ML21294A408

From kanterella
Jump to navigation Jump to search
Enclosure 8 - Attributes of the Real Time Risk Model
ML21294A408
Person / Time
Site: Callaway Ameren icon.png
Issue date: 10/21/2021
From:
Ameren Missouri, Union Electric Co
To:
Office of Nuclear Reactor Regulation
Shared Package
ML21294A393 List:
References
ULNRC-06688
Download: ML21294A408 (6)
v • d • e


Text

ENCLOSURE 8

License Amendment Request

Callaway Unit No. 1 Renewed Facility Operating License NPF -30 NRC Docket No. 50 -483

Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b."

Attributes of the Real Time Risk Model Enclosure 8 Attributes of the Real Time Risk Model

1.0 INTRODUCTION

Section 4.0, Item 9 of the NRC Final Safety Evaluation (Reference 1) for NEI 06-09-A (Reference 2) requires that the license amendment request provide a description of PRA models and tools used to support the Risk-Informed Completion Time (RICT) Program. This includes identification of how the baseline PRA model is modified for use in the Configuration Risk Management Program (CRMP) tools, quality requirements applied to the PRA models and CRMP tools, consistency of calculated results from the PRA model and the CRMP tools, and training and qualification programs applicable to personnel responsible for development and use of the CRMP tools. This item should also confirm that the RICT Program tools can be readily applied for each Technical Specification Limiting Condition for Operation within the scope of the plant-specific submittal.

This enclosure describes the necessary changes to the peer-reviewed baseline PRA models for use in the CRMP software to support the RICT Program. The process employed to adapt the baseline models is demonstrated:

a) To preserve the core damage frequency (CDF) and large early release frequency (LERF) quantitative results;

b) To maintain the quality of the peer-reviewed PRA models.

c) To correctly accommodate changes in risk due to configuration-specific considerations.

Quality controls and training programs applicable to the CRMP are also discussed in this enclosure.

2.0 TRANSLATION OF BASELINE PRA MODEL FOR USE IN REAL-TIME RISK

The baseline PRA models for Internal Events, Internal Flooding, Fire, High Winds and Seismic are the peer-reviewed models which will be implemented into the CRMP software tool. These models are updated when necessary to incorporate plant changes to reflect the as-built, as-operated plant. The five models are all currently maintained as separate models which will be combined into an integrated one-top model for incorporation into the CRMP. The models may be optimized for quantification speed but are verified to provide reasonable results when compared with the baseline models in accordance with approved procedures (Reference 9).

Additionally, individual hazards may be quantified separately to provide more detailed importance measures and RMAs.

The CRMP software will be used to facilitate all configuration-specific risk calculations and support the RICT Program implementation. The baseline PRA models are modified as follows for use in configuration risk calculations:

  • The unit availability factor is set to 1.0 (i.e., the unit is available).
  • Maintenance unavailability of structures, systems, and components in the PRA model is set to zero/false unless the unavailability is due to the configuration in question, and a maintenance unavailability failure mode is the only failure mode modelled for these structures, systems, or components.

E8-2

Enclosure 8 Attributes of the Real Time Risk Model

  • Mutually exclusive combinations, including normally disallowed maintenance combinations, are adjusted to allow accurate analysis of the configuration.
  • Average alignment fractions of running/standby equipment trains are adjusted as needed to one/true or zero/false to accurately represent the configuration.
  • The Callaway PRA calculates Common Cause Basic Event (CCBE) probabilities from the Multiple Greek Letter (MGL) method and places the basic events under appropriate gates in the fault tree. Adjustments to the Common Cause Failure (CCF) grouping or CCF probabilities are not necessary when a component is taken out-of-service for preventative maintenance:
  • The component is not out-of-service for reasons subject to a potential common cause failure, and so the in-service components are not subject to increases in common cause probabilities.
  • CCF relationships are retained for the remaining in-service components.
  • The net failure probability for the in-service components includes the CCF contribution of the out-of-service component.

As described in Regulatory Guide (RG) 1.177 (Reference 7), Section A-1.3.2.2, the CCF term should be treated differently when a component is taken down for preventive maintenance (PM) than as described for failure of a component. For PMs, the common cause factor is changed so that the model represents the unavailability of the remaining component. In the example provided in Reg Guide 1.177 for a 2-train system, the CCF event can be set to zero for PMs. This is done so that the model represents the unavailability of the remaining component, and not the common cause multiplier. The Callaway approach is conservative in that for a 2-train system, the CCF event is retained for the component removed from service. Likewise, for systems with three or more trains, the CCF events that are related to the out-of-service component are retained.

The Vogtle RICT Safety Evaluation (Reference 8) describes the Vogtle approach for modeling common cause events with planned inoperability: "For planned inoperability, the licensee sets the appropriate independent failure to 'true' and makes no other changes while calculating a RICT." The Callaway approach is the same as this Vogtle approach.

It is recognized that other modifications could be made to CCF factors for planned maintenance, particularly for common cause groups of three or more components. For example, in the Safety Evaluation (SE) in the Vogtle RICT Amendment (Reference 8), the NRC identifies a possible planned maintenance CCF modification to "modify all the remaining basic event probabilities to reflect the reduced number of redundant components."

Like Vogtle, the Callaway CCF approach is a straightforward simplification that has inherent uncertainties. In the context of modifying CCF basic events for PMs, the Vogtle SE states the following:

"The NRC staff also notes that common cause failure probability estimates are very uncertain and retaining precision in calculations using these probabilities will not necessarily improve the accuracy of the results. Therefore, the NRC staff concludes that the licensee's method is acceptable because it does not systematically and purposefully produce non-conservative results and because the calculations

E8-3

Enclosure 8 Attributes of the Real Time Risk Model

reasonably include common cause failures consistent with the accuracy of the estimates." (Reference 8)

The Callaway approach for CCF during PMs is the same as the Vogtle approach; therefore, the Callaway CCF approach is acceptable for RICT calculations and adjusting the common cause grouping is not necessary for PMs. However, if a numeric adjustment is performed, the RICT calculation shall be adjusted to numerically account for the increased possibility of CCF in accordance with RG 1.177, as specified in Section A-1.3.2.1 of Appendix A of the RG.

For emergent conditions where the extent of condition is not completed prior to entering into the RMAT or the extent of condition cannot rule out the potential for common cause failure, common cause Risk Management Actions (RMAs) are to be implemented to mitigate common cause failure potential and impact, in accordance with Callaway procedures. This is in line with the guidance of NEI 06-09-A (Reference 2) and precludes the need to adjust CCF probabilities. However, if a numeric adjustment is performed, the RICT calculation shall be adjusted to numerically account for the increased possibility of CCF in accordance with RG 1.177, as specified in Section A-1.3.2.1 of Appendix A of the RG.

  • No success criteria change based on seasonal variation.
  • Where ATWS Design Basis Success criteria change slightly based on time in cycle, conservative values are assumed in the PRA.

The CRMP software is designed to quantify the configuration for Internal Events, Internal Flooding, Fire, High Winds, and Seismic risk, when calculating the risk management action time and RICT. The unique aspect of the CRMP for the RICT Program is the quantification of the model given the adjustments ab ove and adjustments to common cause events, which will generally rely on (RMAs) to mitigate common cause failure potential and impact, however, any quantitative CCF adjustments will be made in accordance with RG 1.177, as specified in Section A-1.3.2.1 of Appendix A of the RG. The other adjustments above are those used for the evaluation of risk under the 10 CFR 50.65(a)(4) program.

3.0 QUALITY REQUIREMENTS AND CONSISTENCY OF PRA MODEL AND CONFIGURATION RISK TOOLS

The approach for establishing and maintaining the quality of the PRA models, including the CRMP model, includes both a PRA model update process (described in Enclosure 7) and the use of self-assessments and independent peer review (described in Enclosure 2).

The information provided in Enclosure 2 demonstrates that the sites Internal Events, Internal Flooding, Fire, High Winds, and Seismic PRA models reasonably conform to the associated industry standards endorsed by RG 1.200 (Reference 3). This information provides a robust basis for concluding that the PRA models are of sufficient quality for use in risk-informed licensing initiatives.

For maintenance of an existing CRMP model, changes made to the baseline PRA model in translation to the CRMP model will be controlled and documented in accordance with Callaway PRA procedures (Reference 5). These procedures address the process for identification of issues and corrective actions taken to evaluate and disposition model errors and changes to

E8-4

Enclosure 8 Attributes of the Real Time Risk Model

ensure models are accurate, as described in Enclosure 7. Acceptance testing is performed after every configuration risk model update to ensure that the software works as intended and that quantification results are reasonable. The CRMP model is nominally updated to reflect the as-built, as-operated plant once every two fuel cycles.

These actions satisfy NEI 06-09-A, Section 2.3.5, Item 9.

4.0 TRAINING AND QUALIFICATION

The PRA staff is responsible for development and maintenance of the CRMP model.

Operations and Work Management staff will use the CRMP tool under the RICT Program. The PRA and Operations staff are trained in accordance with a program using National Academy for Nuclear Training (ACAD) documents, which is also accredited by the Institute of Nuclear Power Operations (INPO).

5.0 APPLICATION OF THE CRMP TOOL TO THE RICT PROGRAM SCOPE

The EPRI Phoenix Risk Monitor (PRM) software, or equivalent, will be used to facilitate all configuration-specific risk calculations and support RICT Program implementation. These programs are specifically designed to support implementation of the RICT Program. PRM will permit the user to evaluate all plant configurations using appropriate mapping of plant equipment to PRA basic events. The equipment in the scope of the RICT Program can be evaluated in the appropriate PRA models. The CRMP will meet RG 1.174 (Reference 4 and Reference 10) and Callaway software quality assurance program requirements (Reference 6).

E8-5

Enclosure 8 Attributes of the Real Time Risk Model

6.0 REFERENCES

1. U.S. Nuclear Regulatory Commission (NRC) Letter from Jennifer M. Golder to Biff Bradley (NEI), Final Safety Evaluation for Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RICT Program) Gu idelines, May 17, 2007 (ADAMS Accession No. ML071200238).
2. Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RICT Program) Guidelines, Revision 0, October 12, 2012 (ADAMS Accession No. ML12286A322).
3. Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, March 2009.
4. Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 2, May 2011.
5. Callaway Plant Procedure PRA-ZZ-00001, PRA Model Updates and Maintenance, Revision 002.
6. Callaway Plant Procedure APA-ZZ-00109, "Software Quality Assurance Program,"

Revision 027.

7. Regulatory Guide 1.177, An Approach for Plant-Specific, Risk-Informed Decision-making: Technical Specifications, Revision 1, May 2011.
8. Vogtle Electric Generating Plant, Units 1 and 2 - Issuance of Amendments Regarding Implementation of Topical Report Nuclear Energy Institute NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specification (RMTS)

Guidelines," Revision 0-A (CAC NOS. ME9555 and ME9556), ML15127A669.

9. Callaway Plant Procedure PRA-ZZ-00002, "Risk Monitoring Software Configuration Control", Revision 000.
10. Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 3, January 2018.

E8-6

Retrieved from "https://kanterella.com/w/index.php?title=ML21294A408&oldid=3743837"