ML21312A360
| ML21312A360 | |
| Person / Time | |
|---|---|
| Issue date: | 11/17/2021 |
| From: | Laura Dudes Region 2 Administrator |
| To: | |
| Nicole Coovert | |
| References | |
| Download: ML21312A360 (6) | |
Text
IMC 2519, Appendix M, Determination for Apparent Violation 05200025/2021010-02, Failure to Install Electrical Raceways and Connections in Accordance with Applicable Instructions, Procedures, and Drawings Significance and Enforcement Review Panel (SERP) dated October 21, 2021 TABLE 4.1 Qualitative Decision-Making Attributes for NRC Management Review Decision Attribute Applicable to Basis for Input to Decision - Provide Decision? qualitative and/or quantitative information for management review and decision making.
Finding can be bounded Yes Inspection Manual Chapter 2519, Appendix A, using qualitative and/or AP 1000 Construction Significance quantitative information? Determination Process, dated October 26, 2020, classifies this issue as a YELLOW finding based on multiple high-risk systems (i.e., protection and safety monitoring system (PMS), Class 1E DC and Uninterruptible power supply system (IDS), reactor coolant system (RCS)) being affected and at least one safety-related function of a system being unable to perform its function (Automatic RCP Trip on an Engineering Safeguards actuation signal - PMS Safety related function #2),
resulting in a quality of construction of Row 3 in the AP1000 construction significance determination matrix.
This is the bounding assumption since high-risk systems were clarified as systems with a risk achievement worth (RAW) value of >400.
This RAW value does assume all safety related functions fail. It is recognized that all safety related functions are not lost; therefore, this qualitative assessment is bounding and conservative.
2 The extent the performance YES This performance deficiency (PD) was deficiency affects other repeated in approximately 50 cabinets equipment. affecting a significant number of high-risk systems and associated safety related functions. It is not clear that the PRA evaluation performed by the licensee adequately accounts for all functions and systems affected by this PD.
Common Cause Failure (CCF) dependent failure coupling factor(s) - nuclear industry data and methods for derivation of CCF include many sites that have greater degree of as-built cable separation. There are also AP 1000 instrumentation and control (I&C) design features (e.g., grounding, plant control system (PLS), diverse actuation system (DAS), etc.)
that may not be captured by generic industry data. Therefore, the dependent failure likelihood for this PD to impact more than one division (i.e., CCF coupling factor) could be underestimated for the separation non-conformance.
Modeling of extent of condition - there may be some uncertainty with respect to the licensees modeling of the extent of condition of the separation issue (beyond IDS, reactor trip and reactor coolant pump trip functions).
Although the licensee has utilized cables associated with IDS as a means to address the overall extent of condition (because that system operates in support of many safety-related functions), it is uncertain as to whether or not this would capture the potential risk contribution of non-IDS Class 1E cables associated with functions other than reactor trip or reactor coolant pump trip (e.g., power, instrumentation, or control cables for the automatic depressurization system (ADS) and core makeup tank (CMT) injection). This could potentially be a source of underestimation of risk associated with the separation non-conformance.
Period of time effect on the YES The cabinets were inspected and used during performance deficiency. hot functional testing with the condition present. NRC inspectors identified this concern, not the licensee, so it is reasonable to assume the condition would not have been identified.
Issue Date: 10/26/20 AppM-3 2519
3 The likelihood that the YES Corrective actions were in place at the time of licensees corrective actions identification but had not been effective in would successfully mitigate identifying issues inside the cabinet/panels.
the performance deficiency. Corrective actions going forward, which include identifying and bringing the panels into compliance with Institute of Electrical and Electronics Engineers (IEEE) 384, would successfully mitigate the PD.
Additional qualitative YES The licensee conducted a probabilistic risk circumstances associated assessment (PRA) of the condition. The with the finding that regional licensee concluded the risk was less than 1 E-management should 6 and, therefore, of very low safety consider in the evaluation significance (GREEN). The NRC assessed process. the licensees submittals regarding the PRA and failure modes and effects analyses and determined that, while the methodology and assumptions that were used in estimating the change in risk had value, there remained sufficient uncertainties as to whether the risk evaluation, including its sensitivities, would capture all the potential risk of the non-conforming conditions.
Result of management review (COLOR): WHITE Issue Date: 10/26/20 AppM-3 2519
4 Discussion: Given these threshold values, and the baseline core damage frequency (CDF) values for a new reactor, one could find technically consistent values of RAW for each of the columns of the x-axis. Since the top row in the matrix represents the greatest degree of nonconformance, the RAW values for each column are derived from the corresponding CDF values for each column of the top row and the baseline CDF as shown in Figure 1.
Figure 1 AP 1000 Construction SDP Matrix Assumption: AP1000 internal events baseline CDF ~ 2.5 E-7 Quality of Construction CDF CDF CDF CDF Row 4 < 1 E-6 1 E-6 to 1 E-5 1 E-5 to 1 E-4 > 1 E-4 Row 3 Row 2 Row 1 Very low Low Intermediate High RAW < 4 RAW 4 to 40 RAW 40 to 400 RAW > 400 System/Structure Risk Importance The PMS, IDS, and RCS systems all have a system RAW of greater than 400; however, it is recognized that, when that RAW value is calculated, it is assumed that all safety-related and non-safety related functions are lost. In this case, each affected cabinet represents a single function, so for a postulated initiating event where only one function is adversely affected, it is reasonable to conclude that RAW value for the affect function is less than the RAW value for the system as a whole. Additionally, in many cases the equipment would fail safe and not preclude the safety related function or would only affect a single train/channel as discussed in enclosure 2 of the licensees response letter.
The y-axis of the matrix in Figure 1 is a measure of quality of construction. One objective of the construction inspection program (CIP) is to provide reasonable assurance that the facility has been constructed in conformity with the license. In evaluating potential consequences of an issue of concern (IOC) identified through the CIP, the NRC considers whether the IOC impacted the quality of construction. The quality of construction informs the decision on whether or not reasonable assurance exists that the plant is being constructed in accordance with its design.
The matrix rows are generally defined as follows:
Row 1: Finding is More-than-Minor but the system or structure would have been able to meet its design function.
Row 2: Finding has moderate impact on a system or structure. Finding escalated from Row 1 due to a repetitive significant condition adverse to quality.
Row 3: Finding has substantial impact on a system or structure. Finding escalated from Row 2 due to a repetitive significant condition adverse to quality.
Row 4: Finding escalated from Row 3 due to a repetitive significant condition adverse to quality Issue Date: 10/26/20 AppM-3 2519
5 Taking into consideration that approximately 50 cabinets were not constructed in accordance with design standard IEEE 384 and the equipment was cleared for use during hot functional testing, reasonable assurance has not been established. It was also established that one of the safety-related functions for PMS could not be performed. This would constitute a substantial impact on a system because all trains would be affected and the function as a whole not met.
This is also consistent with IMC 2519, Appendix A, Step 11 for determining what row a system issue of concern impacts. Therefore, the staff concluded that Row 3 was appropriate.
The licensee presented a risk-based argument using an adjustment made to their CAFTA PRA model to attempt to model the condition. The licenses conclusion was the change in core damage frequency was less that 1 E-6 so the issue should be characterized as Green. NRC senior risk analysts reviewed the licensees PRA methodology and assumptions and found the modeling approach taken by the licensee to be conservative. However, several sources of uncertainty remain. For example, component failure rates and common cause probabilities all make the basic assumption the equipment was installed per the applicable codes and standards. Since the IEEE Standard 384 was not met, those assumption are not valid. The fact that the performance deficiency affects approximately 50 different cabinets also creates uncertainty. The performance deficiency in essence establishes a new common cause population for equipment with this degraded condition which cannot be estimated using historical or industry data. The initiating event frequency also must be adjusted since, for example, a less energetic fire would result in greater consequences due to the PD.
Common Cause Failure (CCF) dependent failure coupling factor(s) - nuclear industry data and methods for derivation of CCF include many sites that have greater degree of as-built cable separation. There are also AP 1000 I&C design features (grounding, PLS, DAS, etc.) that may not be captured by generic industry data. Therefore, the dependent failure likelihood for this performance deficiency to impact more than one division (i.e., CCF coupling factor) could be underestimated for the separation non-conformance.
Modeling of extent of condition - there may be some uncertainty with respect to the licensees modeling of the extent of condition of the separation issue (beyond IDS, reactor trip and reactor coolant pump trip functions). Although the licensee has utilized cables associated with IDS as a means to address the overall extent of condition (because that system operates in support of many safety-related functions), it is uncertain as to whether or not this would capture the potential risk contribution of non-IDS Class 1E cables associated with functions other than reactor trip or reactor coolant pump trip (e.g., power, instrumentation, or control cables for the ADS and CMT injection). This could potentially be a source of underestimation of risk associated with the separation non-conformance.
Findings during construction also are challenging to evaluate using operational significance determination process (SDP) tools and models since variables such as exposure period are not clear (i.e., if not identified the condition may not have been detected for years). Additionally, the fact that SDP tools do not address reasonable assurance that the plant is being constructed in accordance with its design also make it inappropriate to make a regulatory decision solely based upon a quantitative evaluation. However, the risk-informed argument presented can support the argument that it may be appropriate to deviate from the IMC 2519, Appendix A characterization as discussed above.
Issue Date: 10/26/20 AppM-3 2519
6 Based upon all the factors presented, mitigating the characterization of this finding from Yellow to White is recommended. The uncertainties involved, however, do not warrant reduction of the significance of the issue by two or more orders of magnitude below the upper bound obtained from the AP1000 Construction Significance Determination Matrix.
Issue Date: 10/26/20 AppM-3 2519