ML25105A198

CCCG Modeling and Treatment of Cross-Unit CCFs

ML25105A198
Person / Time
Issue date:	04/18/2025
From:	Christopher Hunter Office of Nuclear Regulatory Research
To:
References
Download: ML25105A198 (12)

Text

1 Common Cause Component Modeling and Treatment of Cross-Unit Common-Cause Failures 1

INTRODUCTION There are some aspects of the current modeling and treatment of common-cause failures (CCFs) that is resulting in significant uncertainties in event and condition assessments (ECAs).

In some cases, these uncertainties could result in an overestimation of potential for CCF that could impact risk-informed decisionmaking. Two areas where U.S. Nuclear Regulatory Commission (NRC) staff and Idaho National Laboratory (INL) have discussed the need for revised guidance and/or modifications to the standardized plant analysis risk (SPAR) models are the modeling of common cause component groups (CCCGs) and the treatment of cross-unit CCF. This report provides discussion on these two topics along with revised guidance and recommendations on additional research activities.

2 CCCG MODELING

2.1 Background

A key step in the modeling of CCFs in the SPAR models is the identification of the CCCGs.

According to NUREG/CR-5485, a CCCG is a group of (usually similar [in mission, manufacturer, maintenance, environment, etc.]) components that are considered to have a high potential for failure due to the same cause or causes. There are three main ways CCCGs are reflected in the SPAR models:

The most common approach is identifying CCCGs in the SPAR models that are limited to redundant components within the same system. For example, the suction and discharge check valves to redundant pumps are divided into two separate CCCGs (one for the discharge valves and one for the suction valves).

In some cases, CCCGs may be expanded to contain the components with similar, but not fully redundant, functions within the same system. This is usually based on a review of licensee probabilistic risk assessments (PRAs) and benchmarking efforts. For example, there is a CCCG that relates to the potential for CCF of auxiliary feedwater (AFW) pump volutes regardless of the pump driver (e.g., motor, turbine, or engine).1 The third case expands the CCCGs to include cross-unit components (e.g., cross-unit emergency diesel generator (EDGs) when they have the capability for crosstie).

The most common CCCG practice of only modeling functionally redundant components within the same system is the result of data limitations (i.e., data is collected consistent with this approach). In addition, intersystem CCCGs that contain similar components across multiple systems are generally not used because this would greatly increase the size of the CCCG resulting in challenges in modeling specific system level impacts and larger uncertainties associated due to the lack of operating experience data for large CCCGs. The expansion of the CCCGs from redundant components to similar components across multiple systems (including cross-unit components) reflect the PRA model developers efforts to capture the potential for CCF between similar (but not redundant components) that would be otherwise omitted.

1 In this context, the term pump volute includes all hydraulic and supporting components for the pump assembly.

This includes the volute casing, the impeller, shaft, bearings, packing, and associated subcomponents.

2 The ASME/ANS PRA Standard requires PRA model developers to define CCCGs considering the following coupling factors(a) service conditions, (b) environment, (c) design or manufacturer, and (d) maintenance. However, there is no current guidance on how these coupling factors should be considered when assigning redundant components to a CCCG. For example, no guidance is provided on the circumstances under which similar components, that would typically be in the same CCCG due to sharing several coupling factors, be separated from the CCCG due to having different manufacturers. In addition, the SPAR model developers do not have access to all the required plant information to make a detailed evaluation.

Therefore, the current CCCGs in the SPAR models are based on the developers experience and expectation, along with any available licensee PRA information.

The desire to avoid underestimating CCF impacts has resulted in some SPAR models having redundant components that are associated with multiple, overlapping CCCGs. This can result in an overestimation of the potential CCF. When they appear, these duplicative CCCGs are mostly limited to EDGs and service water pumps.

2.2 Proposed Guidance on CCCG Modeling This section proposes that the duplicative CCCGs (i.e., multiple CCCGs with same components) should be eliminated to the maximum extent possible. The following subsections provide a revised CCCG modeling approaches for single-unit sites and multi-unit sites with shared systems. SPAR model developers will use this approach to modify the SPAR model CCCGs as part of the normal model update process. If the same component is included in multiple CCCGs in a manner not consistent with this guidance, analysts should contact the SPAR Model Help Desk for assistance in modifying the applicable CCCGs to support event and condition assessments (ECAs) on as needed basis.

2.2.1 CCCG Modeling for Single-Unit Sites The CCCG modeling approach is relatively straightforward for single-unit sites. Specifically, functionally redundant components should only be contained in a single CCCG. The existing SPAR models currently follow this approach in most cases. However, there are few exceptions with the most notable exception being that some plants have multiple CCCGs for the EDGs.

These duplicative CCCGs typically stem from having EDGs that differ in manufacturer or design and/or having alternative diesel generator(s) (e.g., SBO diesel generator).

The CCCG modeling approach should include redundant components in the same CCCG if the same individual component failure data is used. Component failure data is pooled for components that are determined to be sufficiently similar and, therefore, have the same reliability. For example, the existing EDG failure data is pooled from multiple class 1E EDG manufacturers (e.g., Fairbanks Morse, Worthington, General Motors, etc.). This approach is potentially conservative if the redundant components have a significantly different design because the design CCF coupling factor could be mitigated.2 However, the redundant components will likely share the other CCF coupling factors (e.g., similar environment, common maintenance practices, etc.). Therefore, the existing practice of grouping these components in the same CCCG in most cases is justifiable. However, this could be a key modeling uncertainty in some ECAs, which can be evaluated using sensitivity calculations.

The existing state-of-practice CCF models (including the Alpha Factor Model) assume that all components withing the CCCG have the same reliability (i.e., the same Qt). Therefore, if 2

A different manufacturer does not necessarily constitute a different design.

3 redundant components are judged to be sufficiently different to warrant the use of different individual component failure data, the applicable components should generally not be included in the same CCCG.3 For example, the individual failure events (e.g., failure to start, failure to run, etc.) for SBO diesel generators may use different individual component failure data than the EDGs. The use of the different data sets for the EDGs and SBO diesel generators is due to these components being sufficiently different (i.e., significantly diverse) and, therefore, having different reliabilities. Therefore, the SPAR models should not generally include both SBO and Class 1E diesel generators in the same CCCG. However, a plant (or site) that has multiple SBO diesel generators should have a separate CCCG for these diesel generators.4 Note that this approach is nonconservative since it is expected that some CCF coupling factors (e.g., similar maintenance practices, environments, etc.) will exist between the different diesel generator types. This could be a key modeling uncertainty in some ECAs, which should be evaluated qualitatively and/or quantitatively. However, there are some sites where the SBO diesel generator(s) are similar to the EDGs and grouping them together in a CCCG is appropriate (e.g., see Section 2.2.4.4 for an example).

2.2.2 CCCG Modeling for Multi-Unit Sites with Shared Systems In addition to the single-unit CCCGs of redundant components with the same system per unit, the potential for cross-unit CCF between redundant components across shared systems/components or systems that can be crosstied should be considered. Some SPAR models for multi-unit sites have additional CCCGs for EDGs and/or service water pumps when these components can be aligned/crosstied to multiple units. These additional CCCGs can result in overestimation of the potential CCF because they are duplicative of the single unit CCF events. However, these overcounting effects will be reduced by using adjusted cross-unit CCF parameters (see Section 3 for additional information). If the redundant cross-unit components are judged to be sufficiently different to warrant the use of different individual component failure data (e.g., EDGs and SBO diesel generators), the applicable components should not be included in the cross-unit CCCG.

2.2.3 CCCG Modeling of Similar Subcomponents of Diverse Equipment Some existing SPAR models for pressurized-water reactors (PWRs) have a CCCG associated with the AFW pump volutes regardless of the types of pump driver (e.g., motor, turbine, and engine). This CCF basic event can have a significant impact on some ECAs because it reduces the risk benefits of having diverse equipment. Operating experience does indicate that there is potential CCF between similar subcomponents of redundant, but diverse, equipment.

Specifically, a CCF event occurred in 1998 due to failures of pump packing of both the motor-and turbine-driven AFW pumps at PWR 2. This CCF event is only included in the generic CCF prior, which includes all CCF events that occurred during the 1997-2015 period. There are no CCF events associated with AFW pump volutes that affected diverse pumps during the rolling 15-year period (2006-2020) used for the Bayesian update.5 The modeling of similar subcomponents of diverse redundant equipment goes beyond the standard practice of modeling components per their boundary definitions provided in Appendix 3

For ECAs where the reliability of a single component within a CCCG is adjusted to account for an observed degraded condition, the affected component should not be removed from the CCCG.

4 There are currently no CCF parameters for SBO diesel generators. The generic demand and rate CCF parameters should be used. Future development of SBO diesel generator CCF parameters will be considered.

5 The current CCF parameters use the CCF data from the 2006-2020 period. See INL/EXT-21-62940, CCF Parameter Estimations, 2020 Update, for additional information.

4 A of NUREG/CR-6928, Industry-Average Performance for Components and Initiating Events at U.S. Commercial Nuclear Power Plants, (ML070650650) and, therefore, it is not recommended to model this type of potential CCFs explicitly. This does not mean that some CCF coupling factors are not present between redundant, but diverse, components. However, the application of the existing CCF models with the very limited CCF data likely provide results that have greater uncertainties than the benefit their inclusion provides. There is potential for underestimating the risk contribution from CCF of the similar sub-components and this should be treated as an uncertainty in the evaluation.

2.2.4 CCCG Modeling Examples The following examples of existing SPAR model CCCGs and how the proposed guidance should be applied for each case.

2.2.4.1 PWR 1 EDGs PWR 1 has two Fairbanks Morse EDGs. In addition, there is an SBO diesel generator that can be crosstied to either of the two safety buses. The SBO diesel generator is considered sufficiently different than the EDGs and, therefore, uses different component failure data. There is no crosstie capability with the opposite units EDGs. Version 8.83 of the PWR 1 SPAR model has two EDG CCCGs per failure mode:6 CCF of all three diesel generators CCF of both EDGs Since the SBO diesel generator uses the different individual component failure data than the EDGs, the PWR 1 SPAR model should not have a CCCG of all three diesel generators. And given the EDGs cannot be crosstied to the opposite unit safety buses there should be no cross-unit CCCG. Therefore, the PWR 1 SPAR model should only have one CCCG associated with its two EDGs:

CCF of both EDGs 2.2.4.2 PWR 2 EDGs PWR 2 has two EDGs per unit and no SBO diesel generator. All four EDGs are Bruce General Motors diesel generators. Each EDG can be crosstied to either safety bus on the opposite unit.

Version 8.82 of the PWR 2 SPAR model has three EDG CCCGs per failure mode.7 One of these CCCGs include EDGs across units:

CCF of all four diesel generators CCF of both Unit 1 EDGs CCF of both Unit 2 EDGs The CCCG of both Unit 2 EDGs is not needed because there is no Unit 2 SPAR model. Since all four EDGs use the same individual component failure data and can be crosstied between units, the PWR 2 SPAR model should only have two CCCGs associated with the EDGs:

Cross-Unit CCF of all four EDGs 6

Each unit at PWR 1 has their own SPAR model.

7 There is only one PWR 2 SPAR model representing Unit 1. ECAs associated with Unit 2 operational events can be performed using this model because the units are judged to be nearly identical.

5 CCF of both Unit 1 EDGs However, the CCCG of all four EDGs should use the revised parameters as discussed in Section 3.5.

2.2.4.3 PWR 3 EDGs PWR 3 has two EDGs per unit. All four EDGs are Fairbanks Morse diesel generators. Each EDG can be crosstied to either safety bus on the opposite unit. In addition, there is an SBO diesel generator that can be crosstied to either units safety buses. The SBO diesel generator was manufactured by Caterpillar, and is considered sufficiently different than the EDGs and, therefore, uses different component failure data. Version 8.82 of the PWR 3 SPAR model has four EDG CCCGs per failure mode.8 One of these CCCGs include EDGs across units:

CCF of all five diesel generators CCF of both Unit 1 EDGs and the SBO diesel generator CCF of both Unit 1 EDGs CCF of both Unit 2 EDGs The CCCG of both Unit 2 EDGs is not needed because there is no Unit 2 model. Since the SBO diesel generator uses the different individual component failure data, it should not be included in any CCCG containing the four EDGs. Given the four EDGs can be crosstied between units, the PWR 3 SPAR model should only have two CCCGs associated with the EDGs:

Cross-unit CCF of all four EDGs CCF of both Unit 1 EDGs However, the CCCG of all four EDGs should use the revised parameters as discussed in Section 3.5.

2.2.4.4 PWR 4 EDGs PWR 5 has five total EDGsthree Colt-Pielstick (1-2A, 1B, and 2B and two Fairbanks Morse (1C and 2C). EDG 1-2A can supply power to train A safety bus of either unit. EDGs 1B and 2B can only supply power to their respective units train B safety bus. EDG 1C supplies power to the river water bus of either unit. EDG 2C is the SBO diesel generator that can be manually aligned to supply either units train B safety bus. All five diesel generators use the same reliability data. Version 8.82 of the PWR 4 SPAR model has two EDG CCCGs per failure mode.9 One of these CCCGs include EDGs across units:

CCF of EDGs 1-2A, 1B, 1C, and 2C CCF of EDGs of both Unit 1 EDGs (1-2A and 1B)

Since the all the EDGs use the same individual component failure data and EDGs 1-2A, 1C and 2C can be crosstied between units, the existing PWR 4 SPAR model CCCGs are correct.

However, the CCCG of EDGs 1-2A, 1B, 1C, and 2C will use the revised parameters as 8

There is only one PWR 3 SPAR model representing Unit 1. ECAs associated with Unit 2 operational events can be performed using this model because the units are judged to be nearly identical.

9 There is only one PWR 4 SPAR model representing Unit 1. ECAs associated with Unit 2 operational events can be performed using this model because the units are judged to be nearly identical.

6 discussed in Section 3.5. Note that EDG 2B is not included in any CCCG because it cannot be crosstied to Unit 1 and the SPAR model is a Unit 1 model.

2.2.4.5 Boiling-Water Reactor (BWR) 1 EDGs BWR 1 has five identical Electro-Motive Diesel EDGs. EDGs 1A and 2A can supply the division II safety buses on their respective unit. In addition, these EDGs can be crosstied to the division II safety bus on the other unit.10 EDGs 1B and 2B can only supply the division III safety buses on their respective unit (i.e., these EDGs cannot be crosstied).11 EDG 0 is a swing diesel generator that is automatically aligned to supply either units division I safety bus.12 Version 8.81 of the BWR 1 SPAR model has two EDG CCCGs per failure mode.13 One of these CCCGs include EDGs across units:

CCF of EDGs 1A, 2A and 0 CCF of EDGs 1A and 2A Both existing CCCGs contain the EDG 2A, which duplicates the potential the cross-unit CCF and, therefore, this EDG should be eliminated from the Unit 1 EDG CCCG. Therefore, the BWR 1 SPAR model should have two CCCGs associated with the EDGs:

Cross-unit CCF of EDGs 1A and 2A CCF of EDGs 1A and 0.

However, the CCCG for EDGs 1A and 2A should use the revised parameters as discussed in Section 3.5. Note that EDGs 1B and 2B only support HPCS and cannot be crosstied and, therefore, should not be in a CCCG with the other EDG nor should there be a CCCG for the potential cross-unit CCF between these two HPCS EDGs.

2.2.4.6 PWR 5 EDGs PWR 5 has five total EDGs. The Unit 1 EDG 1A consists of two UD45 Societe Alsacienne De Constructions Mecaniques De Mulhouse (SACM) engines connected to a common generator.

EDG 1B is a Fairbanks-Morse opposable piston diesel generator. Unit 2 has two Fairbanks-Morse EDGs (2A and 2B). These EDGs cannot be crosstied to the safety buses on the opposite unit. The SBO diesel generator is a SACM diesel generator (similar to EDG 1A),

which can be manually aligned to either units safety buses. The safety-related SACM and Fairbanks-Morse diesel generators use the same EDG reliability parameters. Further, the SACM SBO diesel generator uses the same safety-related EDG reliability parameters because it is judged to be similar to the EDGs.

Both Version 8.84 PWR 5 SPAR models have seven EDG CCCGs per failure mode.14 Some of these CCCGs include EDGs across units:

10 EDG 1A and 2A can supply both units concurrently; however, there are loading restrictions for LOCA scenarios.

11 The division III safety buses at General Electric Type 5 and 6 boiling-water reactors only support the high-pressure core spray system.

12 EDG 0 will automatically align to the division I bus that loses power first. Operators can manually align the EDG to supply the division I bus on the other unit.

13 There is only one BWR 1 SPAR model representing Unit 1. ECAs associated with Unit 2 operational events can be performed using this model because the units are judged to be nearly identical.

14 Each unit at PWR 5 has its own SPAR models.

7 CCF of all five diesel generators CCF of both Unit 1 EDGs and the SBO diesel generator CCF of both Unit 2 EDGs and the SBO diesel generator CCF of all three Fairbanks-Morse EDGs CCF of both Unit 1 EDGs CCF of both Unit 2 EDGs CCF of the EDG 1A and SBO diesel generator (i.e., both SACM DGs)

Since the EDGs cannot be crosstied to the opposite unit safety buses there should be no cross-unit CCCG. Since the EDGs from different manufacturers (including the SBO diesel generator) use the same individual component failure data, each PWR 5 SPAR model should only have one CCCG associated with the EDGs:

CCF of the unit EDGs combined with the SBO diesel generator.

3 TREATMENT OF CROSS-UNIT CCFs

3.1 Background

The modeling of CCFs in the SPAR models is typically limited to functionally redundant components within the same reactor plant unit and system. However, it is also recognized that similar components across plant units at multi-unit sites (cross-unit) or across different systems within the same unit (intersystem) can share CCF coupling factors such as:

Hardware similarities (e.g., manufacturer, components)

Design Maintenance practices Operational practices Environmental factors This SPAR modeling limitation on cross-unit or intersystem CCF is largely due to how the existing failure data is coded into the CCF database. Failure data is submitted by licensees to Institute of Nuclear Power Operations (INPO) for inclusion in Industry Reporting and Information System (IRIS). INL reviews this failure data, along with licensee event reports (LERs), to identify CCF events. The CCF events are coded on a per unit and component basis. However, potential cross-unit and intersystem CCF events can be inferred by comparing failure reports across systems and units; but there are larger uncertainties regarding the strength of the CCF coupling for similar components across systems or units. In addition, the modeling of intersystem CCF would result in CCCGs that become too large and complex to be practical for use using the existing CCF models (e.g., Alpha Factor, Multiple Greek Letter).15 One exception to this CCF modeling approach is that some SPAR models (for multi-unit sites) include cross-unit CCF modeling of emergency diesel generators (EDGs) and service water 15 Intersystem CCF is not currently modeled in the SPAR models, which is a nonconservative approach to CCF.

Therefore, consideration for addressing the impact of similar components used in multiple systems should be evaluated when an issue impacts similar components found in multiple systems (e.g., motor-operated valves, breakers, fuse holders, fans, etc.).

8 pumps.16, 17 This cross-unit CCF modeling has been the dominant risk contributor in some ECAs. The inclusion of this cross-unit CCF modeling mitigates the potential to provide excessive credit for cross-unit accident mitigation (since cross-unit components may share similar coupling factors with the other unit); however, there is concern that the extension of the existing CCF parameters (i.e., alpha factors) to address cross-unit CCF can overestimate the CCF coupling and result in an overestimation of the risk impact. In addition, this cross-unit model can result in additional CCCGs that may double-count the CCF impact (i.e., if the same basic events are included in multiple CCCGs).

3.2 CCF Data Review This section explores this issue to determine if the existing CCF data can provided additional insights and whether an alternative approach to assessing the potential for cross-unit CCF is needed. As was previously mentioned, all existing CCF events contained in the CCF Database are reported on a per-unit basis. However, a review of the CCF data could help to determine how many cross-unit CCFs have occurred by identifying CCF events at other units at the same site for similar components occurring close in time to each other. If cross-unit CCFs have occurred, a relative comparison with the number of CCFs that occurred a single unit can be made to determine if the strength of CCF coupling factors across units is the same or less than that of CCFs within the same system.

A review of the existing CCF database resulted in a total of 341 CCF events that occurred from 1989 through 2021.18 Of these, 74 were complete CCF events (i.e., a CCF of all components within a CCCG) and 267 were partial CCF events (i.e., a CCF of only some components within a CCCG or a failure where at least one CCF weighting factor was below 1.0). Further review of the 341 CCF events revealed the following 10 CCF events for similar components across units:19 Table 1. Cross-Unit CCF Events Event Date Plant System Component Type Failure Mode 1

3/17/1996 BWR 2, Unit 1 Service Water MDP Fail to Run 3/17/1996 BWR 2, Unit 2 Service Water MDP Fail to Run 2

6/28/1996 BWR 1, Unit 1 Service Water Strainer Plug 6/28/1996 BWR 1, Unit 2 Service Water Strainer Plug 3

10/3/1996 PWR 3, Unit 1 High-Pressure Injection MDP Fail to Run 10/3/1996 PWR 3, Unit 2 High-Pressure Injection MDP Fail to Run 4

9/14/2000 PWR 7, Unit 1 DC Power Battery Charger Fail to Operate 9/14/2000 PWR 7, Unit 2 DC Power Battery Charger Fail to Operate 16 Some plants have additional crosstie capabilities that are not currently included in the applicable SPAR models.

These crossties, including the potential for cross-unit CCF of key components, will be added to the applicable SPAR models if the appropriate plant information becomes available.

17 The PWR 6 SPAR model includes a cross-unit CCCG for the safety injection pumps. In addition, some plants have shared systems/components (e.g., Turkey Point turbine-driven AFW pumps and Susquehanna EDGs).

18 The existing CCF parameters used in the SPAR models were calculated using a generic CCF prior from all CCF events that occurred during the 1997-2015 period and Bayesian updated using the applicable component/failure model CCF data from the 2006-2020 period.

19 The cross-unit CCFs of the EDGs and service water strainers at PWR 7 (April 2003) and circulating water strainers at PWR 5 (July 2006) are each counted as single cross-unit CCF.

9 Event Date Plant System Component Type Failure Mode 5

4/24/2003 PWR 7, Unit 1 Emergency AC Power EDG Fail to Run 4/24/2003 PWR 7, Unit 2 Emergency AC Power EDG Fail to Run 4/24/2003 PWR 7, Unit 1 Service Water Strainer Bypass 4/24/2003 PWR 7, Unit 2 Service Water Strainer Bypass 6

11/10/2005 BWR 3, Unit 1 Circulating Water Strainer Bypass 11/20/2005 BWR 3, Unit 2 Circulating Water Strainer Bypass 7

12/30/2005 BWR 4, Unit 1 Main Steam SRV Fail to Open 12/30/2005 BWR 4, Unit 2 Main Steam SRV Fail to Open 8

7/6/2006 PWR 5, Unit 1 Circulating Water Strainer Fail to Operate 7/6/2006 PWR 5, Unit 2 Circulating Water Strainer Plug 7/7/2006 PWR 5, Unit 1 Circulating Water Strainer Plug 7/7/2006 PWR 5, Unit 1 Circulating Water Strainer Fail to Operate 7/12/2006 PWR 5, Unit 2 Circulating Water Strainer Plug 7/12/2006 PWR 5, Unit 2 Circulating Water Strainer Fail to Operate 7/13/2006 PWR 5, Unit 2 Circulating Water Strainer Plug 7/13/2006 PWR 5, Unit 2 Circulating Water Strainer Fail to Operate 9

1/20/2011 PWR 8, Unit 1 Service Water Strainer Plug 1/20/2011 PWR 8, Unit 2 Service Water Strainer Plug 10 3/24/2011 PWR 9, Unit 1 Circulating Water Strainer Plug 4/21/2011 PWR 9, Unit 2 Circulating Water Strainer Plug Of these 10 cross-unit CCFs events, 3 are complete CCFs (indicated in bold) and 7 are partial CCF events.20 There is a substantially lower number of cross-unit CCF events when compared to total CCF events. Although this was a preliminary review and there are limitations to this data review, there is indication that the cross-unit CCF coupling is weaker than CCF of redundant components in the same system.21 Future work described in Section 4 includes a more comprehensive review of potential cross-unit CCF events, though it is not expected that this would significantly impact the insights that can be drawn from Table 2. In most cases, it would be expected that the CCF coupling is weaker. One potential exception is certain environment events (e.g., biologic intrusion, frazil ice, etc.) where CCF coupling of components (e.g., service water strainers and pumps) across multiple units could be as strong as single unit CCF coupling. And it is likely that the cross-unit CCF coupling is dependent on the system and component type. Table 2 provides breakdown of the cross-unit CCF events by system, component type, and failure mode.

20 One of the complete cross-unit CCF events (April 2003 CCF of EDGs and service water strainers at PWR 7) was associated with dependent failures caused to extreme environment conditions and, therefore, are not accounted for in the CCF parameter estimates.

21 Examples of the limitations of this data review include being unable to identify (a.) individual failures on each unit that could have resulted in partial cross-unit CCF and (b.) a CCF on one unit and individual failure on another unit due to the same cause.

10 Table 2. Additional Breakdown of Cross-Unit CCF Events22 System Component

1. of Component CCFs Failure Mode1

1. of Failure Mode CCFs

1. of Failure Mode Cross-Unit CCFs Service Water MDP 70 Fail to Run 8

1 High-Pressure Injection MDP Fail to Run 17 1

Main Steam Relief Valve 45 Fail to Open 24 1

DC Power Battery Charger 9

Fail to Operate 9

1 Emergency AC Power EDG 23 Fail to Run 10 1

Circulating Water/

Service Water Strainer 74 Fail to Operate2 25 1

Circulating Water/

Service Water Strainer Plug 44 4

Circulating Water/

Service Water Strainer Bypass 5

2 1 The Failure Mode column only includes failure modes associated with a cross-unit CCF.

2 The Failure to Operate is used as a general failure mode that represents strainer failures from other than plugging or bypass. Examples include a failure of traveling screens to rotate, tripped or broken shear pins, and screen wash systems failing to operate.

The cross-unit CCF data indicates that strainers for open systems (e.g., circulating water, service water) are more susceptible to environmental challenges and, therefore, likely have stronger cross-unit CCF coupling, albeit still weaker as shown by the smaller number of cross-unit CCF events when compared to those provided in Table 2. This conclusion aligns with stronger CCF coupling identified in the causal alpha factor and component-specific prior work that indicates strainers have a significantly stronger coupling due to environmental factors for redundant components in the same system.

3.3 Conclusions As indicated by the data review, the current SPAR models of record (as of January 2025) include an extension of the Alpha Factor Model across units using the existing CCF parameters overestimate the risk impact from potential cross-unit CCF. In some cases, this overestimation could be significant. Additional research is needed to calculate cross-unit CCF parameters that can be used to replace the existing CCF parameters in the cross-unit CCF basic events that are currently included in the base SPAR models (see Section 3.4 for additional information). An interim approach (provided in Section 3.5) should be used for treating cross-unit CCF in ECAs until cross-unit CCF parameters can be developed.

3.4 Future Cross-Unit CCF Research INL has developed a work plan for a limited scope study of cross-unit CCF events for SPAR model components for which cross-unit CCF is currently modeled (EDGs and service water pumps). In addition, this study will also include cross-unit CCF of circulating water and service water strainers since the initial data review indicates that these components are likely the most susceptible to cross-unit CCF. This limited scope study will require the creation of a new tool in the Integrated Data Collection and Coding System (IDCCS) that can generate a cross-unit CCF 22 The number of cross-unit CCF events in Table 2 is higher than what is provided in Table 1 because some events involved multiple systems and/or failure modes.

11 report to identify the cross-unit CCF events in the current CCF Database. The cross-unit CCF events will then be added to IDCCS.

After a review of these results provides confidence that all cross-unit CCF events have been identified, cross-unit CCF parameters will be calculated. It is unlikely that the existing Bayesian process will be used because of small number of cross-unit CCF events. Therefore, the cross-unit CCF parameters will likely be calculated from the failure data of the applicable components directly. A technical report will be produced that documents the study including background information, the processes used to identify cross-unit CCF events and calculate the cross-unit CCF parameters, results, and insights.

3.5 Interim Approach for Treatment of Cross-Unit CCF in ECAs To provide a better estimate of the potential for cross-unit CCF in ECAs until additional research is completed, the best estimate evaluation should use cross-unit CCF parameters that are multiplied by a factor of 0.1.23 This factor is believed to bound cross-unit CCF for most of the component types and failure modes provided in Table 2.24 These adjustments will also reduce the effect of overcounting effects resulting from having EDGs in multiple CCCGs.

Although these adjustments are judged to be best estimate given the current CCF data and modeling, they should be identified as key uncertainty associated with ECAs. It is recommended that analysts perform sensitivity calculations to bound the effects of the potential for cross-unit CCF. Analysts should contact the SPAR Model Help Desk for assistance on making the adjustments to the cross-unit CCF parameters.

3.5.1 Use of Interim Approach Example As stated in Section 2.2.4.2, the PWR 2 SPAR model should have the following EDG CCCGs using the proposed guidance provided in Section 2.2:

CCF of both Unit 1 EDG CCF of all four EDGs The CCF of all four EDGs will use the revised CCF parameters. The CCF parameters are revised by multiplying the existing EDG alpha factors, except for 1, by a factor of 0.1. For consistency with the alpha factor model, 1 should be adjusted such that the sum of all alpha factors equals 1.0. The following table shows the existing alpha factors applicable to a CCCG of four CCCGs, along with the adjuster CCF parameters multiplied by a factor of 0.1:

CCF Template Event Alpha Factor Existing 2020 CCF Parameters (Mean)

Adjusted Cross-Unit CCF Parameters (Mean)

EPS-EDG-FR-04A01 1

9.87E-1 9.987E-1 EPS-EDG-FR-04A02 2

7.06E-3 7.06E-4 EPS-EDG-FR-04A03 3

4.55E-3 4.55E-4 EPS-EDG-FR-04A04 4

1.54E-3 1.54E-4 23 No adjustments are made on 1 (i.e., it will remain at its nominal value).

24 Possible exceptions include failure of battery chargers to operator and bypass events for circulating water/service water strainers.

12 These changes result in CCF probability of all four EDGs deceasing from 4.6E-5 to 4.6E-6.

Given an observed failure of a single EDG, the conditional CCF probability decreases from 1.7E-3 to 1.7E-4, which could have a significant impact of ECAs for some plants. For some component failure modes, such as battery charger failures or strainer bypass events, an adjustment factor of 0.2 or larger (rather than 0.1) should be used to modify cross unit CCF alpha factors. Use of any adjustment other than 0.1 should be made based on available CCF data and in consultation with the SPAR Model Help Desk.

4 Next Steps/Path Forward The following list are the next steps regarding CCCG modeling in the SPAR models and treatment of cross-unit CCF:

The CCF section of the RASP Handbook will be updated with the applicable information provided in this paper.

The CCCG modeling approach described in this paper will be integrated into SPAR model change process.

INL will conduct a more comprehensive review of cross-unit CCF events to augment the data contained in Table 2 and will start work on the calculation of a limited set of cross-unit CCF parameters. Work is expected to be completed by the end of calendar year 2025.

Develop guidance on how to identify and evaluate uncertainties associated with CCCG modeling and treatment of intersystem CCF (including cross-unit CCF).