ML21294A409
| ML21294A409 | |
| Person / Time | |
|---|---|
| Site: | Callaway  |
| Issue date: | 10/21/2021 |
| From: | Ameren Missouri, Union Electric Co |
| To: | Office of Nuclear Reactor Regulation |
| Shared Package | |
| ML21294A393 | List: |
| References | |
| ULNRC-06688 | |
| Download: ML21294A409 (32) | |
Text
E9-1 ENCLOSURE 9 License Amendment Request Callaway Unit No. 1 Renewed Facility Operating License NPF-30 NRC Docket No. 50-483 Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b" Key Assumptions and Sources of Uncertainty Key Assumptions and Sources of Uncertainty E9-2 1.0 Introduction The purpose of this enclosure is to disposition the impact of Probabilistic Risk Assessment (PRA) modeling epistemic uncertainty for the Risk Informed Completion Time (RICT) Program.
Nuclear Energy Institute (NEI) topical report NEI 06-09-A, "Risk-Informed Technical Specification Initiative 4b, Risk-Managed Technical Specification (RMTS) Guidelines,"
Revision 0 (Reference [1]), Section 2.3.4, Item 10 requires an evaluation to determine insights that will be used to develop risk management actions (RMAs) to address these uncertainties.
The baseline Internal Events, Internal Flooding, Fire, High Winds, and Seismic PRA models' notebooks document assumptions and sources of uncertainty and these were reviewed during the model peer reviews. The approach taken is, therefore, to review these documents to identify the items which may be directly relevant to the RICT Program calculations, to perform sensitivity analyses where appropriate, to discuss the results and to provide dispositions for the RICT program. The Callaway Internal Events, Internal Flooding, Fire, High Winds, and Seismic PRA models described within this LAR are the same as those described with the Ameren submittals regarding adoption of 10 CFR 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems, and Components for Nuclear Power Reactors" (Reference [2]).
The epistemic uncertainty analysis approach described below applies to the Internal Events PRA and any epistemic uncertainty impacts that are unique to either the Flooding, Fire, High Winds, or Seismic PRA are also addressed. In addition, NEI 06-09-A requires that the uncertainty be addressed in RICT Program Real Time Risk tools by consideration of the translation from the PRA model. The Real Time Risk model also referred to as the Configuration Risk Management (CRM) model, discussed in Enclosure 8, will include internal events, flooding events, high winds events, fire events, and seismic events. The model translation uncertainties evaluation and impact assessment are limited to new uncertainties that could be introduced by application of the Real Time Risk tool during RICT Program calculations.
The list of assumptions and sources of uncertainty were reviewed to identify those which would be significant for the evaluation of this application. If the Callaway Plant, Unit No. 1 (Callaway)
PRA model used a non-conservative treatment, or methods that are not commonly accepted, the underlying assumption or source of uncertainty was reviewed to determine its impact on this application. Only those assumptions or sources of uncertainty that could significantly impact the risk calculations were considered key for this application.
To identify these assumptions and sources of uncertainty both plant-specific and generic sources of uncertainty (as identified in Electric Power Research Institute (EPRI) TR-106737) were considered. All PRA notebooks were reviewed, and sources of uncertainty were compiled and characterized in the Callaway PRA Uncertainty Analysis and Sensitivities Notebook (Reference [3]). The identification and characterization of the sources of uncertainty was performed consistent with the requirements of the ASME/ANS PRA Standard (ASME/ANS RA-Sa-2009). This evaluation meets the intent of steps C-1 and E-1 of NUREG-1855, Revision 1. To assess the impact of sources of uncertainties on the TSTF-505 application, a review of the base case sources of uncertainty for the Callaway PRA models was performed.
Key Assumptions and Sources of Uncertainty E9-3 Each identified uncertainty was evaluated with respect to its potential to significantly impact the decisions of this submittal. This evaluation meets the intent of the screening portion for steps C-2 and E-2 of NUREG-1855, Revision 1. The uncertainty impacts for each of the PRA models are discussed in the following Sections 2.0 - 6.0 of this Enclosure.
2.0 Assessment of Internal Events (including Internal Flooding) PRA Epistemic Uncertainty Impacts In order to identify key sources of uncertainty, the Internal Events PRA model uncertainties were evaluated using the guidance in NUREG-1855 Revision 1 (Reference [4]) and EPRI 1016737 (Reference [5]). As described in NUREG-1855, sources of uncertainty include parametric uncertainties, modeling uncertainties, and completeness (or scope and level of detail) uncertainties.
Parametric uncertainty was addressed as part of the Callaway PRA model quantification. The parametric uncertainty evaluation for the Internal Events PRA model is documented in Section 5.1 of the PRA Uncertainty Analysis Notebook (Reference [6]).
Modeling uncertainties are considered in both the base PRA and in specific risk-informed applications. Assumptions are made during the PRA development as a way to address a particular modeling uncertainty because there is not a single definitive approach. Plant-specific assumptions and modeling uncertainties for each of the Callaway Internal Events PRA technical elements are noted in the PRA Uncertainty Analysis Notebook (Reference [6]).
The Internal Events PRA model uncertainties evaluation considers the modeling uncertainties for the base PRA by identifying assumptions, determining if those assumptions are related to a source of modeling uncertainty and characterizing that uncertainty, as necessary. EPRI compiled a listing of generic sources of modeling uncertainty to be considered for each Internal Events PRA technical element (Reference [5]), and the evaluation performed for Callaway considered each of the generic sources of modeling uncertainty as well as the plant-specific sources.
Completeness uncertainty addresses scope and level of detail. Uncertainties associated with scope and level of detail are documented in the PRA but are only considered for their impact on a specific application. No specific issues of PRA completeness have been identified relative to the TSTF-505 application, based on the results of the Internal Events PRA peer reviews.
Additionally, an evaluation of Level 2 (LERF) Internal Events PRA model uncertainty was performed, based on the guidance in NUREG-1855 (Reference [4]) and EPRI 1026511 (Reference [7]). The potential sources of model uncertainty in the Callaway PRA model were evaluated for the 32 Level 2 PRA topics outlined in EPRI 1026511.
A detailed review of the generic and plant-specific sources of Internal Events model uncertainties is discussed in Report P3463-RICT-UNCERT_APP5 (Reference [3]) and are Key Assumptions and Sources of Uncertainty E9-4 therefore not repeated in this enclosure. The purpose of this enclosure is to summarize the key sources of uncertainty that could potentially impact the RICT calculations.
Based on following the methodology in EPRI 1016737, as supplemented by EPRI 1026511, the impact of key sources of uncertainty in the Internal Events PRA model on the RICT application is summarized in Table E9-1. The key sources of uncertainty identified in Table E9-1 do not present a significant impact on the Callaway RICT calculations and therefore, the Internal Events PRA model can produce accurate RICT calculations. Note that RMAs will be developed when appropriate using insights from the PRA model results specific to the configuration.
Key Assumptions and Sources of Uncertainty E9-5 Table E9-1 Assessment of Internal Events (including Internal Flooding) PRA Epistemic Uncertainty Sources of Uncertainty and Assumptions RICT Program Impact Model Sensitivity and Disposition Battery Life Calculations Station blackout events are important contributors to baseline CDF at nearly every U.S. NPP. Battery life is an important factor in assessing a plant's ability to cope with an SBO. Many plants only have design basis calculations for battery life. Other plants have very plant plant/condition-specific calculations of battery life. Failing to fully credit battery capability can overstate risks, and mask other potential contributors and insights.
Realistically assessing battery life can be complex.
The batteries at Callaway will maintain output for four hours after loss of all AC power; however, there are several evaluations that show that the batteries will last at least eight hours. This time is somewhat conservative since it could reasonably be extended with additional considerations (e.g., load shedding). The primary components in the PRA that rely on the battery supply are for AFW control or pressurizer power-operated relief valve (PORV) operation during transients. The PORVs are not credited after battery depletion; therefore, sensitivity studies involving their continued operation are not warranted in the baseline PRA. Upon battery depletion, loss of all remote AFW flow control to the steam generators may lead to an overfill condition that could disable the TDAFW pump. Design and procedure at Callaway make this an unlikely occurrence, and an operator The uncertainty/assumption represents a conservative bias in the PRA model, and removing the identified conservative bias would make an already acceptable calculated risk metric more acceptable compared to the acceptance guidelines.
This is consistent with the guidance in Section 3.1.1 of EPRI 1016737.
Key Assumptions and Sources of Uncertainty E9-6 Table E9-1 Assessment of Internal Events (including Internal Flooding) PRA Epistemic Uncertainty Sources of Uncertainty and Assumptions RICT Program Impact Model Sensitivity and Disposition action is included in the model to locally control AFW flow to the steam generators after battery depletion.
Containment Sump/Strainer Performance All PWRs are improving ECCS sump management practices, including installation of new sump strainers at most plants.
Containment sump plugging is a concern with LOCAs of all sizes. The method employed to account for sump plugging is simplified in that it includes a single sump plugging probability per train (and includes CCF). An alternative method would be to define LOCA size-based probabilities for sump plugging, using WCAP-16882-NP, which provides event-dependent values.
A sensitivity was performed on the Callaway model where probabilities without limiting breaks were used in all cases (which minimizes the impact), all non-LOCAs were given the same value, and both trains were modeled to fail by single events. No change was seen, which indicates that the existing method does not introduce undue optimism or conservatism relative to other methods.
Core Melt Arrest In-Vessel Typically, the treatment of core melt arrest in-vessel has been limited.
However, recent NRC work has indicated that there may be more potential than previously credited. An example is credit for CRD in BWRs.
The Callaway model does not credit offsite power recovery after core damage and prior to vessel breach (The path to arresting core melt given a station blackout (SBO)). Recovering offsite power in the time window between core The first sensitivity assumed that if power was recovered, equipment is able to be restored for injection in order to cease core melt progression. Two values were used for non-recovery probabilities (multipliers for not recovering power Key Assumptions and Sources of Uncertainty E9-7 Table E9-1 Assessment of Internal Events (including Internal Flooding) PRA Epistemic Uncertainty Sources of Uncertainty and Assumptions RICT Program Impact Model Sensitivity and Disposition damage and vessel failure is not likely to buy a lot in terms of mitigating the progression. However, for the purpose of quantifying the assumption, two sensitivity cases were made for which representative values derived from the convolution method for offsite power non-recoveries were used.
between core damage and vessel failure);
one for high RCS pressure and one for low RCS pressure. Both values were selected to be on the conservative side of the available representative values. The LERF impact results were negligible.
For non-SBO sequences, the Callaway model gives limited credit to arresting core damage via cavity flooding to provide ex-vessel cooling. For these cases, VB was used as a surrogate, which was simply increased and decreased by a factor of two, and then set to TRUE to see the impact of not crediting core melt arrest. The results showed LERF increased by 1.4%.
Support System Initiating Events Support System Initiating Events -
Increasing use of plant-specific models for support system initiators (e.g., loss of SW, CCW, or IA, and loss of AC or DC buses) have led to inconsistencies in Explicit support system initiating event (SSIE) models were developed for the total loss of service water and component cooling water systems, in accordance with current industry practice (as well as The uncertainty with the MTTR implements a conservative bias in the PRA model that is the current state-of-practice in PRA.
Key Assumptions and Sources of Uncertainty E9-8 Table E9-1 Assessment of Internal Events (including Internal Flooding) PRA Epistemic Uncertainty Sources of Uncertainty and Assumptions RICT Program Impact Model Sensitivity and Disposition approaches across the industry. A number of challenges exist in modeling of support system initiating events: (1) treatment of common cause failures and (2) potential for recovery.
DC systems NK01 and NK04). For these events, a mean time to repair is included in the model structure to account for the probability that a train of equipment may be restored prior to redundant train failure or administrative shutdown of the plant. MTTR for Callaway was calculated to be 19.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> but the model uses an MTTR of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> since it is bounding and facilitates ease of modeling through the use of existing basic events.
Default CCW Train Alignment The default operating CCW train alignment is for the Train A CCW to be running. Alternate configurations are possible between SW, CCW, and ESW.
The alternate CCW configurations are modeled, and a sensitivity was performed which shows the model is not significantly sensitive to the alternate alignment.
The uncertainty or assumption will have minimal impact on the PRA results. In the RTR model the actual alignments will be modeled to produce accurate configuration risk results and appropriate RMAs will be applied if necessary.
Therefore, there would be no impact on the TSTF-505 application.
Key Assumptions and Sources of Uncertainty E9-9 Table E9-1 Assessment of Internal Events (including Internal Flooding) PRA Epistemic Uncertainty Sources of Uncertainty and Assumptions RICT Program Impact Model Sensitivity and Disposition Core Debris Contact with Containment In some plants, core debris can come in contact with the containment shell (e.g.,
some PWRs including free-standing steel containments). Molten core debris can challenge the integrity of the containment boundary. Some analyses have demonstrated that core debris can be cooled by overlying water pools.
The WCAP method that was used to develop the Callaway LERF model provides two opportunities (early and late) for intentional or unintentional RCS depressurization. The early depressurization is intended to avert an induced tube rupture, while the late depressurization is based on the relative likelihood of hot leg or surge line failure prior to vessel breach. Other RCS boundary failures not credited in this model include a stuck open PORV/PSV after the core uncovers (which could potentially have a non-negligible probability), or an increased likelihood of an RCP seal LOCA after the seal package is introduced to superheated steam.
Both of the depressurization probabilities play a role in determining likelihood of early containment failure as well. So the uncertainty inherent in their values could To assess the impact of these event values on LERF, surrogate values were used as calculated for a similar plant, for early depressurization and late, separately. The impact on the model is negligible. The uncertainty or assumption will have no impact on the PRA results.
Key Assumptions and Sources of Uncertainty E9-10 Table E9-1 Assessment of Internal Events (including Internal Flooding) PRA Epistemic Uncertainty Sources of Uncertainty and Assumptions RICT Program Impact Model Sensitivity and Disposition impact several other calculations. These are modeled as split fractions in the Callaway model; however, the early split fraction has a value of 1.0 for both complementary events (i.e., they are treated as flags). The success complement (RCS depressurized) is always ANDed with other events that are set to zero so the end result is effectively a split fraction with values of one and zero.
Key Assumptions and Sources of Uncertainty E9-11 3.0 Assessment of Translation (RTR Model) Uncertainty Impacts Incorporation of the baseline PRA models into the RTR model used for RICT Program calculations may introduce new sources of model uncertainty. Table E9-2 provides a description of the relevant model changes and dispositions of whether any of the changes made represent possible new sources of model uncertainty that must be addressed. Refer to for additional discussion on the RTR model.
Table E9-2 Assessment of Translation Uncertainty Impacts RTR Model Change and Assumptions Part of Model Affected Impact on Model Disposition PRA model logic structure may be optimized to increase solution speed.
Fault tree logic model structure, treatment of flag and house events and associated pruning for specific hazards, treatment of assumed-failed operator actions for specific hazards and post-processing approach affecting both Internal Events and hazard models.
The model, if restructured, will be logically equivalent and produce results comparable to the baseline PRA logic model.
Since the results will be verified as representative of baseline results, this is not a source of uncertainty for the Real Time Risk Model PRA and there is no impact on risk for the 4b process.
Set plant availability factor (Reactor Critical Years Factor) basic event to 1.0.
Basic event PAF Since the Real Time Risk model evaluates specific configurations during at-power conditions, the assumption of a plant availability factor that is less than 1.0 is not appropriate. Adjustment of the initiating event frequencies allows the Since this aligns the initiator frequencies for at-power conditions, it is not a source of uncertainty for the Real Time Risk Model PRA and there is no impact on risk for the 4b process.
Key Assumptions and Sources of Uncertainty E9-12 Table E9-2 Assessment of Translation Uncertainty Impacts RTR Model Change and Assumptions Part of Model Affected Impact on Model Disposition Real Time Risk Model to produce appropriate results for specific at-power configurations Configuration of the plant must be reflected in the RICT calculations.
Calculation of RICT and RMAT within Real Time Risk model.
The PRA model is modified to reflect that a component which is out of service is no longer normally running and, similarly, another train is no longer in standby (e.g., alternate train alignments than the default), thus the model will produce accurate results. Additionally, for certain SSC components that are not modeled in detail, surrogate events or gates are selected to generate conservative risk impact results.
The uncertainty/assumption represents an accurate alignment/configuration change or a conservative bias in the Real Time Risk Model PRA, and removing the identified conservative bias would make an already acceptable calculated risk metric more acceptable compared to the acceptance guidelines. This criterion is consistent with the guidance in Section 3.1.1 of EPRI 1016737.
Only select failure modes are mapped rather than all failure modes (e.g., Fails to Start is True and Fails to Run is False, breakers are set to failed Open, valves are set to failed Closed).
Calculation of RICT and RMAT within Real-Time Risk model.
Since the Real Time Risk model is mapping to only one failure for a given set of failure modes, the assumption is that for the given maintenance activity, the model will be aligned for the appropriate failure mode of a set of potential failures.
Since the failure mode chosen for mapping is consistent with normal maintenance configuration, and in select cases manual selection of component configuration is provided, this represents an accurate alignment/configuration change or a conservative bias in the Real Time Key Assumptions and Sources of Uncertainty E9-13 Table E9-2 Assessment of Translation Uncertainty Impacts RTR Model Change and Assumptions Part of Model Affected Impact on Model Disposition Risk Model PRA, and removing the identified conservative bias would make an already acceptable calculated risk metric more acceptable compared to the acceptance guidelines.
Key Assumptions and Sources of Uncertainty E9-14 4.0 Assessment of Supplementary Fire PRA Epistemic Uncertainty Impacts The purpose of the following discussion is to address the epistemic uncertainty in the Callaway Fire PRA. The Callaway Fire PRA model includes various sources of uncertainty that exist because there is both inherent randomness in elements that comprise the Fire PRA and because the state of knowledge in these elements continues to evolve. The development of the Callaway Fire PRA was guided by NUREG/CR-6850 (Reference [8]). The Callaway Fire PRA model used consensus models described in NUREG/CR-6850.
Callaway used guidance provided in NUREG/CR-6850 and NUREG-1855 (Reference [4]) to address uncertainties associated with the Fire PRA for the RICT Program application. As stated in Section 1.3 of NUREG-1855:
Although the guidance in this report does not currently address all sources of uncertainty, the guidance provided on the uncertainty identification and characterization process and on the process of factoring the results into the decision making is generic and independent of the specific source of uncertainty. Consequently, the guidance is applicable for sources of uncertainty in PRAs that address at-power and low power and shutdown operating conditions, and both internal and external hazards.
NUREG-1855 also describes an approach for addressing sources of model uncertainty and related assumptions. It defines:
A source of model uncertainty exists when (1) a credible assumption (decision or judgment) is made regarding the choice of the data, approach, or model used to address an issue because there is no consensus and (2) the choice of alternative data, approaches or models is known to have an impact on the PRA model and results. An impact on the PRA model could include the introduction of a new basic event, changes to basic event probabilities, change in success criteria, or introduction of a new initiating event. A credible assumption is one submitted by relevant experts and which has a sound technical basis. Relevant experts include those individuals with explicit knowledge and experience for the given issue. An example of an assumption related to a source of model uncertainty is battery depletion time. In calculating the depletion time, the analyst may not have any data on the time required to shed loads and thus may assume (based on analyses) that the operator is able to shed certain electrical loads in a specified time."
NUREG-1855 defines consensus model as:
A model that has a publicly available published basis and has been peer reviewed and widely adopted by an appropriate stakeholder group. In addition, widely accepted PRA practices may be regarded as consensus models. Examples of the latter include the use of the constant probability of failure on demand model for standby components and the Poisson model for initiating events. For risk-informed regulatory decisions, the Key Assumptions and Sources of Uncertainty E9-15 consensus model approach is one that NRG has utilized or accepted for the specific risk-informed application for which it is proposed.
The plant-specific assumptions in the Callaway Fire PRA and the 71 generic sources of uncertainty identified in EPRI 1026511 (Reference [7]) were evaluated for their potential impact on the RICT application (Reference [3]). This guideline organizes the uncertainties in Topic Areas similar to those outlined in NUREG/CR-6850 and was used to evaluate the baseline Fire PRA epistemic uncertainty and evaluate the impact of this uncertainty on RICT Program calculations.
A detailed review of the generic and plant-specific sources of Fire PRA model uncertainties are discussed in Reference [9] and are therefore not repeated in this enclosure. The purpose of this enclosure is to summarize the key sources of uncertainty that could potentially impact the RICT calculations.
Table E9-3 summarizes the review for key sources of uncertainty in the internal fire PRA model for the RICT application.
As noted above, the Callaway Fire PRA was developed using consensus methods outlined in NUREG/CR-6850 and interpretations of technical approaches as required by NRC. Fire PRA methods were based on NUREG/CR-6850, other more recent NUREGs, (e.g., NUREG-7150, Reference [10]), and published "frequently asked questions" (FAQs) for the Fire PRA.
The key sources of uncertainty identified in Table E9-3 do not present a significant impact on the Callaway RICT calculations and therefore, the Callaway Fire PRA model can produce accurate RICT calculations. Note that RMAs will be developed when appropriate using insights from the PRA model results specific to the configuration.
Key Assumptions and Sources of Uncertainty E9-16 Table E9-3 Assessment of Supplementary Fire PRA Epistemic Uncertainty Sources of Uncertainty and Assumptions RICT Program Impact Model Sensitivity and Disposition Treatment of unknown cable locations It is common to not know specifically in a room where every cable is located. As a result, the fire PRA assumes the cable is damaged for every fire until the cable is traced in detail.
This is a level of detail issue.
As described in EPRI 1026511, the approach selected is based on the level of detail within the model. Cable routing was not assumed for any credited equipment. All components and cables located in a Fire Area are assumed to be failed by the fire in that area as documented in the Individual Fire Area Notebook.
See also "Lack of Cable Data" Scope and treatment of instrumentation, annunciators, and alarms The treatment of instrumentation is a potential source of model uncertainty.
The standard requires the identification of any single instruments that are relied on for all credited HFEs in the fire PRA model.
The standard also requires the Instrumentation may be included as part of the requirements needed for appropriate operator response in the PRA logic model.
Failures of systems may also be included if spurious indications could lead to failure of the system to meet its PRA credited As described in EPRI 1026511, specific instrumentation may be included in the model as required for each modeled operator action and integrated into the Fire PRA model. A detailed review of HEPs and their required instrumentation has been performed. The Component Selection Notebook lists all the Key Assumptions and Sources of Uncertainty E9-17 Table E9-3 Assessment of Supplementary Fire PRA Epistemic Uncertainty Sources of Uncertainty and Assumptions RICT Program Impact Model Sensitivity and Disposition identification of potential spurious indications that could cause an undesired operator action related to that portion of plant design credited in the analysis.
function.
instruments included in the fire PRA and identifies which ones are subject to spurious actuation.
All of the instruments being used for information in the PRA (i.e., supporting operator actions) are listed in groups for functional indication (e.g., RCS pressure, containment sump level, etc.) meaning that the operator is not reliant on a single instrument for that indication.
Main control room abandonment scenarios Incorporation of NUREG-1921 Supplement 2, introduced a new assumption and source of model uncertainty associated with the timing for the MCR abandonment due to loss of control.
Scenarios involving control room abandonment and subsequent response actions were evaluated as described in EPRI 1026511. This can be achieved by incorporating detailed sequence event tree and system fault tree modeling for executing safe shutdown procedures from the alternate shutdown panels or by using a screening approach based on CCDP.
The Callaway Fire PRA model has detailed analysis that considers control room abandonment and its impacts on operators ability to safely shutdown the plant.
Key Assumptions and Sources of Uncertainty E9-18 Table E9-3 Assessment of Supplementary Fire PRA Epistemic Uncertainty Sources of Uncertainty and Assumptions RICT Program Impact Model Sensitivity and Disposition Lack of Cable Data Exclusion of certain systems due to lack of cable data Lack of credit for some systems could mask the risk associated with those systems in some applications.
Additionally, that same lack of credit could overestimate the importance of other credited systems.
As described in EPRI 1026511, the approach selected is based on the level of detail within the model. Cable routing was not performed for instrument air, main feedwater, or condensate but all of those systems are assumed unavailable.
Any components deemed less significant to route, too complex to route, or not credited in the PRA quantification are assumed failures. These assumed failures are applied to all fire scenarios.
To determine the importance of the components that are assumed failed, a sensitivity was performed. The flag file was updated to remove the assumed failure list and the model re-quantified.
Noteworthy insights from this sensitivity show that the components assumed failed have a non-negligible impact on the results (CDF -5% and LERF -39%).
Key Assumptions and Sources of Uncertainty E9-19 Table E9-3 Assessment of Supplementary Fire PRA Epistemic Uncertainty Sources of Uncertainty and Assumptions RICT Program Impact Model Sensitivity and Disposition Note that these "always failed" SSCs represent the industry consensus modeling approach. To ensure the calculated RICTs for these functions are not significantly affected by the "always failed" assumptions, RMAs will be developed for the affected RICT LCOs.
Key Assumptions and Sources of Uncertainty E9-20 5.0 Assessment of Supplementary High Winds PRA Epistemic Uncertainty Impacts An assessment was conducted of the supplementary High Winds PRA (HWPRA) epistemic uncertainty impacts on the TSTF-505 application. Table E9-4 provides the results of the assessment. A detailed discussion of the sensitivity studies performed for the High Winds PRA model is provided in Reference [11].
Key Assumptions and Sources of Uncertainty E9-21 Table E9-4 Assessment of Supplementary High Winds PRA Epistemic Uncertainty Sources of Uncertainty and Assumptions RICT Program Impact Model Sensitivity and Disposition High Wind Missile and Grid Fragilities There is an inherent assumption of statistical independence between missile fragilities when they are implemented in the CAFTA model for the HWPRA.
This is potentially non-conservative for separately modeled opposite train components in close proximity whose missile fragilities may be positively correlated. To test the impact of this assumption, the TORMIS Monte Carlo simulation results were used to determine the Boolean Intersection fragilities for selected opposite train components modeled in TORMIS. A sensitivity case in the HWPRA model was then undertaken using the Boolean intersection fragilities as the probabilities for new correlated wind missile failure events that were mapped to the components in both trains of equipment. The sensitivity case results showed only a very small impact on CDF.
The sensitivity case undertaken in the HWPRA study demonstrated that this assumption has only a very small impact on the PRA results; therefore, there would be no impact on the TSTF-505 application.
High wind events occurring at the plant are assumed to lead to either a turbine trip or a loss of offsite power event sequence, with the electrical grid fragility assigned based on the wind speed.
The probability of loss of offsite power at the time of the high wind event, that is, the electrical grid fragility, is assigned based on the wind speed. The same probabilities are used for both straight The baseline grid fragility values assumed for the Callaway HWPRA are viewed as reasonable estimates; however, grid fragility is recognized as an uncertainty significant to the evaluation of wind Key Assumptions and Sources of Uncertainty E9-22 Table E9-4 Assessment of Supplementary High Winds PRA Epistemic Uncertainty Sources of Uncertainty and Assumptions RICT Program Impact Model Sensitivity and Disposition winds and tornadoes. These probabilities are a pure assumption for the Callaway HWPRA but are generally consistent with values assumed in other studies. The HWPRA documentation includes a sensitivity study to assess the impact of these assumed electrical grid fragilities on CDF.
hazards.
The sensitivity case shows that the CDF results are highly sensitive to this assumption. This result is not surprising given the relative importance of the F1 wind speed initiating events, their high frequencies of occurrence (particularly for F1 straight winds), and the many dominant CDF cutsets that involve F1 winds combined with LOOP due to electrical grid fragility. While Case 1B (Reference [12]) shows a 114% increase in CDF versus the baseline, it is widely recognized (References [13] and [14])
that assuming grid failure with certainty at lower wind speeds can lead to over-conservatism in the results. The baseline grid fragility values assumed for the Callaway HWPRA are viewed as reasonable estimates.
Research performed by EPRI [High Wind Loss of Offsite Power Durations and Recovery: EPRI, Palo Alto, CA: 2020.
Key Assumptions and Sources of Uncertainty E9-23 Table E9-4 Assessment of Supplementary High Winds PRA Epistemic Uncertainty Sources of Uncertainty and Assumptions RICT Program Impact Model Sensitivity and Disposition 3002018232.] shows that the probability of offsite power recovery from wind-induced LOOPs for wind speeds less than 165 mph (lower end of F3 scale) is comparable to the nominal weather-related offsite power recovery probability.
The Callaway HWPRA does not credit offsite power recovery at any wind speed; this conservatism is not accounted for in the grid fragility sensitivity but there is no different reasonable alternative assumption that is at least as sound as this modeling approach.
Data analysis of the likelihood of a loss of offsite power following high wind events is an area of ongoing investigation for the nuclear industry.
Appropriate compensatory measures and RMAs (e.g., restrict work in switchyard, protect equipment, etc.) will be developed to maintain the risk below acceptable levels.
Key Assumptions and Sources of Uncertainty E9-24 Table E9-4 Assessment of Supplementary High Winds PRA Epistemic Uncertainty Sources of Uncertainty and Assumptions RICT Program Impact Model Sensitivity and Disposition Operator Actions in Unprotected Areas For operator actions where one or more of the diagnosis or execution steps takes place in the field outside the protected areas of the Category I buildings, the timing details are reviewed and used as a basis for modifying the human error probabilities.
For human failure events where one or more of the diagnosis or execution steps takes place in the field outside the protected areas of the Category I buildings, the timing details are reviewed and used as a basis for modifying the human error probabilities:
If the total system time window (TSW) is less than 60 minutes, regardless of the time margin, then the operator action is not credited (i.e., set to logical TRUE) for all wind speeds.
If the field action does not need to be completed within the first 60 minutes after the high wind event, the human error probability is adjusted depending on the time margin (i.e., the difference between the time required and the time available) and the severity of the wind.
The human error probability multipliers are a pure assumption for the Callaway HWPRA study The sensitivity case undertaken in the HWPRA study demonstrated that this assumption has only a very small impact on the PRA results; therefore, there would be no impact on the TSTF-505 application.
Key Assumptions and Sources of Uncertainty E9-25 Table E9-4 Assessment of Supplementary High Winds PRA Epistemic Uncertainty Sources of Uncertainty and Assumptions RICT Program Impact Model Sensitivity and Disposition but are generally consistent with similar multipliers recommended for seismic PRA.
A sensitivity case was undertaken in the HWPRA study to assess the sensitivity of the results to these human error probability multipliers. The sensitivity case results showed only a very small impact on CDF.
Default CCW Train Alignment The default operating CCW train alignment is for the Train A CCW to be running. Alternate configurations are possible between SW, CCW, and ESW.
The alternate CCW configurations are modeled, and a sensitivity was performed which shows the equipment related failures for the alternate alignments are not significantly sensitive. For High Winds, operator actions drive some deltas in the alternate alignment.
The uncertainty or assumption will have minimal impact on the PRA results. In the RTR model the actual alignments will be modeled to produce accurate configuration risk results and appropriate RMAs will be applied if necessary.
Therefore, there would be no impact on the TSTF-505 application.
Key Assumptions and Sources of Uncertainty E9-26 6.0 Assessment of Supplementary Seismic PRA Epistemic Uncertainty Impacts An assessment was conducted of the supplementary Seismic PRA (SPRA) epistemic uncertainty impacts on the TSTF-505 application. Table E9-5 provides the results of the assessment.
Significant assumptions and sources of model uncertainty identified during the development of the SPRA model are documented in Section 4 of the SPRA plant response model notebook (Reference [15]). Table 2-1 of the Quantification Notebook (Reference [16]) characterizes these assumptions and sources of model uncertainty for their impact on the seismic risk results.
Key Assumptions and Sources of Uncertainty E9-27 Table E9-5 Assessment of Supplementary Seismic PRA (SPRA) Epistemic Uncertainty Sources of Uncertainty and Assumptions RICT Program Impact Model Sensitivity and Disposition Non-Safety Component Sensitivity Non-safety components basic events were assigned a generic fragility value and were assumed to be fully correlated.
This treatment is conservative. A seismic sensitivity is performed to show that the generic fragility value used for the non-safety component basic events does not significantly impact CDF.
The uncertainty/assumption represents a conservative bias in the PRA model, and removing the identified conservative bias would make an already acceptable calculated risk metric more acceptable compared to the acceptance guidelines.
This criteria is consistent with the guidance in Section 3.1.1. of EPRI 1016737.
Mission Time A mission time of 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> was used in the Callaway SPRA model consistent with the Internal Events model. Mission times are used to define a safe stable state at which time the core has not been damaged, remains in a safe condition, and offsite resource and/or personnel may be available to aid in restoring equipment, connecting temporary equipment, etc.
A sensitivity study was performed to show that use of a 48-hour mission time has a negligible increase on CDF.
The sensitivity study performed on the base model shows that there is no impact on the PRA results and therefore the uncertainty or assumption will have no impact on the PRA results and therefore no impact on the TSTF-505 application.
Key Assumptions and Sources of Uncertainty E9-28 Table E9-5 Assessment of Supplementary Seismic PRA (SPRA) Epistemic Uncertainty Sources of Uncertainty and Assumptions RICT Program Impact Model Sensitivity and Disposition Given that a seismic event can potentially impact the ability for offsite plant or supplemental personnel to reach the site, there is an inherent uncertainty associated with the use of the 24-hour mission time. A seismic event can have impacts that are wide ranging on not only plant structure but offsite infrastructure (roads, communications, etc.) that may prevent personnel from easily accessing the site to assist in plant recovery actions.
On-Site FLEX Equipment Sensitivity FLEX equipment has the potential to be incorporated into a plant given a severe accident on site and with some assumed conditions during the extreme event. The SPRA Model currently includes no credit for this equipment in the baseline model (events set to True).
The current treatment of FLEX equipment is conservative. Sensitivity studies show that CDF and LERF can be reduced by improving credit for FLEX equipment.
The sensitivity documented in the Seismic Uncertainty analysis shows that significant reductions in CDF could result from fully crediting FLEX capabilities.
The uncertainty/assumption represents a conservative bias in the PRA model, and removing the identified conservative bias would make an already acceptable calculated risk metric more acceptable compared to the acceptance guidelines.
This criteria is consistent with the Key Assumptions and Sources of Uncertainty E9-29 Table E9-5 Assessment of Supplementary Seismic PRA (SPRA) Epistemic Uncertainty Sources of Uncertainty and Assumptions RICT Program Impact Model Sensitivity and Disposition guidance in Section 3.1.1. of EPRI 1016737.
Model Sensitivity to Seismic HRA Bin Definitions An inherent uncertainty associated with the SPRA development relates to the binning for the HEP seismic hazard group to the number of seismic hazard bins modeled in the SPRA.
HEP binning can have a significant impact on the baseline results. The binning process used in the Callaway model is developed consistently with EPRI Guidance, and is ensured to be realistic based on the relevant component fragilities used to define plant damage.
The use of the EPRI Guidance in HEP binning is essentially a consensus model or process.
The binning is developed using EPRI guidance, which is in essence, a consensus process for HEP binning.
There is also no reasonable alternative to the assumption which would produce different results and/or there is no reasonable alternative that is at least as sound as the assumption being challenged. This criterion is consistent with Section C.3.3.2 of RG 1.200 Revision 2. Therefore, no additional sensitivity studies are required.
Default CCW Train Alignment The default operating CCW train alignment is for the Train A CCW to be running. Alternate configurations are possible between SW, CCW, and ESW.
The alternate CCW configurations are modeled, but a sensitivity has not been performed. Based on the sensitivity of Internal Events and the modeling for Seismic, the existing Internal Events The uncertainty or assumption will have minimal impact on the PRA results. In the RTR model the actual alignments will be modeled to produce accurate configuration risk results and appropriate Key Assumptions and Sources of Uncertainty E9-30 Table E9-5 Assessment of Supplementary Seismic PRA (SPRA) Epistemic Uncertainty Sources of Uncertainty and Assumptions RICT Program Impact Model Sensitivity and Disposition sensitivity is expected to bound the results of a Seismic sensitivity. The Seismic results are not expected to be sensitive to the alternate alignments.
RMAs will be applied if necessary.
Therefore, there would be no impact on the TSTF-505 application.
Key Assumptions and Sources of Uncertainty E9-31 References
[1] Nuclear Energy Institute (NEI) Topical Report (TR) NEI 06-09, "Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines,"
Revision 0-A, October 12, 2012 (ADAMS Accession No. ML12286A322).
[2] Ameren Missouri Letter to NRC, Callaway Plant Unit No. 1, Union Electric Co., Renewed Facility Operating License NPF-30, Application To Adopt 10 CFR 50.69, "Risk-Informed Categorization And Treatment Of Structures, Systems And Components For Nuclear Power Reactors," October 30, 2020 (ADAMS Accession No. ML20304A455).
[3] PRA-IE-UNCERT_APP5, "Disposition of Key Uncertainties: Risk Informed Completion Times (RITS 4b)," Revision 1, June 2021.
[4] NUREG-1855, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision-making," USNRC, Revision 1, March 2017.
[5] Electric Power Research Institute (EPRI) TR-1016737, "Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments," Final Report, December 2008.
[6] PRA-IE-UNCERT, "Probabilistic Risk Assessment (PRA), Uncertainty Analysis Notebook," Revision 1, June 2021.
[7] Electric Power Research Institute (EPRI) Technical Report TR-1026511, "Practical Guidance on the Use of PRA in Risk-Informed Applications with a Focus on the Treatment of Uncertainty," December 2012.
[8] NUREG/CR-6850 (also EPRI 1011989), "Fire PRA Methodology for Nuclear Power Facilities," September 2005, with Supplement 1 (EPRI 1019259), September 2010.
[9] PRA-IE-UNCERT_APP2, "Fire Uncertainty Analysis and Sensitivities," Revision 1, June 2021.
[10] NUREG/CR-7150, Joint Assessment of Cable Damage and Quantification of Effects from Fire (JACQUE-FIRE), October 2012.
[11] PRA-IE-UNCERT_APP4, "High Wind Uncertainty Analysis and Sensitivities," Revision 0, June 2021.
[12] EPM Report P3463-HW-UNCERT, "Callaway Energy Center High Wind Probabilistic Risk Assessment High Wind Sensitivities," Revision 0.
[13] High-Wind Risk Assessment Guidelines, EPRI, Palo Alto, CA: 2015. 3002003107.
[14] Nuclear Energy Institute (NEI), "Tornado Missile Risk Evaluator (TMRE) Industry Guidance Document," NEI Technical Report 17-02 Rev 1, Washington, D.C.
Key Assumptions and Sources of Uncertainty E9-32
[15] PRA-SEISMIC-PLANT_RESPONSE, "Seismic Probabilistic Risk Assessment Modeling Notebook," Revision 1, May 2021.
[16] PRA-SEISMIC-QUANT, "Seismic Probabilistic Risk Assessment, Quantification Analysis Notebook," Revision 1, June 2021.