ML20244C293
| ML20244C293 | |
| Person / Time | |
|---|---|
| Site: | Saint Lucie  |
| Issue date: | 11/30/1988 |
| From: | Mackowiak D EG&G IDAHO, INC., IDAHO NATIONAL ENGINEERING & ENVIRONMENTAL LABORATORY |
| To: | NRC |
| Shared Package | |
| ML17223A164 | List: |
| References | |
| CON-FIN-D-6023 EGG-REQ-7842, NUDOCS 8904200138 | |
| Download: ML20244C293 (33) | |
Text
{{#Wiki_filter:-
. s .
EGG-REQ-7842 November 1988 TECHNICAL EVALUATION REPORT e'
/daho A REVIEW OF THE FLORIDA POWER AND LIGHT COMPANY SAFETY EVALUATIONS FOR EXTENDING THE ST. LUCIE National PLANT, UNIT NO. 2 ESFAS SUBGROUP RELAY TEST ;
Engineering INTERVAL Laboratory Managed David P. Mackowiak by the U.S. Department ofEnergy 1 I t.: .
,, Prepared for the 0 E G t G .n.,.
94 U.S. NUCLEAR REGULATORY COMMISSION Were performed urene DOE Contact No. M ka77 5D01.90
. ./
_ _ _ _ _ . . - - - _ - . _ . _ _ _ - - _ _ - J
V EGG-REQ-7842 1
~
A REVIEW OF THE FLORIDA POWER AND LIGHT COMPANY SAFETY EVALUATIONS FOR EXTENDING THE ST. LUCIE PLANT, UNIT NO. 2 ESFAS SUBGROUP RELAY TEST INTERVAL David P. Mackowiak Published November 1988 l l EG&G Idaho, Inc. Idaho Falls, Idaho 83415 Prepared for the U.S. Nuclear Regulatory Commission Washington, DC 20555 Under DOE Contract No. 0E-AC07-76ID01570 FIN No. D6023
. 1
)
-=
.. ABSTRACT This review examines. the FloMda Power and Light Company's (FPL's) request to the Nuclear Regulatory Commission (NRC) to amend the operating license for FPL's St. Lucie Plant, Unit No. 2. The proposed amendment
~
would change the surveillance test. interval of the Engineered Safety Features Actuation System (ESFAS) subgroup relays from 6 to 18 months. EG&G Idaho, Inc., at the Idaho National Engineering Laboratory (INEL), conducted the review to assist the NRC in assessing the validity of FPL's claim that extending the subgroup relay test interval'will not significantly impact the ESFAS availability. We examined FPL's modeling i methodologies and assumptions, compared,their models to the system I
' drawings, and checked their model quantifications for accuracy. FPL's data were examined and compared to data from other sources. We conduc'ted uncertainty and time-dependent reliability analyses to assess the impact of test interval extensions on the ESFAS availability. The uncertainty. !
analyses showed the 6-month and the 18-month system unavailability , distribution means to represent different populations. Based on these results, we conclude the impact of subgroup relay test interval extension to be significant and reject FPL's claim that the impact is insignificant. FIN No. D6023--Review of Plant-Specific Licensiog Actions For Operating Reactor Issues 11
~
SUMMARY
J This is a review of the Florida Power and Light Company's (FPL's) request to the Neelcar Regulatory Commission (NRC)I to extend the surveillance test interval of the Engineered Safety Feature Actuation System (ESFAS) subgroup relays at its St. Lucie Plant, Unit No. 2. To support its request, FPL provided the NRC with Safety Evaluations of the impact of reduced testing on two subsystems of the ESFAS, the Safety Injection Actuation Signal (SIAS), and the Auxiliary Feedwater Actuation System (AFAS). FPL analyzed the SIAS and AFAS separately because they are different designs manufactured by different companies. The review was done to' assess the validity of FPL's claim tha't the test interval extension does not significantly affect the availability of the ESFAS, and therefore ir.volves no significant hazards considerations and does not result in a safety margin reduction. The NRC's Office o,f Nuclear Reactor Regulation (NRR) requested the Probabilistic Risk Assessment (FRA) Unit of EG&G Idaho, Inc. (EG&G), at the Idaho National Engineering Laboratory (INEL), to conduct the review. The review assessed the adequacy of FPL's SIAS and AFAS analyses methodologies, data, and assumptions. Specifically, we determined the adequacy of the failure rate data FPL used for the ESFAS subgroup relays and compared them to other sources. We also determined the impact of the surveillance reduction on ESFAS availability by using uncertainty and time-dependent reliability analysis computer codes. l Based.on the data and methodology reviews and on the uncertainty anaiyses, we conclude that the test interval extention impact on the ESFAS { availability will be significant and reject FLP's assertion that the impact is insignificant. For the'AFAS model, had the uncertainty analyses shown . l no significant impact due to test interval extension, the FRACTIC IIIN j analyses' results showed that time-dependent reliability behavior would ! have to be accounted for to accurately assess the iqact of subgroup relay ~ test interval extentions. iii
.- ACKNOWLEDGMENTS 1
I appreciate the assistance of Scott D. Mathews and John P. Poloski in conducting this review. ., i ( l l l i l I 1 I iv
.-____--___-___a
ACRONYMS. . AFAS Auxiliary Feedwater Actuation System A7W Auxiliary Feedwater System CCC Consolidated Controls Corp. CE Combustion Engineering EG&G EG&G Idaho, Inc. EPRI Electric Power Research Institute ESFAS Engineered Safety Features Actuation System FPL Florida Power and Light Company INEL Idaho National Engineering Laboratory-IREP Interim Reliability Evaluation Program IRRAS Integrated Reliability and Risk Assessment System LPSI Low Pressure Safety Injection MOCARS Monte Carlo Simulation NRC Nuclear Regulatory Commission NRR Office of Nuc'. ear Reactor Regulation PRA Frouabilistic Risk Assessment SIAS Safety Injection Actuation Signal SL 2 St. Lucie Plant Unit No. 2 I V
.. CONTENTS ABSTRACT ............................................................... 11
SUMMARY
................................................'.............., iii ACKNOWLEDGMENTS"....................................................... iv ACRONYMS ........................................ ..................... v l
- 1. INTRODUCTION ...................................................... 1 l 2. SIAS AND AFAS DATA REVIEW ....................................... 3 2.1 SIAS Data ................................................. 3 ;
2.2 AFAS Data ................................................. 3. l 3. SIAS REVIEW ...................................................... 6 l 3.1 SIAS System Description ................................... 6 3.2 SIAS Methodology Review .................................... 6
- 3.3 SIAS Uncertainty Analyses ................................. 9 l I
3.4 SIAS Time-Dependent Reliability Analyses .................. 9
- 4. AFAS REVIEW ..................................................... 23 4
4.1 AFAS System Description ................................... =13 4.2 AFAS Methodology Raview ................................... 15 4.3 AFAS Uncertainty Analysas ................................. 26 4.4 AFAS Time-Dependent Reliability Analyses .................. 16
- 5. CONCLUSIONS ..................................................... 22
- 6. REFERENCES ...................................................... 23 FIGURES
- 1. SIAS actuation logic diagram ..................................... 7
- 2. SIAS reliability block diagram .................................. 8
- 3. AFAS block diagram .............................................. 14 l
vi
- 4. Time-depend 2nt- AFAS unavailability plot of the FPL c'ata for a 6-month test interval ....................................... 20 '
- 5. . Time-dependent AFAS unavailability plot of the FPL data for
, an 18-month test interval ......................................... 21 TABLES .
- 1. Summary of NUREG/CR-3862 AFAS-initiating transients for I Combustion Engineering reactors .................................. 5
- 2. Summary of MOCARS SIAS uncertainty analyses results for FPL and EG&G data ..................................................... 10
- 3. Summary of FRANTIC III SIAS time-dependent reliability analyses with a comparison to MOCARS and FPL SIAS unavailability point estimates ......................................................... 12
- 4. Summary of MOCARS AFAS uncertainty analyses for FPL and EG&G data ........................................................ 17 .
- 5. Summary of FRANTIC III AFAS time-dependent reliability analyses with a comparison to MOCARS and FPL AFAS unavailability point estimates ...................................
18
'l vii l
l O c 1. INTRODUCTION This report presents a review of the Florida Power and Light Company
' l (FPL) submittal for proposed Engineered Safety Features Actuation System (ESFAS).and Auxfliary Feedwater Actuation System (AFAS) surveillance test
]
interval changes at its'St. Lucie Plant, Unit No. 2 (SL 2). Personnel'in the Probabilistic Risk Assessment (PRA) Unit of EG&G Idaho, Inc. (EG&G) at-the Idaho National' Engineering Laboratory (INEL), conducted this review at i the request of the Nuclear Regulatory Commission-(NRC), Office of Nuclear Reactor Regulation (NRR). The FPL submittal, Reference 1, presented analyses of a typical ESFAS subsystem and the AFAS show the proposed { subgroup relay test interval changes did not significantly-affect the systems' availability. The'EG&G review assessed the adequacy of the FPL submittals' methodologies, data, assumptions, and conclusions. , The FPL analyses used standard reliability / availability modeling and l estimation techniques to demonstrate quantitatively the effects of ESFAS f and AFAS subgroup relay testing frequency on system availability. FPL used f a reliability block diagram to model the Safety Injection Actuation Signal- j (SIAS) ESFAS subsystem and a fault tree to model the Auxiliary Feedwater Actuation System (AFAS). For both models, FPL intentionally overestimated the system availability by not including wire / cable faults, test or maintenance unavailability, manual initials,'or common cause failures. FPL 1 did this to maximize t N relative importance of the subgroup relays to the j calculated system availability. The two system models were reduced to Boolean equations and were quantified using published component failure rates with the time between component failures used as a variable where ; appropriate. From these analyses, FPL concluded the ESFAS and AFAS actuation logic surveillance test intervals could be safely extended from I i the present 6 months to 18 months. I In a letter dated June 19, 1985,2 the NRC transmitted to FPL the results of the NRC staff review of FPL's request for surveillance test l l I l l l 1 i
changes, a request for more information regarding FPT's evaluation, and,a - copy of the NRC draft Safety Evaluation Report that provided the bases for - denying FPL's. request. The major relevant disagreement the NRC bcd with FPL's analyses was with the failure rates FPL used for the subgroup relays. Using the FLP assumptions and methodologies and the different
~
failure rates, the NRC results showed higher changes in system availability than FPL did. From this, the NRC concluded the EEFAS and AFAS are sensitive to changes in test interval and tentatively denied FPL's request. 3 FPL responded to the NRC's review by supplying additional information to support their contention that even using the NRC's failure rate data, the estimated change in ESFAS/AFAS availability was not statistically significant. 4 On March 7, 1986, the NRC issued a memorandum recommending FPL's application be denied unless further raview substantiates FPL's contention that the reduction in ESFAS/AFAS availability resulting from the proposed surveillance frequency reduction is statistically insignificant. The NRC requested EG&G to review the FPL submittals, References 1 and 3, to specifically determine the adequacy of the failure rate data used in the FPL submittals and determine whether or not the impact of the proposed surveillance frequency reduction on the ESFAS/AFAS availability is statistically significant. The results of the EG&G review comprise the body of this report. Section 2 presents the review of the FPL data used for the SIAS and AFAS analyses. Section 3 presents the review of the FPL SIAS analysis. Section 4 presents the review of the FPL AFAS analysis. The conclusions of the review are presented in Section 5. I e i 2
~
- 2. SIAS AND AFAS DATA REVIEW 1
For their ESFAS analyses, FPL used data from two primary sources; a reliability study done for SL 2 by Consolidated Controls' Corp., , 5 CCC-ER-1213 and- a draft Interim Reliability Evaluation Program (IREP) } component failure rate report.0 The data in CCC-ER-1213'were obtained I from MIL-HDBK-217B. FPL used the median component failure rate data from these two reports to quantify the ESFAS ~unavailabilities. Tor our review, we compared the FPL component failure rate data to { data for similar components from IEEE Std 500-19840an'd the IREP Procedures Guide,tiUREG/CR-2728.9 In general, the FPL failure rate data . were higher than the failure rates given in IEEE Std 500 a'nd NUREG/CR 2728. l 2.1 SIAS Data i The one exception to the comparison discussed above is the failure rate FPL used for the SIAS subgroup relay K501B short to power failure mode. FPL used a MIL-HDBK-2178 derived value of 6E-8/hr. The IREP ! Procedures Guide recommends a median valve of-1E-6/hr. To determine the effect of the different component failure rates on system unavailability, ! we conducted uncertainty and time-dependent reliability analyses using the FPL SIAS model and both the FPL data and the NUREG/CR-2728 recommended values. The results of these analyses are discussed in Section 3. i 2.2 AFAS Data , The relay failure modes of contacts fail to transfer (open or shut) and coil short to power dominated the FPL AFAS data. FPL used a draft IREP (Reference 6) value of IE-7/hr for contact transfer failures for all relays except for actuation relay K810, where they used a CCC-ER-1213 (Reference 5) value of 6E-8/hr. For the relay coil short to power failure they used a draft IREP value of IE-8/hr. 1 i 3 l
For the EG&G data usGd to conduct the uncertainty analyses, we used _ the NUREG/CR-2728 median values of IE-4/ demand for contact transfer . failures and IE-6/hr for relay coil short to power: Tailures. For the 6-month time-dependent reliability analysis, we used the NUREG/W-2728 mean values of 3E-4/ demand and 3E-6/hr for the contact failures and the coil failures, respectively.
- For the:18-month. test interval time-dependent reliability analysis, we used the NUREG/CR-2728 recommended procedure (Reference 9 .Part III, ,
Section 5.1, page 125) of making the upper bound on the demand failure probability the computational median for test intervals on'.the order of a refueling cycle, 18 months. This NUREG/CR-2728 recommendation affected only the contact transfer failures and resulted in a mean value of 3E-3/ demand. The results of the. AFAS uncerninty and time-dependent reliability analyses are discussed in Section 4. We also reviewed the data FPL used to determine the effective AFAS test interval by taking into account'the average number of transients that actuate the AFAS during a year. They used'EPRI NP-223010 data to' calculate an average of 2.67 AFAS-actuating transients per year. II We used data from NUREG/CR-3862 and calculated the same number of AFAS actuating transients per year. Our results are summarized in Table 1. However, as Table I shows, several plants went as-long as three years with only one transient that would actuate the'AFAS, and, of the 67 plant years considered, 13 years (19% of the total).had no transients that would activate the AFAS. Because of the variability of the i transient rate and because FPL is relying or. " miracles" (unplanned i transients) to test the AFAS, we reject their inclusion of transients as a valid reduction in the effective test interval for availability analysis l purposes. . i \ i 1 4 , i l l
1 1
)
.' i J
l
- e. - a. l.,. . . . . . . . . . i
. ~-~ I,. i
. . i .. .
..~ :
* : 4
- l. :
~
m n m u
. m ,
. : r :
- -l 4 {
. :. 1_ 1
! .; e
. e l
l
. .=
1 .
=m I : 1. :
1 g
~5 xn 4
- i. : -v 1
. i= i
.. . l mw
<=
-::.I . ,
.I :
m
<e
- E:: -! !
- . N-
=
=
. .n.
. ex \
o . R.ww= o . -
. ;"St. g.
- '.:.:: x-
, u I E. ...t:. .v l- 380.s.: 3!lE ew
. t 15.g . w. 1
-i. .
.- .!, ~
...u. .: =E.
m
.i
.t.. - .,.
o..
- 80"g , . .
. .~~. m.
mm
.-h::.P. ., a.
- 3!* - *J -
l' ~~F.,:.:::2..: . om
- . . . .... ... ]
m %. *.
. l ..~~~:. =
v
- . n*--*
1
* * - 1 -: g e ::.,$ .::.'
.... ::"15 1:-.
~
l
. . l':r g;;;: .n mm
.... ~. ... -
~ . . ..~, .
E:- ::-*: .t I . ,: tat *
*1RE!**littc 4.t.
. .&& .- . .1....~
l... ~... ...
.c
*E!*"""E""E eI', ~ . . . , ..:
- i
&"::thha. la
*:*gA. _ bad : .
g . l, P~:- : c..o.--c.F.r
. .a 5.s:e:c .I .
.a e
. . l
........... i -la - ~ ~ - - -
- .::::ce x:e. :
- c:n!
. .i ,
.:.:u.: !
. .-~.-... .-. ,~~. 2 !
SE8t&&tBES :. ;
.. ~ , ~ . .
I *.c 4.:
. .I <
r.. ..
. .- , I. .: ,~ C.'"*
.F * ::.~S~ . .a. 4~ 4 2f :.
- ! ' - 5.. ,fra K ..".* R..*'S *
. I- . . 1 . 1
' e,~-. E .y * : y.t'Etl~ t&.: *.3:
- - I..t ...
,. ..e-...
l
.. w.
\
l 5 j l
c 3. SIAS REVIEW
3.1 System Description
FPL nodeled the SIAS as a typical SL 2-ESFAS subsystem. The SIAS is-
-initiated by either two Low' Pressurizer Pressure. signals or two High Containment Pressure signals. .There are four independent measurement 4 channels. One channel may be bypassed for test'or maintenance. Bistables-condition the signals and, through isolation modules, provide inputs to the actuation modules. Upon a valid trip signal, the actuation modules' relay drivers- deenergize the SIAS subgroup relays which actuate safeguards equipment. Figure 1, from Reference 1,'shows the actuation. logic for the l-l SIAS subsystem.
3.2 SIAS Methodology Review-FPL constructed a reliability block diagram, Figure' 2, to model the SIAS. The system boundaries were chosen in accordance with Regulatory Guide 1.22 12 definitions of Protection System and Actuation Device. The model included the measurement channels, bistables, isolation and actuation' modules, associated power supplies, subgroup relay, and the. control circuit and circuit breaker for the Low Pressure Safety Injection (LPSI) Pump 2A, a typical safeguard equipment. The SIAS model does not include the pump and l its motor driver. To maximize the importance of the subgroup relays to the calculated ' system availability, FPL intentionally overestimated the SIAS availability by not including all possible component fault models or common cause failures.' Specifically, FPL did not include wire or cable faults, test or I l maintenance unavailability contributions, manual system initiation, or common cause ftilures. l l FPL trans)ated the reliability block diagram directly into a Boolean i equation. The system unavailability was calculated from the Boolean equation with the time between actuation logic tests for the ; b 6 4 1 1
'l l
_________.___._____.1_1__._____ _..__;_ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ . . _ _ _ _ _ _
O O 7r e s1 ag, s M gJ W .
, aoo lill IT id;T "
sia gg -:-j, {j' _ t i,n, o G!vs
.. M i --
3i
!ig!
le : u a *. J 7-es, se g5 -le - [g. I T s ;w
, {, a w
g i 2 r; a , -
- g,
, b)
- v. qlp -
gle dj{ * , _ ..* a sg 'I
"""I"""Jf - e c.
1 a
.y y- " 2 Y* N}N 6
B
< y __.< i
*4 ek s
N *, c3
}i lh
> t i' ,d :
I lII t h r d. o 'g"~.i'(( c E r -
- 5. $
- 1 tj. t g-
- N.r l
- 1 I -
N h 1 9
.Y
. .t kk -
- go -. _ u __ -
.J F d*i ' *1 d'. 5
_ It > ta - 5-{-j jht o h. *1 ll { { . .- .I - e gf __. uti k -
*5,
[ -
$s k;N
- a. I 1 #All 7
1
, L. I h \
I
+
$ :1 ,
. $ r g h :
T T s I-I g { l , , j 9 g -- ;
- e ,- .. ;
Y i ! i 1 1 (w
- d. #
T T 1 l l l I g l e. i E i % = 2- E k L ' f Ii t i 1 i t n l T i b i I g 5 i ' 4 3 i 7 E
^ 7
( 7 7 7 , , j r x e 5
]
9 4 j I 3 E *
= I- 6 i l'
- I h h
' $ I $ $ N
- 1 o I v s j
- s c c e g
v , 3
, t. I l l fI E Y J J N J 7.*
g lI, t, J y J
$ fe I3
- 5 .k
. H t
- fW :
l E I A f '
, E $ *
> ' i t , ,
5 I y I I E { ! i r - t i t - 1 iI e - i e 3 I I I - 1 l I l , 5 1 l
! 4 I g.
[ > v n s t -- . W ' Sh* k Hihes:see as 3. n y3. us .r..e > 8
~
subgroup relay left as a variable. The resulting expression was then - quantified using the current semi-annual (9380 hr) and the proposed refueling outage (13,140 hr) surveillance test intervals. We compared Ahe FPL reliability block diagram to the SIAS system block diagram and the FPL Boolean equation to the reliability block diagram. No discrepan:1es were found in either the reliability block diagram or the Boolean equation. 3.3 SIAS Uncertainty Analyses To determine whether or not the FPL SIAS system 6-month and 18-month availabilities were the same statistically, we cenducted uncertainty analyses using the Monte Carlo Simulation (MOCARS) computer code.13 MOCARS allows a user to make distribution and simulation limit inferences from either a user supplied model or a system unavailability function. MOCARS uses Monte Carlo techniques to make such inferences by randomly sampling from specified probability distributions. MOCARS runs were made for both the FLP and the EG&G data using an assumed error factor of 10 and an assumed log-normal component failure rate distribution for the current 6-month and the proposed 18-month sest intervals. The results of the SIAS M0 CARS runs are summarized in Table 2. A large sample Z test for the equality of population variances and a two-sample t test for the equality of population means were performed on both the FPL 6-month and 18-month MOCARS results and the EG&G 6-month and 18-month MOCARS results. For both the FPL data and the EG&G data, the 6-month and 18-month distribution means were found to be from different populations. In other words, the true values of the SIAS 6-month and 18-month system unavailabilities for both 'che FPL data and the EG&G data are statistically different. 3.4 SIAS Time-Dependent Reliability Analyses FPL did not use a time-dependent reliability analysis in their SIAS evaluation. They used gn average unavailability for the basic events l calculated by: 9
4
- e. ,
- e. 6D se
'MWC e -
A en CL 3 N
- . =* N N-m m CL O = w *
" N 3e .O O w C e I I
- m w w had had 8 e C w w . O M e w to e W* e* 69 I O e *
- C w W wi N r== - - N M 3 in On C
- sn O. C 9 m 9 sa
- A 9 > eW" ' W
, ** 6 '* D m 9 9 &
C we A C W
. u
- C -
N W w sn 6 &# 69 *- er u as ta= MWC w w C m CL 3 @ W SA - et CL O S E 6. - De
- As 1
E, f"5 N N M M w 'I C e #- e e
.C- Sp i w' w- w w M N & @ W M f*b 8 e. N.
ee CD 6W 8 8 C 4l w
*
- C w w n- ;
- M, 4 M 3 C M- ,
m O M
- M 1 wa
- e m # {
1 1 w j 6- @ , O
- I
, e l en s
== O M m C == h N &-
e 6O e g- =.*
. 1' s,
M M Sa C and *
- i
*= K no CL 3 e *= ==
.O #1 9. O - sur 4 JD J ** (*) M (*) M Ce * > g llD C e M
a e e m e m w O w w and w C *= E O m m C tO -3 9 GE C e
- m* C e w >
M El . C
- f*J m W- m N
- 6D C w
'E 9
C M m M m 3 f"') =* 3
>= 4 O N* ' e4 J > sS h $
4 9 L. @ e sa E ** 89 ** E 9 =* M sn C C q A i J
> === one sn i 8"-
g -J w E & =* K s== w in A =* 4 W C
* >= N C- c E 6D '
( $ w MWC w a i 4.iJ K g to CL 3 N s *2 E ** f"5 (*) On O. O N @ m 3 f"') M 2S
- C e e e e
- 664 sd w g a ,
M see 4 8 m e e e b. na. en. 8'=
- f"== ID C M t 4 * * * *
- 6. T l M f"') e M nn N I- 48 48 ii C 6 A E M4
- M 3 P== =* =* ,
E P= m O W i CC -d e
- A E)C w E.
. -w C w= ==
E 3 3 w w sn an Cw ts ' 3 6 9 C m W SA Sp e na
>C g T 4 4 6. 6 8ht E C C == > CPt S D 9 9 9 M6 9 9 44 k ** 47 C 47
.d &
48 E en E W) ** Sp W *
- 4. C 3 3
- Mw C C C C *= m m W O OC O O g g i
hs == == 0 ==
== in .* .e ==
== ti
.e y
> > 1 en 3 3 =*
N m 3 3C na en es g
.O
===
J"3 9 .O .O SA - ==
= = = = *= == 'O E w - 6 '> E J C;L .C p*
b 6 ** P= m M es.# es Sp me .md 6 C E E sn sn C
- e O .mn
- .an
- % *= == O =
- I M E C C C C 4.8 4 .O 10 ;
Q = 1T ,
. where Q = average unavailability l' = component failure rate fault exposure time, where the fault exposure time is T =
l one-half the time between tests. 14 We used the FRANTIC III computer code to conduct time-dependent analyses using the FPL model and both FPL data and EG&G data to determine-if time dependency should be taken into account for the proposed 18-month test interval. Table 3 is a summary of the FRANTIC III SIAS time-dependent. reliability analyses along with a comparison of the FRANTIC III results with the MOCARS and FPL SIAS unavailability point estimates. Table 3 shows that for the FPL and EG&G data sets there is general agreement in the results regardless of the computer program used. For the SIAS system, component unavailability adjustments to account for. time-dependent behavior are not necessary. e II
TABLE 3.
SUMMARY
OF FRANTIC III SIAS TIME-DEPENDENT RELIABILITY ANALYSES WITH A COMPARISON.TO MOCARS AND FPL SIAS UNAVAILABILITY POINT ESTIMATES
' ~
FPL Data EG&G Data Test Interval Test Interval l 6 month 18 month 6 month 18 month FRANTIC III SIAS mean 1.49E-3 2.38E-3 9.54E-3 2.68E-2 MOCARS SIAS point 1.41E-3 1.67E-3' 4.12E-33 2.56E-2 l estimates FPL SIAS point estimate '1.3E-3 1.6E-3 -- -- I 1 l l i l l l 1 i 1 l l l l l 12 l
. I i
- 4. AFAS REVIEW j j
I 4.1 System Description 1 FPL modeled,, the AFAS separately from the ESFAS because Combustion Engineering (CE) designed the AFAS while Consolidated Controls Corp. (CCC) fesigned the ESFAS. The AFAS, shown in Figure 3, includes input signals
" rom Steam Generators A and B (SG-A, SG-B) level, pressure, and Feedwater Header A and B (FH-A, FH-B) pressure. There are four measurement channels of each parameter. Any two channels providing a coincident trip signal ;
will actuate the AFAS. The system is designed to allow by pass of one channel and may be operated in a two-out of-three logic. Normally, a low level condition in the steam generaturs will cause the AFAS te actuate Auxiliary Feedwater System (AFW) components to direct flow to the steam generators. If a steam or feedline break exists, differential steam l generator or feedwater header pressure will cause the AFAS to isolate flow ! to the faulted generator. Bistable outputs are arranged to identify the ruptured generator. AFAS-1 actuates AFW componentr which provide or prevent flow to SG-A, AFAS-2 controls flow to SG-B. The bistable relay i' contacts are combined into six "AND" gates which represent all possible combination of 2 of 4 channel inputs. Each 2 of 4 logic matrix deenergizes' ! four matrix relays whose contacts are arranged in series to form a six-input "0R" gate. Any open contact will deenergize this path and provide a signal to its trip relay. When the tr4 relay times out, the j trip relay deenergizes, which deenergizes for AI-AS initiation relays. The i initiation relay contacts are combined in a " selective" 2 of 3 logic. Coincidental signals from matrix ladder combinations AB, AD, CB, and CD will deenergize two interposing relays. This removes power from the i subgroup actuation relays which control AFW components. Of the ten actuation relays per channel, five are latching and five are cycling. When I steam generator level increases to a setpcint, the cycling relays will reenergize, closing AFW pump discharge valves to prevent overfilling a steam generator and/or allowing restoration of main feedwater. The latching relays control AFV pumps dod remain deenergized until AFAS is reset. l 13
i F g;llilha y gg it I 8 I si n P. $; $:
+
.pu.+- -,_
~
C
- l b li E b ij k b $ h b Ii h
~
'r' i i -
\ hab d;hi M E@s 4T-2 ! CEi"CCdWCCCCi;'ishsss dc l 4 4 + + i : 15 h 05 t! E
- p , .~.p 3 2 l
I Q R4 Qi!- dlF . ; dr i!- . i 2 i
\
l $$> $$> $ $ s' '$> 3$> E 1 3 ,-. , a V W s a 3 I x w h 7 , J' P s c.m: e ig g6 e e u es c
!.c i i m a.S TP !c 9 2e te i
p 4- gJ - - -. L gg-A i -
.k _ . __
** ~
14
R
. j 4.2 AFAS Methodology Review !
For the AFAS, FPL used a fault tree to model the system. The AFAS system boundaries were chosen, as were the SIAS boundaries, in accordance with Regulatory _ Guide 1.22 (Reference 12) definitions of Protection System -f and Actuation Device. FPL developed the AFAS model to consider the actuation path of one typical component. ' Faults' were developed to the component level for measurement channels, bistables, logic matrices, trip relays, initiation relays, associated power supplies, subgroup relays, ar,d the control circuit and circuit breaker for the AFW Pump 2A. The'AFAS model did not include the pump and its motor driver. In a similar manner to their SIAS analysis, FPL intentionally overestimated the AFAS availability to maximize the subgroup relay importance by not including all possible component fault modes or comon
, cause failures. They did not include wire or cable faults, test or maintenance unavailability contributors, manual system initiation, circuit breaker control power, or common cause failures.
FPL solved the fault tree for minimal cutsets, retaining cutsets up to order 3. All higher order cutsets were truncated. The cutsets were then quantified with the time between actuation relay tests left as a variable. The resulting expression for AFAS unavailability was then quantified using ) the current semi-annual (4380 hr) and the proposed refueling outage j i (13,140 hr) surveillance test intervals. i For our review, we compared the FPL fault tree to the actuation logic diagram. No discrepancies were noted. We also solved the FPL AFAS fault I tree for minimal cutsets of order three or fewer as FPL did, using the Integrated Reliability arid Risk Analysis System (IRRAS) computer cod 9. When the FPL component unavailabilities were substituted for the basic events in the cutsets and'the two test interval times substituted for the time variable, the EG&G AFAS system unavailabilities were approximately three times greater than the corresponding FPL results. Since we used l FPL's fault tree and data, the obvious answer was the minimal cutset lists ! l l l 15 i
-l i
__ _____________J
were different. de inspected,the IRRAS cutset list for cutsets that,,1f - left out of the quantification process, would account for the differences
- in EG&G ed FPL AFAS unava11 abilities. We found two second-order cutsets involving internal faults of the four trip delay devices.that account for the different results. After checking the actuation logic diagram; the fault tree general assumptions, the fault tree itself, and the FPL AFAS
~
data table, we can find no logical reason to remove the two cutsets from the list. Since FPL did not include a cutset list in its SL 2 submittal, there is no way of resolving the apparent discrepancy with FPL. For the EG&G review, we included all IRRAS cutsets in the quantification and uncertainty and time-dependent reliability analyses. 4.3 AFAS Uncertainty Analyses We conducted uncertainty analyses of the AFAS for the same reasons we analyzed the SIAS. We wanted to determine if the AFAS 6-month and 18-month system mean unavailabilities were statistically different. We used MOCARS for both the FPL cata and the EG&G data again using an error factor of 10 and a legnormal component failure rate distribution. The results of the AFAS MOCARS runs are summarized in Table 4 We tested both the FPL and EG&G 6-month and 18-month MOCARS results with large sample Z tests for pcpulation variance equality and two-sample t tests for population mean equality. For both the FPL and EG&G results, the 6-month mean and the 18-month mean were statistically different. 4.4 AFAS Time-Dependent Reliability Analyses FPL used average component unavailabilities for the AFAS analysis just l as they did for the SIAS. To determine if time-dependent reliability l analyses were necessary for the AFAS, we used the minimal cutsets from Section 4.2 and conducted FRANTIC III runs using FPL and EG&G component l failure rate data for the current and proposed test intervals. The l FRANTIC III results.are summarized in Table 5 and are compared to the 16
b w. no 5 - -. *ta - [ g*-. aaa lis s : ; -
'3
. -, "E I a~~.
t 8 3e
- u.
MEI x ~~- ~ *t8 i e aaa a 8 [ S2 '
?
- .: aa ; A6 n
< el~E a 1
a C 3; w t? c om e. my eI 77* w
*ta -
5 8; e
- m. a. n
# @ N
- N w
. ,A: -
'T}i a i
> . wl21e %. 8, i t I.
r C
. . C.
I E t , E b wg - ~ SI ,
$ e. .. ~. $E a e eI h M= M
.! I f I ,
5 "* 9 a ! m1 m E MI-8 . l o I E. c 2
=
>.1e l- 23 I e s :.
- : :s :
,- -a
- os v n n.
2.2 I. I. . I, 1 gRa$ e o2* 2
~
4 .
~ e o I
TABLE 5.'
SUMMARY
OFFRANTICIIIAFASTIME-DEPENDENTRE[IABILITYANALYSES - WITH A COMPARISON TO MOCARS AND FPL AFAS UNAVAILABILITY. POINT- . ESTIMATES. 4 FPL Data EG&G Data Test Interval Test Interval Unavailability- 6 month 18 month 6 month 18 month . FRANTIC III AFAS mean 5.66E-2' 3.19E-1 8.80E-2 5.01E-1 MOCARS AFAS point' 8.11E-3 5.50E-2: 1.82E-2. 1.96E-1 estimate FPL AFAS point estimate 2.5E-3 4.7E-3 -- -- l l l
- l 18 l
_--________a
,, H0 CARS and FPL unavailability poir.t estimates. For the FPL data, Table 5 shows the FRANTIC mean is greater than the MOCARS point estimates by a
, factor of 5-7 for both test intervals. For the EG&G data, the FRANTIC III mean is greater than the MOCARS point estimates by a fac' tor of -5 for a 6-month test interval and a factor of ~2.6 at'18 months. Figures 4 and 5, the FRANTIC plots for the FPL data for 6-month and 18-month test intervals, respectively, show the peak unavailabilities at the end of the test intervals to be approximately two times higher than the mean values and to reach values that are unacceptable from a risk standpoint. These peak values show that, had the uncertainty analyses not already shown a significant impact, time dependent reliability analyses would have to be used to assess the impact of the test interval change.
l f 19
c. a. i l N u
=.
a s N a N
\ o
\ 8' .
N *
\
\N =.
g iu
% s s
ob
-e s
a-
\ o- bt
\ '
S "n>- ::3 c c I.t N ;c s -
.e s 1 g E.
s vi u
\ ,=C 53 x . .i. -
\ '"{
_. J,4 x . = .2: -Ei
's s
- - .g s.
in .I g-e. Fo N
\
8_ .-
\ E
\
\
e a g C
\
\ *
= '
N s 's o s s e
= ~ v
'a a
a c 1 l 111119811WABNR W31515 i I l a i 20 l _ _ _ _ _ _ _ _ _ _ _ _ _ _ - - l
- o. .
o. 8-a c R b. 3* o- ,
$ '!.3 us
- I l
S o* g-
\
"C O O. M,
*z e- I5
\ m,d mb -
i -
&~
\ c. H
,g_
a"
-et 74 u Ln .
is C A. E= 1"
\ =3 '4 E- -
du I' n E's i:
- J s @ e N
s h o i \ C s o. I- N 8
~
\
\
N =
. \ .
ss e N d
. . r ? e O.
O O O 1117IEW118AWND W31515 l 1 21 l1
. . a
m_ - - - - - - - _ _ _ _ _ _ _ _ _ _ __ Q
^
f
- 5. CONCLUSIONS Based on the data and methodology reviews and the uncertainty and time-dependent reliability analyses, we conclude that test interval extension to 18 ponths will have a significant impact on the ESFAS and AFAS system ava11 abilities as modeled by FPL and reject FPL's assertion that it will not. The uncertainty cnalyses using the FPL data for both systems showed the 6-month and 18-month distribution means to be statistically different. The AFAS time-dependent reliability analyses showed FPL's point estimate to underestimate the time-dependent mean unavailability by a factor of ~7 and the peak unavailability by factor of ~12. For the AFAS
,model, had the uncertainty analyses shown'no impact, the FRANTIC III results for FPL component failure rate data show time dependent reliability behavior would have to be accounted for to eccurately assess the impact of' subgroup relay test interval changes. -
l l 22
\
. 6. REFERENCES
- 1. Florida Power and Light Company, Evaluation of Surveillance Freou?n,cy of Engineered Safety Features Actuation System (ESFAS)/ Auxiliary Feedwater Actuation System ( AFAS) Subgroup Relays, .L-84-183, May 22, 1984.
- 2. E. J. Butcher letter to J. W. Williams, Jr., Emeroency Safety Feature Actuator System Instrumentation Surveillance Requirement, Nuclear
. Regul'atory Commission, June 14, 1985.
- 3. Florida Power and Light Company, Additional Information in Support of i the Proposed Chance to St. Lucie Unit No. 2 ESFAS/AFAS Surveillance j Test Frequency, L-85-406, Octocer 31, 1985.
- 4. R. D. Walker memorandum for T. M. Novak, Emergency Safety Feature i Actuation System (ESFAS)-Surveillance Requirements (TAC Number-55063)
Docket ho. 50-389, Nuclear Regulatory Commission, March 7, 1986.
- 5. Consolidated Controls Corp. Reliability Analysis of Engineered ,
Safeouard Panels for St. Lucie Nuclear Power Station. Unit 27 ] Engineering Report No. 1213, April 26, 1978. l l
- 6. Nuclear Regulatory Commission, C_omponent Failure Rates for Nuclear '
Plant Safety System Reliability Analysis, craft, September. 23, 1980. i
- 7. Rome Air Development Center, Military Handboolt: Reliability Predictici of Electronic Ecuipment, MIL-HDBK-217B, March 17, 1978.
- 8. Institute of Electrical and Electronics Engineers, IEEE Guide to the )
i Collection and Presentation of Electrical, Electrcnic anc Sensina l Component Reliability Data for Nuclear Power Generatino Stations, IEEE l Ste-500, June 1977. -l l
- 9. D. D. Carlson et al., Interim Reliability Evaluation Program Procedures {
Guide, NUREG/CR-2728, SAND 82-100, January 1983.
- 10. A. 5. McC1yment and B. W. Pochiman, ATWS: A Reappraisal, Part 3: I Frecuency of Anticipated Transients, NP-2230, January 1982.
- 11. D. P. Mackowiak et al., Development of Transient Initiating Event Frequencies For Use In Probabilistic Risk Assessment, NUREG/CR-3862, EGG-2323, May 1985.
- 12. Nuclear Regulatory Commission, Reculatory Guide 1.22: Periodic Testing l of Protection System Actuation Functions, February 17, 1972.
- 13. S. D. Matthews and J. P. Poloski, MOCAR$: A Monte Carlo code for j e Determining Distribution and Simulation Limits and Ranking System '
Components by Importance, TREE-1138, Revision 1, August 1978. l 23
e
- 14. T. Giazburg and J. T. Powers, FRANTIC III--A Computer Code for . .
Time-Derendent Reliability Analysis (Methodology Manual), A-3230, April 1984. i 15. K. D. Russell et al., Integrated Reliability and Risk Analysis System (IRRAS) Users Guide Version 1.0 (DRAFT), NUREG/CR-4644 EGG-2495 (DRAFT), February 1987. N t 24
e - , 4
,- . ,,. .u ... . .. .- r=. - .
.=,,
.";'"2 seuosaAPwe OAra swasT- EGG-REQ-7842 A Review of.the Florida Powe'r and Light Company Safety Evaluations for Extending the. St. Lucie . . . , , . . . . ....
Plant. Unit No. 2 ESFAS Subgroup Relay Test Interpai ~ l
... . ::ovember 192D David P. Mackowiak .*.'"**'*a j
Hovember ivMR.
.............,.m . -macm = =. * ' =.
Probabilistic Risk Assessment Unit ""'""""""""" EG&G Idaho Inc. P.O. Box 1625 Idaho Falls. ID 83415 D6023 Division Engineering and Systems Technology Technical
. Office of Nuclear Reactor Regulatory * -_.
U.S. Nuclear Regulatory Connission
~-~-
Washington. DC 20555 Docket No. 50-389
,,,..e,- .
This review examines the Florida Power and Light Company's (FPL's) request to the Nuclear Regulatory Commission (NRC) to amend the operating license for FPL's St. Lucie Plant Unit No. 2. The proposed amendment would change = the surveillance test interval of the Engineered Safety Features System
~
(ESFAS) Subgroup relays from 6 to 1P months. The review was conducted to assist the NRC in assessing the validity of FPL's claim that extending the subgroup relay test interval will not.significantly impact the ESFAS' availability. The review examined FPL's modeling methodologies. and assumptions. compared their models to the system drawings. and checked their model cuantifications for accuracy.. FPL's data were examined and compared to data from other sources. . Uncertainty and' time-dependent reliability analyses were conducted to assess the impact of test interval changes on the ESFAS availability. The uncertainty analyses results showed the 6-month and the 18-month system unavailability distribution means to represent different populations. Based on these results. we conclude the impact of subgroup relay test interval extension to be significant and reject FPL's claim that the impact is insignificant.
..c .... == . .. ;.=, .
Unlimited
.c....
a.
.= Uneiassified Unclassified 3 p..gg
_ _ _ _ _ _ _ . . _ _ _ _ _ _ _ _ _ _ _}}