ML22048B594
| ML22048B594 | |
| Person / Time | |
|---|---|
| Issue date: | 04/12/2022 |
| From: | Jeffery Wood NRC/RES/DRA/PRAB |
| To: | |
| O'Donnell E | |
| Shared Package | |
| ML22048B590 | List: |
| References | |
| Download: ML22048B594 (4) | |
Text
Summary of EDG protection trips bypass risk significance assessment
[By Jeffery Wood, NRC office of RES-DRA-PRAB]
The impacts of various plants approaches to bypassing protective trips for emergency diesel generators are evaluated to assess the risk significance of this issue.
Background on SBO risk This issue has the potential to influence station blackout (SBO) modeling assumptions and results. SBO risk has been assessed in NUREG/CR-6890, Reevaluation of Station Blackout Risk at Nuclear Power Plants, which reports average SBO core damage frequency risk is about 3x10-6 per reactor-critical year (rcy). The estimate in NUREG/CR-6890 includes credit for recovery of a failed EDG. The analysis was completed in 2005. There have been some changes in data estimates since that time, but this still provides a reasonable reference point for the overall SBO risk for the industry. Some plants may have higher risk, and some lower. The average SBO risk across the industry is expected to be slightly lower today with improvements in EDG failure rates and improved coping capabilities (e.g., addition of supplemental diesels, FLEX strategies).
Potential impacts of bypassing protective trips The various strategies for bypassing protective trips could influence how the SBO coping response is modeled in the SPAR models. A set of alternative assumptions are developed to assess the risk impacts.
Assumption 1. Bypassing of protective trips could lead to non-recoverable EDG failures. To assess the risk impact of this assumption, the SPAR models are solved with all EDG recovery events failed.
Assumption 2. The bypassing of protective trips could have an impact on EDG performance. The EDGs are being run under different conditions during testing versus actual demands, which could mean the testing data do not accurately reflect the failure rates for actual demands. To assess the potential impacts, the SPAR models are solved with the EDG failure to run and common-cause failure probabilities increased by 30%. There is no clear causal relationship between the bypassing of protections and increase in failure rates. So, this assumption is highly speculative, but it is included to assess potential impacts.
Interpreting CDF results The following summarizes risk acceptance guidelines from Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis. The guidelines are used as a reference point for acceptable changes in risk associated with this issue. Note that for all changes in risk, the quantitative risk results are only one input to the decision making. Other qualitative factors should be taken into account to determine an acceptable level of risk.
When the calculated increase in CDF (CDF) is less than 10-6 / rcy, then the change is considered very small. This change in risk is typically considered acceptable.
When the calculated increase in CDF is in the range of 10-6 / rcy to 10-5 / rcy, then the change is considered small. If the total CDF is less than 10-4 / rcy (which is the case for all SPAR models), then the change is typically considered acceptable.
Changes that result in CDF increase above 10-5 / rcy are typically not considered to be acceptable.
Conclusions Four SPAR models were assessed to determine the risk significance of the assumptions stated above, namely, removing credit for EDG recovery and increasing the EDG failure rate. The results are shown in Tables 1 through 4 below. The impacts of these assumptions vary depending on the plants risk profile and SBO coping abilities. For the majority of plants, the risk increase assuming no EDG recovery is expected to be very small.
Only one of the plants assessed (Catawba, see Table 1) had a risk increase greater than 10-6 / rcy.
Catawba has a relatively high nominal CDF value and a large portion of its risk is associated with SBO sequences in comparison to other SPAR model results. This makes it more susceptible to the EDG changes than most plants. For comparison, Sequoyah (Table 2) also has a relatively high base CDF, but a smaller contribution from SBO. The risk impact of no EDG recovery for Sequoyah is less than 10-6 / rcy.
There may be a small number of plants that have similar risk profiles to Catawba, but the majority of plants are expected to have a risk increase less than 10-6 / rcy. No plant is expected to exceed the CDF increase threshold of 10-5 / rcy due to removing credit for EDG recovery.
Another assumption was applied to the sample of SPAR models to assess potential degradation of EDG failure rates associated with this issue. There is a potential inconsistency between the testing conditions (that are the primary input into failure rate estimates) and the actual demand conditions. There is no clear indication that this would result in higher failure rates or unavailability, but the potential for this impact is assessed to provide a bounding estimate of potential impacts. Even with these more conservative assumptions, the risk increase is not expected to exceed 10-5 / rcy for any plants.
Other considerations The modeling of EDG recovery is acknowledged to be an area of uncertainty in the SPAR models. There have been discussions among risk analysts at the NRC to remove credit for EDG recovery for reporting the nominal SPAR model results. Recovery events could be added into the models for specific analyses if warranted for those conditions. Interactions with industry PRA staff and PRA standards groups suggest that most industry PRA results DO NOT credit EDG recovery (or any other equipment recovery events).
As can be seen in the example SPAR model results, Tables 1 - 4, this assumption does not have a significant impact on the overall SPAR results with the Catawba example being indicative of the largest impact.
The inconsistent approaches across the industry for EDG protection bypassing suggest that SPAR modelers should reconsider how recoveries are applied on a plant-specific basis. The position for keeping EDG recovery in the SPAR models is mainly driven by their use in supporting the Significance Determination Process. However, it may be appropriate to remove credit for EDG recovery for other risk-informed decision making.
The SPAR model example results presented here do not include credit for plants implementing FLEX strategies. Currently, there is much uncertainty related to the risk impacts of the FLEX strategies related to the uncertainty in the reliability of FLEX equipment and the human reliability of operators to perform
the actions. Still, the overall impact of FLEX is expected to reduce the SBO risk for all plants. Two of the examples (Catawba and Braidwood) were assessed with preliminary estimates for FLEX strategy credit.
The FLEX model changes do reduce the overall CDF and SBO risk, but they do not have a significant impact on the change in risk comparing with EDG recovery and without EDG recovery. The FLEX changes would tend to give more margin in assessing the acceptability of the risk significance, but the conclusions of this assessment would not be changed whether FLEX is considered or not.
The examples presented here include only the results for internal events, i.e., the risk results associated with safety function challenges that are internal to the plant operation. External hazards, such as seismic events or hurricanes, are not included. The focus on internal events is typical since the PRA models have a greater degree of using consensus methods, have undergone peer reviews, and have a better characterization of uncertainties compared to external hazard PRA models. However, the exclusion of external hazard modeling could result in underestimating the risk impact of the EDG recovery credit, especially if those external hazards can contribute to inducing SBO conditions. The Catawba model was reevaluated to include seismic, hurricane, and high wind events along with internal events. The CDF risk increase from removing the EDG recovery events increased from 1.9 x 10-6 / rcy to 3 x 10-6 / rcy. It is difficult to assess the external hazards impact across all SPAR models because the models do not all include a full complement of external hazard models. However, as can be seen from the Catawba example, the internal event risk is expected to be the largest contribution to CDF, and inclusion of the external hazards is not expected to change the conclusions of the overall risk significance level.
Table 1. Catawba unit 1 Base CDF = 3.9 x 10-5 / rcy CDF contribution from SBO is 9.8 x 10-6 / rcy This plant has higher than average SBO risk.
Alternate modeling assumptions applied Change in risk, CDF / rcy No EDG recovery 1.9 x 10-6 30% increase in EDG failure rate, and No EDG recovery 4.8 x 10-6 No EDG recovery, with FLEX: delta-CDF = 1.8E-6 (3.4E 3.2E-5)
Table 2. Sequoyah unit 1 Base CDF = 6.9 x 10-5 / rcy CDF contribution from SBO is 1.8 x 10-6 / rcy Alternate modeling assumptions applied Change in risk, CDF / rcy No EDG recovery 5.8 x 10-7 30% increase in EDG failure rate, and No EDG recovery 2.8 x 10-6 Table 3. Braidwood unit 1 Base CDF = 1.8 x 10-5 / rcy CDF contribution from SBO is 6 x 10-7 / rcy Alternate modeling assumptions applied Change in risk, CDF / rcy No EDG recovery 1.2 x 10-7 30% increase in EDG failure rate, and No EDG recovery 8.4 x 10-7 No EDG recovery, with FLEX: delta-CDF = 1.1E-7 Table 4. Brunswick unit 1 Base CDF = 7.1 x 10-6 / rcy CDF contribution from SBO is 1.3 x 10-7 / rcy Plant has lower than average SBO risk Alternate modeling assumptions applied Change in risk, CDF / rcy No EDG recovery (base SPAR model does not include credit for EDG recovery)
No risk increase 30% increase in EDG failure rate, and No EDG recovery 8.9 x 10-8