ML21078A178
| ML21078A178 | |
| Person / Time | |
|---|---|
| Site: | Duane Arnold  |
| Issue date: | 03/30/2021 |
| From: | Sunil Weerakkody NRC/NRR/DRA |
| To: | Joseph Donoghue, Mike Franovich, Chris Miller NRC/NRR/DRA, NRC/NRR/DRO, NRC/NRR/DSS |
| Sunil Weerakkody | |
| Shared Package | |
| ML21084A010 | List: |
| References | |
| LIC-504 | |
| Download: ML21078A178 (11) | |
Text
SUMMARY
OF RISK ANALYSIS RESULTS AND INSIGHTS To support the LIC-504 analysis, staff in the Division of Risk Assessment performed risk estimates using the NRCs standardized plant risk analysis (SPAR) models for eight plants of diverse designs. These risk estimates represent the increases to the base core damage frequency (CDF) for an event similar to the one at the Duane Arnold Energy Center (DAEC) on August 10, 2020, when that plant experienced a derecho and a weather-related loss of offsite power (WRLOOP). The plant designs studied included boiling-water reactor (BWR) 4 plants with a Mark-1 containment design, BWR-6 with a Mark 3 containment, and pressurized-water reactors (PWRs) including designs by Westinghouse and Combustion Engineering (CE).
The eight plants chosen for this analysis include six of the seven plants previously selected for the first step of the LIC-504 process, as documented in a memo dated November 25, 2020 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML20315A117). These plants were chosen because they have features similar to those of DAEC. Specifically, the plants selected were either (1) single unit sites that do not have a dedicated alternate source of Alternating Current (AC) source such as a station blackout (SBO) diesel which could mitigate the risk from such events or (2) plants that may have service water systems more susceptible to the effects of high winds.
This risk analysis in support of LIC-504 differs from an Accident Sequence Precursor Program analysis and a Management Directive 8.3 analysis in the treatment of the initiating event frequency (IEF) and the risk metric used. For initiating event assessments when performing ASP or MD 8.3 analyses, the IEF is set to 1.0 (i.e., the event happened) and the metric used is conditional core damage probability (CCDP). This LIC-504 analysis uses the normal frequency of a WRLOOP (i.e., 5.99 x 10-6), and the metric used is a change in CDF (CDF).
This analysis refers to each plants emergency service water (ESW) system. However, it is recognized that this systems name and features may vary from plant to plant. For the purpose of this analysis, ESW refers to the safety-related portion of the service water system that provides a source of cooling water to the emergency diesel generators (EDGs) and other loads during a loss of offsite power.
Modifications to the Simplified Plant Analysis Risk Models In order to model the impact of an extended WRLOOP challenging the plants ESW system strainers, the following model changes were applied to the analyzed plants:
Offsite Power Recovery. To model an event similar to that which occurred at DAEC, the
analysis assumed that offsite power is lost and cannot be recovered for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. This assumption captures the difficulty of recovering from the potential effects of significant damage to switchyard and transmission components in a severe weather event.
Crediting FLEX Strategies. FLEX refers to the plants diverse and flexible mitigation
capabilities that are used during extended loss of AC power (ELAP) scenarios. Since the initiating event for these estimates is a WRLOOP, it is appropriate to provide credit for flexible coping strategies or FLEX.
2 FLEX hardware reliability parameters suitable for inclusion in the NRC SPAR models are not yet available.
Therefore, the base SPAR models currently use the reliability of permanently installed equipment for FLEX equipment as the default, which is nonconservative and inconsistent with the limited operating experience with FLEX equipment. As part of an NRC audit of preliminary FLEX hardware data provided by the Pressurized-Water Reactor Owners Group, Idaho National Laboratory reviewed the FLEX hardware parameters estimated by the owners group. This review revealed that the FLEX diesel generator failure-to-start (FTS) probability is 3 to10 times higher and failure-to-run rate (FTR) is 2 to 5 times higher than permanently installed EDGs. The portable engine-driven centrifugal pump FTS probability is at least 8 times higher and FTR rate is at least 6 times higher than permanently installed pumps. See Table 1 in INL/EXT-20-58327, Evaluation of Weakly Informed Priors for FLEX Data, issued May 2020 (ADAMS Accession No. ML20155K834), for additional information. Therefore, to provide a more representative estimate of the FLEX hardware reliability parameters, this analysis increased the hardware failure rates by a factor of 3.
Removal of EDG Repair Credit for ELAP Scenarios: The SPAR models provide credit
for repair of postulated EDG failures for SBO scenarios. However, this potential credit may not apply in scenarios where an ELAP will be declared because (1) operators will be focused on implementing the FLEX mitigation strategies, (2) the DC load shedding activities could preclude recovery of EDGs, and (3) the failure of EDG due to degraded ESW (a likely outcome for this scenario) may be difficult to recover. As a result, the decision was made to not credit EDG repair. This may be a conservative approach since some scenarios could exist where diesel recovery could be possible.
Removal of 72-Hour AC Power Recovery Requirement: The base SPAR model requires
AC power recovery within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> for a safe/stable end state for ELAP scenarios with successful FLEX implementation. If AC power is not recovered in these scenarios, the SPAR models assume core damage. The probabilistic risk assessment (PRA) standard definition for safe/stable end state does not require AC power recovery. Because of the large uncertainty in modeling assumptions related to availability and reliability of components and strategies for mission times that are well beyond 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, the 72-hour AC power requirement was eliminated in this analysis. As part of this change, the FTR events for FLEX diesel generators and pumps have a 72-hour mission time in the base SPAR model. These mission times were changed to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to be consistent with the 24-hour mission time used in the SPAR model.
Adjusting the Common Cause Failure (CCF) Parameters for ESW Strainers: This
change constitutes an approach to model the increased potential for the ESW system strainers to fail due to the increased debris loading experienced during events similar to what occurred at DAEC. The event that occurred at DAEC demonstrated the potential for a derecho to cause a failure of redundant trains of ESW.
The CCF failure rate of the ESW strainers was recognized as a key source of uncertainty in the analysis. Strainer design can vary. Many plants (like DAEC) have strainers with automatic backwash capability, other plants have different designs. As a result of the uncertainty associated with choosing a CCF failure rate, the analysis used three different CCF values of.1, 0.038, and.01. The value of 0.1 was chosen since it had been used
3 as the screening analysis in the first step of the LIC-504 analysis documented in the memo dated November 25, 2020, ADAMS Accession No. ML20315A117.
The CCF value of 0.038 was chosen based on the following. A review of operating experience found 12 WRLOOPs from 1997 to 2019. None of the documentation reviewed captured a concurrent degradation of ESW. For the DAEC event, the conditional probability of ESW failure given a WRLOOP would be 1 over 13, or 0.077.
Since the DAEC was an ESW degradation rather than a complete failure, the conditional probability could be better represented by 0.5 over 13, which is 0.038.
Sensitivity analyses were performed at different failure rates as shown in Table 1. The Uncertainties portion of this enclosure discusses this further.
Ability to Bypass Clogged ESW Strainers: The ability for operators to bypass the
clogged ESW strainers is inconsistently applied in the base SPAR models. However, when readily available information was found for each plant that supported bypass of the strainers, the model was confirmed to include the action or modified to include the operator action. All plants that were found to have the ability to bypass a clogged strainer have been credited in this analysis. It is noted as a potential nonconservatism in the analysis for crediting a bypassed strainer. Once a strainer is bypassed and unstrained water is provided to downstream heat exchangers there is an increased potential for obstructing or fouling the heat exchangers complicating a potential recovery of the EDGs affected. This analysis does not quantify this risk; it is simply noted as an uncertainty. There have been examples of plants that have operated for short periods with service water strainers bypassed without issues.
Additional Model Changes: During the development of these risk estimates staff from
the Division of Risk Assessment modified some SPAR models to provide a more accurate estimate using readily available information.
Uncertainties The following uncertainties were considered when deriving risk insights during the integrated risk-informed decisionmaking process discussed in LIC-504. The analysis is intended to support NRC decisionmakers in evaluating appropriate regulatory actions and should not be considered an exhaustive risk assessment of the issue. Therefore, the analysis has some known conservatisms, non-conservatisms, and key uncertainties in the analysis. For instance, the NRC staff did not review plant-specific procedures, engage with licensees for more details about their PRA models, conduct operator and staff interviews, perform plant walkdowns, etc.
Also, use of an IEF for a WRLOOP is likely more conservative than for an extreme LOOP caused by a derecho, which would both prevent both offsite power recovery for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and pose a significant challenge to ESW strainers. Further details on these items are included below:
Uncertainties in the nature of the event itself and the effect on each plants ESW system:
Because of the number of unknowns associated with this type of event, this analysis does not assume a complete blockage of the intake to traveling screens that would prevent sufficient water from entering the ESW system. This analysis assumes ESW supply itself is not lost, and that the traveling screens are not completely blocked.
4 On the contrary, the analysis assumes that smaller debris is able to reach and clog the ESW strainers. This is similar to what happened at DAEC on August 10, 2020. DAEC had traveling screens that remained powered during a LOOP, but not all plants have that same design feature (i.e. some plants have traveling screens that do not have a safety-related power supply and would not continue to rotate during a LOOP).
Use of the WRLOOP IEF: The standard SPAR models contain initiating event
frequencies for various LOOP events. Of those events, a WRLOOP provides the closest estimate to the type of derecho event that Duane Arnold experienced. It is likely that the actual frequency for a WRLOOP that would simultaneously cause a sustained loss of offsite power and an in-rush of debris that would challenge a plants service water system is likely to be lower than the standard IEF used for a WRLOOP. However, not enough data exist to derive a more accurate frequency estimate, and the standard frequency for a WRLOOP was used while noting that its use could be conservative.
Crediting Strategies That Use Fire Protection Water as an Alternate Cooling Strategy for
Diesel Generators: Several plants studied in this analysis use water from the fire protection system as an alternate cooling source to their EDGs in the event that the normal supply of cooling water (ESW) becomes unavailable. For this analysis there would be potential that the same in-rush of debris that could cause an ESW strainer to clog could also impact a fire protection system in a similar way. However, there were too many variables to consider (different plant designs, differences in suction sources, relative distance between ESW intakes and fire water suction intakes) for the sake of this study. As a result, it was noted as a potential non-conservatism and uncertainty to assume fire water would not be impacted by the debris.
Modeling of FLEX Strategies: The crediting of FLEX mitigation strategies has a
significant impact on these analysis results. Considerable uncertainty is associated with various aspects of FLEX modeling in PRA. Factors such as the failure rates for FLEX components, how to credit operator actions, and modeling how the FLEX strategies will affect the plant during an accident sequence are key uncertainties for this analysis.
Plant Effects When a Strainer Is Bypassed: It was not possible to accurately model the
effect on the plant when a strainer is bypassed and unstrained cooling water is flowing through downstream heat exchangers, so this is another uncertainty. It is noted that during the derecho at DAEC, when operators bypassed one of the ESW strainers they found no degradation in service water flow to downstream components.
Differences in Individual Plants Ultimate Heat Sink (UHS): It was noted during the
analysis that some plants were likely to be more susceptible to an in-rush of storm created debris than others. This because of the different characteristics of each plant.
Some plants have rivers as their source for their UHS, while others use different types of reservoirs, lakes, or service water ponds. Although it is not possible to evaluate this factor quantifiably, some plants are likely more susceptible than others to this type of event.
Adjusting the CCF Parameters for ESW Strainers: Often, since LIC-504 analyzes
emerging issues for which the information on the magnitude of the degradation is limited, significant uncertainties may be associated with the estimated failure probabilities of potentially affected structures, systems, and components. In such cases, the best tools
5 available for decisionmakers are sensitivity analyses. In Table 1, sensitivities have been performed at different CCF probabilities for the ESW strainers to fail since this was identified as a key source of uncertainty in this analysis.
Failure Probability Assigned to Operators Deciding Whether to Declare an Extended
Loss of AC Power: In scenarios where FLEX is considered, there is a basic event representing the probability that operators will fail to declare an ELAP when beneficial.
Within the PRA model, this represents a key decision point for whether operators will choose to implement FLEX strategies during an SBO or pursue restoration of power.
Recent experience studying this human error probability has indicated that a failure probability of between 1.1x10-3 to 1.6x10-2 would apply to this event in cases in which the plant procedures required operators to use judgment in that decision. The current SPAR models for this analysis used a value of 1x10-2 for each plant. A sensitivity was performed in which this value was lowered to 1x10-3, however, the results for each plant did not change significantly, and this event was found not to influence the risk results.
Once the SPAR models were modified to reflect these changes, the increase in risk for a WRLOOP for each plant was estimated using CDF as the metric. Changes to large early release frequency (LERF) were not estimated, since earlier reviews had indicated that CDF and not LERF was the metric of concern.
6 Table 1 - CDF for Each Plant with Various ESW Strainer CCF Probabilities Plant WRLOOP Baseline CDF CDF at CCF of 0.1 CDF at CCF of 0.038 CDF at CCF of 0.01 Plant# 1:
Westinghouse PWR 1.2x10-6 8.4x10-5 3.4x10-5 1.1x10-5 Plant# 2: CE PWR 2.6x10-7 2.2x10-6 1.1x10-6 6.1x10-7 Plant# 3: BWR-4 3.5x10-7 7.1x10-7 5.2x10-7 4.3x10-7 Plant# 4:
Westinghouse PWR 9x10-7 3x10-6 1.8x10-6 1.5x10-6 Plant# 5:
Westinghouse PWR 6.6x10-7 1.9x10-5 8.4x10-6 3.5x10-6 Plant# 6: BWR-6 with Mark III Containment 1.1x10-6 3.8x10-6 2.4x10-6 1.8x10-6 Plant# 7: BWR4 with Mark 1 Containment 2x10-7 2.4x10-6 1x10-6 4.1x10-7 Plant# 8: BWR-4 with Mark 1 Containment 4.8x10-6 1.4x10-5 1.2x10-5 1.1x10-5 FLEX 10 CFR 50.155 Mitigation in Beyond-Design Basis Accident, issued in response to Fukushima Daiichi event has further strengthened the ability of operating nuclear plants to withstand the impacts of natural hazards, such as a derecho which could cause an extended LOOP concurrent with challenges accessing the UHS. Specifically, FLEX strategies and equipment were significant in lowering the risk to each plant in this analysis.
Since the initiating event of concern is a WRLOOP without the possibility for recovering offsite power for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, combined with a challenge to the ESW system, the majority of accident sequences were SBO sequences that FLEX strategies were designed to mitigate. As a result, all plants studied had a substantial risk reduction from FLEX. Crediting FLEX remains a key source of uncertainty in this analysis. Table 2 presents the results of a sensitivity study showing the difference in CDF (risk reduction) for each plant crediting FLEX.
7 Table 2 - Sensitivity Study CDF for Each Plant Showing the amount of Risk Reduction Provided by FLEX. (using the strainer CCF value of 0.038)
Plant CDF (FLEX strategies credited)
CDF (FLEX strategies not credited)
Difference in CDF made by FLEX (factor of reduction)
Plant 1 3.4x10-5 2.7x10-4 2.3x10-4 (7.9)
Plant 2 1.1x10-6 4.4x10-6 3.3x10-6 (4.1)
Plant 3 5.2x10-7 7.3x10-7 2x10-7 (1.4)
Plant 4 1.8x10-6 2x10-5 1.8x10-5 (11.4)
Plant 5 8.4x10-6 9.5x10-5 8.7x10-5 (11.4)
Plant 6 2.4x10-6 1.3x10-5 1.1x10-5 (5.4)
Plant 7 1x10-6 2.9x10-6 1.9x10-6 (2.9)
Plant 8 1.2x10-5 3.5x10-5 2.2x10-5 (2.8)
Summary After estimating the CDFs, the staff reviewed the risk results and dominant PRA cutsets for each plant.
During the review of the results, it became clear that there were three mitigation features that significantly influenced plant risk for this event. Those were: (1) the ability of operators to bypass a clogged strainer if needed; (2) the ability to align fire protection water or another source of water to provide cooling to diesel generators; and (3) having additional diesel generators (not including FLEX diesels) that were not dependent on service water for cooling.
Of the eight plants studied, the three plants that had the most of these mitigating features, had the lowest risk.
An additional beneficial feature that could reduce plant risk would be having a safety related power supply to traveling screens for the ESW system.
Table 3 provides additional details.
8 Table 3 Plant Notes 1
Westinghouse PWR This plant showed the highest risk of the eight plants analyzed with a CDF of 8.4x10-5 when the strainer CCF was assumed to be 0.1. The CDF lowered to 3.4x10-5 at 0.038 and 1.1x10-5 when the strainer CCF was lowered to 0.01.
Factors that increase risk: The reason for the risk of this plant being higher compared to other plants is that fewer systems are available to help mitigate the combined WRLOOP and challenge to the service water system. As stated above, the features that could reduce the risk are the ability for operators to bypass strainers, an additional diesel generator (not including FLEX diesels), or the ability to align an alternate cooling source to their EDGs, and this plant does not have those features Factors that reduce risk: This plant has ESW traveling screens that have safety related power supplies and remain in service following a LOOP.
A review of the cutsets (when strainer CCF is at 0.038) finds that 26% of the risk is from a dominant cutset in which the ESW strainers fail from CCF. This prevents cooling water from reaching the EDGs and they fail causing an SBO. The turbine driven auxiliary feedwater pump (TDAFW) fails to run, which leads to core damage before FLEX strategies can be implemented.
2 CE PWR This plant had a CDF of 2.2x10-6 when the strainer CCF was assumed to be 0.1. The CDF was 1.1x10-6 at 0.038 and 6.x10-7 when the strainer CCF was lowered to 0.01.
Factors that increase risk: This plant has service water strainers that cannot be bypassed.
The top 3 cutsets, which collectively make up about 16% of the risk are non-SBO scenarios.
The top cutset is due to a failure of the ESW strainers combined with Reactor Coolant Pump (RCP) seal failure, and failure of Reactor Coolant System (RCS) injection leading to core damage.
In the next two cutsets the strainers fail, and then auxiliary feedwater subsequently fails leading to core damage Factors that reduce risk: This plant has multiple systems that would help in the event of interest. Including a nonsafety diesel that is air cooled and therefore doesnt rely on service water for cooling. Operators can place this diesel in service during an SBO event. The availability of this additional diesel without a dependency on service water lowers the plant risk for this event.
Additionally, this plant has multiple backup sources of cooling water for its EDGs if the service water system fails. These additional sources of cooling have only been partially credited in the SPAR model for this analysis, and additional modeling would only lower the risk further for this plant.
9 3
BWR-4 with Mark-I containment This plant had a CDF of 7.1x10-7 when the strainer CCF was assumed to be 0.1. The CDF lowered to 5.2x10-7 at 0.038 and 4.3x10-7 when the strainer CCF was assumed to be 0.01.
Factors that reduce risk: This plant has a small nonsafety supplemental diesel that does not rely on service water for cooling. Also, this plant has service water strainers that can be manually bypassed by operators if the strainers fail. That ability was already modeled in the SPAR model and helps lower the risk for the event.
The top cutsets which account for 15% of the risk are not due to failures of the service water strainers, but result from the following:
A WRLOOP initiating event followed by failures of reactor core isolation
cooling (RCIC) and combined with operators failing to initiate a manual reactor depressurization A WRLOOP initiating event followed by a failure of RCIC and combined with
operators failing to initiate a manual reactor depressurization, and a stuck-open solenoid operated relief valve (SRV) 4 Westinghouse PWR This plant had a CDF of 3x10-6 when strainer CCF was assumed to be 0.1. The CDF lowered to 1.8x10-6 at 0.038 and 1.5x10-6 when strainer CCF was assumed to be 0.01.
Factors that reduce risk: This plant has the ability for fire protection water to automatically (without operator action required) realign to supply cooling water to their diesels. This feature reduces the risk significantly in the event their service water system fails.
This plants service water system differs from the others in our study in that it does not have strainers. Instead each pump has an independent traveling screen and screen wash system with automatic controls. For the purpose of this study the decision was made to adjust the traveling screen CCF as a surrogate instead of adjusting the CCF for a strainer failure. The traveling screens have a smaller screen mesh than most other plants.
Qualitative considerations show that the configuration of this plants service water intake makes an in-rush of debris from a derecho less likely than at some other plants.
The PRA cutsets reveal that the top 25% of the risk is due to scenarios in which a WRLOOP occurs, a the TDAFW pump fails, and subsequent random failures of the EDGs occur, causing an SBO. Without a TDAFW pump, the plant does not have time to implement FLEX, and core damage occurs.
The CCF of the traveling screens (used as a surrogate for the ESW strainers) is not in the top 25% of the cutsets.
10 5
Westinghouse PWR This plant had a CDF of 1.9x10-5 when strainer CCF was assumed to be 0.1. The CDF lowered to 8.4x10-6 at 0.038 and 3.5x10-6 when strainer CCF was lowered to 0.01.
Factors that increase risk: This plant has strainers on their service water system that cannot be bypassed.
Factors that reduce risk: This plant can provide an alternate cooling source to at least one of their EDGs. The process for this requires manual actions that could take some time to align. For the purpose of this analysis some credit for these manual actions were provided to credit this additional source which did reduce the risk for this plant.
The PRA cutsets reveal that roughly the top 50% of the risk was due to the following scenario:
A WRLOOP occurs, the ESW strainers fail which causes the EDGs to fail, and the plant enters an SBO. The alternate cooling source to the EDGs fails, and while FLEX is being deployed part of the FLEX strategy fails (either due to reactor makeup pumps, FLEX diesels, or operator errors) that leads to core damage.
6 BWR-6 with Mark III containment This plant had a CDF of 3.8x10-6 when the strainer CCF was assumed to be 0.1. The CDF lowered to 2.4x10-6 at 0.038 and 1.8x10-6 when the strainer CCF was assumed to be 0.01.
Factors that reduce risk: Operator action can manually bypass a clogged strainer if required, and the analysis gives credit for this.
The top 30% of the risk came from the following PRA cutsets:
17% of the risk was from a scenario in which a WRLOOP occurs, the ESW
strainers fail from CCF, and operators fail to bypass the strainers which causes the EDGs to fail from lack of cooling. An SBO results and RCIC fails which leads to core damage before FLEX can be deployed.
13% of the risk was from a scenario in which a WRLOOP occurs, the ESW
strainers fail from CCF, and operators fail to bypass the strainers which causes the EDGs to fail from lack of cooling. An SBO results and SRV fails to shut.
7 BWR-4 with Mark-1 containment This plant had a CDF of 2.4x10-6 when the strainer CCF was assumed to be 0.1. The CDF lowered to 1x10-6 at 0.038 and 4.1x10-7 when the strainer CCF was assumed to be 0.01.
Factors that reduce risk: This plant has more EDGs than the other plants studied and can use the fire protection water as a backup cooling source for its EDGs in case service water fails. Both these features lowered risk significantly.
The top PRA cutset accounts for 6% of the risk. In this scenario a WRLOOP occurs and the EDGs fail from CCF unrelated to service water. The failed EDGs cause an SBO, and RCIC fails to run. With the failure of RCIC FLEX cannot be implemented and core damage occurs.
11 8 BWR-4 with a Mark-1 containment This plant had a CDF of 1.4x10-5 when the strainer CCF was assumed to be 0.1. The CDF lowered to 1.2x10-5 at 0.038 and 1.1x10-5 when the strainer CCF was assumed to be 0.01.
Factors that increase risk: This plant doesnt have an alternate cooling strategy for their EDGs or additional diesel generators.
Factors that reduce risk: This plant does have the ability for operators to bypass the strainers. The SPAR model provided credit for this.
Cutsets show that failure of the ESW strainers is not in the top 10 cutsets.
Of the risk, 8% is from a dominant cutset that is a WRLOOP with random failures of the EDGs causing an SBO. RCIC fails to run, and the failure of RCIC leads to core damage.
The next dominant cutset (6% of risk) is from a WRLOOP, with the EDGs failing to run, causing an SBO. An SRV fails to close, which causes core damage before FLEX can be deployed.