ML25168A058
| ML25168A058 | |
| Person / Time | |
|---|---|
| Issue date: | 05/18/1983 |
| From: | Ebersole J Advisory Committee on Reactor Safeguards |
| To: | Dircks W NRC/EDO |
| References | |
| Download: ML25168A058 (1) | |
Text
UNITED STATES NUCLEAR REGULATORY COMMISSION ADVISORY COMMITTEE ON REACTOR SAFEGUARDS WASHINGTON, D. C. 20555 Mr. W il l i am J. Di r ck s Executive Director for Operations U.S. Nuclear Regulatory Commission Washington, DC 20555
Dear Mr. Dircks:
May 18, 1983
SUBJECT:
ACRS REPORT ON THE ACCIDENT SEQUENCE PRECURSOR STUDY AND THE USE OF OPERATIONAL EXPERIENCE During its 276th meeting, April 14-16 and its 277th meeting, May 12-14, 1983, the Advisory Committee on Reactor Safeguards reviewed some of the recent work and proposed programs related to the evaluation and use of operational experience, including the possible identification of accident sequences likely to lead to core damage.
In addition to the report, NUREG/CR-2497, "Precursors to Potential Severe Core Damage Accidents:
1969-1979" (also known as the ASP Study), the Committee had the benefit of discussions with representatives of Oak Ridge National Laboratory (ORNL), Science Applica-tions, Inc. (SAI), the Institute of Nuclear Power Operations (INPO) and the NRC Staff.
Subcommittee meetings on the subject were held on February 9 and March g, 1983.
The latter meeting also included a summary report by a representative of the Electric Power Research Institute (EPRI) on an EPRI workshop held on the subject on February 28 -
March 1, 1983.
The Committee also had the benefit of the documents referenced.
The Committee undertook this review at the request of the Office of Nuclear Regulatory Research.
The Accident Sequence Precursor Study The ASP Study, which was performed by ORNL and SAI for the NRC, was initi-ated largely in response to a recommendation by the NRC's Risk Assessment Review Group to try to use operational experience to improve reactor safety.
The ASP Study represents an interesting and useful first effort to categor-ize and numerically rank the significance of operating experience reported in Licensee Event Reports (LERs).
It endeavors to apply the methodology of probabilistic risk assessment (PRA) to such reported experience in a pio-neering attempt to quantify an area of investigation previously treated primarily by qualitative means.
To this extent, it appears to be a worth-while effort to reduce dependence on subjective evaluation, but it is not without shortcomings.
The original objectives were consciously vague.
However, with the comple-tion of the first phase of the work and the ensuing review and discussion, the purpose of the ASP program as now defined by the NRC Staff is to develop 1967
Honorable Nunzio May 18, 1983 and apply a formalized, systematic methodology for the evaluation of nuclear plant operational experience data.
This methodology will be used to iden-tify precursors to potentially serious accidents or incidents and to esti-mate their occurrence frequency.
The specific objectives include the fo 11 owing:
. identification of strengths and weaknesses of existing PRA studies by the use of operational experience; interpretation of operational experience in terms of margins to co re damage;
. evaluation of average, industry-wide risk as it emerges from operational experience.
Thus, the NRC Staff views the ASP program as complementary to the nuclear plant PRAs currently being performed by industry and by the NRC.
The contents of the ASP Study (NUREG/CR-2497) can be divided into three parts:
definition and use of a screening process to select "significant" event sequences from the large mass of LERs available for the 1969-1979 decade;
. quantitative ranking, based on a definition of probabilistic margins to severe core damage, of those events judged significant for the above period;
. use of the probabilistic margin to core damage to formulate an experience-based, "industry-wide" estimation of severe core damage likelihood as it existed in the same 1969-1979 period.
The data base upon which this first phase of the ASP program was based was composed of approximately 19,400 computerized abstracts of LERs dated 1969-1979.
A reading and selection process guided by written criteria and knowledgeable judgments was used to reduce this base of short abstracts to a group of 529 event reports before examining the complete documentation which composes each report.
Given the superficial quality and scope of most LER abstracts, it is to be anticipated that a significant number of events were probably overlooked during the event selection process.
The study estimated that at least 10% of the significant events were missed.
With regard to the screening process, the ASP Study. concentrated on the identification of sequences containing multiple failures and resulting either in the complete loss of one function required to prevent core damage or in the degradation of more than one such function.
1968
Honorable Nunzio May 18, 1983
.L\11 available LER documentation was reviewed for the group of 529 events selected and a determination based on written criteria was made which led to the identification of 169 events as precursors to potential severe core damage.
The events finally selected were categorized and mapped onto standardized (generic} event trees that described the sequence of possible mitigating actions or events following a given transient or accident (e.g.,
loss of offsite power, occurrence of a small LOCA, loss of feedwater, or steam line break).
The event trees chosen were not plant-specific but did represent likely transient or accident situations which co,uld have been affected by the identified precursors.
Initiating event frequencies, failure time intervals, and functional fail-ure probabilities were developed where practical from information contained in the full LER documentation itself.
Quantitative ranking of the postu-lated events was then performed by evaluating the conditional probability of severe core damage given the event considered.
The parts of an event sequence that actually occurred were treated deterministically in this evaluation, whereas the parts that did not occur were treated probabilisti-cally, but with an updating of the failure rate information available from prior PRA studies with the data contained in the selecte~ event sequences.
The top 52 events had conditional probabilities of 10-or greater and were selected as significant precursors for the purposes of the Study.
Credit was not given in the standardized fault trees for plant-unique systems or differences, or for possible alternative pathways or processes that might have influenced the outcome.
This is a recognized shortcoming.
An industry-wide, severe core damage (SCD) probability estimate was de-rived in the ASP Study by summing the conditional probabilities of SCD for the selected events and dividing the result by 432, the number of reactor-years of operation over the time period included in the Study.
A good deal of controversy has arisen concernin~ both the methodology and the numerical results obtained for the precursors quantified in NUREG/
CR-2497.
The authors of the report have recognized that their methodology, as employed, is subject to possible 11 overcounting 11 and have estimated that this might make their probabilistic results high by a factor of up to three.
Other methods of analyzing the data have been suggested but none appears to be unequivocally "the right one" and the actual degree of "overcounting" remains difficult to quantify.
INPO applied the same methodology to the 11significant 11 precursors identified by ORNL but made different interpretations of the data and employed detailed event sequences that frequently differed from the ASP Study with regard to available mitigative features.
INPO obtained average numerical results which are substantially lower than those in the ASP Study, as well as a different ranking of the events in order of significance.
Representatives of the NRC Staff reported a partial list of results that tended to support the ASP Study in some cases and the INPO Study in others.
1969
Honorable Nunzio May 18, 1983 Some of these differences will be reduced or will disappear as part of the continuing dialogue.
However, it is clear that subjective opinion plays a considerable role in the ASP Study methodology, as it does in PRA in general, and large differences are likely to remain even if the same de-tailed event trees are employed by each group.
There exists a considerable school of thought in the industry that ASP Studies shoul*d be performed using plant-specific methods and data.
This suggestion has its attractions.
However, suitable plant-specific PRAs do not exist in sufficient number, and plant-specific data will be sparse.
- Thus, the resources required for event-significance quantification on a plant-specific basis would be far larger than those used in the ASP Study.
- Also, even plant-specific studies would be forced to rely on generic data in many instances, and there does not appear to be a universally accepted recipe for this procedure.
Hence, there appears to be merit in both plant-specific and generic interpretation of ope rat i ona 1 experience, each properly exe-cuted.
It is noted that neither the ASP Study nor the INPO Study included an analy-sis of the uncertainty in the reported results or an assessment of their sensitivity to assumptions made in the analysis.
This lack can be under-stood in a status report.
However, we believe that future efforts along this line should include a careful evaluation of such uncertainties and sens it iv it i es.
It should be noted that the authors of NUREG/CR-2497 were not trying to predict the future risk in making an estimate of the average likelihood of core damage; rather, they were trying to evaluate the existing risk during the years 1969-1979.
Hence, improvements in safety made since 1979 are not reflected in the report.
Because of differences in the methodology used and because each pl ant has its own safety characteri s-ti cs (which may differ from the generic event trees used in the ASP Study),
the results of the ASP Study should not be directly compared with those of the PRA for a specific plant.
T~e INPO SEE-IN Pro ram and the Work of the NRC Office of Anal sis and Evaluation of O erational Data AEOD "f.tle ACRS reviewed briefly the I NPO SEE-IN program and the work of AEOD in order to better understand their relationship to the ASP program.
Both the SEE-IN program and the work of AEOD are largely qualitative and focus on an examination of specific operational events (or sets of similar events), screen these events for significance, and strive to extract lessons which can be used directly in improving safety.
The efforts of both groups have been productive and both groups continue to improve their methodology.
1970
Honorable Nunzio J. Palladino 5 -
May 18, 1983 Both efforts are needed, since they serve different users and provide somewhat different perspectives.
Some Concluding Comments and Recommendations
- 1.
It was reasonable for the first phase of the ASP Study to develop somewhat specific objectives as the work progressed, since it was exploratory research.
The future ASP program is expected to have better defined, albeit still flexible, objectives.
- 2.
There is a class of information which the AEOD and SEE-IN programs may be treating only in part and which the ASP program largely has not considered.
The ACRS suggests that further evaluation be made as to whether adequate attention is being given to operational experience in connection with matters such as the following:
- a.
where improved maintenance practices are needed (e.g., the Salem circuit breakers),
- b.
whether there are adequate diagnostic capabilities to indicate impending problems and how to control them,
- c.
whether plant operating procedures are adequate and effective,
- d.
deficiencies in engineering design, construction and application of plant systems, controls, and components,
- e.
the stage at which accident consequences can be controlled most effectively,
- f.
effects of plant aging on safety, and
- g.
quality deficiencies that may have been overlooked.
- 3.
The objectives of the AEOD work, the INPO SEE-IN effort, and the ASP program should be coordinated so that significant gaps do not exist when the combined efforts are considered.
- 4.
The ASP program has highlighted deficiencies in most existing PRAs even though some of these weaknesses had been previously recognized.
Examples include operator errors of commission and complex scenarios such as the Browns Ferry fire.
Strong interaction in both directions between PRAs and the ASP program is needed in the future.
Much more work is needed before quantitative results from the ASP program can be considered to be meaningful.
However, there is merit in continuing to attempt to obtain average estimates of risk, as well as a quantitative ranking of event significance, by analyzing operational experience.
1971
Honorable Nunzio May 18, 1983
- 5.
Some attention should be given to the following methodological issues:
. Single failures should not be discarded automatically, as single failures of high frequency might be symptomatic of bad mainten-ance practices, or pl ant vulnerability to "external events II and other common causes or "bypass mechanisms."
In particular, the screening process should be altered so that the ASP program includes single failures of on-line systems of special importance to safety.
The ASP Study considered only precursors which could lead to core damage, so that experience with containment was not a factor.
Such experience would, of course, become relevant were one to attempt to evaluate public risk.
The ACRS recommends that the scope of future studies be extended to cover mitigation systems such as the containment.
. Sensitivity and uncertainty evaluation should be included as an integral part of the ASP program itself. A special effort should be made to identify the principal causes of uncertainty.
Since there appears to be no single, agreed-upon way to perform the quantitative evaluation of risk, either in relative or in absolute terms, the evaluation should be attempted in several alternative ways and studies made to explain the key reasons for differences which may materialize.
The issue of "blending" plant-specific and generic data is one area in which one could gain beneficial insight by pursuing such a "multi-faceted" approach.
An evaluation should be performed and published to make clear the reasons for the different results obtained for conditional severe core damage probability by the ASP Study and the INPO critique (INPO 82-025) for the 52 significant precursors.
The handling of human error probability is highly subjective.
It is potentially a large source of difference in the estimates developed.
The matter should be specifically reviewed from several points of view, including:
the usefulness of a common mode of treatment as one alternative in each such study to place similar studies on a comparable basis; the development of failure models more applicable to real occurrences; and the inclusion of errors of commission in the event trees.
1972
Honorable Nunzio May 18, 1983
- 6.
The importance of the qualitative aspects of the evaluation of opera-tional data and experience must continue to be emphasized.
Study efforts should examine the chain of events in important incidents in terms of root cause.
- 7.
The ACRS endorses continuation of studies of operational experience, both qualitative and quantitative.
Sincerely, r:::..~ Eb:f:~rt--
Acting Chairman References:
- 1.
Science Applications, Inc. Oak Ridge National Laboratory, 11Precursors to Potential Severe Core Damage Accidents:
1969-1979, A Status Re-port," Prepared for USNRC, NUREG-CR-2497, Vols. 1-2, dated June 1982.
- 2.
Institute of Nuclear Power Operations Confidential Report, 11Review of NRC Report:
'Precursors to Potential Severe Core Damage Accidents:
1969-1979, A Status Report,"' NUREG/CR-2497, dated September 1982 1973