ML20232B443

Request for Supporting Information for the D.C. Cook SPRA Audit Review - Plant Response Model Questions

ML20232B443
Person / Time
Site:	Cook
Issue date:	03/25/2020
From:	Stephen Philpott NRC/NRR/DORL/LPMB
To:	David Williams - No Known Affiliation
Philpott S
References
Download: ML20232B443 (7)

Text

From: Philpott, Stephen To: David L Williams Cc: Valentin-Olmeda, Milton

Subject:

Request for Supporting Information for the D.C. Cook SPRA Audit Review Date: Wednesday, March 25, 2020 11:24:00 AM Good morning Dave, The purpose of this email is to request the following information to support the audit review of the Donald C. Cook Nuclear Plant, Units 1 and 2 (CNP) 50.54(f) seismic probabilistic risk assessment (SPRA) submittal dated November 4, 2019 (ADAMS Accession No. ML19310D805). The NRC staff is using a technical checklist (see ADAMS Accession No. ML18173A017) to guide this review. The following audit questions will support this effort. Please provide your responses to the following questions via your Scientech (OneCWCloud) e-Portal SPRA audit site.

Donald C. Cook Nuclear Plant, Units 1 and 2 (CNP)

Plant-Response Model Questions Question 1 - Topic #12 - Selection of Dominant Risk Contributors that Require Fragility Analysis Using the Separation of Variables Methodology (SPID Section 6.4.1)

Section 4.4.1 of the submittal states that once dominant contributors were identified they were subject to refined analysis methods detailed in EPRI TR-103959 using the separation of variables (SOV) approach.However, the fragilities for over one-half of the top 10 seismic-induced failures reported in Tables 5.4-2 and 5.5-2 of the submittal used refined CDFM, judgement, and screened fragilities. This issue was the topic of SPRA peer review Facts and Observations (F&Os) 22-2 and 22-5. The recommended closeout of F&Os 22-2 and 22-5 requested a fragility sensitivity analyses on SCDF and SLERF be performed for the remaining risk important SSCs that do not have a refined analysis. The NRC staff reviewed the sensitivities provided in Section 5.7 of the submittal where Am values were increased by 50 percent for these SSCs (Case 14c). It is unclear to the NRC staff whether the modeling of these SSCs is masking the risk importance of other SSCs. In light of these observations, provide Tables 5.4-2 and 5.5-2 for the case 14.c sensitivity study and discuss the significance of these results to the SPRA submittals conclusion.

Question 2 - Topic #12 - Selection of Dominant Risk Contributors that Require Fragility Analysis Using the Separation of Variables Methodology (SPID Section 6.4.1)

Tables 5.4-2 and 5.5-2 provide risk significant SSCs for Unit 1. However, no Unit 2 risk-significant SSC results were provided. The licensee states in Sections 5.4 and 5.5 of the submittal that even though there are small numerical differences, the risk insights from Unit 1 are applicable to Unit 2.

However, Section 8.2 of the CNP SPRA Quantification Notebook details the modeling differences between Units 1 and 2. Some examples are that the same relay fragility groups have different failure probabilities, there are several asymmetries in the instrument air and 600vDC systems, differences in fire impacts, and additional differences in safe shutdown seal failures. In addition, Section 5.3 of the CNP SPRA Quantification Notebook states that Unit 2 SCDF and SLERF Fussell-Veseley (F-V) are within 2 and 4 percent of Unit 1.In light of these observations, identify any risk-significant Unit 2 SSCs that are not on the Unit 1 list, provide F-Vs for these SSCs, and discuss the impact of these SSCs to the SPRA submittals conclusions.

Question 3 - Topic #14 - Peer Review of the Seismic PRA, Accounting for NEI 12-13 (SPID Section 6.7)

Section 5.1 of the submittal states that the internal events F&O dispositions are provided in Appendix B of the CNP SPRA Model Notebook. In reviewing this appendix and open F&Os 2-10 and HR-B2-01, regarding Pre-initiator HRA, it was determined that several updates were made to the IEPRA HRA and that they were incorporated into the SPRA model used for the submittal.

However, Section 5.1 of the CNP SPRA HRA Notebook states that all internal events pre-initiator Human Failure Events (HFEs) were screened from the SPRA model. Therefore, it is unclear to the NRC staff the status of the pre-initiator HFEs in the SPRA model and if they were screened out or used.In light of these observations:

a. Provide clarification on the status of the internal events PRA pre-initiator HFEs in the SPRA model.

b. If not included in the SPRA model, provide justification for excluding

pre-initiator HFEs from the seismic analysis.Also provide justification, such as a sensitivity study, that the exclusion of the pre-initiator HFEs does not impact the results of the submittal.

Question 4 - Topic #15 - Documentation of the Seismic PRA (SPID Section 6.8)

Tables 5.4-1 and 5.5-1 of the submittal summarize the top ten SCDF and SLERF cutsets, respectively. During the review it was noted that the multiplication of the basic event (BE) probabilities in the cutset did not match the cutset probability. During the audit, Section 8.1 of the CNP SPRA Quantification Notebook was reviewed, which states that BEs that begin with a hyphen - are complement events and that the BE probability for the complements presented in the cutset are the failure probabilities. Therefore, the success probability used in the cutset requires an additional calculation (e.g., success probability = 1 - failure probability). The NRC staff was able to confirm the cutset probabilities when using the success probabilities based on the cutset descriptions provided in the SPRA Quantification Notebook.

However, there appears to be inconsistencies with the application of the success logic. Section 5.2.3.3 of the CNP SPRA Modeling Notebook states that seismic failure of either the screenhouse, main control boards, reactor coolant system (RCS) piping and significant LOCAs, RCS accumulators, reactor coolant pumps, or the polar crane lead directly to core damage (D-CD).

One SCDF cutset, Cutset #2 in Table 5.4-1 of the Submittal, contains only the seismic failure of the auxiliary building that leads directly to core damage and contains no success BEs. This appears to be contrary to the D-CD scenarios listed in the CNP SPRA Modeling Notebook. But the corresponding SLERF cutset is in accordance with the CNP SPRA Modeling Notebook since it identifies direct large early release (D-LER) failures that include the auxiliary and containment buildings seismic failures. The screenhouse cutset (Cutset #1), which is stated as a D-CD event, contains three seismic success BEs, and this also appears to be contrary to the CNP SPRA Modeling Notebook criteria. The turbine building seismic failure cutset (Cutset #3) only has one failure event, which the staff understands would represent a D-CD, but the cutset contains fourteen success BEs. The other remaining cutsets have two to four failures and contain the same fourteen success BEs as seen in the turbine building failure cutset.

The application of success criteria for the screenhouse and turbine building appears to have been forwarded to the SLERF results (SLERF Cutsets #9 and 10, respectively).

Regarding SLERF, Table 7 of the CNP SPRA Modeling Notebook explains that, with the exception of direct-LERF items mapped in the seismic initiator event tree, the internal events LERF event tree remains untouched. During the review of Section 8.1.2 of the CNP SPRA Quantification Notebook that corresponded to Table 5.5-1 of the submittal, with the exception of D-LER events (Cutsets #1, 2, 4, 7, and 8), the following failures are apparently required for large early release (Cutsets #3, 5, 6, 9, and 10): containment failure due to early RCS pressure high with late depressurization, pressurizer PORV or safety valve stuck open, and RCS depressurized prior to vessel breach (note: these three BEs do not appear in any SCDF cutset in Section 8.1.1).When reviewing SLERF Cutset #3, after removing the three LERF failure, initiator, and power availability events, the only remaining failures are the seismic-induced failure of both offsite power and the supplemental diesel.However, during the review of Section 8.1.1, no cutset had only those two failures leading to core damage.For example, SCDF Cutset

1. 79, which represents the same seismic bin initiator and the same seismic failure of the supplemental diesel generator, also contained the seismic failures of Relay Groups B_2_U1 and B_5_U1. In applying the same approach to SLERF Cutsets #5 and 6, the path to core damage is seismic failure of offsite power and the ESW alignment being either east or west. It appears that SCDF Cutsets #22 and #23 are a match to these LERF sequences, but they require the additional seismic failures of Relay Groups D_1 and D_2. It is unclear to the NRC staff if the SLERF event tree, D-CD, and D-LER guidance of CNP SPRA Modeling Notebook is being appropriately implemented in the SPRA model.

In addition, these fourteen BEs represent seismic failure of the following SSCs:

RCS accumulators, main control room boards, small and medium LOCAs, polar crane, pressurizer supports, reactor coolant pump support system room, reactor pressure vessel, auxiliary building, screenhouse, containment, steam generators, containment elevation 625, and the auxiliary building valves.The NRC staff notes that most of the fourteen success BEs appear to be related to the D-CD seismic failure SSCs described in the CNP SPRA Modeling Notebook.

Given that the success BEs basically represent that this SSC did not seismically fail in an event tree logic sequence, this implies that the survival of that structure is required to implement a mitigation strategy used in the event tree.For many of the sequences there does not appear to be a causal relationship between the survival of a structure (or room) providing any mitigation of the initiator.In some cases, mitigation strategies are not available since the supporting operator action is not considered feasible (e.g., HEP is set to 1.). For example, the seismic failure of the turbine building that causes both a main steam line break and loss of mitigating strategies (submittal states that the mitigating operator actions are failed) appears to be a D-CD

event (Cutset #3),but the cutset includes the seismic survival of the same fourteen SSCs.However, with regard to other cutsets (that include seismic-induced loss of offsite power), structures that enclose the 250VDC and group B-2 relays and are impacted by internal flooding would have to survive the seismic event, but it is not apparent that the survival of these SSCs would depend on all fourteen SSCs surviving.

Section 5.2.8.1 of the CNP SPRA Modeling Notebook states that the two-top model is assembled by PRAQuant using the A AND not B logic structures where the A side represents the failures and the B side represents the success. The staff notes that this logic structure usually deletes from the resultant cutset file an A cutset sequence that matches a B sequence. In addition, the B side basic events would not appear in the results (similar to mutually exclusive logic). The staff is knowledgeable of the industry practice to include success probabilities to address the FTREX conservatism in using min cut upper bound (MCUB) calculations. However, the software program ACUBE was developed to address this issue and as stated in Section 5.3.2.3 of the submittal this program was used to quantify the SPRA model. It is unclear to the staff if this was the intended purpose of using success criteria logic.If application of the ACUBE software already accounts for the large overestimation of SCDF/SLERF from using MCUB on cutsets having success BEs, then the use of success BEs would appear to further lower the risk value (e.g., double counting) for the same issue. In light of these observations:

a. Describe how success probabilities were determined and utilized in both the PRAQuant/CAFTA and ACUBE quantification.

b. Provide the purpose, reasoning, and application of the use of success BE logic in the SPRA model. Include in this discussion how the guidance of the SPRA Modeling Notebook regarding D-CD and D-LER is reflected in the success logic of the SPRA model.

c. Provide clarification of how core damage accident sequences, including their failure probabilities, are reflected in the quantified SLERF cutsets.

d. Provide justification for the use of success BEs that appear to be unrelated to the mitigation of the specific seismic accident sequence.Include in this discussion a description of the event

tree(s) that represents the use of success logic.

e. Provide clarification if the use of success BEs in the SPRA model is to address MCUB issues and/or given the A AND not B logic, to ensure success sequences do not appear in the final results.Include in this discussion, related to the AND not logic, why do the success BEs appear in the cutset and effect the overall risk value. If used to address MCUB conservatisms, then provide justification that the use of success BEs does not impact the SPRA results when ACUBE is used for quantification.

f. Alternatively, if either the use of success BEs cannot be justified, is not appropriately applied, or is no longer required, then appropriately update the SPRA model logic and provide updated SPRA results.

Question 5 - Topic #16 - Review of Plant Modifications and Licensee Actions, If Any Section 6 of the submittal states that I&M plans to develop and implement a plant modification that will provide supplemental power to the containment DIS (hydrogen igniters) that mitigates loss of offsite power (LOOP). However, no details were provided in the submittal about this modification.

Provide the implementation schedule for this modification, details of the plant modification, assumptions that went into the sensitivity for the 50% SLERF risk reduction, and how the design will ensure the validity of the assumptions associated with this modification.

Please let me know when the responses are made available so that we can proceed with the audit review. If a conference call would be helpful to clarify or further explain any of these audit question, please let me know and I will be happy to arrange a call.

Also, we may have additional questions related to the fragility aspects of the SPRA, which I will send later.

Thank you, Steve Steve Philpott Project Manager Nuclear Regulatory Commission (NRR/DORL/LPMB) phone: 301-415-2365 e-mail:Stephen.Philpott@nrc.gov