ML20232B443

Request for Supporting Information for the D.C. Cook SPRA Audit Review - Plant Response Model Questions

ML20232B443
Person / Time
Site:	Cook
Issue date:	03/25/2020
From:	Stephen Philpott NRC/NRR/DORL/LPMB
To:	David Williams - No Known Affiliation
Philpott S
References
Download: ML20232B443 (7)

Text

From:

Philpott, Stephen To:

David L Williams Cc:

Valentin-Olmeda, Milton

Subject:

Request for Supporting Information for the D.C. Cook SPRA Audit Review Date:

Wednesday, March 25, 2020 11:24:00 AM Good morning Dave,

The purpose of this email is to request the following information to support the audit review of the Donald C. Cook Nuclear Plant, Units 1 and 2 (CNP) 50.54(f) seismic probabilistic risk assessment (SPRA) submittal dated November 4, 2019 (ADAMS Accession No.ML19310D805). The NRC staff is using a technical checklist (see ADAMS Accession No.ML18173A017) to guide this review. The following audit questions will support this effort. Please provide your responses to the following questions via your Scientech (OneCWCloud) e-Portal SPRA audit site.

Donald C. Cook Nuclear Plant,Units 1 and 2(CNP)

Plant-Response ModelQuestions

Question1-Topic #12 -Selection of Dominant Risk Contributors that Require Fragility Analysis Using the Separation of Variables Methodology (SPID Section 6.4.1)

Section 4.4.1 of the submittal states that once dominant contributors were identified they were subject to refined analysis methods detailed in EPRI TR-103959 using theseparation of variables (SOV)approach.However, the fragilities for over one-half of the top 10 seismic-induced failures reported in Tables 5.4-2 and 5.5-2 of thesubmittalused refined CDFM, judgement, and screened fragilities. This issue was the topic of SPRA peer reviewFacts and Observations (F&Os)22-2 and 22-5. The recommended closeout of F&Os 22-2 and 22-5 requested afragility sensitivity analyses on SCDF and SLERFbeperformedfor the remainingrisk importantSSCsthat do not have a refined analysis. The NRC staff reviewed the sensitivitiesprovided in Section 5.7 of the submittal where Am values were increasedby 50 percentfor these SSCs (Case 14c). It is unclear to the NRC staffwhether themodeling of these SSCs is masking the risk importance of other SSCs. In light ofthese observations, provide Tables 5.4-2 and 5.5-2 forthecase 14.csensitivity studyand discuss thesignificance of these resultstothe SPRA submittalsconclusion.

Question2 - Topic #12 -Selection of Dominant Risk Contributors that Require Fragility Analysis Using the Separation of Variables Methodology (SPID Section 6.4.1)

Tables 5.4-2 and 5.5-2 provide risk significant SSCs for Unit 1. However, no Unit 2 risk-significant SSC results were provided. The licensee states inSections5.4 and 5.5 of thesubmittalthat even though there are small numerical differences,the risk insights from Unit 1 are applicable to Unit 2.

However,Section 8.2 of the CNP SPRA QuantificationNotebook details the modeling differences between Units1 and 2. Someexamples arethatthe same relay fragility groups have different failure probabilities,there areseveral asymmetries in the instrument airand600vDCsystems,differences infire impacts, and additionaldifferences insafe shutdown seal failures. In addition, Section 5.3 of theCNP SPRAQuantificationNotebook states that Unit 2 SCDF and SLERFFussell-Veseley(F-V)are within 2 and 4 percent of Unit 1.In light of these observations, identify any risk-significant Unit 2 SSCs that are not on the Unit 1 list, provide F-Vs for these SSCs, and discuss theimpactof these SSCstothe SPRA submittalsconclusions.

Question 3 -Topic #14-Peer Review of the Seismic PRA, Accounting for NEI 12-13 (SPID Section 6.7)

Section 5.1 of the submittal states that the internal events F&O dispositions are provided in Appendix B of the CNP SPRAModelNotebook. In reviewing this appendix and open F&Os2-10 and HR-B2-01, regarding Pre-initiator HRA, it was determined that several updates were made to the IEPRA HRA and that they were incorporated into the SPRA model used for the submittal.

However,Section 5.1 of the CNP SPRA HRANotebook states that all internal events pre-initiatorHuman Failure Events (HFEs)were screened from the SPRA model.Therefore,it is unclear to the NRC staff the status of thepre-initiatorHFEsin the SPRA modelandifthey were screened out or used.In light of these observations:

a. Provide clarificationon the status ofthe internal events PRA pre-initiator HFEs in the SPRA model.

b. If notincluded in the SPRA model, providejustificationforexcluding

pre-initiator HFEs from the seismic analysis.Alsoprovide justification, such as a sensitivity study,thatthe exclusion of the pre-initiator HFEs doesnot impact the results of the submittal.

Question4-Topic #15-Documentation of the Seismic PRA (SPID Section 6.8)

Tables5.4-1 and 5.5-1of thesubmittalsummarize the top ten SCDF and SLERF cutsets, respectively. During the review it was noted that the multiplication of thebasic event (BE)probabilitiesin the cutsetdid not match the cutset probability. During the audit,Section 8.1 of the CNP SPRA QuantificationNotebookwas reviewed,whichstates that BEs that begin with a hyphen - arecomplement events and that the BE probability for the complementspresented in the cutsetare the failure probabilities. Therefore, thesuccess probabilityused in thecutsetrequiresan additional calculation(e.g., success probability = 1 - failure probability). The NRC staff was able to confirm the cutset probabilities when using the success probabilitiesbased on the cutset descriptions provided in the SPRA Quantification Notebook.

However, there appears to be inconsistencieswith the application ofthesuccess logic. Section 5.2.3.3of the CNP SPRA ModelingNotebook states that seismic failure ofeitherthe screenhouse, main control boards, reactor coolant system(RCS) pipingand significant LOCAs,RCSaccumulators, reactor coolant pumps,orthe polar cranelead directly to core damage (D-CD).

OneSCDF cutset, Cutset #2 in Table 5.4-1 of the Submittal,containsonlytheseismic failureof the auxiliary buildingthatleadsdirectly to core damageand containsno successBEs. This appears to be contrary totheD-CDscenarioslisted in theCNP SPRAModelingNotebook. Butthe corresponding SLERF cutsetisin accordance with theCNP SPRAModelingNotebooksince itidentifiesdirect large early release (D-LER) failuresthatincludethe auxiliary and containment buildingsseismicfailures. The screenhouse cutset(Cutset #1), which isstated asaD-CDevent,contains threeseismicsuccessBEs, and this also appears to be contrary to theCNP SPRAModelingNotebookcriteria.The turbine buildingseismic failurecutset(Cutset #3)only has one failure event, which the staff understandswouldrepresent aD-CD, but the cutsetcontainsfourteen successBEs. The other remaining cutsets have two to four failures and contain the same fourteen success BEs as seen in the turbine building failure cutset.

The application of success criteria for the screenhouse and turbine building appears to have been forwarded to the SLERF results (SLERF Cutsets #9 and 10, respectively).

Regarding SLERF, Table 7 of the CNP SPRAModelingNotebookexplainsthat,with the exception ofdirect-LERF items mapped in theseismic initiator event tree,the internal events LERF event tree remains untouched. During the review of Section 8.1.2 of the CNP SPRAQuantificationNotebook that corresponded to Table 5.5-1 of the submittal, with the exception of D-LER events (Cutsets #1, 2, 4, 7, and 8), the following failuresareapparently required for large early release (Cutsets #3, 5, 6, 9, and 10): containment failure due to early RCS pressure highwithlate depressurization, pressurizer PORV or safety valve stuck open, and RCS depressurized prior to vessel breach(note: these three BEs do notappearin any SCDF cutsetin Section 8.1.1).When reviewing SLERF Cutset #3, after removing the three LERF failure, initiator, and power availability events,the only remainingfailuresarethe seismic-induced failure of both offsite power and the supplemental diesel.However, during the review of Section 8.1.1, no cutset had only those two failures leading to core damage.For example,SCDF Cutset

1. 79, which represents the same seismic bin initiator and the same seismic failure of the supplemental diesel generator, also contained the seismic failures of Relay Groups B_2_U1 and B_5_U1. In applying the same approach to SLERFCutsets#5 and 6,the path to core damage is seismic failure of offsite power and the ESW alignment being either east or west. It appears that SCDF Cutsets #22 and #23 are a match to these LERF sequences,butthey require the additional seismic failures of Relay Groups D_1 and D_2. It is unclear to the NRC staff if theSLERF event tree,D-CD, and D-LERguidance of CNP SPRAModelingNotebook is being appropriately implemented in the SPRA model.

In addition, these fourteenBEsrepresentseismic failure ofthe followingSSCs:

RCS accumulators, main control room boards, small and medium LOCAs, polar crane, pressurizer supports, reactor coolant pump support system room, reactor pressure vessel, auxiliary building, screenhouse, containment, steam generators, containment elevation 625, and the auxiliary building valves.The NRC staff notes that most of the fourteen success BEs appear to be related to the D-CD seismic failure SSCs described in theCNP SPRAModelingNotebook.

GiventhatthesuccessBEsbasicallyrepresentthatthis SSC did not seismically failinan event tree logic sequence, thisimpliesthatthe survival of that structure is requiredto implement amitigationstrategyused in the event tree.For many of the sequences there does not appear to be acausalrelationship between the survival of a structure (or room) providing any mitigationofthe initiator.In some cases, mitigation strategies are not available since the supporting operator action is not considered feasible (e.g., HEP is set to 1.). For example, the seismic failure of the turbine building that causes both a main steam line break and loss of mitigating strategies(submittal states that themitigating operator actions are failed)appears to beaD-CD

event(Cutset#3),butthecutsetincludesthe seismic survival of the same fourteen SSCs.However,with regardto othercutsets(that include seismic-induced loss of offsite power),structures that enclose the 250VDCandgroup B-2relaysandareimpacted byinternal flooding would have to survive the seismic event, butit is not apparent thatthesurvival of these SSCswoulddepend on all fourteen SSCssurviving.

Section 5.2.8.1 of the CNP SPRA ModelingNotebook states thatthe two-top modelis assembled by PRAQuant using theAAND notBlogic structures where theAside represents the failures and theBside represents the success. The staff notes that this logic structureusuallydeletes from theresultantcutset file anAcutset sequence that matches aBsequence. In addition,theBside basic events would not appear in the results (similar to mutually exclusive logic). The staff isknowledgeable of theindustry practice to include success probabilities to address the FTREX conservatism inusingmincutupper bound (MCUB) calculations. However, the software program ACUBE was developed to address thisissueand as stated in Section 5.3.2.3 of the submittal this program was used to quantify the SPRA model. It is unclearto the staffif this was the intendedpurpose ofusingsuccess criterialogic.If application of the ACUBE softwarealready accounts for the large overestimation of SCDF/SLERF from using MCUB on cutsets having success BEs, then the use of success BEs would appear to further lower the risk value (e.g., double counting) for the same issue. In light of these observations:

a. Describehow success probabilitiesweredeterminedand utilized inboththePRAQuant/CAFTA andACUBE quantification.

b. Provide the purpose, reasoning, and application of the use of success BE logic in the SPRA model. Include in this discussion how the guidance of the SPRAModelingNotebook regarding D-CD and D-LER is reflected in the success logic of the SPRA model.

c. Provide clarificationofhow core damage accident sequences, including their failure probabilities,are reflected in the quantified SLERF cutsets.

d. Provide justificationforthe use ofsuccess BEs that appearto beunrelated to the mitigation of the specific seismicaccident sequence.Include in this discussion a description of the event

tree(s)that represents the use of success logic.

e. Provide clarification if the use of success BEs in the SPRA model is to address MCUB issuesand/or given theAAND notBlogic, to ensure success sequences do not appear in the final results.Include in this discussion, related to the AND not logic, why do the success BEs appear in the cutset and effect the overall risk value. If used to address MCUB conservatisms, then provide justification that the use of success BEs does not impact the SPRA results when ACUBE is used for quantification.

f. Alternatively, ifeitherthe use of success BEs cannot be justified, is not appropriately applied, or is no longer required, then appropriately update the SPRA model logic and provide updated SPRA results.

Question5-Topic #16 -Review of Plant Modifications and Licensee Actions, If Any

Section 6 of the submittal states that I&M plans to develop and implement a plant modification that will provide supplementalpower to the containment DIS (hydrogen igniters) that mitigates loss of offsite power (LOOP). However, no details were provided in the submittalabout this modification.

Provide the implementation schedulefor this modification, details of the plant modification,assumptions that went into the sensitivityfor the 50% SLERFrisk reduction,and how the design will ensure the validity of the assumptionsassociated with this modification.

Please let me know when the responses are made available so that we can proceed with the audit review. If a conference call would be helpful to clarify or further explain any of these audit question, please let me know and I will be happy to arrange a call.

Also, we may have additional questions related to the fragility aspects of the SPRA, which I will send later.

Thank you, Steve

Steve Philpott Project Manager Nuclear Regulatory Commission (NRR/DORL/LPMB) phone: 301-415-2365 e-mail:Stephen.Philpott@nrc.gov