ML20197J211
| ML20197J211 | |
| Person / Time | |
|---|---|
| Site: | Comanche Peak  |
| Issue date: | 12/18/1997 |
| From: | Kelley J TEXAS UTILITIES ELECTRIC CO. (TU ELECTRIC) |
| To: | NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM) |
| References | |
| TXX-97272, NUDOCS 9801020113 | |
| Download: ML20197J211 (13) | |
Text
.
~
~
LNe#TXX97272 F
- 10050.1 E "..=l:
905.4 (clo) 10186 nlELEC7RIC' December 18, 1997
- . C. Lance Terry Gnw We rmure U. S. Nuclear Regulatory Commission Attn
- Document C9.ntrol Desk Washington, DC 2 W 3
SUBJECT:
COMANCHE-PEAK STEAM ELECTRIC STATION (CPSES)
DOCKET NOS 50 445 AND 50 446 TRANSHITTAL OF RISK INFORMED INSERVICE TESTING INFORMATIOP-REQUESTED BY NRC REF:
Gentlemen:
At a public meoting on December 8,1997, and during folhup phone conversations with the NRC, the NRC requested that TU Electric submit a draft revision of Enclosure 2 of Reference 1.
TV Electric has developed the draft " Risk Informed Inservice Testing Program Description" (Enclosure),
TU Electric will re submit this document after final resolution of comments.
This communication contains commitments regarding CPSES Units 1 and 2 as identified in the Atta:hment.
If you have any questions, lease call Carl Corbin at (254) 897 0121.
Sincerely.
C. L. Terry t
f a
By:
James J. Kelley, Jr.
CBC/cbc Vice President of Nuclear Engineering and Support c-E. W. Herschoff,- Region IV J. I. Tapia, Region IV T. J. Polich, NRR f
NRC Document Control Desk b"', O Resident Inspectors, CPSES 9001020113 97121E' ~
H. H. H..E0. 0 pl goa anock 0 5 4 s g
R O. Box 1002 Glen Rose Texas 76N3
l l
A3.tachment to TXX 97272 Page 1 of 1 Attachment This communication contains the following commitment which will be completed as noted:
6CL Number Commitment 97 147 TV Elec. Ic will re submit the Risk Informed Inservice Testing Program Description after final resolution of comments.
The ACL (Action Correspondence Log) number is used by TU Electric for the internal tracking of CPSE5 commitments which are one time action requirements.
This communicatioa centains the following potential commitment which is ongoing in nature and will be incorporated into the CPSES licensing basis in the next appropriate update to Inservice Testing Plan (IST):
C0F Number Commitment 26998 If a risk informed Inservice Testing (IST) program is implemented, it will be maintained in accordance with an NRC approved " Risk Informed Inservice Testing Program Description". This program will be described in 3 relief request to the IST Plan.
The CDF (Commitment Data Form) number is used by TV Electric for internal tracking of CPSES commitments.
1 m
Euclcsure ta TXX 97272
-Page 1 of 11 RISK INFORMED INSERVICE TESTING PROGRAM DESCRIPTION (RI IST)
.The proposed alterndtive is a risk informed process to determine the safety significance and testing strategy of components in the ASME Section XI Inservice Testing (IST) Program, and identify non ASHE IST components (pumps &
valves) modeled in the Individual Plant Examination (IPE) that are determined to be High Safety Significant Components (HSSCs).
The process consists of the following elements.
1)
Utilization of the IPE and Probabilistic Risk Analysis (PRA) techniques to identify component importance measure values.
(IPE/PRA Techniques) 2)
Rank components based on importance measures determined by the IPE and PRA techniques.
(Component Ranknig) 3)
Blended deterministic and probabilistic data to perform a final importance ranking of components and categorization as either low Safety Significant Component (LSSC) or High Safety Significant Component (HSSC).
(Integrated Decision Process) (IDP) 4)
Develop / Determine Test Frequencies end Test Methodologies for the renked components.
(Testing Philosophy) 5)
Develop an implementation plan.
(Implementation)
C 6)
Develop a Corrective Action plan.
(Corrective Action) 7)
Perform periodic reassessments.
(Periodic Reassessments) 8)
Develop a methodology for making changes to the RI IST.
(Changes to RI-IST)
With these elements and their implementation, the key safety principle discussed in the " Basis for Acceptance" are maintained.
1)
IPE/PRA Techniaues PRA methods will be used to determine the risk significance of components based on end states of interest. such as core damage frequency (CDF) and release of radioactivity (e.g. large early release frequency (LERF)).
The PRA used to develop the importance measures will be adequate for this application, and is complemented for by the Integrated Decision Process (IDP).
As such a review of plant equipment and operating procedures will be performed to identify potential plant specific initiating events as well as those initiating events that have been identified in the Nuclear industry.
Evaluation of initiating events will also include loss of support systems and other special events such as Loss of Coolant Accident (LOCA), Steam Generator Tube Rupture (STGR),
internal flooding, station blackout and Anticipated Transient without Scram (ATWS).
RISK INFORMED INSERVICE TESTING 1
DRAFT PROGRAM DESCRIPTION December 18, 1997 l
I Encicsure to TXX 97272 Page 2 of 11' i
The PRA model used for the development of importance measures for the RI IST will be independently reviewed to ensure ragletress and
'accuraev. Additionally, when there are significant changes to the PRA methodology used in the CPSES IPE, the PRA model will be reviewed by a team of PRA practitioners to ensure comoleteness and accentability of assumptions (i.e.
Peer Review).
The PRA will be periodically updated (Sec Section 7) to reflect the current plant design, procedures, and program.
Also the PRA will be updated prior to any other IST changes (e.g. woving components to the LSSC category).
A full scope PRA is not required.
However, any limitations (e.g.
missing initiating events) will be addressed by the IDP using the methodology described in Section 2 below.
The evaluation of the change in risk will include consideration of component degradation.
This evaluation of component degredation will consider credit for enhanced testing and searches for potential compensatory measures. The avaluation will determine if common cause failure groups were affected and could be addressed by enhanced testing.
To the extent possible. plant specific data will be used to justify ranking of components as Low Safety Significant Components (LSSC).
Compensatory measures which are used as part of the IDP process to justify the extension of test interval will be re verified during the IDP process update (See Section 7).
2)
Comoonent Rankino Two figures of nerit will be used to initially risk rank components.
Fussell Vesely (FV) and Risk Ac.hievement Worth (RAW).
For the RI IST Program, the fc11owing criteria will be used to initially rank components for review by the Integrated Decision Process (IDP).
Ct.teoqty Criterion High FV > 0.001 Potentially High FV < 0.001 and RAW > 2 Low FV < 0.001 and RAW < 2 The 6CDF and 4LERF for the change are within the acceptance guideiines of draft Regulatory Guide 1061.
Until the draft Regulatory Guide is approved by the NRC. any risk informed IST change that results in an increase will be submitted to NRC for approval.
Methodology / Decision Criteria for Limited Scone PRA The following describes a methodology that may be used to categorize components in the RI IST when the program is reassessed. However. only those elements that are significantly affected by the model changes (e.g., design modifications or RISK INFORMED INSERVICE TESTING 2
DRAFT PROGRAM DESCRIPTION December 18. 1997
Encl @sure to TXX 97272 i
Page 3 of 11 procedural changes) need to be reviewed in detail using this process.
The scope of the review and the justification for it
. ill be documented as part of the IDP.
In addition, if a shutdown w
model is available, a quantitative ranking can be used in lieu of the qualitative methodology described below.
Acolv Imoortance Criteria to IPE and Review Review FV and RAW importance measures for pumps and valves considered in the IPE against the criteria and determine if the grouping of components is logical.
Review component importance measures to make sure that their bases are Well understood.
IPE Limitations Consider a range of limitations in the IPE, examples of '..'hich are described below.
Address the sensitivity of the results to common cause failures (CCF), assuming all/none of the CCF importance is assigned to the associated component.
Evaluate the sensitivity Jue to human action modeling.
Identify / evaluate operatar actions omitted by the IPE that can change the ranking of a component. The omitted recovery actions are those not credited because they are not important to the CDF.
Consider industPJ history for particular IST components.
Review such sources as NRC Generic Letters, SOERs, 10ERs and Technical Bulle'cins and rank arcordingly.
For components with low FV/high RAW ensure that other compematory measures are available to maintain the reliability of the component.
Identify and evaluate components whose performance shows a history of causing entry into LC0 conditions. To ensure that safety margins are maintained, consider retaining the ASME test frequency for these components.
Ensure that truncated components have been eliminated due to redundancy of function rather thtn mely due to reliability.
Validate or change the IPE-bas 6d component ranking.
If the validated IFE. ranking is high, rank the component high; if the IPE ranking is low and the other. factors such as the operating performance of the component validate the ranking, rank as low.
RISK INFORMED INSERVICE TESTING 3
DRAFT PROGRAM DESCRIPTION December 18, 1997
L Enclosure to TXX 97272 -
{
Page 4 of 11 Fire.-Tornado and Seismic Considerations Consider the following for, risk ranking components for external events.
Calculate risk importance measures for components in the fire and torr; ado cutsets.
Compare these calculated values and the IPE values to identify those components that are less risk significant for the IPE but more risk significant for fire and tornado.
Iteview component importance measures and the IDE limitations for fire and tornado in a manner similar to that described for internal events discussed above and adjust the rankings c.f the components accordingly.
For those components on the Safe Shutdown Equipment List (SSEL) and the containment systems list, evaluate wnether 7
the risk ranking is consistent with the seismic risk an1 adjust the ranking accordingly.
Outaae Criteria Consider the following for risk ranking components for outage I
modes:
If a component performs the same function and is in the same initial state as at pcwer, the at power ranking is assumed to bound the outage ranking.
If a component performs a different function or is in a different initial state than at power, then the cutage ranking must be evaluated. This can be done using qualitacive means.
B_ackend Imoortance Consider components / systems that are potential contributors to large, early release.
Determine FV LERF for components and/or determine which would have the equivalent of a high FV with respect to LERF and rank accordingly.
IST Comoonents Not 1D_111 Review scenarios not explicitly modele, sy the IPE to ensure an IST component is in fact low risk.
Hich Risk IPE Comoonents Not in the TST Proaram Identify other high r1sk pumps and v-1ves that are not in the IST program but should be tested commensurate with their importance.
RISK INFORMED INSERVICE TESTING
. 4 DRAFT PROGRAM DEECRIPTION December 18, 1997
..-----,_---na_--,
--a-__-----------x--
Enclesure to TXX 97272 Page 5 of.11 Evaluate the IPE moaeling assumptions and conservatisms, component failure modes, operator action, recoveries and any other effects that could substantiate the rankings.
Determine whether current plant testing is commensurate with the importance of these va'ves.
If not, determine what test, e.g 3 the IST test, would be the most appropriate.
Other Considerationi t
Review the IPE to determine that sensitivity studies for cumulative effects and defense in depth have been adequately addressed in the determination of component importances.
3)
Intearbted Decision Progen The purpose of utilizing the Integrated Decision Process (IDP) is to 3
confirm or adjust the initial risk ranking developed from the PRA re:dts, and to provide qualitative assessment based on engineering judgement and experience, This qualitative assesrment compensates for limitations of the PRA, including cases where adequate quaAtitative data is not-available.
The IDP utilizes deterministic insights, engineering judgerant, experience and regulatory requirements as described above in Section 2.
The IDP will review the initial PRA risk ranking, evaluate applicable deterministic information, and determine the final safety significance categories. The IDP considerations will be documented for each individual component to allow for future repeatability and scrutiny of the categorization process, The scope of the IDP includes both categorization and application.
The IDP is to provide determintetic insights that might inf4uence categorization. The IDP will identify components whose performance justifies e higher categorization.
The IDP will determine appropriate changes'to testing strategies.
The
?
IDP will identify compensatory measures for potentially high components or justify the final categorization. The IDP wir also concur on the test interval for components categorized as low.
The end product of the IDP will be components categorized as Low Safety Significant Component (LSSC) or tiigh Safety Significant Component (HSSC).
In making these determinations, the Integrated Decision Process (IDP) will ensure that key safety principles, namely defense in depth and safety margins, are maintained and that the changes in risk 'or both CDF ana LERF are acceptable per the guidelines discussed in Section 2 above.
The key safety princioles are described below.
RISK INFORMED INSERVICE TESTING 5
DRAFT PROGRAM DESCRIPTION December 18, 1997 l
1
___m___.___.__.
l Enc 1csure to TXX 97272-
-Page 6 cf 11 Defense in Deoth
" To ensures that defense in depth is maintained by the CPSES RI IST program, adherence to four basic principles will be reviewed and documented as part of the IDP for any future changes to the program.
The foliowing describes these four basic principles:
= 1',
No changes to the plant design or operation's procedures will be rade as part of the RI IST program which either significantly l
reduce defense in depth or place strong reliance on any particular plant feature, human action, or programmatic activity.
2.
The balance, in sources of core damage risk calculated in the CPSES IPE and IPEEE, will be reviewed to ensure that the categorization of components using PRA is done on an evenhanded bcsis covering the full scope of safety functions. A review will be done to ensure that components which mitigate the spectrum of E
accidents are not rsnked low solely because of initiating event frequency.
Further, sensitivity studies will be performed for human actions to ensure that components which mitigate the spectrum of accidents are not ranked low solely because of the i
reliability of a human action. The safety functions which uniquely mitigate LOCAs. provide reactivity control, and mitigate steam generator tube ruptures will be consiaered to ensure that couponents that support these functions are appropriately represented in the risk profile.
3.
The methodology for component categorization, namely the selection of importance measures and= how they are applied and understanding the basic reasons why component-s are categorized HSSC or LSSC, will be reviewed to ensure that redundancy and diversity are preserved as the more important principles. Component reliability can be used to categorize a component LSSC only when:
- 1) plant performance hcs been good and 2) a compensatory measure ur feedback mechanism is available to ensure adverse trends in equipment performance can be detected in a timely manner. A review will be dor.a to ensure that relaxation in the RI IST program occurs only when the level of redundancy or diversity in the plant design or operation supports it.
In this regard, all compon9nts that have significant contributions to common cause
' failure will be reviewed to avoid relaxation of requirements on those components with the lowest level of diversity within the systeia.
4.
The use of multiple risk metrics, including core damage frequency 4
(CDF) and large early release frequency (LERF), with additional checks for large but late releases and consequence mitigation, will be done to: ensure a reasonable balance between risk redu: tion methods.
Other Considerations Related To Defense In Deoth.
When the PRA does not explicitly model a component, function or mode of RISK INFORMED INSERVICE TESTING 6
ORAFT PROGRAM DESCMPTION-December 18, 1997.
. Enc 1Ssure to TXX 97272
'Page 7 of 11 operation, a qualitative method may be used to classify.the component HSSC or LSSC and to determine whether a compensatory measure is S
required.
The qualitative method is consistent with the princi)1es of defense in depth because it preserves the distinction between t1ose com)onents which have high relative redundancy and those which have only hig1 relative reliability.
Sufficient safety Marain is Maintained The IDP will perform reviews to ensure that sufficient safety margin is-N maintained wnen compared to the existing IST program.
In-performing this review, the IDP will consider such things as proposed changes to test intervals and, where appropriate, test methods. The IDP will ensure that the )roposed comps...atory measures are effective fault finding tasks, w1ere this is required in the program, to assure safety margin is maintained. To enhance the safety margin, the IDP will also review IPE important com)onents not in the current IST program for potential inclusion 1n tie RI IST program, Cateaorization Guidelines Modeled Components / Functions For modeled components / functions with a FV 10,001 the IDP either confirms the component categorization is HSSC or justification of conservatism in the PRA model will be developed.
For modeled components / functions with a FV <0,001, but a RAW E2.0.the component will be categorized LSSC provided a compensatory measure exists that ensures operational readiness and the components' performance has been acceptable.
If a compensatory measure is not available or the component has a history of performance problems, the component will be ranked HSSC.
For modeled components / functions with a FV <0.001.and a RAW <2.0, the component will be categorized as LSSC provided the components' performance has been 6cceptable.
For those components with performance problems, a compensatory measure will be identified to ensure operational readiness or the component will be categorized as HSSC, Non Hodeled Comoonents/ Functions For components not modeled or the safety function not modeled in the PRA, the categorization is as follows:
e If the sister. train is mooeled then the component takes that-final categorization.
If the component is implicitly modeled, the FV and RAW are
- estimated and the deliberation is as discussed for modeled-components / functions.
RISK INFORMED INSERVICE TESTING 7
DRAFT PROGRAM DESCRIPTION December 18, 1997
=
= _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
-Enc 1:sure to TXX 97272 j
.Pa9e 8 of 11-If the component is not implicitly modeled, the system ranking associated with the Maintenance Rule will be confirmed.
For confirmed system ranking, the component performance history will be reviewed.
For acceptable performance history the component will be categorized as LSSC.
For poor performance history, a compensatory measure will be identified to ensure operational readiness and the component catego-1ted as LSSC. or if no compensatory measures are available, categorize the component as HSSC.
Documentation Documentation of the IDP will be available for review at the plant site.
4)
Testina Philosonhv Hotor Onerated Valves (HOVs)
HSSC Testing will be performed in accordance with Code Case OHN 1 and NRC Generic Letter 89 10 and 96 05 commitments.
LSSC Testing will be performed in accordance with Code Case OMN 1, and NRC Generic Letter 89 10 and 96 05 commitments.
Relief Valves l I HSSC &
Testing will be perforined in accordance with the Code LSSC of Record as defined in 10CFR50.55a.
Check Valve Testina Strateov HSSC Testing will be performed in accordance with the ASME Code of Record as defined by 10CFR50.55a.
Certain HSSC check valves will also be tested in accordarce with the Check Valve Reliability Program (CVRP). This program was developed in response to INP0 SOER 86 03. Testing fer the CVRP includes nonintrusive testing (e.g. accoustic monitoring) and where conditions direct. valve disassembly.
The enhanced nonintrusive testing provides for condition monitoring by comparing data from current testing to a known baseline where the valve was operating in a satisfactory manner.
LSSC Testing will be performed in accordance with the ASME Code of Record as defined by 10CFR50.S5a except at a test frequency not to exceed 6 years (with 25%
margin).
RISK INFORHED INSERVICE TESTING 8
DRAFT PROGRAM DESCRIPTION December 18. 1997
Enclosure to TXX 97272
[
Page 9 of 11 Certain LSSC check valves will be tested in accordance with the CVRP as necessary.
Air Ooerated Valves (A0Vs)
HSSC Testing will be performed in accordance with the Code of Record as defined by 10CFR50.55a.
LSSC Testing will be performed in accordance with the Code of Record as defined by 10CFR50,55a except with a test frequency not to exceed 6 years (with 25% margin).
Additionally LSSC A0Vs will be stroked o,1ce during the operating cycle.
Note: Currently certain A0V's are tested using diagnostic equipment. TU Electric is participating in a tailored collaboration project with EPRI to develop an A0V program similar to the M0V Program mandated by GL 89 10 and 96 05.
This program will evaluate the valve / operator characteristics / capabilities and the design conditions under which the valve is expected to operate.
P ee this information is developed the valves will bt tested and modified as necessary to meet their safety function.
5)
Imolementation Implementation of the RI IST to LSSC will consist of grouping components and then staggering the testing of the group ovar the test frequency.
Grouping:
Components will be grouped based on:
1 manufacturer model service condition size The population of the group will be dependent on:
total population available maintaining current testing schedule Grouping components in this manner and testing on a staggered basis over the test frequency will reduce the importance of common cause failure modes as components in the same staaaerina failure mode group are continually being tested.
Testing of components within the defined group C11 be staggered over the test interval, typically 6 years.
Testing will be scheduled on regular intervals over the 6 year period to ensure all components in ti'e group are tested at least once during the 6 year test interval and not all components are tested at one t t :.
The staggering allows the RISK INFORMED INSERVICE TESTING 9
DRAFT PROGRAM DESCRIPTION December 18, 1997 1
_u
l Enclosure to TXX 97272 Page 10 of 11 trending of components in the group to ensure the test frequency
, selected is appropriate.
=
Testing will be scheduled / planned such that there is no more than one cycle between tests of components in a group.
6)
Corrective Act10D When an LSSC on the extended test interval fails to meet established test criteria, corrective actions will be taken in accordance with the CPSLS corrective action prcgram as described below for the RI-IST.
For LSSCs not meeting the acceptance criteria, an Operation Notification and Evaluation (ONE) Form will be generated.
This document initiates the corrective action process.
Also, the initiating event for a ONE Form may be from causes other than an unacceptable IST test.
The initiating event could be sny other indications that the component is in a non conforming condition. The unsatisfactory condition will be evaluated to:
a)
Determine the impact on system operability since the previous test.
b)
Review the previous test data for the component 'nd all components in the group.
c)
Perform a root cause analysis, d)
Determine if this is a generic failure.
If it is a generic failure whose implications affect a group of components, initiate corrective action for all components in the affected group.
e)
Initiate corrective " tion for failed IST components.
f)
Evaluate the adequacy of the test interval.
If a change is required, review the IST test schedule and change as appropriate.
The results of component testing will be provided to the PRA group for input to PRA model update.
(See Section 7)
For an emergent plant modification, any new IST component added will initially be included at the current Code of Record test frequency.
Only after evaluation of the compcnent through the RI IST Program (i.e.,
PRA model update if applicable and IDP reviev.) will this be considered LSSC.
7)
Periodic Reassessment As a 1 lying process, components will oe reassessed at a frequency not to exceet every other refueling outage (based on Unit I refueling outages) to re' lect changes in plant configuration, component performance test results, industry experience. and other inputs to the process.
The RISK IPT0RHED INSERVICE TESTING 10 DRAFT PROGRAM DESCRIPTION December 18. 1997 O
I Enc 1:sure to TXX 97272 Page 11 of 11 RI IST reassessment will be completed within 9 months of completion of
, the outage.
9 Pr*t of this periodic reassessment will be a feedback icop of information to the PRA. This will include'information such as com>onents tested sirce last reassessment, number and type of tests, num)er of failures, corrective actions taken including generic implication and changed test frequencies. Once the PRA has been reassessed, the information will be brought back to the IDP for deliberation and confirmation of the existing lists of HSSCs and LCCSs or modification of these lists based on the new data. As part of the IDP, confirmatory measures previously utilized to categorize components as LSSC will be validated. Additionally, the maximum test interval will be verified or modified as dictated by the IDP.
8)
Chanaes to RI ISI Changes to the process described above will require prior NRC approval.
Changes to the categorization of components and associated testing strategies using the above process will not require prior NRC approval.
As changes to component categorization are made. TU Electric will periodically submit them to the NRC for their information.
RISK INFORMED INSERVICE TESTING 11 DRAFT PROGRAM DESCRIPTION December 18, 1997 l
_ _ - - -