ML21294A409
| ML21294A409 | |
| Person / Time | |
|---|---|
| Site: | Callaway  |
| Issue date: | 10/21/2021 |
| From: | Ameren Missouri, Union Electric Co |
| To: | Office of Nuclear Reactor Regulation |
| Shared Package | |
| ML21294A393 | List:
|
| References | |
| ULNRC-06688 | |
| Download: ML21294A409 (32) | |
Text
ENCLOSURE 9
License Amendment Request
Callaway Unit No. 1 Renewed Facility Operating License NPF-30 NRC Docket No. 50 -483
Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF -505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b"
Key Assumptions and Sources of Uncertainty
E9-1
Enclosure 9 Key Assumptions and Sources of Uncertainty
1.0 Introduction
The purpose of this enclosure is to disposition the impact of Probabilistic Risk Assessment (PRA) modeling epistemic uncertainty for the Risk Informed Completion Time (RICT) Program.
Nuclear Energy Institute (NEI) topical report NEI 06-09-A, "Risk-Informed Technical Specification Initiative 4b, Risk-Managed Technical Specification (RMTS) Guidelines,"
Revision 0 (Reference [1]), Section 2.3.4, Item 10 requires an evaluation to determine insights that will be used to develop risk management actions (RMAs) to address these uncertainties.
The baseline Internal Events, Internal Flooding, Fire, High Winds, and Seismic PRA models' notebooks document assumptions and sources of uncertainty and these were reviewed during the model peer reviews. The approach taken is, therefore, to review these documents to identify the items which may be directly relevant to the RICT Program calculations, to perform sensitivity analyses where appropriate, to discuss the results and to provide dispositions for the RICT program. The Callaway Internal Events, Internal Flooding, Fire, High Winds, and Seismic PRA models described within this LAR are the same as those described with the Ameren submittals regarding adoption of 10 CFR 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems, and Components for Nuclear Power Reactors" (Reference [2]).
The epistemic uncertainty analysis approach described below applies to the Internal Events PRA and any epistemic uncertainty impacts that are unique to either the Flooding, Fire, High Winds, or Seismic PRA are also addressed. In addition, NEI 06-09-A requires that the uncertainty be addressed in RICT Program Real Time Risk tools by consideration of the translation from the PRA model. The Real Time Risk model also referred to as the Configuration Risk Management (CRM) model, discussed in Enclosure 8, will include internal events, flooding events, high winds events, fire events, and seismic events. The model translation uncertainties evaluation and impact assessment are limited to new uncertainties that could be introduced by application of the Real Time Risk tool during RICT Program calculations.
The list of assumptions and sources of uncertainty were reviewed to identify those which would be significant for the evaluation of this application. If the Callaway Plant, Unit No. 1 (Callaway)
PRA model used a non-conservative treatment, or methods that are not commonly accepted, the underlying assumption or source of uncertainty was reviewed to determine its impact on this application. Only those assumptions or sources of uncertainty that could significantly impact the risk calculations were considered key for this application.
To identify these assumptions and sources of uncertainty both plant-specific and generic sources of uncertainty (as identified in Electric Power Research Institute (EPRI) TR-106737) were considered. All PRA notebooks were reviewed, and sources of uncertainty were compiled and characterized in the Callaway PRA Uncertainty Analysis and Sensitivities Notebook (Reference [3]). The identification and characterization of the sources of uncertainty was performed consistent with the requirements of the ASME/ANS PRA Standard (ASME/ANS RA-Sa-2009). This evaluation meets the intent of steps C-1 and E-1 of NUREG-1855, Revision 1. To assess the impact of sources of uncertainties on the TSTF-505 application, a review of the base case sources of uncertainty for the Callaway PRA models was performed.
E9-2 Enclosure 9 Key Assumptions and Sources of Uncertainty
Each identified uncertainty was evaluated with respect to its potential to significantly impact the decisions of this submittal. This evaluation meets the intent of the screening portion for steps C-2 and E-2 of NUREG-1855, Revision 1. The uncertainty impacts for each of the PRA models are discussed in the following Sections 2.0 - 6.0 of this Enclosure.
2.0 Assessment of Internal Events (including Internal Flooding) PRA Epistemic Uncertainty Impacts
In order to identify key sources of uncertainty, the Internal Events PRA model uncertainties were evaluated using the guidance in NUREG-1855 Revision 1 (Reference [4]) and EPRI 1016737 (Reference [5]). As described in NUREG-1855, sources of uncertainty include parametric uncertainties, modeling uncertainties, and completeness (or scope and level of detail) uncertainties.
Parametric uncertainty was addressed as part of the Callaway PRA model quantification. The parametric uncertainty evaluation for the Internal Events PRA model is documented in Section 5.1 of the PRA Uncertainty Analysis Notebook (Reference [6]).
Modeling uncertainties are considered in both the base PRA and in specific risk-informed applications. Assumptions are made during the PRA development as a way to address a particular modeling uncertainty because there is not a single definitive approach. Plant-specific assumptions and modeling uncertainti es for each of the Callaway Internal Events PRA technical elements are noted in the PRA Uncertainty Analysis Notebook (Reference [6]).
The Internal Events PRA model uncertainties evaluation considers the modeling uncertainties for the base PRA by identifying assumptions, determining if those assumptions are related to a source of modeling uncertainty and characterizing that uncertainty, as necessary. EPRI compiled a listing of generic sources of modeling uncertainty to be considered for each Internal Events PRA technical element (Reference [5]), and the evaluation performed for Callaway considered each of the generic sources of modeling uncertainty as well as the plant-specific sources.
Completeness uncertainty addresses scope and level of detail. Uncertainties associated with scope and level of detail are documented in the PRA but are only considered for their impact on a specific application. No specific issues of PRA completeness have been ident ified relative to the TSTF-505 application, based on the results of the Internal Events PRA peer reviews.
Additionally, an evaluation of Level 2 (LERF) Internal Events PRA model uncertainty was performed, based on the guidance in NUREG -1855 (Reference [4]) and EPRI 1026511 (Reference [7]). The potential sources of model uncertainty in the Callaway PRA model w ere evaluated for the 32 Level 2 PRA topics outlined in EPRI 1026511.
A detailed review of the generic and plant-specific sources of Internal Events model uncertainties is discussed in Report P3463-RICT-UNCERT_APP5 (Reference [3]) and are
E9-3 Enclosure 9 Key Assumptions and Sources of Uncertainty
therefore not repeated in this enclosure. The purpose of this enclosure is to summarize the key sources of uncertainty that could potentially impact the RICT calculations.
Based on following the methodology in EPRI 1016737, as supplemented by EPRI 1026511, the impact of key sources of uncertainty in the Internal Events PRA model on the RICT application is summarized in Table E9-1. The key sources of uncertainty identified in Table E9-1 do not present a significant impact on the Callaway RICT calculations and therefore, the Internal Events PRA model can produce accurate RICT calculations. Note that RMAs will be developed when appropriate using insights from the PRA model results specific to the configuration.
E9-4 Enclosure 9 Key Assumptions and Sources of Uncertainty
Table E9-1 Assessment of Internal Events (including Internal Flooding) PRA Epistemic Uncertainty
Sources of Uncertainty and RICT Program Impact Model Sensitivity and Disposition Assumptions
Battery Life Calculations
Station blackout events are important The batteries at Callaway will maintain The uncertainty/assumption represents a contributors to baseline CDF at nearly output for four hours after loss of all AC conservative bias in the PRA model, and every U.S. NPP. Battery life is an power; however, there are several removing the identified conservative bias important factor in assessing a plant's evaluations that show that the batteries would make an already acceptable ability to cope with an SBO. Many plants will last at least eight hours. This time is calculated risk metric more acceptable only have design basis calculations for somewhat conservative since it could compared to the acceptance guidelines.
battery life. Other plants have very plant reasonably be extended with additional This is consistent with the guidance in plant/condition-specific calculations of considerations (e.g., load shedding). The Section 3.1.1 of EPRI 1016737.
battery life. Failing to fully credit battery primary components in the PRA that rely capability can overstate risks, and mask on the battery supply are for AFW control other potential contributors and insights. or pressurizer power-operated relief valve Realistically assessing battery life can be (PORV) operation during transients. The complex. PORVs are not credited after battery depletion; therefore, sensitivity studies involving their continued operation are not warranted in the baseline PRA. Upon battery depletion, loss of all remote AFW flow control to the steam generators may lead to an overfill condition that could disable the TDAFW pump. Design and procedure at Callaway make this an unlikely occurrence, and an operator
E9-5 Enclosure 9 Key Assumptions and Sources of Uncertainty
Table E9-1 Assessment of Internal Events (including Internal Flooding) PRA Epistemic Uncertainty
Sources of Uncertainty and RICT Program Impact Model Sensitivity and Disposition Assumptions
action is included in the model to locally control AFW flow to the steam generators after battery depletion.
Containment Sump/Strainer Performance
All PWRs are improving ECCS sump Containment sump plugging is a concern A sensitivity was performed on the management practices, including with LOCAs of all sizes. The method Callaway model where probabilities installation of new sump strainers at most employed to account for sump plugging is without limiting breaks were used in all plants. simplified in that it includes a single sump cases (which minimizes the impact), all plugging probability per train (and non-LOCAs were given the same value, includes CCF). An alternative method and both trains were modeled to fail by would be to define LOCA size-based single events. No change was seen, probabilities for sump plugging, using which indicates that the existing method WCAP-16882-NP, which provides event-does not introduce undue optimism or dependent values. conservatism relative to other methods.
Core Melt Arrest In-Vessel
Typically, the treatment of core melt The Callaway model does not credit The first sensitivity assumed that if power arrest in-vessel has been limited. offsite power recovery after core damage was recovered, equipment is able to be However, recent NRC work has indicated and prior to vessel breach (The path to restored for injection in order to cease that there may be more potential than arresting core melt given a station core melt progression. Two values were previously credited. An example is credit blackout (SBO)). Recovering offsite used for non-recovery probabilities for CRD in BWRs. power in the time window between core (multipliers for not recovering power
E9-6 Enclosure 9 Key Assumptions and Sources of Uncertainty
Table E9-1 Assessment of Internal Events (including Internal Flooding) PRA Epistemic Uncertainty
Sources of Uncertainty and RICT Program Impact Model Sensitivity and Disposition Assumptions
damage and vessel failure is not likely to between core damage and vessel failure);
buy a lot in terms of mitigating the one for high RCS pressure and one for progression. However, for the purpose of low RCS pressure. Both values were quantifying the assumption, two sensitivity selected to be on the conservative side of cases were made for which the available representative values. The representative values derived from the LERF impact results were negligible.
convolution method for offsite power non-recoveries were used. For non-SBO sequences, the Callaway model gives limited credit to arresting core damage via cavity flooding to provide ex-vessel cooling. For these cases, VB was used as a surrogate, which was simply increased and decreased by a factor of two, and then set to TRUE to see the impact of not crediting core melt arrest. The results showed LERF increased by 1.4%.
Support System Initiating Events
Support System Initiating Events - Explicit support system initiating event The uncertainty with the MTTR Increasing use of plant-specific models (SSIE) models were developed for the implements a conservative bias in the for support system initiators (e.g., loss of total loss of service water and component PRA model that is the current state-of-SW, CCW, or IA, and loss of AC or DC cooling water systems, in accordance practice in PRA.
buses) have led to inconsistencies in with current industry practice (as well as
E9-7 Enclosure 9 Key Assumptions and Sources of Uncertainty
Table E9-1 Assessment of Internal Events (including Internal Flooding) PRA Epistemic Uncertainty
Sources of Uncertainty and RICT Program Impact Model Sensitivity and Disposition Assumptions
approaches across the industry. A DC systems NK01 and NK04). For these number of challenges exist in modeling of events, a mean time to repair is included support system initiating events: (1) in the model structure to account for the treatment of common cause failures and probability that a train of equipment may (2) potential for recovery. be restored prior to redundant train failure or administrative shutdown of the plant. MTTR for Callaway was calculated to be 19.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> but the model uses an MTTR of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> since it is bounding and facilitates ease of modeling through the use of existing basic events.
Default CCW Train Alignment
The default operating CCW train The alternate CCW configurations are The uncertainty or assumption will have alignment is for the Train A CCW to be modeled, and a sensitivity was performed minimal impact on the PRA results. In the running. Alternate configurations are which shows the model is not significantly RTR model the actual alignments will be possible between SW, CCW, and ESW. sensitive to the alternate alignment. modeled to produce accurate configuration risk results and appropriate RMAs will be applied if necessary.
Therefore, there would be no impact on the TSTF-505 application.
E9-8 Enclosure 9 Key Assumptions and Sources of Uncertainty
Table E9-1 Assessment of Internal Events (including Internal Flooding) PRA Epistemic Uncertainty
Sources of Uncertainty and RICT Program Impact Model Sensitivity and Disposition Assumptions
Core Debris Contact with Containment
In some plants, core debris can come in The WCAP method that was used to To assess the impact of these event contact with the containment shell (e.g., develop the Callaway LERF model values on LERF, surrogate values were some PWRs including free-standing steel provides two opportunities (early and late) used as calculated for a similar plant, for containments). Molten core debris can for intentional or unintentional RCS early depressurization and late, challenge the integrity of the containment depressurization. The early separately. The impact on the model is boundary. Some analyses have depressurization is intended to avert an negligible. The uncertainty or assumption demonstrated that core debris can be induced tube rupture, while the late will have no impact on the PRA results.
cooled by overlying water pools. depressurization is based on the relative likelihood of hot leg or surge line failure prior to vessel breach. Other RCS boundary failures not credited in this model include a stuck open PORV/PSV after the core uncovers (which could potentially have a non-negligible probability), or an increased likelihood of an RCP seal LOCA after the seal package is introduced to superheated steam.
Both of the depressurization probabilities play a role in determining likelihood of early containment failure as well. So the uncertainty inherent in their values could
E9-9 Enclosure 9 Key Assumptions and Sources of Uncertainty
Table E9-1 Assessment of Internal Events (including Internal Flooding) PRA Epistemic Uncertainty
Sources of Uncertainty and RICT Program Impact Model Sensitivity and Disposition Assumptions
impact several other calculations. These are modeled as split fractions in the Callaway model; however, the early split fraction has a value of 1.0 for both complementary events (i.e., they are treated as flags). The success complement (RCS depressurized) is always ANDed with other events that are set to zero so the end result is effectively a split fraction with values of one and zero.
E9-10 Enclosure 9 Key Assumptions and Sources of Uncertainty
3.0 Assessment of Translation (RTR Model) Uncertainty Impacts
Incorporation of the baseline PRA models into the RTR model used for RICT Program calculations may introduce new sources of model uncerta inty. Table E9-2 provides a description of the relevant model changes and dispositions of whether any of the changes made represent possible new sources of model uncertainty that must be addressed. Refer to for additional discussion on the RTR model.
Table E9-2 Assessment of Translation Uncertainty Impacts
RTR Model Part of Model Change and Affected Impact on Model Disposition Assumptions
PRA model logic Fault tree logic The model, if Since the results will be structure may be model structure, restructured, will be verified as representative optimized to treatment of flag logically equivalent and of baseline results, this is increase solution and house events produce results not a source of speed. and associated comparable to the uncertainty for the Real pruning for baseline PRA logic Time Risk Model PRA specific hazards, model. and there is no impact on treatment of risk for the 4b process.
assumed-failed operator actions for specific hazards and post -
processing approach affecting both Internal Events and hazard models.
Set plant Basic event PAF Since the Real Time Risk Since this aligns the availability factor model evaluates specific initiator frequencies for (Reactor Critical configurations during at-at-power conditions, it is Years Factor) power conditions, the not a source of basic event to assumption of a plant uncertainty for the Real 1.0. availability factor that is Time Risk Model PRA less than 1.0 is not and there is no impact on appropriate. Adjustment risk for the 4b process.
of the initiating event frequencies allows the
E9-11 Enclosure 9 Key Assumptions and Sources of Uncertainty
Table E9-2 Assessment of Translation Uncertainty Impacts
RTR Model Part of Model Change and Affected Impact on Model Disposition Assumptions Real Time Risk Model to produce appropriate results for specific at-power configurations Configuration of Calculation of The PRA model is The the plant must be RICT and RMAT modified to reflect that a uncertainty/assumption reflected in the within Real Time component which is out represents an accurate RICT Risk model. of service is no longer alignment/configuration calculations. normally running and, change or a conservative similarly, another train is bias in the Real Time no longer in standby Risk Model PRA, and (e.g., alternate train removing the identified alignments than the conservative bias would default), thus the model make an already will produce accurate acceptable calculated results. Additionally, for risk metric more certain SSC components acceptable compared to that are not modeled in the acceptance detail, surrogate events guidelines. This criterion or gates are selected to is consistent with the generate conservative guidance in Section 3.1.1 risk impact results. of EPRI 1016737.
Only select failure Calculation of Since the Real Time Risk Since the failure mode modes are RICT and RMAT model is mapping to only chosen for mapping is mapped rather within Real -Time one failure for a given set consistent with normal than all failure Risk model. of failure modes, the maintenance modes (e.g., Fails assumption is that for the configuration, and in to Start is True given maintenance select cases manual and Fails to Run activity, the model will be selection of component is False, breakers aligned for the configuration is provided, are set to failed appropriate failure mode this represents an Open, valves are of a set of potential accurate set to failed failures. alignment/configuration Closed). change or a conservative bias in the Real Time
E9-12 Enclosure 9 Key Assumptions and Sources of Uncertainty
Table E9-2 Assessment of Translation Uncertainty Impacts
RTR Model Part of Model Change and Affected Impact on Model Disposition Assumptions Risk Model PRA, and removing the identified conservative bias would make an already acceptable calculated risk metric more acceptable compared to the acceptance guidelines.
E9-13 Enclosure 9 Key Assumptions and Sources of Uncertainty
4.0 Assessment of Supplementary Fire PRA Epistemic Uncertainty Impacts
The purpose of the following discussion is to address the epistemic uncertainty in the Callaway Fire PRA. The Callaway Fire PRA model includes various sources of uncertainty that exist because there is both inherent randomness in elements that comprise the Fire PRA and because the state of knowledge in these elements continues to evolve. The development of the Callaway Fire PRA was guided by NUREG/CR -6850 (Reference [8]). The Callaway Fire PRA model used consensus mode ls described in NUREG/CR -6850.
Callaway used guidance provided in NUREG/CR -6850 and NUREG -1855 (Reference [4]) to address uncertainties associated with the Fire PRA for the RICT Program application. As stated in Section 1.3 of NUREG-1855:
Although the guidance in this report does not currently address all sources of uncertainty, the guidance provided on the uncertainty identification and characterization process and on the process of factoring the results into the decision making is generic and independent of the specific source of uncertainty. Consequently, the guidance is applicable for sources of uncertainty in PRAs that address at -power and low power and shutdown operating conditions, and both internal and external hazards.
NUREG-1855 also describe s an approach for addressing sources of model uncertainty and related assumptions. It defines:
A source of model uncertainty exists when (1) a credible assumption (decision or judgment) is made regarding the choice of the data, approach, or model used to address an issue because there is no consensus and (2) the choice of alternative data, approaches or models is known to have an impact on the PRA model and results. An impact on the PRA model could include the introduction of a new basic event, change s to basic event probabilities, change in success criteria, or introduction of a new initiating event. A credible assumption is one submitted by relevant experts and which has a sound technical basis. Relevant experts include those individuals with explicit knowledge and experience for the given issue. An example of an assumption related to a source of model uncertainty is battery depletion time. In calculating the depletion time, the analyst may not have any data on the time required to shed loads and thus may assume (based on analyses) that the operator is able to shed certain electrical loads in a specified time."
NUREG-1855 defines consensus model as:
A model that has a publicly available published basis and has been peer reviewed and widely ad opted by an appropriate stakeholder group. In addition, widely accepted PRA practices may be regarded as consensus models. Examples of the latter include the use of the constant probability of failure on demand model for standby components and the Poisson model for initiating events. For risk-informed regulatory decisions, the
E9-14 Enclosure 9 Key Assumptions and Sources of Uncertainty
consensus model approach is one that NRG has utilized or accepted for the specific risk-informed application for which it is proposed.
The plant-specific assumptions in the Callaway Fire PRA and the 71 generic sources of uncertainty identified in EPRI 1026511 (Reference [7]) were evaluated for their potential impact on the RICT application (Reference [3]). This guideline organizes the uncertainties in Topic Areas similar to those outlined in NUREG/CR-6850 and was used to evaluate the baseline Fire PRA epistemic uncertainty and evaluate the impact of this uncertainty on RICT Program calculations.
A detailed review of the generic and plant-specific sources of Fire PRA model uncertainties are discussed in Reference [9] and are therefore not repeated in this enclosure. The purpose of this enclosure is to summarize the key sources of uncertainty that could potentially impact the RICT calculations.
Table E9-3 summarizes the review for key sources of uncertainty in the internal fire PRA model for the RICT application.
As noted above, the Callaway Fire PRA was developed using consensus methods outlined in NUREG/CR-6850 and interpretations of technical approaches as required by NRC. Fire PRA methods were based on NUREG/CR-6850, other more recent NUREGs, (e.g., NUREG-7150, Reference [10]), and published "frequently asked questions" (FAQs) for the Fire PRA.
The key sources of uncertainty identified in Table E9-3 do not present a significant impact on the Callaway RICT calculations and therefore, the Callaway Fire PRA model can produce accurate RICT calculations. Note that RMAs will be developed when appropriate using insights from the PRA model results specific to the configuration.
E9-15 Enclosure 9 Key Assumptions and Sources of Uncertainty
Table E9-3 Assessment of Supplementary Fire PRA Epistemic Uncertainty
Sources of Uncertainty and RICT Program Impact Model Sensitivity and Disposition Assumptions
Treatment of unknown cable locations
It is common to not know specifically in a This is a level of detail issue. As described in EPRI 1026511, the room where every cable is located. As a approach selected is based on the level result, the fire PRA assumes the cable is of detail within the model. Cable routing damaged for every fire until the cable is was not assumed for any credited traced in detail. equipment. All components and cables located in a Fire Area are assumed to be failed by the fire in that area as documented in the Individual Fire Area Notebook.
See also "Lack of Cable Data"
Scope and treatment of instrumentation, annunciators, and alarms
The treatment of instrumentation is a Instrumentation may be included as part As described in EPRI 1026511, specific potential source of model uncertainty. of the requirements needed for instrumentation may be included in the The standard requires the identification of appropriate operator response in the PRA model as required for each modeled any single instruments that are relied on logic model. operator action and integrated into the for all credited HFEs in the fire PRA Fire PRA model. A detailed review of model. Failures of systems may also be included HEPs and their required instrumentation if spurious indications could lead to failure has been performed. The Component The standard also requires the of the system to meet its PRA credited Selection Notebook lists all the
E9-16 Enclosure 9 Key Assumptions and Sources of Uncertainty
Table E9-3 Assessment of Supplementary Fire PRA Epistemic Uncertainty
Sources of Uncertainty and RICT Program Impact Model Sensitivity and Disposition Assumptions
identification of potential spurious function. instruments included in the fire PRA and indications that could cause an undesired identifies which ones are subject to operator action related to that portion of spurious actuation.
plant design credited in the analysis.
All of the instruments being used for information in the PRA (i.e., supporting operator actions) are listed in groups for functional indication (e.g., RCS pressure, containment sump level, etc.) meaning that the operator is not reliant on a single instrument for that indication.
Main control room abandonment scenarios
Incorporation of NUREG-1921 Scenarios involving control room The Callaway Fire PRA model has Supplement 2, introduced a new abandonment and subsequent response detailed analysis that considers control assumption and source of model actions were evaluated as described in room abandonment and its impacts on uncertainty associated with the timing for EPRI 1026511. This can be achieved by operators ability to safely shutdown the the MCR abandonment due to loss of incorporating detailed sequence event plant.
control. tree and system fault tree modeling for executing safe shutdown procedures from the alternate shutdown panels or by using a screening approach based on CCDP.
E9-17 Enclosure 9 Key Assumptions and Sources of Uncertainty
Table E9-3 Assessment of Supplementary Fire PRA Epistemic Uncertainty
Sources of Uncertainty and RICT Program Impact Model Sensitivity and Disposition Assumptions
Lack of Cable Data
Exclusion of certain systems due to lack Lack of credit for some systems could As described in EPRI 1026511, the of cable data mask the risk associated with those approach selected is based on the level systems in some applications. of detail within the model. Cable routing Additionally, that same lack of credit could was not performed for instrument air, overestimate the importance of main feedwater, or condensate but all of other credited systems. those systems are assumed unavailable.
Any components deemed less significant to route, too complex to route, or not credited in the PRA quantification are assumed failures. These assumed failures are applied to all fire scenarios.
To determine the importance of the components that are assumed failed, a sensitivity was performed. The flag file was updated to remove the assumed failure list and the model re-quantified.
Noteworthy insights from this sensitivity show that the componen ts assumed failed have a non-negligible impact on the results (CDF -5% and LERF -39%).
E9-18 Enclosure 9 Key Assumptions and Sources of Uncertainty
Table E9-3 Assessment of Supplementary Fire PRA Epistemic Uncertainty
Sources of Uncertainty and RICT Program Impact Model Sensitivity and Disposition Assumptions
Note that these "always failed" SSCs represent the industry consensus modeling approach. To ensure the calculated RICTs for these functions are not significantly affected by the "always failed" assumptions, RMAs will be developed for the affected RICT LCOs.
E9-19 Enclosure 9 Key Assumptions and Sources of Uncertainty
5.0 Assessment of Supplementary High Winds PRA Epistemic Uncertainty Impacts
An assessment was conducted of the supplementary High Winds PRA (HWPRA) epistemic uncertainty impacts on the TSTF-505 application. Table E9-4 provides the results of the assessment. A detailed discussion of the sensitivity studies performed for the High Winds PRA model is provided in Reference [11].
E9-20 Enclosure 9 Key Assumptions and Sources of Uncertainty
Table E9-4 Assessment of Supplementary High Winds PRA Epistemic Uncertainty
Sources of Uncert ainty and RICT Program Impact Model Sensitivity and Disposition Assumptions
High Wind Missile and Grid Fragilities
There is an inherent assumption of This is potentially non-conservative for The sensitivity case undertaken in the statistical independence between missile separately modeled opposite train HWPRA study demonstrated that this fragilities when they are implemented in components in close proximity whose assumption has only a very small impact the CAFTA model for the HWPRA. missile fragilities may be positively on the PRA results; therefore, there would correlated. To test the impact of this be no impact on the TSTF -505 assumption, the TORMIS Monte Carlo application.
simulation results were used to determine the Boolean Intersection fragilities for selected opposite train components modeled in TORMIS. A sensitivity case in the HWPRA model was then undertaken using the Boolean intersection fragilities as the probabilities for new correlated wind missile failure events that were mapped to the components in both trains of equipment. The sensitivity case results showed only a very small impact on CDF.
High wind events occurring at the plant The probability of loss of offsite power at The baseline grid fragility values assumed are assumed to lead to either a turbine the time of the high wind event, that is, for the Callaway HWPRA are viewed as trip or a loss of offsite power event the electrical grid fragility, is assigned reasonable estimates; however, grid sequence, with the electrical grid fragility based on the wind speed. The same fragility is recognized as an uncertainty assigned based on the wind speed. probabilities are used for both straight significant to the evaluation of wind
E9-21
Enclosure 9 Key Assumptions and Sources of Uncertainty
Table E9-4 Assessment of Supplementary High Winds PRA Epistemic Uncertainty
Sources of Uncert ainty and RICT Program Impact Model Sensitivity and Disposition Assumptions winds and tornadoes. These probabilities hazards.
are a pure assumption for the Callaway HWPRA but are generally consi stent with The sensitivity case shows that the CDF values assumed in other studies. The results are highly sensitive to this HWPRA documentation includes a assumption. This result is not surprising sensitivity study to assess the impact of given the relative importance of the F1 these assumed electrical grid fragilities on wind speed initiating events, their high CDF. frequencies of occurrence (particularly for F1 straight winds), and the many dominant CDF cutsets that involve F1 winds combined with LOOP due to electrical grid fragility. While Case 1B (Reference [12]) shows a 114% increase in CDF versus the baseline, it is widely recognized (References [13] and [14])
that assuming grid failure with certainty at lower wind speeds can lead to over -
conservatism in the results. The baseline grid fragility values assumed for the Callaway HWPRA are viewed as reasonable estimates.
Research performed by EPRI [High Wind Loss of Offsite Power Durations and Recovery: EPRI, Palo Alto, CA: 2020.
E9-22
Enclosure 9 Key Assumptions and Sources of Uncertainty
Table E9-4 Assessment of Supplementary High Winds PRA Epistemic Uncertainty
Sources of Uncert ainty and RICT Program Impact Model Sensitivity and Disposition Assumptions 3002018232.] shows that the probability of offsite power recovery from wind-induced LOOPs for wind speeds less than 165 mph (lower end of F3 scale) is comparable to the nominal weather -
related offsite power recovery probability.
The Callaway HWPRA does not credit offsite power recovery at any wind speed; this conservatism is not accounted for in the grid fragility sensitivity but there is no different reasonable alternative assumption that is at least as sound as this modeling approach.
Data analysis of the likelihood of a loss of offsite power following high wind events is an area of ongoing investigation for the nuclear industry.
Appropriate compensatory measures and RMAs (e.g., restrict work in switchyard, protect equipment, etc.) will be developed to maintain the risk below acceptable levels.
E9-23
Enclosure 9 Key Assumptions and Sources of Uncertainty
Table E9-4 Assessment of Supplementary High Winds PRA Epistemic Uncertainty
Sources of Uncert ainty and RICT Program Impact Model Sensitivity and Disposition Assumptions
Operator Actions in Unprotected Areas
For operator actions where one or more For human failure events where one or The sensitivity case undertaken in the of the diagnosis or execution steps takes more of the diagnosis or execution steps HWPRA study demonstrated that this place in the field outside the protected takes place in the field outside the assumption has only a very small impact areas of the Category I buildings, the protected areas of the Category I on the PRA results; therefore, there would timing details are reviewed and used as a buildings, the timing details are reviewed be no impact on the TSTF -505 basis for modifying the human error and used as a basis for modifying the application.
probabilities. human error probabilities:
- If the total system time window (TSW) is less than 60 minutes, regardless of the time marg in, then the operator action is not credited (i.e., set to logical TRUE) for all wind speeds.
- If the field action does not need to be completed within the first 60 minutes after the high wind event, the human error probability is adjusted depending on th e time margin (i.e., the difference between the time required and the time available) and the severity of the wind.
- The human error probability multipliers are a pure assumption for the Callaway HWPRA study
E9-24
Enclosure 9 Key Assumptions and Sources of Uncertainty
Table E9-4 Assessment of Supplementary High Winds PRA Epistemic Uncertainty
Sources of Uncert ainty and RICT Program Impact Model Sensitivity and Disposition Assumptions but are generally consistent with similar multipliers recommended for seismic PRA.
A sensitivity case was undertaken in the HWPRA study to assess the sensitivity of the results to these human error probability multipliers. The sensitivity case results showed only a very small impact on CDF.
Default CCW Train Alignment
The default operating CCW train The alternate CCW configurations are The uncertainty or assumption will have alignment is for the Train A CCW to be modeled, and a sensitivity was performed minimal impact on the PRA results. In the running. Alternate configurations are which shows the equipment related RTR model the actual alignments will be possible between SW, CCW, and ESW. failures for the alternate alignments are modeled to produce accurate not significantly sensitive. For High configuration risk results and appropriate Winds, operator actions drive some deltas RMAs will be applied if necessary.
in the alternate alignment. Therefore, there would be no impact on the TSTF-505 application.
E9-25
Enclosure 9 Key Assumptions and Sources of Uncertainty
6.0 Assessment of Supplementary Seismic PRA Epistemic Uncertainty Impacts
An assessment was conducted of the supplementary Seismic PRA (SPRA) epistemic uncertainty impacts on the TSTF -505 application. Table E9-5 provides the results of the assessment.
Significant assumptions and sources of model uncertainty identified during the development of the SPRA model are documented in Section 4 of the SPRA plant response model notebook (Reference [15]). Table 2-1 of the Quantification Notebook (Reference [16]) characterizes these assumptions and sources of model uncertainty for their impact on the seismic risk results.
E9-26
Enclosure 9 Key Assumptions and Sources of Uncertainty
Table E9-5 Assessment of Supplementary Seismic PRA (SPRA) Epistemic Uncertainty
Sources of Uncertainty and RICT Program Impact Model Sensitivity and Disposition Assumptions
Non-Safety Component Sensitivity
Non-safety components basic events This treatment is conservative. A seismic The uncertainty/assumption represents a were assigned a generic fragility value sensitivity is performed to show that the conservative bias in the PRA model, and and were assumed to be fully correlated. generic fragility value used for the non-removing the identified conservative bias safety component basic events does not would make an already acceptable significantly impact CDF. calculated risk metric more acceptable compared to the acceptance guidelines.
This criteria is consistent with the guidance in Section 3.1.1. of EPRI 1016737.
A mission time of 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> was used in the A sensitivity study was performed to show The sensitivity study performed on the Callaway SPRA model consistent with the that use of a 48-hour mission time has a base model shows that there is no impact Internal Events model. Mission times are negligible increase on CDF. on the PRA results and therefore the used to define a safe stable state at which uncertainty or assumption will have no time the core has not been damaged, impact on the PRA results and therefore remains in a safe condition, and offsite no impact on the TSTF-505 application.
resource and/or personnel may be available to aid in restoring equipment, connecting temporary equipment, etc.
E9-27
Enclosure 9 Key Assumptions and Sources of Uncertainty
Table E9-5 Assessment of Supplementary Seismic PRA (SPRA) Epistemic Uncertainty
Sources of Uncertainty and RICT Program Impact Model Sensitivity and Disposition Assumptions Given that a seismic event can potentially impact the ability for offsite plant or supplemental personnel to reach the site, there is an inherent uncertainty associated with the use of the 24-hour mission time. A seismic event can have impacts that are wide ranging on not only plant structure but offsite infrastructure (roads, communicati ons, etc.) that may prevent personnel from easily accessing the site to assist in plant recovery actions.
On-Site FLEX Equipment Sensitivity
FLEX equipment has the potential to be The current treatment of FLEX equipment The sensitivity documented in the Seismic incorporated into a plant given a severe is conservative. Sensitivity studies show Uncertainty analysis shows that accident on site and with some assumed that CDF and LERF can be reduced by significant reductions in CDF could result conditions during the extreme event. The improving credit for FLEX equipment. from fully crediting FLEX capabilities.
SPRA Model currently includes no credit The uncertainty/assumption represents a for this equipment in the baseline model conservative bias in the PRA model, and (events set to True). removing the identified conservative bias would make an already acceptable calculated risk metric more acceptable compared to the acceptance guidelines.
This criteria is consistent with the
E9-28
Enclosure 9 Key Assumptions and Sources of Uncertainty
Table E9-5 Assessment of Supplementary Seismic PRA (SPRA) Epistemic Uncertainty
Sources of Uncertainty and RICT Program Impact Model Sensitivity and Disposition Assumptions guidance in Section 3.1.1. of EPRI 1016737.
Model Sensitivity to Seismic HRA Bin Definitions
An inherent uncertainty associated with HEP binning can have a significant The binning is developed u sing EPRI the SPRA development relates to the impact on the baseline results. The guidance, which is in essence, a binning for the HEP seismic hazard group binning process used in the Callaway consensus process for HEP binning.
to the number of seismic hazard bins model is developed consistently with There is also no reasonable alternative to modeled in the SPRA. EPRI Guidance, and is ensured to be the assumption which would produce realistic based on the relevant component different results and/or there is no fragilities used to define plant damage. reasonable alternative that is at least as The use of the EPRI Guidance in HEP sound as the assump tion being binning is essentially a consensus model challenged. This criterion is consistent or process. with Section C.3.3.2 of RG 1.200 Revision 2. Therefore, no additional sensitivity studies are required.
Default CCW Train Alignment
The default operating CCW train The alternate CCW configurations are The uncertainty or assumption will have alignment is for the Train A CCW to be modeled, but a sensitivity has not been minimal impact on the PRA results. In the running. Alternate configurations are performed. Based on the sensitivity of RTR model the actual alignments will be possible between SW, CCW, and ESW. Internal Events and the modeling for modeled to produce accurate Seismic, the existing Internal Events configuration risk results and appropriate
E9-29
Enclosure 9 Key Assumptions and Sources of Uncertainty
Table E9-5 Assessment of Supplementary Seismic PRA (SPRA) Epistemic Uncertainty
Sources of Uncertainty and RICT Program Impact Model Sensitivity and Disposition Assumptions sensitivity is expected to bound the RMAs will be applied if necessary.
results of a Seismic sensitivity. The Therefore, there would be no impact on Seismic results are not expected to be the TSTF-505 application.
sensitive to the alternate alignments.
E9-30
Enclosure 9 Key Assumptions and Sources of Uncertainty
References
[1] Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,"
Revision 0-A, October 12, 2012 (ADAMS Accession No. ML 12286A 322).
[2] Ameren Missouri Letter to NRC, Callaway Plant Unit No. 1, Union Electric Co., Renewed Facility Operating License NPF-30, Application To Adopt 10 CFR 50.69, "Risk-Informed Categorization And Treatment Of Structures, Systems And Components For Nuclear Power Reactors," October 30, 2020 (ADAMS Accession No. ML20304A455).
[3] PRA-IE-UNCERT_APP5, "Disposition of Key Uncertainties: Risk Informed Completion Times (RITS 4b)," Revision 1, June 2021.
[4] NUREG-1855, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision-making," USNRC, Revision 1, March 2017.
[5] Electric Power Research Institute (EPRI) TR-1016737, "Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments," Final Report, December 2008.
[6] PRA-IE-UNCERT, "Probabilistic Risk Assessment (PRA), Uncertainty Analysis Notebook," Revision 1, June 2021.
[7] Electric Power Research Institute (EPRI) Technical Report TR-1026511, "Practical Guidance on the Use of PRA in Risk-Informed Applications with a Focus on the Treatment of Uncertainty," December 2012.
[8] NUREG/CR-6850 (also EPRI 1011989), "Fire PRA Methodology for Nuclear Power Facilities," September 2005, with Supplement 1 (EPRI 1019259), September 2010.
[9] PRA-IE-UNCERT_APP2, "Fire Uncertainty Analysis and Sensitivities," Revision 1, June 2021.
[10] NUREG/CR-7150, Joint Assessment of Cable Damage and Quantification of Effects from Fire (JACQUE-FIRE), October 2012.
[11] PRA-IE-UNCERT_APP4, "High Wind Uncertainty Analysis and Sensitivities," Revision 0, June 2021.
[12] EPM Report P3463-HW-UNCERT, "Callaway Energy Center High Wind Probabilistic Risk Assessment High Wind Sensitivities," Revision 0.
[13] High-Wind Risk Assessment Guidelines, EPRI, Palo Alto, CA: 2015. 3002003107.
[14] Nuclear Energy Institute (NEI), "Tornado Missile Risk Evaluator (TMRE) Industry Guidance Document," NEI Technical Report 17 -02 Rev 1, Washington, D.C.
E9-31
Enclosure 9 Key Assumptions and Sources of Uncertainty
[15] PRA-SEISMIC-PLANT_RESPONSE, "Seismic Probabilistic Risk Assessment Modeling Notebook," Revision 1, May 2021.
[16] PRA-SEISMIC-QUANT, "Seismic Probabilistic Risk Assessment, Quantification Analysis Notebook," Revision 1, June 2021.
E9-32