible with A-45, which was sort of like a deja 8 vu of where we had been previously. And it was also clearly 9 pointed out that you have to deal with common cause effects 10 and do a little better job. 11 So, in a sense, what we've got is a package which 12 was relatively narrowly scoped, wherein the final decisions r-(_)8 13 have not been made as to how to broaden them, as to whether 14 to broaden them. It is in the SRO. I think Spies and 15 Minners are going to come to grips with it. It has to take 16 into account the Davis-Besse short-term generic issues, the 17 Davis-Besse long-term generic issues, A-45, other staff 18 ongoing efforts. 19 For example, it wasn't clear to us when you 20 looked at B&W plants the significance of the uprgrades that 21 they had made in putting in the feed only good generators. 22 Some of these have almost totally been insulated from some 23 of the causes which caused main feedwater failure. 24 For example, the kind of thing that happened in ( 25 Davis-Besse on some of the other plants is extremely low ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverase 800-336-6646
i 2550 15 09 187 1 probability. The ICS and NNI are completely buffered from {)DAV/bc 2 being an actor in causing the demand. 3 So we're in a situation now, and I can't give you 4 a date, where the jury's still out. How to deal with it? I 5 think it's going to go abroad. I, myself, was a proponent 6 because I saw the opportunity after a couple of years to 7 upgrade in a narrow sense the hardware on the feedwater 8 system that didn't have much to do with the human factors or 9 feed and bleed issues. 10 But I think it's in good hands now. And I can 11 only say that there is no final NRR policy which says this 12 is the way we're going to go, and we're going to ( 13 systematically deal with these consideratins and come up 14 with a policy, which we're going to pump back to CRGR. 15 I would hope it's on the order of months, a few 16 months, rather than six. I'll take questions on it, but I 17 hope I've cleared it up. 18 MR. EBERSOLE: In the aux feedwater spectrum of 19 possibilities, and of course Palo Verde is invoked, you can 20 get qualified grade secondary PORV's-down to whatever 21 pressure you want to, and pump in water from the sewage 22 system, I guess, or whatever. 23 MR. RUBINSTEIN: I was here for the Palo Verde 24 meeting. ( 25 MR. EBERSOLE: Does this augment the reliability ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-33MM6 _ _
2550 15 10 188 7)DAV/bc 1 of the system? Is it considered as an adjunct method to \_/ 2 improving the reliability? 3 MR. RUBINSTEIN: There's a school on the staff 4 that definitely believes you should give credit for feed and 5 bleed capability. In the case of Palo Verde -- 6 MR. EBERSOLE: I'm talking just about the 7 secondary. 8 MR. RUBINSTEIN: I understand. That's a narrow 9 view if you talk only the secondary. If you talk only the 10 secondary, then you darned well better deal with the AFW and 11 make sure that it's reliable. 12 MR. EBERSOLE: We also found at that meeting, you j~h (_) 13 may recall, that that didn't do much good to depressurize 14 the primary. 15 MR. RUBINSTEIN: Yes, I do remember. But, for 16 those plants which have modest feedwater unavailabilities, 17 which are maybe borderline, on one or two times 10 to the 18 minus 4, where they have an excellent feed and bleed, 19 philosophically, we have never given directly credit for 20 feed and bleed in the analysis. 21 When you start to deal with the staff or be in 22 core performance people, we've never sat down and said 23 you've got it. That's always been part of the defense 24 indepth philosophy, that enhancement. ( 25 Now, in a sense, we may have to come to grips ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336-6646
2550 15 11 189 DAV/bc 1 with the question: Should I give credit for feed and bleed? 2 How do I quantify it? And does it compensate for the 3 feedwater system of slightly lower availability? 4 MR. EBERSOLE: It's interesting to observe, I 5 think, how we work in different camps and we don't look 6 across the borders in that the boilers of course use that 7 method as one of the methods to go on. Now they're even 8 invoking open boiling to atmosphere. 9 MR. RUBINSTEIN: Boilers have 13 ways of 10 delivering water to the core. My buddies in General 11 Electric always point out to me. 12 MR. EBERSOLE: At a variety of pressures. () 13 MR. RUBINSTEIN: I think the staff's position is 14 that the preferred heat removal capability be relied on 15 through the secondary side, through the steam generators. 16 This is how the plant was designed. This is how I saw it. 17 This is why I press and I think the staff in general presses 18 for an upgrading of the AFWS. 19 20 21 22 23 24 () 25 ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336-6646
2550 16 01 190 T~NDAVbur 1 MR. EBERSOLE: It leaves the coupling mechanism V 2 from primary to secondary, which involves the delta V and 3 delta T, and there's lots of ways of losing that. 4 MR. RUBINSTEIN: But then in the real world, if 5 you are looking at the back end of the decay heat removal 6 system, you may then start to rely on feed and bleed. 7 But also, I think the industry, through their 8 owner's group -- and it shouldn't be ignored -- are making a 9 large effort to reduce the number of main feedwater 10 failures. 11 I would add that even A-44 is going to contribute 12 to it. One of the main sequences we looked at is the loss () 13 of offsite power, and anything you can do in that regard, 14 including B-56, which hopefully can upgrade the diesel 15 generator a lot. 16 So we are looking at the subject a little more 17 totally. We are interested in comments. If you feel 18 strongly that the narrow view should prevail or the broad 19 view -- 20 MR. EBERSOLE: This challenge frequency bit is 21 also important from an economic viewpoint. 22 MR. RUBINSTEIN: Oh, yes, they love it. + 23 MR. EBERSOLE: So that is one incentive that the 24 other doesn't have. 25 I recall an old philosophy that if you call a ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800 336-6646
2550 16 02 191 DAVbur safety system a safety system and it really is, it should 1 2 never have to do its thing. 3 MR. RUBINSTEIN: That would be nico. 4 MR. WARD: Okay. Any other questions for 5 Mr. Rubinstein? 6 (No response.) 7 MR. WARD: Thank you, Les. 8 We have one more topic, Mr. Hernon, about 9 overseas practices. 10 MR. HERNON: Not really. What I am going to tell 11 you is that Dr. Spies, who is probably the best prepared one 12 to address this subject, prefers to wait for a couple of () 13 months and come down and talk about this area,in general and 14 in particular. 15 MR. WARD: Who is this? 16 MR. HERNON: Dr. Spies, and he wants to work 17 this in with a planned presentation to the committee on his 18 visit to the plant in France. 19 MR. WARD: Okay. Any questions for Mr. Hernon? 20 (Laughter.) 21 MR. HERNON: One other comment I did want to 22 make. I gave Paul Boehnert a while ago several copies of an 23 October 29th letter from Florida Power on Crystal River. 24 This letter, I feel, is a very well-done submittal in that () 25 it summarizes the overall aux feedwater system reliability ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336-6666
2550 16 03 192 f^3DAVbur 1 problem at Crystal River.
\J 2 It summarizes the NRC requirements that have I'
3 emerged since TMI and very specifically indicates what 4 Crystal River has done, including a reassessment of their l 5 system reliability study with the' fixes on further j 1 6 reliability, and they also talk about a number of other 7 things that have come up today, like their involvement with 8 the owner's group and their effort to reduce trip 9 frequency. 10 They talked about the environmental qualification 11 aspects, and that answered Mr. Michelson's questions. 12 I think Paul has distributed this to you. () 13 MR. DAVIS: Excuse me. On the last page of that 14 letter, it indicates that by November of '85 they are going 15 to have a system reliability assessment completed. 16 MR. HERNON: A reassessment. 17 MR. DAVIS: Has that been completed? 18 MR. HERNON: If you look on the second page of 19 the letter, it is very close to completion. They draw out a 20 number in this letter of 1.7 times 10 to the minus 4. I 21 understand that has been inched up a little bit to 1.9. 22 They are very close. But as far as I know, they haven't 23 completed it yet. 24 MR. DAVIS: You haven't seen their facility? () 25 MR. HERNON: I haven't. ACE-FEDERAL REPORTERS, INC. 202 347-3700 Nationwide Coverage 800-336-6646
2550 16 04 193
- ^%DAVbur 1 MR. THADANI: It is not in yet.
k_) i 2 MR. HERNON: I think realistically we are 3 probably looking for it in January. 4 MR. EBERSOLE: Dave, one of the themes that I 5 have heard here from time to time is the subject of 6 environmental qualification of the combined steam-electric 7 systems where the steam system has some potential of leaking. 8 seals, burst casing, or for whatever, to cause the common 9 environments to be saturated with steam, which contain both 10 the electric motor pumps as well as the steam pumps, that 11 cause the problem. 12 I have been somewhat dismayed to find no () 13 particular rigidity and discipline or anything else to 14 protect the electrical apparatus from this submerging in a 15 steam atmosphere wherein the equipment must be initially 16 somewhat subcooled from the condition it is going to and 17 thus have quite general surface condensation over all the 18 terminal boards and equipment, wherever electrical apparatus 19 exists, which is critical to safety. 20 When this problem comes up, I see a run off to 21 qualify in a partial way the environmental capability of 22 en equipment by doing studies on leakage currents, how 23 l much functional electricity is left after part of it leaks 24 to ground or leaks phase to phase, and in no way do I find a () 25 real attempt to enclose this apparatus and make it ACE-FEDERAL REPORTERS, INC. l 202-347-3700 Nationwide Coverage 80 4 336-6646
2550 16 05 194 1 independent of this environment that it is subject to.
}
-{~DAVbur 2 I take it the staff is accepting these sort of 3 half-shot methods of getting environmental capability this 4 way on a more or less individual plant-by-plant basis and 5 individual equipment-by-equipment basis. 6 Am I wrong? 7 MR. HERNON: I can point out what Crystal River 8 has done. If you look at the very bottom of the next to the 9 last page in this letter, they either have qualified the 10 equipment for a harsh environment or replaced it. 11 MR. EBERSOLE: But when they qualify, they do it 12 by these methods of attempting to measure the quantity being () . 13 boiled and the degree of leakage current, and they attempt s l4 to make judgmental conclusions about whether there is enough 15 working current without short circuits to survive the 16 environmental conditions. They don't haul off and enclose 17 the apparatus, as I think is the reasonably conservative 18 practice. 19 MR. HERNON: I have no idea specifically. 20 MR. EBERSOLE: I think the staff needs to have 21 some sort of equipment test conducted where a saturation 22 environment is applied to common ordinary electrical 23 apparatus and the dirty conditions that exist after 20 to 30 24 years of service, when the leakage current problem is a () 25 great deal different from what it is when it is washed ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwidc Coverage 800 3364646
i l l 2550 16 06 195 ; I DAVbur 1 down. 2 I don't know of anybody that is going around 3 scrubbing the electrical contacts on a monthly or yearly 4 basis to provide this laboratory type of state in which the 5 environmental qualifications were measured. 6 MR. WARD: Okay. I think that applies to several 7 things. It is not particularly unique to the aux feed 8 reliability issue. 9 MR. EBERSOLE: That is true. 10 MR. WARD: Let's see. Our intent here with this s 11 meeting was to begin to find out what the staff was doing in 12 this area. There have been a number of events which have (') 13 been a stimulus to some sort of regulatory activity toward 14 understanding or improving aux feedwater systems. 15 I guess I have been a little disappointed that 16 more real information isn't available frcm the operating 17 . experience data base, if there is a data base. 18 Most of the responses seem to be still at kind of 19 the anecdotal responses to events rather than a 20 comprehensive body of experience. 21 But be that as it may, staff does seem to have a 22 program. It hasn't jelled, as Mr. Rubinstein told us. They 23 still haven't decided on the narrow view or the broad view. 24 He has indicated they are going to come back -- well, that () 25 they will be ready with a package proposal from NRR in ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-33(4 646
i 2550 16 07 196 1 several months, less than six, and I guess I would like some {~)DAVbur 2 subcommittee comments on what they think of the status of 3 the issue. 4 I don't really -- we didn't plan to take anything 5 to the full committee on it other than a five or 10-minute 6 report. I don't think it is at the stage yet where the 7 committee needs to hear something or where the committee 8 will be making some recommendations. 9 But if you think there are some recommendations 10 the committee ought to be making, I would like to hear about 11 it. 12 MR. EBERSOLE: Dave, I notice one theme through 13 this whole presentation is the notion that water should be 14 got into the secondaries only by means of the main and 15 auxiliary feed supplies, and I kept thinking about the 16 benefits of the boiler having access to 13 or 14 sources of 17 water by the process of depressurization and thus 18 conditioning the secondary to receive water from whatever 19 source is available, like the fire pumps. 20 I didn't hear any mentior. of this sort of thing, 21 but I would certainly endorse the degree of flexibility that 22 would permit getting water from anywhere, from the primary 23 to the secondary. I would rather have a wet secondary, and 24 I would find it anywhere I could get it. (si 25 MR. WARD: I guess there was an absence of that J ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336-6646
2550 16 08 197 1 sort of thing. I recall that in the analysis Combustion 7']DAVbur U 2 Engineering Owners Group credited getting condenser 3 cooling. 4 MR. EBERSOLE: Even if I have to go up and crank 5 open the PORVs and the safeties, I have got to get water to 6 the secondary. That has to be an infallible process as far 7 as I see it. Gravity feed if I could find it. 8 MR. WARD: Any other comments? 9 Harold? 10 MR. ETHERINGTON: I am afraid all I found out is 11 how little I know about the subject. 12 MR. WARD: Carl? () 13 MR. MICHELSON: I already knew how little I think 14 I knew that. 15 I do have a problem on this question, of course, 16 of how reliable is the present feedwater arrangement in the 17 given plant. That will determine in part how much I really 18 worry about fixing it. 19 It gets back to the questions which I think 20 remain unaddressed, and that is:- what is the staff going to 21 do, if anything, about improving its knowledge of the 22 reliability of the existing systems? 23 I sense the answer is nothing they aren't already 24 doing. There is no additional program or no additional () 25 effort except perhaps through the IREP route of trying to ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-336 6646 y
2550 16 09 198 T'sDAVbur 1 come up with better numbers. U 2 MR. WARD: You mean the ORNL? 3 MR. MICHELSON: That is right. It is not IREP. 4 It is going into the given plant and going into the details 5 of all the operations and trying to find utilities that will 6 let them go in and do it. 7 The point was that maybe 15 percent of the 8 utilities will volunteer. Maybe they won't. 9 That seems to be the only source of new 10 information on the reliability of these systems as far as I 11 can tell, the only potential source. 12 MR. WARD: Why isn't more coming out of the AEOD () 13 analysis? , 14 MR. MICHELSON: AEOD is dealing with LERs, which 15 are not reliability oriented to begin with. They are just' 16 simply reporting that an event occurred and telling you 17 about the event, but it doesn't tell you the number of 18 challenges to the systems that occurred before the event, 19 that sort of thing. 20 It is a one data point, and without other s 21 information it is of limited value because you don't, for 22 instance, know the number of demands or the nature of the 23 other demands. 24 You have to have quite a bit more information ( 25 than just an LER, and not all the LERs have to be reported, ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-33M446
2550 16 10 199 l T~ 1 particularly if these people think that it is a d'DAVbur 2 nonsafety-related system. Then you don't have to report it 3 at all. 4 DR. CATTON: AEOD is not limited just to LERs. 5 MR. MICHELSON: That is why I asked them did they 6 use NPRDS in the study. The answer is no. 7 Now, they could go in and dig ~there, but you 8 won't get the demands number out of the NPRDS system 9 either. 10 You have to do some thinking about what do you 11 really want to know and how do you go about getting it. 12 MR. WARD: What are we getting out of AEOD? () 13 MR. MICHELSON: Just a detailed analysis of 14 whatever LERs were submitted. 15 MR. WARD: But.to what end? 16 MR. MICHELSON: It is very limited because it 17 isn't suitable for LERs. It is a good deterministic tool. 18 It tells you the kinds of failures that are occurring. 19 So it is helpful to the PRA people to be sure to 20 include those kinds of scenarios in their analysis. But the 21 PRA people have to have good reliability numbers on the j 22 components and/or the systems. 23 It is the same problem we have got with valves. 24 We don't have good reliability numbers on valves either. We 25 have got numbers that people are using, but their goodness ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800-33H446
2550 16 11 200 DAVbur is somewhat in question. 1 2 MR. EBERSOLE: The main reason for that is the 3 valves are rarely, if ever, tested under true duress. 4 MR. MICHELSON: Now, I would like to hear more 5 about, you know, how good are the reliability numbers, how 6 could they be improved, how do we presently test the 7 systems, what is wrong with those tests in terms of counting 8 them as real challenges, real demands. i
- 9 I think it can be done. I don't believe it is a 10 big undertaking. But I think we ought to feel that it is l 11 being done. I think we ought to feel the staff is searching 12 for better numbers with which to judge these systems because
() 13 I don't know how reliable they are presently. 14 But if I took Dennig's numbers somewhat 15 literally, they don't look all that reliable. But that is 16 limited; it is a one-year study. Statistically, the number 17 of counts are so small that they are hard to use. 18 MR. WARD: I don't know. 19 Does there seem to be a consensus from the 20 subcommittee that there is a problem with aux feed systems? 21 Are we just reacting to press clippings, or can we agree i 22 that there really is some sort of a problem for which the
- 23 staff should be addressing programs?
24 If so, does it look like the program we have r
) 25 heard about is going in the right direction?
- - ACE-FEDERAL REPORTERS, INC.
NationwideCoverage i 800 202-347-3700 '
- , . . . - - .--- - _ 336-6646- .-, . - - -
2550 16 12 201 t ( DAVbur 1 MR. MICHELSON: Speaking for myself, I think the 2 answer is yes. Rc? i the LERs, and individually there are 3 some serious events occurring to these auxiliary feedwater 4 systems, and I think we have to react to those events with 5 appropriate corrective actions. 6 Now, how those corrective actions will improve 7 the reliability is a little bit of a question because I 8 don't see good reliability. You know, I don't see a good 9 analysis of the reliability of the present system. 10 Therefore, it is hard to judge what changes would be useful 11 to make. 12 s 13 14 15 16 - 17 18 19 20 21 22 23 24 25 ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800 336-6646
2550 17 01 202 1 Clearly, I think there's a problem, unless I'm {}DAVbw 2 misreading the LERs, 3 MR. WARD: Ivan, do you have some comments? 4 DR. CATTON: I have several comments. 5 I thought that the summary on operating 6 experience was rather poor. 7 I think AEOD needs more analysis to supplement 8 the numbers. A more inquisitive pursuit of reasons behind 9 the numbers would be very helpful, and I think maybe 10 necessary to make them meaningful. To just put the numbers 11 up there doesn't serve much purpose. 12 The auxiliary feedwater testing was mentioned, () 13 and from what Carl tells me, this was only done in a 14 research mode. That's only a partial test. It misses the 15 kind of things that Jesse was referring to. I don't 16 understand why they can't test it completely. If thermal 17 shock is a problem, test it during refueling. That area 18 needs to be looked into a little bit. 19 One wonders what is an ESF and what is not, and 20 who decides. That never did become clear. 21 . It seems to me that NRC ought to require that all 22 of the auxiliary feedwater systems be classified as ESFs and 23 be done with it. I don't know why some were and some were 24 not. m (s) 25 MR. EBERSOLE: In the ESF category, if you're ACE-FEDERAL REPORTERS, INC. 202-347 3700 Nationwide Coverage 800-336-6646
2550 17 02 203 1 looking at the FSARs and all the old classical literature, {a^)DAVbw 2 there's a very limited number of pieces in there that are 3 called ESF items or equipment items. All of it relevant to 4 LOCAs. That's all it is. That was the whole safety picture 5 for 20 years. 6 DR. CATTON: Maybe they ought to upgrade some of 7 them. I didn't understand the discussion of safety grade 8 and safety-related. It seems to me the difference is 9 clear. In one case, you make it safety grade. And I didn't 10 understand whether a safety-related system has to be 11 safety-related, or does it have to be safety grade. I 12 didn't understand it at all. () 13 There seem to be two views about whether 14 auxiliary feedwater systems were ESFs or not. Jerry's 15 presentation implied that they all were, as well as Dennig's 16 presentation. A part of the arguments for not having 17 complete information was that they were not. 18 MR. EBERSOLE: Let me ask Staff, is there a 19 possibility that one could take a hard line and just come 20 along and forcibly say what are engineering safety features, 21 ESFs, and clear up this muddy business about categorization 1 22 of equipment? 23 MR. HERNAN: I suspect we already have that 24 information in FSARs or SERs. () 25 MR. MICHELSON: If it isn't, what can you do l ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800 336-6646 ;
2550 17 03 204 1 about it? {)DAVbw 2 VOICE: So what, if it is or is not an ESF? 3 MR. EBERSOLE: I guess that's true, as long as it 4 has the same material qualifications. 5 VOICE: That's safety-related. 6 MR. WARD: I think they told us that before '75 7 aux field systems were not safety grade, safety related. 8 Those two terms means the same thing.
-9 Post '75, they are safety grade. Now there is 10 some questions about to what extent they have really 11 upgraded the older systems to be the equivalent of safety 12 grade.
) 13 DR. CATTON: Some have tech specs, some don't.
, 14 MR. WARD: They all have tech specs, but we don't 15 know what that means. We don't know whether that means the 16 equivalent. 17 DR. CATTON: Dennig said some didn' t, but were 18 going to. 19 MR. EBERSOLE: There was a statement made that 20 safety-related was easier to understand as a description of 21 something than safety grade. I would take the reverse 22 view. 23 MR. WARD: Jesse, let's not talk about that. 24 That's an old argument. 25 MR. EBERSOLE: Safety grade is rather clear. ACE FEDERAL REPORTERS, INC. 202 347-3700 Nationwide Coverage 80 4 336 6646
2550 17 04 , 205 fgDAVbw 1 DR. CATTON: I think so too. Coming from a more
. s,)
2 deterministic side of the fence, I was somehow very 3 comforted by Carl's presentation. I liked the sort of thing 4 he was doing. I was very disappointed to see that only PL&G 5 is involved in the European benchmark exercise, and I think 6 these benchmrk exercises are very good, and they bring a 7 bunch of people together, and one technique gets tested 8 against another. 9 I would think that NRC would sponsor one of their 10 contractors. PL&G is basically a PRA manufacturer for the 11 utilities, not for the NRC, yet NRC is sponsoring them. I 12 think they would sponsor one of the national labs or () 13 somebody who does their PRAs. 14 Also, I really liked the recommendation that Carl 15 made about the analyst and his documentation and 16 rationalization for what he does. It seems to me that doing 17 so would give the PRA numbers much more credibility than 18 they presently have. 19 MR. WARD: Thank you. Pete? 20 MR. DAVIS: Just a couple of brief things. 21 I think, Dave, maybe we should consider having 22 INPO come in and give us an assessment of what they found on 23 auxiliary feedwater. I know they've done quite an extensive 24 look at the problems and have talked to most of the n
'(_) 25 ' utilities and have investigated several plants. In addition i
ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800 33H64
l 2550~17 05 206 f~hDAVbw 1 to INPO, I know EPRI and NSAC have both been doing some L/ 2 things on decay heat removal. 3 In fact, last month, our report was published on 4 the Brunswick plant and its decay heat removal capability, 5 so I think there are some other things going on and other 6 sources of data that people are gathering, other than what 7 the NRC has. 8 I am somewhat comforted by NRC's approach to look 9 for the outliers. That's always been my concern. Since 10 there isn't strict design criteria for auxiliary feedwater 11 system, you can expect to find a rather broad spectrum of 12 reliability, and I think we ought to be looking for the bad 13 ones, and I think a lot has been done to identify those and 14 make some fixes. 15 One final comment'. It's my belief that the 16 utility has got to be the place where these system 17 reliabilities are really concontrated. If'the utility is 18 not aware of the significance of aux feed and doesn't 19 understand how their systems operate, I don't think anything 20 NRC does is going to make them reliable. . 21 I really think the utility needs to be made aware 22 that they have a system that's very important, and they need 23 to pay attention to it. I 24 It's not clear to me that's being done. I don't i 25 think it should depend on the NRC to take care of all these ACE-FEDERAL REPORTERS, INC. R%347-3700 Nationwide CovGLD 800 33H646
1 l 2550 17 06 207 f~TDAVbw 1 problems and watch all the data and make sure all the 1
%I '
2 modifications are not destroying reliability. 3 Thank you. 4 MR. WARD: Thank you, Pete. 5 We'll discuss what we've heard here today with 6 the full committee later this week. 7 I think that out of that discussion we'll decide 8 on some course of action for this subcommittee, as far as 9 further review of the issue. 10 MR. HERNAN: Could I briefly respond to one of > 11 Dr. Catton's comments on the recirc flow versus the full 12 test flow. () 13 If you look at the last page of the Crystal River 14 document I gave you -- 15 DR. CATTON: I just got it. 16 MR. HERNAN: One of the items is that we made 17 them commit to a full flow for the aux feedwater system 18 after each cold shutdown. 19 That was quite an issue, and they fought it, but 20 the reason they fought it was not internal stress or 21 anything, it was because it gave them a fairly good 22 opportunity to put corrosion products in their steam 23 generators, which they didn't want. They wanted to try to 24 keep their feedwater very clean. ( 25 MR. MICHELSON: What are they going to use for ACE-FEDERAL REPORTERS, INC. 202-347-3700 Nationwide Coverage 800 136 6646 l
l l 2550 17 07 208 l [N DAVbw 1 steam? b 2 MR. HERNAN: Corrosion products. 3 MR. MICHELSON: What do they intend to use for 4 steam to get a full flow test? Is this going to be after
S their return to power?
6 MR. HERNAN: res. On the power. 7 MR. MICHELSON: They've still got a thermal 8 problem. 9 MR. HERNAN: But their issue was geting crap 10 in their steam generators.
.[, 11 MR. MICHELSON: Where was it coming from?
12 MR. HERNAN: The condensate storage tank. O 13 MR. M1CHEtSON: res. 14 MR. HERNAN: The water sits there and stagnates. 15 MR. MICHELSON: It sounds fine. 16 MR. WARD: We'll recess the meeting, reconvening 17 tomorrow morning at 8:3.0.on another subject. 18 (Whereupon, at 6:30 p.m., the subcommittee 19 meeting was adjourned, to reconvene at 8:30 a.m., Tuesday, 20 December,3, 1985.) 21 22 23 24 25 ACE-FEDERAL REPORTERS, INC. 202 347 3700 Nationwide Coverage 800 336 6646
CERTIFICATE OF OFFICIAL REPORTER (~ (-)/ This is to certify that the attached proceedings before the UNITED STATES NUCLEAR REGULATORY COMMISSION in the matter of: NAME OF PROCEEDING: ADVISORY COMMITTEE ON REACTOR SAFEGUARDS SUBCOMMITTEE ON DECAY HEAT REMOVAL SYSTEMS DOCKET NO.: PLACE: WASHINGTON, D. C. . DATE: MONDAY, DECEMBER 2, 1985 were held as herein appears, and that this is the original transcript thereof for the file of the United States Nuclear Regulatory Commission. (sigt) . - - . _ _ (TYPED) h DAVID L. HOFFMAN Official Reporter ACE-FEDERAL REPORTERS INC. Reporter's Affiliation , O
~
1984 AUXILIARY REDWATER SYSTEM OPERATING EXPERIENCE PRESENTATION TO THE ACRS SUBCOMMITTEE ON DECAY HEAT REMOVAL SYSTEMS OFFICE FOR ANALYSIS AND EVAlllATION OF OPERATIONAL DATA DECEMER 2,1985 g G #
OPERATING DEMAND ESTIMATE o 10 CFR 50.73(A)(2)(Iv) RE0llIRES REPORTS OF ALL ESF ACTUATIONS, BilT AUXILIARY FEEDWATER SYSTEM NOT CONSISTENTl.Y CLASSIFIED AS AN ESF MAY ACTUATE AS PART OF ANOTHER REPORTABLE EVENT, I.E. REACTOR TRIP, AND NOT STATED EXPLICITLY o USED SYSTEM START SIGNALS + REACTOR TRIP SIGNALS, ESF ACTUATIONS TO ESTIMATE LOWER B0UND ON ACTilAL DEMANDS PLANT TO PLANT VARIATIONS VARIATIONS FOR TURBINE DRIVEN VS MOTOR DRIVEN e G G
WESTINGHOUSE PWRS o SYSTEM START SIGNALS o LO L0 STEAM GENERATOR LEVEL o SAFETY INJECTION o ESTIMATE OF DEMANDS o REACTOR TRIPS FROM L0 L0 SG LEVEL o SYSTEM STARTS REPORTED AS ESF ACTUATIONS o SAETY INJECTION SIGNALS REPORTED AS ESF ACTllATIONS o ELIMINATED DVERLAP o 130 DEMANDS FROM 34 oF 37 PLANTS LICENSED IN 1984 O O O
g v v . s
,?
s ll l I: :i
, ._. . _' .! _ .I _ _ t_ l _ .i ._ ,! !
i
. u i
.' ,!.m t_ 1 1 i, ! ; I l g d ,
. ; I ;
l ._ ___; 1'___;I. _ . .i_ . i ! _p_. ! , t
. , _ 4 . f _. _ _. p I : ! ! < ? 1 i -- ! ' ,
__ 7_ i ! 1 i 1 _ j .. l 1I
- 7. _ , , l _
I.t
! ESTIMAIEDj WE STINGHO.VSE - > i 1 T- -T , , I
,i i i,
. i
,i r, - l I i~ i , 4 i i i . ,
i ,
~ 4 -- -
i
'~i T I ' l l l i ~I i I~
~
~CPkRETIUG DEAAND'S"'
~
t i ; i j i . __,I _- ._.i,! _l _ _ . _.l _ ,i_3 ! ;.'_ . I
. ., i
. i i ! l ~
! l i ,
! ; i ! i i . i ,
.__.,._._!_._ _.i_..l_
!'_._ ___I i ! i_.. ._,i _ . .! ~ T ~ ! ! ! .l ! ,
j ! i __ 7 ; , i _. .. . _._.,__: . 4 . _ ! _ ,i _ ., . 1
, ' i
- ,i
! , ! . ! ! ! ; i ! i ! i l i i
! ' i
, 15 - l - - - ----
i
}4_ _____i_,_,_
i 4
-- _+, i , ._ _ . _. i i . ,
t ; .
, i r - - -- 1
_ i ._ 7 _l
.. . . 7 4 l--.- 13 - -' ' ',- -- k I i- L-_1
- -, L -
f !-
< i l ' ' t -
i l l l I l [ l l I . I t Nor 7 "12'-- l l
~---
11 j i ; j y --}- J-' j--]~ ~ -- -; , 11 m -- ~ {- ~-{-~ ,
!t~
Of i f i i ! ! . i ' i i i~~ ! I - i
.Plantsj'9- r-
,i ! ! l ll ; '
< ; I ! !
- ~
"~- ~ ~~-~~ ~ ~
1-~
--t,-t t ,
, 7- r '
.r
, 1, < j t .
i ! , , !.
~ 8' a ._: .
p 7~- Tf',, ,A l~ g . _ . -7 __ _._ _ . _ _ . _ . _ - _ g . . _ , -
- - * - - -' -4
!5i r "!- r! '-- 7- i - - ~ ~ - -*
~. 6 ' - i i
! i '
~ ~ ~
. 5 4' I '
- - ~ ~ ~ - ~ , - - - - - - - - -
r-
- t
_._ 4.. 3-I i
.4
.-l 3 ,
2
.2 l
', l
~- 2 'l II I ' '
1 6 1__ i
! , ; e C'
RR' R
} '
i l 4 1 i i
. 0 . .. 1 .
2.- 3 . .4 _. 5 , .6 7 8 9' 10 11 12 13 14: . 15 16 17 18 19 20 21 __ _...._._2 L_ , . . _ L_!__ .
' i NO.,OF.. DEMANDS
_, _y .. l ,i ,'
! I f 1
i i
> _y.._gl
- i ! ,
l . t I , l 1 l l
, __ ;_ _ .. _ ;__ { ._ . _. ._. _ . _ _ ; - . . _; . l I i
_.7.. _ . - _
, l j
[ ; t l i _;. ' 6 4_ . ' _i . _ . _. k' .4 ' ' ' s I i i i : i . t i i l I e O O
COMB!lSTION ENGINEERING o START ON L0 STEAM GENERATOR LEVEL o ESTIMATE OF DEMANDS o REACTOR TRIPS FROM LO STEM GENERATOR LEVEL o SYSTEM STARTS REPORTED AS ESF ACTUATIONS o ELIMINATED DVERLAP o 22 DEMANDS FROM 8 0F 12 PLANTS LICENSED IN 1984 o HIGH VALUE OF 6 o AVERAGE OF APPROXIMATELY 2 PER PLANT PER YEAR e G G
BABC0CK AND WILC0X o START ON LOSS OF BOTH MAIN FEED PINPS, VARI 0llS OTHER o DEMAND ESTIMATE BASED ON ESF ACTUATION REPORTS ONLY
.. 3 STARTS AT 2 0F 7 UNITS LICENSED IN 1984 e G G
REPORTED OPERATING PROBLEMS o PARAGRAPH 50.73(A)(2)(v) REQUIRES REPORTING 0F:
"(v) ANY EVENT OR CONDITION THAT ALONE COULD HAVE PREVENTED THE FULFILLMENT OF THE SAFETY FUNCTION OF STRUCTURES OR SYSTEMS THAT ARE NEEDED TO:
(A) SHUT DOWN THE REACTOR AND MAINTAIN IT IN A SAFE SHUTDOWN CONDITION; (B) REMOVE RESIDUAL HEAT; (C) CONTROL THE RELEASE OR RADI0 ACTIVE MATERIAL; OR (D) MITIGATE THE CONSEQUENCES OF AN ACCIDENT. o AUXILIARY FEEDWATER PROBLEMS F0llND IN REPORTS FOR: ESF ACTUATIONS [50.73(A)(2)(Iv)] TECH SPEC VIOLATIONS [50 73(A)(2)(!)] COMMON CAUSE [50.73(A)(2)(vil)] DEGRADED CONDITION [50 73(A)(2)(II)] SYSTEM FAllLT [50 73(A)(2)(v)] P O O O
REPORTED OPERATING PROBLEPS o WESTINGHOUSE 1 SYSTEM (ALL TRAINS) FAILURE ON DEMAND 1 MD SUBSYSTEM FAILURE DURING SG FILL 2 TRAIN LEVEL FAllllRE ON TEST 9 ALL OR PART UNAVAllAPLE FOR POTENTIAL DEMMlD DOES NOT MEET DESIGN SPECIFICATIONS, INCLUDING SEISMIC o COMBUSTION ENGINEERING 2 TRAIN LEVEL FAILilRE ON DEMAND 2 TRAIN LEVEL FAILURE ON TEST 3 ALL OR PART UNAVAILABLE FOR POTENTIAL DEMAND o BABC0CK MlD WILC0X 1 SYSTEM FAILURE ON DEMAND 2 TRAIN LEVEL PARTIAL FAILilRE ON DEMAND 1 UNAVAILABLE FOR POTENTIAL DEMAND e O 9
O EVOLUTION OF STAFF REVIEW OF THE AUXILIARY FEEDWATER SYSTEM (AFWS) STAFF CRITERIA FOR AFWS DESIGN PRIOR TO ISSUANCE OF THE SRP (1975) SPECIFIED GOOD ENGINEERING PRACTICE PLANTS REVIEWED AGAINST THE SRP (1975 TO PRESENT) HAVE PROVIDED A
" SAFETY-RELATED* SYSTEM A REVIEW 0F THE AFWS IN PLANTS LICENSED PRIOR TO THE TMI-2 ACCIDENT (1979)
WAS UNDERTAKEN BY THE B80 TASK FORCE . O
- BOTH A DETERMINISTC AND PROBABILISTIC EVALUATION OF RELIABILITY WAS PERFORE D BY THE STAFF
- RESULTS WERE PUBLISHED IN NUREG-0611 AND NUREG-0635 FOR WESTINGHOUSE AND COMBUSTION ENGINEERING PLANTS RES KCTIVELY 1
- B&W PLANTS PERFORFED THEIR OWN AFWS RELIABILITY STUDIES (BAW-1584)
WHICH WERE REVIEWED BY THE STAFF ALL PLANTS WERE REVIEWED AGAINST THE CRITERIA 0F NUREG-0737, ITDE II.E.1.1 , AND II.E.1.2 IN ORDER TO IMPROVE AFWS AVAILABILITY AND FOUND ACCEPTABLE s O s N; 4.7 n ,.--m-==r*- -******&*Na'**-?--e'se***e-~~*~****- e r ' *
- a c
- 3-=== = + ** - * * *
- i
. O l ALL PLANTS WERE REVIEWED AGAINST CRITERIA 0F GENERIC LETTER 81-14 TO IIPROVE AFWS SEISMIC RESISTANCE AND FOUND ACCEPTABLE WITH EXCEPTION OF OCONEE SRP SECTION 10.4.9 WAS REVISED JULY 1981 TO INCORPORATE NUERICAL RELIABILITY CRITERION, 10-4 TO 10-5 / DEMAND BASED ON KNOWLEDGE GAINED DURING B80 TASK FORCE REVIEWS
^
- ALL PWRS NOT REVIEWED IN NUREG-0611 AND NUREG-0635 AND LICENSED AFTER THE TMI-2 ACCIDENT SUBMITTED A RELIABILITY STUDY UTILIZING A COMPARABLE APPROACH
- O
" THESE PLANTS (12 TOTAL) COMPLY WIB E E SRP RELIABILITY G0AL
- CURRENT NTOLS COMPLY WITH THE SRP RELIABILITY G0AL
- STAFF REVIEW 0F AFWS RELIABILITY IN OPERATING PLANTS HAS CONTINUED SINCE COMPLETION OF THE AB0VE ACTIONS
! " CRGR PACKAGE UNDER DEVELOPMENT - STATUS ADDRESSED IN SUBSEQUENT DISCUSSION 1 O 4 1 - ,. . . . - . . . _ . . . , . _ _ _ _ _ . _ _ _ , , _ _ . . , , . _ . , _ _ _ . , _ . , _ _ . . _ _ . . . _ , . . _ _ , _ _ _ _ , _ _ _ , , _ _ . _ . _ , _ . _ . . - . _ . - _ . . _ _
~ ' ll l O PWRS LICENSED AFTER THE TMI-2 ACCIDENT WHICH SATISFY THE AFWS RELIABILITY G0AL DIABLO CANYON 1 & 2 BYRON 1 & 2 CALLAWAY CATAWBA 1 & 2 ST LUCIE 2 McGUIRE 1 & 2 O PALO VERDE 1, 2, 3 SAN ON0FRE 2 & 3 SEQUOYAH 1 & 2 SUMMER WATERFORD WOLF CREEK O
NRR ' STAFF PRESENTATION TO THE O ACRS ,
SUBJECT:
APPLICATION OF AFW RELIABILITY REQUIREMENTS DATE: DECEMBER 2, 1985 PRESENTER: RONALD K. FRAHM O . SECTION LEADER PRESENTER'S TITLE / BRANCH /DIV: RELIABILITY AND RISK ASSESSMENT BRANCH DIVISION OF SAFELY TECHNOLOGY i ! PRESENTER'S NRC TEL. NO.: 492- 7112 1 SUBCOMMITTEE: DECAY HEAT REMOVAL SYSTEMS
+
O
2 i () ~ I, METHODOLOGY (NUREG 0611)
- SRP 10,4,9 REQUIRES AFWS UNAVAILABILITY RANGE OF 10-5 To 10-4 FAILURE PROB / DEMAND, HOWEVER CAN USE OTHER MEANS OF DECAY HEAT REMOVAL.
NUREG 0611 REQUIREMENTS ASSESS RELATIVE RELIABILITY COMPARISONS OF VARIOUS AFWS DESIGN (PURPOSE) NO SPECIFIC COMMON CAUSE EVALUATION USE EVENT TREES (INDUCTIVE LOGIC) FAULT TREES (DEDUCTIVE LOGIC) 0611 DATA BASE TO QUANTIFY TREES 7_ l - ANALYZE LOFW, LOOP, LOAC 1 0611 HAS RESULTS FOR OPERATING PLANTS AFWS EVALUATION INCLUDES HARDWARE FROM THE WATER SOURCE TO THE AFW N0ZZLE ON THE SG, SUPPORT SYSTEMS ANALYZED QUALITATIVELY NO HIGH ENERGY LINE BREAK OR EXTERNAL EVENTS STAFF REVIEW (ASSISTED BY BNL 8 SNL)
- DOMINANT CONTRIBUTORS FOR EACH INITIATOR (MAINTENANCE, AND HARDWARE FAILURE OF PUMPS, VALVES, ACTUATION LOGIC)
SINGLE / COMMON MODE FAILURES O
< i . O -
0611 RESULTS ARE POINT ESTIMATES WITH LARGE r i UNCERTAINTY if
- IMPROVEMENTS IDENTIFIED (AUTO SWITCH 0VER, 2
ACTUATION LOGIC, ALTERNATE WATER SOURCES) t i 1 i a j . IO 1 l' } l ( i j i l l 1 i i O I !^ - _ _ . _ _ . - - . - . ~ _ , . .
f () ' STAFF REVIEW 0F RECENT OL APPLICATIONS II. REVIEWED 17 PLANTS 2 TRAIN AFWS (I E., ANO-1, CR-3, DB-1, RANCHO SECO) 4 3 TRAIN AFWS (I E., CATAWBA, SEABROOK, MIDLAND, WATERFORD, SUMMER) 2 TRAIN AFWS UNAVAILABILITY LMFW ABOUT 10-3 TO 10-4 RANGE LOOP ABOUT 10-3 TO 10-4 RANGE f LOAC ABOUT 10-1 TO 10-2 RANGE 3 TRAIN AFWS UNAVAILABILITY n ,\J LMFW IN 10-4 TO 10-5 RANGE I LOOP IW 10-4 TO 10-5 RANGE LOAC IN 10-1 TO 10-2 RANGE N 4 l.
..w,-
-. ..- ..- ,,._m -.w. m-----..,~,,,,,_,,.,,__,,,,--__,,_.y .- - ,y _.-m _. ...m, , ..--- , -m-<- - - , , , - .r-
III, 1969 - 1981 PRECURSOR STUDY f STUDY REVIEWS LERs TO IDENTIFY AND CATEGORIZE PRECURSORS TO POTENTIAL CORE DAMAGE ACCIDENTS LER SCREENING PROCESS FOR SEQUENCE PRECURSOR REVIEW ACCIDENT SEQUENCE REVIEW SYSTEM DESIGN REVIEW PLANT ACCIDENT ANALYSIS TO DETERMINE WHICH AFFECTED SYSTEMS ARE REQUIRED TO FUNCTION SELECT LER ACCIDENT PRECURSOR ESTIMATE AVERAGE FREQUENCY AND FAILURE PROBABILITY FOR INITIATING EVENTS AND FUNCTION FAILURES []) INITIATING FREQUENCY AND FUNCTION FAILURE ESTIMATES USED IN CONJUNCTION WITH EVENT TREES TO ESTIMATE CONDITIONAL CORE DAMAGE PROBABILITY CONDITIONAL PROBABILITY ASSOCIATED WITH EACH PRECURSOR USED TO RANK PRECURSOR, IDENTIFY DOMINANT SEQUENCES, RANK SAFETY FUNCTIONS AND ESTIMATE INDUSTRY AVERAGE CORE DAMAGE FREQUENCY i () 4
O
- RESULTS PRECURSORS INVOLVING COUPLED FAILURES STILL OBSERVED:
PRIMARILY CAUSED BY ELECTRICAL FAULTS IN 1980 - 1981: NUMBER OF PWR INITIATING EVENTS AND FUNCTION FAILURES (REC 0VERY CONSIDERED) WAS LESS THAN 1969-79 PRECURSOR STUDY ADDITIONAL RISK REDUCTION PWRs: FEED AND BLEED BWRs: LONG TERM CORE COOLING DOMINANT SEQUENCES PWR O - SLOCA WITH RECIRCULATION FAILURE DC BUS FAILURE NON-RESTORATION AND AFW LOFW AND F8B FAILURE BWR LOFW WIIH FAILED L.T. CORE COOLING LOFW WITH HPCI/RCIC FAILED LOFW WITH SCRAM AND SBLC FAILURE AFW UNAVAILABILITY APPROXIMATELY 10-3 MOST FAILURES REC 0VERABLE O
~
? o O O - 1 A SYSTEMATIC PROCEDURE FOR THE I INCORPORATION OF COMMON CAUSE EVENTS INTO RISK AND RELIABILITY MODELS l by KARL N. FLEMING All MOSLEH R.KENNETH DEREMER l j Presenletl el i INTERNATIONAL POST-CONFtMtNCE SEMINAR
' 8th INTERNATIONAL CONFBMENCE ON
- STRUCTURAL MECHANICS IN react 0M TECHNOLOGY (SMiRT-8) '
" Brussels, Belgium , August 26-21,1988 ! j 1 i Pickard,LOwe andGarrick,Inc.
\ Engineers s AppliedScientists e Management Consultants j Newport Beach, CA Washington, DC i
i
M at an . o o ~ O COMPONENT LEVEL MINIMAL CUTSETS FOR EXAMPLE SYSTEM - NORMAL ALIGNMENT Min Cu sets Symbol
- Cutset Descripti;n
- 1 C Common Suction Path .
4 V3 Three Valves 1 P3 Three Pumps 1 TP2 One Turbine and Two Pumps j 2 MP2 One Motor and Two Pumps 2 MtP une Motor, One Turbine, One Pump i 1 MP2 two Motors, One Pump i 1 MtE two Motors, One Turbine 4 Vp2 One Valve. Two Pumps 4 Vi? One Valve, One Turbine, One Pump 4 VPM Une Valve, One Pump, One Motor , j 4 VtM One Valve, One Turbine, One Motor I
; % TOTAL i
l l 1
) Common Cause Events Piekard, Lowe and Garrick inc.
l
M m kl - -
~
l 0 0 - ALGEBRAIC EQUIVALENT OF THE MINIMAL } CUTSETS FOR NORMAL ALIGNMENT (A1 ) Independant Tems Comon Cause Tems [ covering 29 minimal cutsets] [tovering 100 minimal cutsets] C V4 1 3
+ 4V g 4p 3
l
+ (Pg + T)(Pg + M g )(Pg+H) g + 4V 3
1
+ 4Vg (Pg + T)(Pg+M) g + 12V21 Y i
+ 15V 2
l
}
+ 10Pt2V (El + II
+ 10P V M121 !
+ 10V P22
) + 10V EM1T
+ 3P P12
(
+ 3P 2
+ 2P M21
+ 2P M22
+ 4P V21
] +PT 2 I Common Cause Events
; + pp pl Ntitatti, Ltwee and Garrick inc.
J
+Ht 2 l
r -- ri n n 0 - W ie p
!#g ANALYSIS OF A SINGLE COMMON CAUSE >ad YEVENT PRIOR TO PARAMETER ESTIMATION Plant (Date) Status Event Description Cause-Effect Diagram /M- f Point Beach 1 and 2 Power Preoperation strainers left in h
E suction Ifne plugged, making (April 1974) motor-driven AFW pump A on Unit 1 - inoperable. Similar strainers were found in Unit 1 motor-driven AFW p i pump 8 and Units 1 and 2 turbine- r driven AFW pumps. 1 T PU S EVENT CLASSIFICATION I o D f" W Plant P P P P N/A Shock Type 0 1 2 3 4 Fault Mode p Point Beach 0 .9 0 0 .1 0 > N G 'l eW yg. ;;ag 0 .9 0 .1 0 0 Lethal (L) I rt S) P,..t , 0 0 0 0 0 , .
~
-- - e- .t
- cl43
.a l
1
O CLASSIFICATl2N AND IMPAChSSESSMENT OF EVENTS O INVOLVING DEPENDENT FAILURES AND UNAVAILABILITIES OF AUXILIARY FEEDWATER PUMPS Sheet 1 of y stat.s Event Description Ca.se-If fect 3f agram App 1tcation p U"
, 0 1 2 3 4 Cinna Crittcal T.e motor-def ven ausf1tary feedwater IDecenter 1973) p.mos inoperatie due to atr tn ,, Ctana 0 0 1 0 0 0 commes sucttaa line.
. s
- Grohnde 0 0 0 0 0 1 e e ary 1914) attes d1. e fac$ era due N Ifon 2 0 0 1 0 0 0 test to afr in sectf en Itr.es. . g i..... g
'w Crohade 0 0 0 0 0 1 se eunee ino,encer1979)
$heldo.e 8etle elected aust1tary feed.ater pump tiralners caustag reauced flow. Q Ke.eunee 0.9 0 0 0.1 0 0
= Grohnde 0.9 0 0 0 0.1 0
....ss Turkey Point 3 991 Po.er Ausfilarf feed.ater pumps A and B Tv*tly (suy 19741 failed to Start due le if ght pactieg. Potat 3 0 0 1 0 0 0 (two event:1 '***
Purp gsvernerC ttaegd. fa ure.b::t trippee sue to Po.se ,reoperstf en strainers left in s Po.tet 1 .4 ?Beach taction line platted. setteg (April 1974) motor. drives easilfary feee.ater Potat sump A en tinit I tesperatie.
- Beach 1 0 0.9 0 0 0.1 0 htetter Strainers were found in Ue tN p p Nd.1ttslandI tur.ttre Crohnde 0 0.9 0 0 0.1 0
,ee .a,dr.iv.e.n.austlf te .. ary -
1, , so.td f. aier p p. 1, , 0 0 i 0 0 0
'5'"*'""' ni inroe'i:'h a.. iier,Ne':,:"'#
i:ll:: tnat ,eL..itea fro.ac,,,r, c.nt,.i s.iten moes ranure of cr nnde 0 0 0 o 0 1 g a .a.ticassen. eve t e pressure i.iten ... DEPENDENT EVENTS Pickard, Lowe and Garrick, Inc. V V /
;7 m m r D -- - r.: 7 O O' L," .
O CLASSIFICATION AND IMPACT ASSESSMENT OF EVENTS INVOLVING DEPENDENT FAILURES AND UNAVAILABILITIES OF AUXILIARY FEEDWATER PUMPS (CONTINUED) a.. me r .r e s g;,*, ii.s.e c...s o...,,,sie. c.. cer.ci si. . ,,,u . . si . ,, ,, ,, ,, ,, a f;;;.!,i.,.i '~" ri : 0 0 i 0 0 0 i.:.:.!!!.'e?.
. .. .. !.!!.!:'.M tit $."it:f.U.
Brohnee 0 0 0 0 0 i is::.' ,i.rii '"'
.i:ll!!'3, t ni.e .
i~eur . .!!:
. .t.'a,,e.n.t.'t "' " 0 0 i 0 0 0 i.
trohete 0 0 0 0 0 i Unfit!$$ !b!$s!' fakik !Y !Ma N.!r$v7le k$nE4 8 8 9 0 0 1 gy ytyyj, 8tet a pump setent.et ) w arehnee a e a e e i fh5$'IteNc ten we to N sistee settpe probies. n!ht Ah6 8 8 8 1 0 0 0 trehnte O 8 0.9 0 0.1 0 Totai 0.9 0.9 0.9 0 0.3 7 -r l cause-Iffeci ciaoram: . I I e rYtrr.r
- I !:i::i'".Et:i
, . Mi
- :::::n:,2"-- ~:
l ,, I DEPENDENT EVENTS , ,3 , PlchardlL~ovie~end Garrick. Inc. 3 - ;
~
* - ~ -
h jj(; l,. , j l ' ly. [-f'.
.:.__J .
! COMMON CAUSE DATA
SUMMARY
WORK SHEET FOR l l DIESEL-DRIVEN AUXILIARY FEEDWATER PUMPS l 1 COMPONENT: EFW PUMP AND DIESEL BLOCK FAILURE MODE: ALL - i GROUP SIZE: 4 'l
- IMPACT VECTOR: -
i j no ni n2 n3 n4 ns ng N/A* { 5.4 3.8 4.4 1.4 10.2 - - 7 i i OTHER INDEPENDENT EVENTS = 828.1 . l MGL MEAN VALUES: I l 2n2 + Sn3 + 4n4 + 1
, = = 54.8 = 'O.08 ni + 2n2 + Sn3 + 4n4 + 2 887.5
~
3ns+ 4n4 + 1
= 48.0 = 0.82 i
y = 2n2 + Sn3 + 4n4 + 2 , 55.8 j* il l 4n4 + 1 - 1 = 41.8 47.0
= 0.89 .
j 6 = 3n3 + 4n4 + 2 s
.']/
j . . j *N/A = NOT APPLICABLE ' l i i DEPENDENT EVENTS Pickard, Lowe and Garrick, Inc. O %.) .) I
M as M ,
~
O O O THE DISTRIBUTION dF MGL PARAMETERS FOR THE EFW PUMP (EXCLUDING DRIVER) 1.0 0.9 - 0.8 -
# FACTOR DISTRIBUTION O.7 0.6 -
0.5 - 7 FACTOR DISTRIBUTION 0.4 - 0.3 - 0.2 - 0.1 MEAN $ = 0.05 MEAN 7 = 0.82 V I I i i IV I l I 0.1 0.2 0.3 0.4 0.5 0.8 0.7 0.8 0.9 1.0 Common Cause Events Pickard, Lowe and Garrick Inc.
m u O O - O CAUSE TABLE FOR EXAMPLE AUXILIARY FEEDWATER E SYSTEM FOR THREE ALIGNMENTS EVALUATED USING MGL MODEL M tor-Driven Pump Turbine-Driven Pump Normal Alignment in Maintenante in Maintenance Cause Frequency cause Frequency Cause Frequency P3 4.2(-4) P3 4.2(-4) P3 4.2(-4) V4 3.6(-4) 2TV1 4.2(-4) V4 3.6(-4) 4Y3 2.5(-5) V4 3.6(-4) M2 1 9(-4) M2 (P1 + T) 1.1(-5) P2 1.9(-4) P2 1 9I-4I 4Vg (Pg + T)(Pg+M) g 2.7(-6) (Pg + M1 )(Pg + t) 1.8(-4) 4Vi (Py + 111 ) 4.7(-5) C , 2.3(-6) 4V3 2.5(-5) 4v3 2.5(-5) 12V V21 1.9(-6) 5V2(Pi+T) 1.2(-5) 4M V21 2.9(-6) Others - 2.0(-6) Others - 4.0(-5) Others - 2.0(-5) Subtotal 8.2(-4) Subtotal 1.6(-3) Subtotal 1.3(-3) { Alignment _y Alignment Alignment 4*6(-3) 3*6(-3) Probability Probability Probability Total Total Total 6*0(-6) 8*2(-4) 5*8(-6) Contribution Contribution Contribution Common Cause Events Plekerd Lowe and Garrick Inc.
O O O SYSTEM QUANTIFICATION RESULTS BASED ON THREE PARAMETRIC MODELS Basic Parameter Multiple Greek Binomial Failure Algebraic Term Model Letter Model Rate Model 5.5-4 4.2-4 6.8-4 P3 3.8-4 3.6-4 3.8-4 V4 4.1-5 2.5-5 4.9-5 4V3 1.9-5 1.1-5 1.9-5 M2 (P1 + T) 2.7-6 2.7-6 3.1-5 4Vg (Pg + T)(Pg+M) g C 2.3-6 2.3-6 2.3-6 f 2.0-6 1.9-6 1.9-6 ,l 12V V21 Others - 2.0-6 - 2.0-6 - 2.0-6 Total 1.0-3 8.2-4 1.1-3 Pit:httd, Lowe and Garrick inc. Common Cause Events b
O O ~O ; ;. COMPARISON OF CAUSE TABLES FOR THREE AUXILIARY - FEEDWATER SYSTEMS IN NORMAL ALIGNMENT . t EVALUATED USING MGL MODEL . Two Hotor- r ; One ine-Driven Three Motor-Driven (two steam generators per train) , Cause Frequency Cause Frequency Cause Frequency D 3 4.2(-4) P3 4.2(-4) P2 8.0(-4) V4 3.6(-4) V4 3.6(-4) V4 3.6(-4) 4V3 2.5(-5) M3 9.5(-5) M2 1.9(-4) l M2 (P1 + T) , 1.1(-5) 2.5(-5) 4V3 4Vi (P1+M) 1 4.7(-5) 4V3 (Pg + T)(Pg+M) g 2.7(-6) 4P V21 2.B(-6) (Py + M g )(Pg+M) g 9.B(-6) C 2.3(-6) C 2.3(-6) C 2.3(-6) 12V V21 1.9(-6) 12V V21 1.9(-6) 12V V2I 1.9(-6) Others - 2.0(-6) Others -4.0(-6) Others - 1.0(-6) l Total 8.2(-4) Total 9.1(-4) Total 1.4(-3) Cc:nen Cause/ Comon Cause/ Total *996 *997 Comon Cause/ Total Total *958
\ ___
Coenmon Cause Events Ptehad teesandGudekim
O # ' -
~
I CONCLUSIONS ABOUT METHODOLOGY l i e SYSTEMATIC APPROACH TO CCF ANALYSIS j DEMONSTRATED 1 e CHOICE OF PARAMETRIC MODEL NOT AS CRITICAL AS HOW ITS INTEGRATED i i j e DATA ARE AVAILABLE;IT NEEDS TO BE ANALYZED I e IMPORTANT JUDGEMENTS AND UNCERTAINTIES STILL [ REMAIN l
- HOW TO DEFINE COMPONENT GROUPS '
ASSESSMENT OF IMPACT VECTORS
- SPA, CITY OF DATA FOR HIGHER ORDER PARAMETERS i n I
e REALISTIC RELIABILITY PREDICTIONS NO LONGER HINGE ON UNPROVEN ASSUMPTIONS ABOUTINDEPENDENT . EVENTS ! Picketti, Lowe and Garrick, Inc.
O O O - CONCLUSIONS ABOUT SYSTEM RELIABILITY 6v W g/'/> f e CURRENT TWO AND THREE TRAIN AUXILIA '; SYSTEMS (AFWS) HAVE SYSTEM UNAVAILABILITIES ON THE g/sur h b y 0 ORDER OF 10-3/ DEMAND v44A*"I
+ w or to
@y AFWS UNAVAl ITY DOMINATED BY COMMON CAUSE Ir
'% pacyMThdifroze5C6 Ax/4:WE6FTW6
- EVENTS - M '
SN 1. ccp e PRINCIPAL BENEFIT OF STEAM DRIVEN PUMP IS - INDEPENDENCE OF ELECTRIC POWER VERSUS ADDED : DIVERSITY - l b h1 f l f / e NEED TO RETHINK THE USE OF REDUNDANCY AND l' 43 l\ DIVERSITY AS A DEFENSE AGAINST COMMON CAUSE FAILURES Y '
.Pickard, Lowe and Gerrick, Inc.
l
O O-O COMMON CAUSE FAILURE RELIABILITY BENCHMARK EXERCISE ' t e PURPOSE IS TO DEVELOP CONSENSUS CCF ANALYSIS PROCEDURES t e COORDINATED BY JOINT RESEARCH CENTER, ISPRA. ITALY e TEN TEAMS FROM EUROPE AND U.S. ANALYZING SAME PROBLEM ! e PLG REPRESENTING U.S. UNDER EPRI/NRC SPONSORSHIP e PARALLEL EFFORTS AT EPRI AND NRC TO DEVELOP PROCEDURES I e PROBLEM IS LOSS OF FW AT KWU PLANT - SIX-TRAIN SYSTEM i i e INDEPENDENT FAILURE ANALYSIS FIXED ! l e FIRST OF TWO ANALYSIS PHASES COMPLETED : e SCHEDULED FOR COMPLETION, MARCH 1986 I Pickard, Lone and Gamisk, sec.
< a .ameg.wv memssmee m.mPO-;y.:;s.;
nSQ
. mh ..g. ?:j y - .g -
y.. ~ O_ J : +!-if *. f c. N ' ?j:.f.2 i. , ,. g g . [ 'i PRELIMINARY RESULTS OF THE CCF-RBE BENCHMARK - TECHNICAL APPROACH . fj id-
.3 TEAM OUALITATIVE i .'
QUANTITATIVE > gr A. BELGIUM FMEA BETA FACTOR B. DENMARK SYSTEM FAMILIARIZATION BINOMIAL FAILURE RATE C. FEDERAL REPUBLIC SYSTEM FAMILIARIZATION BETA FACTOR, MARSHALL OLKIN OF GERMANY-1 (GRS) D. FEDERAL REPUBLIC SENSITIVITY ANALYSIS MARSHALL OLKIN OF GERMANY.2 (KFA) E. FEDERAL REPUBLIC SYSTEM FAMILIARIZATION MULTIPLE GREEK LETTER - ; OF GERMANY 3 (KWU) F. FRANCE GENERIC CAUSE ANALYSIS G. ITALY MULTIPLE GREEK LETTER ' SYSTEM FAMILIARIZATION BINOMIAL FAILURE RATE H. SWEDEN i SYSTEM FAMILIARIZATION MULTIPLE GREEK LETTER
- 1. UNITED KINGDOM FMEA/ CHECKLIST MODIFIED BETA FACTOR, CUTOFF J. UNITED STATES SYSTEM FAMILIARIZATION ,, } j MULTIPLE GREEK LETTER.
r-si1 Oh a
;5; 1
DEPENDENT EVENTS Plekard, Lowe and Garrick, Inc. ) O \-
O O - CCF-RBE BENCHMARK PRELIMINARY POINT ESTIMATE RESULTS Independent Failure Contribution 9r, , , , BELGIUM i @ @- 1 DENMARK - i ee FRG-GRS $$ l FRG-KFA '
-I FRG-KWU l @
l FRANCE lI S-G I I ITALY g g I SWEDEN --l @ @ l' l' U.K. l -@ @ I U.S. I I. . . IO'S 10-' io-Y Pickard, Lowe and Garrick, Inc.
. _7 .
o O - O
~
i DEVELOPMENT OF CONSENSUS APPROACH TO i DEPENDENT EVENTS ANALYSIS EVENT CLASSIFICATION SCHEMES ' j U i ] h0hW BAtA j NAses l ___
- i j
5 buMMENt 00 Alt EXittlN6 j i PnoctounE GUIDES
$ [tgguM "
CONetN908 APPROACH btPtNDENT EVENTS 4
-ppgggg l ANALY8tt i
f - NR0 , i
~ "R '
EUMVLk1to PnAn ,
- EEC '
v f.: l INttNNAtidNAL - 9tNtHMANit
- EXtMC19th , ,
~ .~ - '~
~
. UtPEWENf EVENf6 Pickard, Law. nd carrick. in J ~ ". 'i 1 i
p ,I ~~~~,-:~ 3- . -.. , '..
-[j.
' t i
- x. , .
5 f
O e ,
"; ~ -
~
GENERAL COMMON CAUSE FAULT TREE SUBTREE FOR COMPONENT A IN A COMMON CAUSE GROUP OF N
- COMPONENTS fall, ,
t L'un'J/1 A A T
-I
,,'OL ESTU7e47' F AILURE . - - -
A 1 I Ii, I il1
=r.=.^r coveauturs
=r.
courouturs
- = ... =r.=^=
ccuecuturs t
.a, actst au
,, j j j "w*
tu ? , Q p l -l b b' (";') (,,') (~:')-> Ef".L ("r') - - > i Pickard, Lowe and Garrick Inc. ; Common Cause Events
NRR STAFF PRESENTATION TO THE O ACRS
SUBJECT:
STAFF COMMENTS ON PLG REPORT DATE: DECEMBER 2, 1985 PRESENTER: ADEL EL-BASSIONI O SENIOR RELIABILITY & RISK ANALYST PRESENTER'S TITLE / BRANCH /DIV: RELIABILITY AND RISK ASSESSMENT BRANCH DIVISION OF SAFETY TECHNOLOGY PRESENTER'S NRC TEL. NO.: 492-7646 SUBCOMMITTEE DECAY HEAT REMOVAL SYSTEMS O S O j
O . HIGHLIGHTS OF THE PLG STUDY TREATMENT OF CCF IN PUBLISHED PRA STUDIES IS INCONSISTENT AND NONSYSTEMATIC RAND 0M INDEPENDENT FAILURES CONTRIBUTED LESS THAN 1% OF THE POINT ESTIMATE OF AFWS UNAVAILABILITY [ INCREASING THE REDUNDANCE OF A 2 TR AFWS BY ADDING A THIRD i
- TRAIN IMPROVED THE PER DEMAND UNAVAILABILITY BY A FACTOR OF ABOUT 1.5 ADDITION OF A THIRD DIVERSE TRAIN SLIGHTLY INCREASED THIS FACTOR TO ABOUT 1.7 O
(NET EFFECT OF DIVERSITY IS UNAVAILABILITY REDUCTION OF ABOUT , 10%) I
- A TYPICAL 3 TR AFWS CONFIGURATION UNAVAILABILITY IS ABOUT t
j 1.0E-3 PER DEMAND O 1 A
'*# "" * * " ' * '~ '
F J ([) l ' STAFF EVALUATION , METHODOLOGY: ATTRACTIVE AND SYSTEMATIC HAS A NUMBER OF LIMITATIONS CCF COVERAGE IS LIMITED TO TREATMENT OF DEPENDENCY AMONG SIMILAR COMPONENTS EXTENSION TO DISSIMILAR COMPONENTS WILL DEPRIVE IT OF SIMPLICITY, 4 FAILURE DEPENDENCY EXPERIENCE DATA IS STILL SPARSE METHODOLOGY RELIES ON SUBJECTIVE INTERPRETATION OF DATA AND,ITS APPLICABILITY Lt CASE STUDY EVALUATION DID NOT ACCOUNT FOR AFWS SUPPORT {I I SYSTEMS, AND FOR REC 0VERY ACTIONS THAT MIGHT HAVE IMPROVED AFWS UNAVAILABILITY p i x
"O STAFF EVALUATION (CONTD.) ,
DEVELOPING FTs BEYOND BASIC EVENT LEVEL (T0 SUB-BASIC EVENT) RESULTED IN AN INCREASE IN THE NUMBER OF CUTSETS BY A FACTOR OF 5 SUCH AN INCREASE CAN OVERBURDEN THE ANALYSIS r METHODOLOGY EMPHASIZES THE QUANTITATIVE ASPECTS OF THE q ANALYSIS AS COMPARED TO QUALITATIVE ASPECTS (INSIGHTS, l .; VULNERABILITIES) [
,O a
t O
4 STAFF EFFORTS lHE CALL FOR CAREFUL, WELL DISCIPLINED, AND CONSISTENT TREATMENT OF DEPENDENT FAILURES HAS THE FULL SUPPORT OF THE STAFF CCF HAS HIGH PRIORITY IN SEVERAL RES AND NRR PROGRAMS
~
SYSTEMS INTERACTION
# i RMIEP l
COOPERATIVE EFFORT WITH EPRI EUROPEAN CCF RELIABILITY BENCHMARK EXERCISE
- O (JRC ISPRA)
{ i f kf l ] l f
,,w-- - - , , - , - -
- - . - - . ..e., 4.r-m_. _ , . _ , - . , . _ , _ , , . - . . . . - _ _ , - , _ .. . .._,_..m ,. . . , _ - . . , . . , , . . . ,_ . . . - .
t' Y-"; , ,- - _ , . , _ ,
.9 0
CONCLUSIONS IMPACT OF CCF ON AFWS UNAVAILABILITY MAY HAVE BEEN OVERSTATED WE DO NOT AGREE WITH THE REPORT CONCLUSIONS ABOUT IMPACT OF DIVERSITY ON SYSTEM UNAVAILABILITY
; STAFF RECOGNIZES THAL ASSURANCE OF INDEPENDENCE AMONG REDUNDANT , AND DIVERSE TRAINS IS THE REAL KEY TO AFWS UNAVAILABILITY IMPROVEMENT i
l' t I
O O O i PRESENTATION OUTLINE t i e COMMON CAUSE ANALYSIS PROCEDURES e EXAMPLE " GENERIC" ANALYSIS OF THREE-TRAIN AFWS i e CONCLUSIONS AND INSIGHTS e INTERNATIONAL BENCHMARK EXERCISE ! f i f l 1 , l Pickard, Lowe and Garrick, Inc. I
~ '
~
- O O O -
MUTUALLY EXCLUSIVE PROPOSITIONSM ('**# A. WE DON'T KNOW HOW TO DEFINE IT, MODEL IT, QUANTIFY IT, OR KNOW EXACTLY WHAT CAUSES IT.
- B. WE KNOW HOW TO DEFEND AGAINST IT.
w pgg men pasess => svn Wlor y cwnsi~nm isonse
=} W f MWh s;pa.~ a w-py-y 4 Yh A.as y&M %'neL4/s, M, jd M at~u/p v a~ WgA4~&
u ~p % w e ss a s ~ n r
^
I M mmw&&pJo L~n -
"" " Pickard, Lowe and Garrick inc.
U )
n a n .
~
O O - O SYSTEMATIC PROCEDURE FOR SYSTEMS ANALYSIS
- 1. SYSTEM FAMILIARIZATION
***"^ "" #'f"'
M "
- 2. LOGIC MODEL DEVELOPMENT * **"**
- 3. BOOLEAN ANALYSIS ='" AM
- 4. ALGEBRAIC MODEL DEVELOPMENT *#"d"~
l
- 5. PARAMETER ESTIMATION N"%f *"
- 6. SYSTEM QUANTIFICATION
- 7. RESULTS INTERPRETATION
- CRITICAL STEPS FOR COMMON CAUSE ANALYSIS Plckard, Lowe and Gstrick Inc.
Common Cause Events
- O .
O O - 4' l SIMPLIFIED SCHEMATIC OF MAJOR COMPONENTS IN AN EXAMPLE AUXILIARY
- FEEDWATER SYSTEM fo0A' M g+/bM pf l 0D
_ _ __ y T STE M MDP1' N @ TO STEAM
] T V2 r GENERATOR 2 SUPPLY TANK XC A TO STEAM r GENERATOR 3 j 4 v.3 I
MDP2
> G NER OR4 v4 Common Cause Events Pickard, Lowe and Garrick Inc.
O O O
~
i RELIABILITY BLOCK DIAGRAM OF l AUXILIARY FEEDWATER SYSTEM
- NORMAL ALIGNMENT l' tI4t Atutt Y INLtt V ALVt '
p V3 [ / MOTOR ORIVE PUMP STE AM h
- NLtt V LVE -
V4
/ QQ- p
,- f Nt ATON INLttVALVE y
MOTOR DRIVE PUMP I STE AM NLET V VE V2 cONutNBAtt l'u"O lRv't
- - - ~ --~
ENE ATOR (r y
- y INLET VALVE vi STE AM i
fNLET VVE 2 TUR8tNE
~- - I f TE MVALVES p3
'*'tETv^I0v"E v3 ENE ATOR Common Cause Events ,
Pickard, Lowe and Garrick inc.
O O O COMMON CAUSE EVENT SUBTREE FOR MOV V1 - FAlt.URE OF VALVE . V1 A hjA r - - - - - N MN l ! FAILUME l CAUSE CAUSE I CCF l FAILUME (CCF) FAILUME(CCk) A 6 P l CCF l l CCF l l CCF l { CCF l l CCF ! CCF l l , f Common Cause Events Pickard, Lowe and Garrick Inc. f O tJ I}}