RS-07-050, Additional Information Supporting Risk-Informed Inservice Inspection Relief Request
| ML070940193 | |
| Person / Time | |
|---|---|
| Site: | Byron  |
| Issue date: | 04/03/2007 |
| From: | Benyak D Exelon Generation Co, Exelon Nuclear |
| To: | Document Control Desk, NRC/NRR/ADRO |
| References | |
| RS-07-050, TAC MD3855, TAC MD3856 | |
| Download: ML070940193 (30) | |
Text
Exelon Generation www_exeloncorp.com 4300 Winfield Road Warrenville, II_ 60555 RS-07-050 April 3, 2007 U. S. Nuclear Regulatory Commission ATTN : Document Control Desk Washington, DC 20555-0001 Byron Station, Units 1 and 2 Facility Operating License Nos. NPF-37 and NPF-66 NRC Docket Nos. STN 50-454 and STN 50-455 Exelom Nuclear
Subject:
Additional Information Supporting Risk-Informed Inservice Inspection Relief Request References :
1.
Letter from D. M. Hoots (Exelon Generation Company, LLC) to U. S. NRC, "Byron Station, Units 1 and 2, Transmittal of Inservice Inspection Program Plan for the Third Ten year Inspection Interval," dated February 14, 2006
- 2. Memorandum from C. Gratton (U.S. NRC) to M. L. Marshall (U.S. NRC),
"Byron Station, Unit Nos. 1 and 2 - Facsimile Transmission of Draft Request for Additional Information (TAC Nos. MD3855 and MD3856)," dated February 26, 2007 In Reference 1, Exelon Generation Company, LLC (EGC) submitted the third ten-year inspection interval Inservice Inspection Program for Byron Station, Units 1 and 2. Section 8 of the Inservice Inspection Program plan contained alternatives to the American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code,Section XI, "Rules for Inspection and Testing of Components of Light Water Cooled Plants." Relief Request 13R-02 requested NRC approval to implement alternative risk-informed selection and examination criteria for certain pressure retaining piping welds.
On January 31, 2007, the NRC provided a draft request for additional information (RAI) related to risk-informed Inservice Inspection Program Relief Request 13R-02. The draft RAI was clarified in a conference call between EGC and the NRC on February 8, 2007. The results of the February 8, 2007, conference call are documented in Reference 2. In response to this request, EGC is providing the attached information.
April 3, 2007 U. S. Nuclear Regulatory Commission Page 2 There are no regulatory commitments contained in this letter. Should you have any questions related to this letter, please contact Mr. Kenneth M. Nicely at (630) 657-2803.
Respectfully, Darin M. Benyak Manager, Licensing Attachments :
1.
Response to Request for Additional Information 2. ER-AA-600-1015, "FPIE PRA Model Update," Revision 7 cc :
NRC Senior Resident Inspector NRC Regional Administrator, Region III
NRC Request 1 ATTACHMENT 1 Response to Request for Additional Information The last paragraph on page 3 of 5 of relief request 13R-02 states that, "[tjhe Consequence Evaluation, Degradation Mechanism, Risk Ranking, and Element Selection steps encompass the complete living program process applied under the Byron RI-SI program." Are the inspection locations in the RI-ISI program that has been developed for the third interval the same locations as those in the program approved in the NRC staff's February 5, 2002, safety evaluation? If not, please summarize the changes to the program and what caused those changes.
Response
As a "living program," the Risk-informed Inservice Inspection (RISI) Program methodology requires on-going revisions due to changes that occur after the original implementation. The following four items describe situations where the initially selected welds were replaced, added, or deleted due to changes in the RISI Program, or where unacceptable scanning limitations were determined at the time of the weld examination.
Item 1 : Changes in selection due to limited access to the examination surface Weld configurations, such as pipe-to-valve or adjacent obstructions, may present limited coverage under the examination requirements of the American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code,Section XI, "Rules for Inspection and Testing of Components of Light Water Cooled Plants," Appendix VIII. Reselection of some initial examination locations was required where greater than 90% coverage could not be obtained.
Item 2 : Changes in selection due to reclassification into different RISI categories Revision of the RISI Program with the updated probabilistic risk assessment (PRA) model resulted in some segments being reclassified into different RISI categories.
Examples include the following.
Main Steam system piping was initially assigned to Category 6 (i.e., low failure potential/medium consequence) requiring no examination selections, and was later revised to Category 4 (i.e., low failure potential/high consequence) requiring 10%
examination selection.
Some Safety Injection piping segments were initially assigned to Category 6 (i.e.,
medium failure potential/low consequence) requiring no examination selections, and were revised to Category 5 (i.e., medium failure potential/medium consequence) requiring 10% examination selection.
Other Safety Injection piping segments were initially assigned to Category 4 or Category 5 requiring 10% examination selection. The Category 5 segments were changed to low consequence, which resulted in a reclassification to Category 6 requiring no examinations. The Category 4 segments were changed to medium consequence,
ATTACHMENT 1 Response to Request for Additional Information thus becoming Category 6 segments requiring no examinations. In both cases, the welds selected for examination were adjusted.
Item 3 : Changes due to reassessment of degradation mechanism Electric Power Research Institute (EPRI) Topical Report (TR) 112657 Rev. B-A, "Revised Risk-Informed Inservice Inspection Evaluation Procedure," was used as the basis of Byron Station's RISI Program. The evaluation of primary water stress corrosion cracking (PWSCC) of Alloy 600 materials specifies a minimum temperature of 620°F for inclusion of this degradation mechanism. Based on input from the Materials Reliability Program (MRP-139), Byron Station altered the PWSCC evaluation to include all Alloy 600 components. This resulted in weld reclassification from Category 4 (i.e., low failure potential/high consequence) requiring a 10% examination selection to Category 2 (i.e., medium failure potential/high consequence) requiring a 25% examination selection.
Item 4: Lines added with new ASME Code requirements For ASME Class 2 components, the IWC-1220 exemption criteria were revised to require the examination of smaller size piping in the Auxiliary Feedwater (AF) system.
AF piping was evaluated for degradation and consequence along with other non-exempt piping systems. The AF piping segments were classified into Category 2 or Category 4 as appropriate. AF welds were selected per the category requirements of 25% or 10%
respectively. EGC's response to NRC Request 5 below provides additional information regarding the selection of AF welds.
The following tables provide a summary of the changes to RISI inspection population for Byron Units 1 and 2.
BYRON UNIT 1 RISK EXAMS EXAMS ITEMS AFFECTING CHANGES CATEGORY (RISI REV. 0)
(RISI REV. 5)
(SEE ITEMS 1 - 4 ABOVE)
High 85 111 Limited Exam Coverage Degradation Mechanism Update New Scope due to ASME Code Medium 168 221 Limited Exam Coverage RISI Category Reclassification Degradation Mechanism Update New Scope due to ASME Code Total 253 332'
' 14 additional welds have been added to the RISI inspection population due to the inclusion of the Break Exclusion Region (BER) piping in Revision 4 to the RISI Program. The total inspections currently scheduled under Revision 5 of the RISI Program is thus 346.
NRC Request 2 Paragraph 4 on page 3 of 5 of your 13R-02 submittal states, "the original risk impact assessment is not a necessary element of the implementing process and is not required to be continually updated." The change in risk acceptance guidelines must continue to be met as the facility, PRA, and the risk-informed program change over time. Please provide the risk impact of implementing the RI-ISI program proposed for the third interval instead of the American Society of Mechanical Engineer's inspection program that was replaced by risk-informed inservice inspection. (The NRC staff has concluded that it is an unnecessary burden to develop a new ASME inspection program when transitioning to a newer edition of the ASME code for the sole purpose of estimating the risk impact of a RI-SI program)
Response
ATTACHMENT 1 Response to Request for Additional Information As part of updating the RISI analysis for the third 10-year interval, the original risk impact assessment was also updated to confirm the change in risk was maintained within the acceptance guidelines. The original methodology of the calculation was not changed, and the change in risk was simply re-assessed using the initial 1989 Section XI program prior to RISI and the new element selection for the third 10-year interval RISI program. This same process has been maintained in each revision to the Byron RISI Report that has been performed to date.
Using this process, the change in risk for Unit 1 was 9.21 E-8 for delta-core damage frequency (delta-CDF) and 1.45E-9 for delta-large early release frequency (delta-LERF). For Unit 2, the values were 5.78E-8 for delta-CDF and -3.53E-10 for delta-LERF. These values are all within the 1.00E-6 and 1.00E-7 acceptance criteria for delta-CDF and delta-LERF respectively. The change in risk analysis was likewise done at a system level, and no system acceptance criteria are exceeded in the current program using the latest RISI element selections.
BYRON UNIT 2 RISK EXAMS EXAMS ITEMS AFFECTING CHANGES CATEGORY _(RISI REV. 0)
(RISI REV. 5)
(SEE ITEMS 1 - 4 ABOVE)
High 112 127 Limited Exam Coverage Degradation Mechanism Update New Scope due to ASME Code Medium 164 191 Limited Exam Coverage RISI Category Reclassification Degradation Mechanism Update
" New Scope due to ASME Code Total 276 3182 2 17 additional welds have been added to the RISI inspection population due to the inclusion of the BER piping in Revision 4 to the RISI Program. The total inspections currently scheduled under Revision 5 of the RISI Program is thus 335.
NRC Request 3 ATTACHMENT 1 Response to Request for Additional Information According to your submittal dated November 17, 2000, and the NRC staff's safety evaluation dated February 5, 2002, the Byron probabilistic risk assessment (PRA) had not undergone a peer review prior to development of the second interval's RI-ISI program. Instead, the submittal states that you used the results of the peer review on the sister plant Braidwood Station, Units 1 and 2, to address potential PRA quality issues. Please indicate when the peer review was performed on the Byron PRA. Please provide the A and B level facts and observations from the Byron PRA peer review and the resolution of each observation or an explanation about why resolving the observation is not expected to significantly affect the proposed RI-ISI program.
Response
The Braidwood PRA was subjected to a Westinghouse Owners' Group peer review in September 1999. The Byron PRA was subjected to a separate peer review in July 2000. No peer reviews have taken place since that date for either site. Since those peer reviews, the PRA model (the Braidwood and Byron PRA models are very similar and exist in an integrated model) has undergone major upgrades as well as interim upgrades (i.e., in January 2002, August 2004, and March 2006).
A list of the open A and B facts and observations (F&Os) remaining from the Byron and Braidwood peer reviews is provided below. Because the models are integrated, the outstanding significant F&Os are listed from each site. The importance of the finding with regards to the RISI application is listed in the right-most column.
The importance of the findings is evaluated in the context of how the PRA is used for the RISI application. A weld inspection regime is based on two variables: (1) PRA risk significance, and (2) susceptibility to damage mechanisms. The following table illustrates the relationship and the associated inspection importance category.
CONSEQUENCES OF PIPE RUPTURE POTENTIAL FOR PIPE RUPTURE IMPACTS ON CONDITIONAL CORE DAMAGE PER DEGRADATION MECHANISM PROBABILITY AND LARGE EARLY RELEASE SCREENING CRITERIA PROBIBILITY NONE LOW MEDIUM HIGH HIGH FLOW ACCELERATED LOW MEDIUM HIGH HIGH CORROSION Category 7 Category 5 Category 3 Category 1 MEDIUM OTHER DEGRADATION LOW LOW MEDIUM HIGH MECHANISMS Category 7 Category 6 Category 5 Category 2 LOW LOW LOW LOW MEDIUM NO DEGRADATION MECHANISMS Category 7 Category 7 Category 6 Category 4
ATTACHMENT 1 Response to Request for Additional Information The pipe rupture consequences for Byron were evaluated using the PRA model and are in terms of conditional core damage probability (CCDP) and conditional large early release probability (CLERP). According to the approved methodology, the numerical results of the analysis are then binned into one of three PRA consequence categories : High, Medium, and Low.
Given this binning process, the results of the PRA, in most cases, would have to change by at least an order of magnitude in order for a weld to experience a change in inspection regime.
Consequence results near the thresholds do not have to change as much. On the other hand, consequences <<1.0E-6 CCDP (and <<1.0E-07 CLERP) can experience much larger changes with still no impact on the weld inspection program.
As a result of these peer reviews and responses to the open A and B F&Os, the PRA is considered to meet the PRA quality criteria of Regulatory Guide 1.174.
CCDP AND CLERP VERSUS CONSEQUENCE CATEGORIES CONSEQUENCE CATEGORY CCDP RANGE CLERP RANGE HIGH CCDP > 1 E-4 CLERP > 1 E-5 MEDIUM 1 E-6 < CCDP < 1 E-4 1 E-7 < CLERP < 1 E-5 LOW CCDP < 1 E-6 CLERP < 1 E-7
ATTACHMENT 1 Response to Request for Additional Information O n "A" and "B" F&Os Cert.
Element Element Description F&O Level F&O Description Status Resolution RISI Impact DA-10 Common cause B
[Braidwood F&O DA-5]
Mostly The asymmetric modeling Negligible.
groups to which Reviewers do not agree Resolved assumption was removed and the Many of the RISI consequences the common with the justification for model logic was changed to consider prescribe an initiator as a result cause failure asymmetric modeling of symmetric common cause among all of the assumed pipe break.
probability applies the emergency diesel four EDGs (two for each plant).
Multiple EDGs are only used for have been derived generators (EDGs).
However, not all the EDG basic loss of offsite initiators which are based on sound judgment and are
[BYron F&O DA-05B]
event calculations were done not likely coincidental with a pip e correctly. Hence, the F&O is not break. Induced loss of offsite documented.
Reviewers do not agree closed.
power (LOOP) was not part of with the rationale the PRA model used for RISI, provided as a resolution but has been adopted in interim to the Braidwood revisions. The induced LOOP finding.
cutsets generally contain the basic event for failure of all four EDGs. This would have yielded conservative results and if corrected would likely reduce the CCDP/CLERP of some consequences.
HR-2 Human reliability B
[Braidwood F&O HR-2]
Mostly Subsequent updates to the HRA Negligible.
analysis (HRA) is The modified cause Resolved methodology and documenation The remaining HEPs with consistent with based decision tree eliminated the conflicts between differences from the industry industry practice.
(CBDT) method used CBDT and human cognitive reliability model response to internal for the HRA apparently modeling. The CBDT methods from flooding initiating events. These deviates from standard Quad Cities were used, which HEPs neither model mitigation of industry practice.
subsequently received favorable pipe breaks stemming from weld peer review certification.
failures, nor operator response However, the flooding analysis to initiating events caused by human error probabilities (HEPs) weld failures. The cutsets with used a modified CBDT that has these HEPs form part of the some differences between the other base model and are subtracted HEPs and should be reviewed.
out in the CCDP/CLERP calculation for degradation of a mitigating system.
ATTACHMENT 1 Response to Request for Additional Information Page 7 Open °A" and "B" F&Os Cert.
Element F&O Element Description Level F&O Description Status Resolution RISI Impact HR-10, Assessment of B
[Braidwood F&O HR-4]
Partially Model assumes that procedures will Negligible.
22 plant procedures The steam generator Resolved direct operators to enter FR-H.1 and An evaluation of the operator and plant specific operating tube rupture
( SGTR
)
use bleed and feed during a SGTR action and timing was performed experience are event tree structure and with a loss of AF. However, it is not as part of the mitigating systems explicitly included HRA do not reflect the clear from the procedures that this is what the performance index (MSPI) in the identification circumstances around operators would do.
documentation. The analysis and quantification entering FR-H.1. The The same timing is used for SGTR indicated that it is likely the process for the success criteria, event as is used as for a complete loss of operators will proceed in a human tree structure, and HRA feedwater. However, this is an manner consistent with the HRA.
interactions (His).
should be modified to assumption and is not based on However, SGTR, like internal reflect accident walk-through or talk-through of the flooding, is not an initiating event The models and sequence mitigation SGTR procedures.
expected to occur as a result of analysis are dictated by the consistent with the emergency operating a weld failure. The cutsets with operating procedures (EOPs).
this HEP form part of the base procedures and model and are subtracted out in training.
the CCDP/CLERP calculation for degradation of a mitigating system.
HR-11 The symptoms B
[Byron F&O HR-07B]
Partially The manual reactor trip operator Minimal.
available during The HRA for manual resolved action is conditioned on the basis of A sensitivity was performed the postulated Reactor Protection whether the failure was due to where the HEP to manually accident sequence System (RPS) and actuation logic failure versus signal initiate SI was set to true in the are evaluated and Engineered SSafety y
failure. However, the operator action saved cutsets. Only the CCDP input into the HRA Feature Actuation to initiate ESFAS manually was not of large and medium loss-of-process.
System (ESFAS) modified.
coolant accidents (LOCAs) actions do not explicitly Separate operator actions are changed appreciably. These account for degradation modeled to manually initiate the PRA consequences are already of plant monitoring (i.e.,
Safety Injection (SI) signal, as well high. None of the PRA different HEP as to manually actuate components, consequence evaluations depending on whether given successful SI initiation with changed bins (e.g., low to or not failure of auto-failure of the component to actuate medium or medium to high PRA actuation of equipment (e.g., such as due to failure of an consequence).
was due to equipment actuation relay). Thus, only the failure or signal failure).
manual SI actuation HRA should be affected by the potential failure of indication (e.g., sensor signals).
ATTACHMENT 1 Response to Request for Additional Information Open "A" and "B" F&Os Cert.
Element Element Description F&O Level F&O Description Status Resolution RISI Impact HR-11, The symptoms B
[Byron F&O HR-02B]
Partially Operator interviews were conducted Negligible.
14, 18, available during Although a significant Resolved on significant operator actions Three risk significant operator 20 the postulated effort has been following the certifications, including actions did not appear to have accident sequence undertaken to gain validation of the timing for actions documented operator input into are evaluated and operator input into specified in the F&O.
the timing assumptions.
input into the HRA evaluating HEPs, the A review of the risk significant One action is concerned with process.
reviewers found the operator actions was performed. All responding to a SGTR, which is Operator actions effort to date had not but three of those actions had not relevant to RISI. One action have been fully addressed operator input.
is concerned with mitigating a reviewed by the observations from the stuck open power operated relief operating staff and Braidwood peer valve (PORV) with the block their impact is certification (F&O valve. Upon further analysis, if included in the HR-5).
the available time for the action HRA evaluation Specifically cited is the is reduced to five minutes, the The performance lack of operator existing probability remains shaping factor for interviews to validate conservative.
time available for input assumptions, The last action addresses an action and the timing and logic of termination of injection prior to time required to certain key operator challenging the PORV. A take an action are actions.
sensitivity was performed developed on a The reviewers also assuming a screening value of plant specific acknowledged that the 0.1 on top of the sensitivity of basis.
sensitivity analyses HR-11 above. The largest The time required performed showed that additional change was only 2%.
to complete the the overall results are No PRA consequence would actions is based not overly sensitive to have changed rank.
on observation or the operator action operations staff modeling.
input.
ATTACHMENT 1 Response to Request for Additional Information Open "A" and "B" F&Os Page 9 C
Cert.
Element Element Description
~
F&O Level F&O Description Status Resolution RISI Impact QU-27, A search is A
[Braidwood F&O QU-7]
Open A set of sensitivity analyses was None.
28 performed for unique or unusual Only parametric performed to examine a number of Based on the activities sources of uncertainty analyses issues associated with the use of the completed to date, the uncertainty Y not have been p performed.
PRA to support the EDG Technical Specification changes and to fundamental issues have been present in the address specific issues raised by the addressed ; however, this F&O is typical or generic certification team, including :
considered open until a roadmap plant analysis.
is documented to identify the Thermal hydraulic analyses to process used and results of the If there are investigate different reactor coolant search for unusual uncertainties.
unusual sources pump (RCP) seal leak initiation times The absence of the supporting of uncertainty, for "popping failure modes" and their documentation has no impact on special sensitivity impacts on the electric power the current RISI analysis.
evaluations or recovery split fractions.
quantitative uncertainty Thermal hydraulic analyses to assessments are investigate the impact of steam performed to generator water volume assumptions support the base on steam generator dry out times conclusion and and impacts on the HRA values for future bleed and feed actions.
applications.
Impact of compensating measures on all the risk metrics used to evaluate the EDG Technical Specification changes.
Impact of alternate initial plant configurations on these same risk metrics.
Impact of different plant strategies to utilize the increased EDG completion time for unplanned maintenance.
Impact of not crediting a variety of operator recovery actions.
Throughout the HRA task, numerous sensitivity studies were performed to evaluate the impact on derived HEPs.
ATTACHMENT 1 Response to Request for Additional Information Open "A" and "B" F&Os Cert.
Element F&O Element Description Level F&O Description Status Resolution RISI Impact TH-9 Documentation B
[Braidwood F&O TH-3]
Resolved Success criteria are described in the None.
provides the basis It is difficult to match Success Criteria Notebook with the This is a documentation issue of the thermal success criteria to specific supporting analyses noted.
only, and the suggested hydraulic analysis, specific analyses and The Event Tree Analysis Notebook resolution exceeds the ASME is traceable to fault trees.
also adequately references success standard requirements.
plant specific or criteria.
generic analysis, However, a table of Success and demonstrates The peer review finding also calls for Criteria for equipment functions the cross referencing success criteria to was created to address this reasonableness of fault tree gates or event tree issue and currently resides in the the success headings.
NISPI program document. The criteria.
RISI analysis and PRA are up-to-date with regard to system function success criteria and its associated documentation.
Therefore, this item is closed.
NRC Request 4 ATTACHMENT 1 Response to Request for Additional Information Risk-informed applications should be developed using a technically adequate PRA that is based on the as-built, as-operated, and as-maintained plant. Please provide the following :
(a)
The revision name or number, date, and base core damage frequency (CDF) and large early release fraction (LERF) of the Byron PRA model used to perform the risk ranking of pipe segments and change in risk evaluation in preparation for the third 10-year ISI interval.
(b)
Please provide a summary of how the changes to the PRA are developed and reviewed.
Response
The Byron PRA model revision used to perform the risk ranking of pipe segments and to evaluate the consequences of pipe rupture for the RISI assessment is documented in BB PRA-014, "Quantification Notebook, Byron and Braidwood Stations," Revision 5B, Addendum 1, dated April 2004. The base CDF and base LERF from the Byron PRA model for Unit 1 are 6.1 E-05 per year and 4.7E-06 per year, respectively. For Unit 2, the base CDF is 6.1 E-05 per year and base LERF is 5.5E-06 per year.
An EGC PRA maintenance and update procedure, ER-AA-600-1015, "FPIE PRA Model Update," formalizes the PRA update process. The procedure defines the process for regular and interim updates for tracking issues identified as potentially affecting the PRA, and for controlling the model and associated computer files. Attachment 2 provides a copy of ER-AA-600-1015.
NRC Request 5 The newer versions of the ASME Code have reduced the exempted portions of Auxiliary Feedwater piping from nominal pipe size (NPS) 4 to NPS 1 1/2. This reduction in exempted piping has caused other licensees to add ASME Class 2 and/or Class 3 Auxiliary Feedwater piping to the scope of their RI-ISI programs, and to implement their chosen RI-ISI methodology to classify, risk-rank, and to select, as necessary, additional locations for the next ISI interval.
Please describe how you treated this issue in your RI-ISI program for the third 10-year ISI interval when you updated your code of record from the 1989 edition to the 2001 edition with 2003 addenda.
Resmnse The RISI Program is applied to ASME Class 1 and 2 piping systems for both Byron Units 1 and 2. Within those systems, the RISI Program applies to the portion of piping not exempted by IWB-1220 and IWC-1220 respectively. AF piping was evaluated for failure potential and consequence of failure along with other non-exempt piping systems. The AF piping segments were classified into the appropriate RISI categories and elements were selected per the category requirements for examination during the third inspection interval. The inclusion of the new AF welds into the RISI analysis resulted in the selection of five additional Category 2 AF
ATTACHMENT 1 Response to Request for Additional Information welds and nine additional Category 4 AF welds in each of the Unit 1 and Unit 2 examination populations.
ATTACHMENT 2 ER-AA-600-1015, "FPIE PRA Model Update,"
Revision 7
1.
PURPOSE Exelon.
Nuclear 1.1.
This T&RM establishes responsibilities and general guidelines for updating the full power, internal events (FPIE) Probabilistic Risk Analysis (PRA) Models at all active nuclear generation sites.
- 2.
TERMS AND DEFINITIONS FPIE PRA MODEL UPDATE ER-AA-600-1015 Revision 7 Page 1 of 15 2.1.
Guidance - Guidance in the context of this T&RM is a means of accomplishing procedural and regulatory requirements. It does not preclude accomplishment of these requirements by other means 2.2.
MAAP (EPRI Modular Accident Analysis Pro-gram) : A thermal-hydraulic computer code utilized to determine plant-specific response under postulated severe accident scenarios. Provides information such as time for core coolant boil off, time for core melt and RPV breach, pressures and temperatures in the RPV and reactor building areas, and the time to reach these pressures and temperatures.
2.3.
PRA Maintenance : PRA maintenance involves the collection and evaluation of new information which could impact the PRA model and updating the model and applications as appropriate.
2.4.
PRA Periodic Update : Revision of the PRA and associated documentation involving evaluation of the adequacy of all technical elements of the PRA on a specified schedule. This includes ASME RA-S-2002 (Ref. 6.2) PRA maintenance and upgrade attributes.
2.5.
PRA Unscheduled Update : Revision of the PRA to incorporate a change of plant design or operation having sufficient impact to the results that it should not wait to the next periodic update or a PRA revision required to correct a PRA model error which should not wait to the next periodic update.
2.6.
PRA Update Project Plan : The Project Plan is a document describing the PRA update tasks, personnel and resource requirements, and schedule.
2.7.
Proper Software : Software meeting the requirements of IT-AA-101 (ref.6.3) or its equivalent.
2.8.
Rollout : The review and revision of PRA applications and documentation, publicizing of results after a PRA model update.
2.9.
Unavailability : The unavailability of a component or system is the fraction of time that a system or component is not capable of supporting its function including but not limited to the time it is disabled for test or maintenance.
2.10.
URE (Updating Requirement Evaluation) : An evaluation in which it is decided whether the change item being evaluated (hardware item or administrative item) requires a revision to the current plant PRA model. The evaluation includes scheduling required model revisions based on the significance of the PRA impact.
See Attachment 1 for an example of a URE form. The URE form may deviate from, but should contain the key elements contained in the example.
2.11.
Acronyms CDF - Core Damage Frequency FPIE - Full Power, Internal Events F-V - Fussell-Vessey (importance measure)
LERF - Large Early Release Frequency MAAP - Modular Accident Analysis Program NFM - Nuclear Fuels Management PRA - Probabilistic Risk Analysis PSA - Probabilistic Safety Analysis RAW - Risk Achievement Worth RPV - Reactor Pressure Vessel 3.
RESPONSIBILITIES Risk Management consists of an integrated team where individuals assigned specific roles and responsibilities delineated below will perform the actions of their position regardless of their employer.
NOTE :
Contractors (This note is to address use of personnel outside of the out-sourced contractor and Exelon organization) may perform any of the tasks stated in sections 3.2 or 3.3 if approved by the Senior Manager Risk Management 3.1.
Senior Manager Risk Management 3.1.1.
Maintains a Periodic Update schedule for all Nuclear Stations.
ER-AA-600-1015 Revision 7 Page 2 of 15 3.1.2.
Interfaces with Station personnel to obtain concurrence with the Project Plan.
3.1.3.
Incorporates update schedule into non site RM work management plan (reference ER-AA-600-1011).
3.1.4.
Reviews qualification of personnel assigned to update tasks and assures experience and/or training is sufficient to support successful completion of those tasks.
3.2.
Model Owner 3.2.1.
Maintain a URE database for each site's PRA.
3.2.2.
Establish a Project Plan for the update which identifies tasks to be performed, a schedule to complete each task and resources to carry out the tasks.
3.2.3.
May update the plant PRA model according to the Project Plan.
3.2.4.
Maintain list of key site procedures.
3.3.
Site Risk Management Enqineers ER-AA-600-1015 Revision 7 Page 3 of 15 3.3.1.
Be actively involved with PRA updates, performing update tasks as part of the update team.
3.3.2.
Provide general PRA training and application specific training to site personnel such as Site Engineers.
3.3.3.
Creates change management plan for model update rollout activities.
3.3.4.
Perform independent reviews of PRA updates performed for other sites as assigned.
3.3.5.
May initiate and/or disposition UREs as specified in this T&RM.
4.
MAIN BODY 4.1.
Update Intervals 4.1.1.
PREPARE periodic updates for each station PRA model and associated PRA model Category 1 documentation (reference 6.4, ER-AA-600-1012) on a schedule agreed upon by the Site Engineering Director, corporate Design Engineering Director, and Senior Manager Risk Management. The typical interval between PRA updates is 4 years.
If the periodic update interval will exceed four years for any PRA technical element, DOCUMENT justification that the PRA continues to represent adequately the as-built, as-operated plant.
4.1.2.
CONSIDER including the following items (at a minimum) in the periodic update :
Design Changes Procedure Changes Technical Specification Changes Component Failure Rates Component Maintenance Unavailability Initiating Event Frequencies
4.1.3.
In addition to periodic updates, the need for unscheduled updates (PRA maintenance) may arise. A Risk Management Engineer will evaluate each URE prepared to determine whether the current PRA model should be immediately updated or the update can be delayed to the next scheduled update. The evaluation will be documented in the URE database. This determination will be made based on whether the PRA model fidelity (representation of the as-built, as operated plant) without the update is adequate to support current PRA applications.
1.
UREs will be evaluated to determine the need for an unplanned update within 30 days of creation.
4.1.4.
An unscheduled update may also be required if an error is identified in the PRA model.
1.
A PRA model error requiring an unscheduled update is one that affects the results of the PRA in a fashion that can or does affect applications. For example a fault tree error that would cause a MOVs classification in the MOV program to change would have to be corrected as would an error that would change the FV of a MSPI monitored component beyond allowable bounds.
An error that does not affect the conclusions may be placed in a U RE for the next periodic update. An example would be a basic event description that is wrong but the basic event is appropriately handled in the model. Also if there is a large impact on CDF or LERF such as a 25% change or a significant shift in distribution, an unscheduled update should be considered.
4.1.5.
If a URE requires an unplanned update of the PRA model, an IR should be generated if one does not already exist. Additionally if an URE has an impact on current applications, an IR should be generated.
4.2.
Periodic Update Process 4.2.1.
Project Planninq Changes to Design Basis Calculations and or Assumptions Open UREs Changes to PRA technology Industry experience Site operating Experience Revisions to PRA standards ASME standard gap analysis ER-AA-600-1015 Revision 7 Page 4 of 15 The model owner will prepare a Project Plan for the periodic updates which identifies tasks to be performed, a schedule to complete each task and resources to carry out the tasks. The schedule should include the performance of the update, the reviews and approvals and the completion of documentation. The schedule should be agreed to by the Senior Manager Risk Management.
2.
Consider the need to update other PRA models such as fire and seismic.
If update of non-FPIE PRA models is deferred, document the basis and create UREs specific to those models.
3.
The SRME will create change management plan per HU-AA-1101 for the model update roll out activities within 30 days of the approval of the PRA model.
4.
The progress of the update and roll out should be periodically statused by the model owner, SRME and Senior Manager Risk Management 4.2.2.
Data collection ER-AA-600-1015 Revision 7 Page 5 of 15 1.
OBTAIN AND REVIEW data and information from the following sources :
A.
Equipment Performance Data (reliability & availability) based on Maintenance Rule Records and CDE (MSPI) records supplemented by Condition Reports and Out of Service Records, as necessary B.
Operating procedures that were used to determine operator actions C.
Surveillance test and operating procedures for changes in the test frequency, test duration, and other aspects that are applicable to failure rate calculations, demands and run hours D.
New and revised Design Changes, Technical Specifications and Design Calculations to determine those changes that require modeling changes in order to represent adequately the as-built, as-operated plant E.
Unit Availability Data (normally available from CDE) supplemented by Event Reports to determine if an update to the Initiating Event Database is required F.
Site operating experience from CRs, NERs, etc.
G.
Open UREs to determine those that will be included in the update.
Changes that most significantly impact risk informed applications should be included in the next periodic update.
2.
In the performance of a periodic update, OBTAIN the concurrence of the Senior Manager Risk Management for UREs deferred to the next update.
3.
The above data should also be evaluated for impact on other PRA models such as fire and seismic PRA.
- 4.
DOCUMENT the results of the review in a manner that allows determination that a specific change has been reviewed and dispositioned. This may be included in the documentation category 2 reports for the update.
A.
Failure Rates-ER-AA-600-1015 Revision 7 Page 6 of 15 5.
REVIEW industry practices and DETERMINE if changes in industry "state-of-the-art" data collection and analysis practices should be applied.
4.2.3.
Model revision 1.
UPDATE the PRA technical elements that require changes in order to represent adequately the as-built, as-operated plant. CONSIDER the following minimum set of elements during the update :
At a minimum consider updating failure rates and maintenance unavailability rates for components/trains with RAW > 2.0 or F-V >
0.005 in the current model. DOCUMENT justification for any risk-significant components that will not be updated or for which only generic failure rates will continue to be used B.
Maintenance Unavailabilities Update with plant data to data cutoff date Evaluate need to model concurrent maintenance unavailabilities.
C.
Fault Trees that are significantly impacted by plant modifications D.
Event Trees that are significantly impacted by plant modifications and/or revisions to Operating Procedures E.
Initiating Event Data Update with plant data to data cutoff date F.
Thermal-hydraulic analyses (MAAP) that are significantly impacted by new calculations or revisions to Operating Procedures.
G.
Human Error Probabilities that are significantly impacted by revisions to Operating Procedures or Policies 4.2.4.
Quantification and Review 1.
QUANTIFY the model.
- 2.
PERFORM a review of the updated model results including the items in prior to final approval of the model.
4.2.5.
Approval 4.3.
Rollout ER-AA-600-1015 Revision 7 Page 7 of 15
- 3.
Have the appropriate system manager(s) review system related changes especially assumptions.
4.
Have operations training or Operations review changes to HEPs especially assumptions 5.
Review the updated model against the appropriate sections of Reference 6.2.
Appropriate sections are those that were altered by the PRA model update.
For example if initiating events were updated or the method for calculating them changed, the initiating events section of the ASME Standard should be reviewed to ensure the updated model still meets the necessary elements.
The updated PRA model will be considered approved when the quantification notebook (level 1 CDF and level 2 LERF) is approved. At this time the PRA may be used for applications.
The Summary notebook should be approved as soon as possible after the quantification notebook.
The PRA is considered complete when all required applications and supporting documentation such as system notebooks are updated. Completion should occur no later than six months after approval.
If completion of the supporting documentation will not be completed within 6 months, approval of the Senior Manager, Risk Management is required.
4.2.6.
Documentation A.
Some changes may require at least a limited peer review to be performed per the ASME PRA standard.
PREPARE a CDF and LERF documentation category 1 quantification notebook at each periodic update. Include in the summary notebook the changes made to the model. Store the model and documentation in accordance with ER-AA-600-1014 (ref. 6.6).
4.3.1.
The SRME creates a change management plan per HU-AA-1101 within 30 days of the approval of the PRA model for the below actions at a minimum.
4.3.2.
EVALUATE at least qualitatively all current documentation category 1 documents which are affected by the periodic PRA update and DETERMINE whether revision is necessary.
The following should be evaluated for revision needs after every periodic update :
ER-AA-600-1015 Revision 7 Page 8 of 15 4.3.3.
The MSPI Basis Document must be updated in the quarter following approval of the PRA model. See ER-AA-600-1047 (Ref. 6.7) for additional detail.
A.
PRA Summary Report.
B.
Training Aids & Posters.
C.
Appropriate management briefings and training to assure plant personnel are kept apprised of new insights gained or revised importance measures.
D.
The CDF and LERF baselines for use in trending and other applications E.
The On-Line Risk Monitor F.
The MSPI basis document (See below)
G.
PRA Model Category 2 documentation (ref. 6.5, ER-AA-600-1012)
H.
List of risk-significant systems/components for input to the Maintenance Rule Expert Panel I.
Component risk rankings as required (for example MOVs, and AOVs)
J.
The analysis for acceptability of the Maintenance Rule Performance Criteria (ER-AA-600-1044)
K.
(If appropriate) risk informed ISI supporting analyses (schedule may be set by ISI program manager).
L.
Equipment importance lists for applications.
M.
Notify Security of new PRA base model N.
List of procedures that impact the PRA (procedures which the site RME reviews quarterly) and add any arising from the update activities.
O.
All current PRA applications, and SCHEDULE revisions as appropriate. A qualitative review is acceptable if it clearly demonstrates that there is no significance impact on a current application.
P.
Limerick only Surveillance Frequency Control Program surveillance test interval evaluations
ER-AA-600-1015 Revision 7 Page 9 of 15 4.3.4.
DOCUMENT the review of PRA applications, including those where there is no impact. Any PRA application whose ER-AA-600-1012 documentation states, "not required to be updated" or whose PRA applications listing entry indicates that it does not need to be updated does not need to be evaluated further.
4.3.5.
Inform the responsible site program or process owner of the results of the review of their application and any changes arising from the above reviews. For example if the AOV ranking is updated, inform the AOV program manager of the changes and provide the revised results to them. The owner must informed even if no changes result from the model update.
4.3.6.
Deferral of any of the above actions in the change management plan beyond a six month completion period should be approved by the Senior Manager Risk Management.
4.3.7.
Ensure the updated model is stored and distributed in accordance with ER-AA-600-1014 (ref. 6.6).
4.4.
Unscheduled Update Process As noted in Section 4.1.3, the need for an unscheduled PRA update may arise because evaluation of a LIRE indicates that the risk significance of the PRA revision involved is such that it should not be delayed until the next scheduled periodic update.
4.4.1.
The Model Owner will prepare a Project Plan for the unscheduled update (if the complexity of the unscheduled update warrants a Project Plan) which identifies tasks to be performed, a schedule to complete each task and resources to carry out the tasks.
4.4.2.
Data Collection OBTAIN AND REVIEW data in the same manner as described in Section 4.2.2 but limited in scope appropriate to the purpose and requirements of the unscheduled PRA update.
CONSIDER only those data sources which are necessary to support the purpose and scope of the update EVALUATE open UREs to determine those that will be included in the update In the performance of an unscheduled PRA update, it is not necessary to obtain the concurrence of the Risk Management Director for UREs deferred to the next periodic PRA update.
4.4.3.
Data Screening and Analysi s The activities specified in Section 4.2.3 NEED NOT BE DONE unless they are necessary to support the scope of the unscheduled PRA update. The scope of
4.4.6.
Approval ER-AA-600-1015 Revision 7 Page 10 of 15 those activities performed should be limited appropriate to the requirements of the unscheduled PRA update.
4.4.4.
Model Changes UPDATE the PRA technical elements appropriate to the requirements of the unscheduled PRA update. CONSIDER only those technical elements listed in Section 4.2.4 which are necessary to support these requirements. CONSIDER only the scope of these technical elements necessary to support the requirements of the unscheduled PRA update.
4.4.5.
Quantification QUANTIFY the model, REVIEW the model per Attachment 2 using the items appropriate to the changes incorporated and PREPARE a CDF and LERF documentation category 1 document for model changes made in the unscheduled PRA update that significantly change baseline CDF and/or LERF numbers, including importance measures. Significance is based on engineering judgment considering the criteria specified in the EPRI PSA Applications Guide (Ref. 6.1) for permanent changes.
1.
PREPARE a documentation category 1 record of the updated PRA quantification, and INCLUDE the results of review of current applications which are significantly impacted by the updated PRA NOTE : Significance is based on whether the current application would no longer adequately represent the as-built, as-operated plant if not revised using the updated PRA. A qualitative review is acceptable if it clearly demonstrates that there is no significant impact on a current application.
2.
UPDATE other PRA documentation appropriate to the scope and impact of the unscheduled PRA update. Normally this would be done as a revision of the documentation. This may also be done by PREPARING addenda to existing documentation category 1 documents or PREPARING other retrievable documentation. UPDATE the appropriate category 1 PRA documentation using the contents of these addenda or other documentation at the next periodic PRA update.
3.
Consider the impact on or need to UPDATE other PRA models such as fire and seismic. If update is deferred create UREs specific to those models as necessary.
Approve per Section 4.2.6.
4.4.7.
Documentation and Rollout
2.
If the updated PRA is to be used in any other current application, then REVIEW the impact to that application, and SCHEDULE revisions as appropriate 4.5.
Ongoing Data Review ER-AA-600-1015 Revision 7 Page 1 1 of 15 The activities specified in Section 4.3 NEED NOT BE DONE unless they are necessary because the updated PRA is to be used in application(s) which would make them appropriate.
If necessary, within six months of approving the PRA model category 1 documentation :
1.
If the updated PRA is to be applied to provide quantification results used in the on-line risk monitor, UPDATE Training Aids & Posters if the changes are significant, PROVIDE training as appropriate, REVISE the on-line risk monitor, REVISE the baseline CDF and LERF results used for trending, and REVISE any directly-associated applications NOTE : Directly associated applications are those in which the risk significance of on-line maintenance activities has been evaluated such as license amendments to provide extended allowed outage times.
During the period between periodic updates, the SRME should review the following for changes that will impact the PRA model :
4.5.1.
Plant Design Changes Evaluate identified modifications for impact on the PRA model when a modification is initiated that may impact the PRA model and prepare a URE or unscheduled update to the PRA model as required.
4.5.2.
Procedure Changes REVIEW all procedures in HRA procedures list and new procedures quarterly for changes that can impact the PRA model. The Model Owner will maintain a list of HRA procedures to be reviewed. These procedures will include all procedures that are used in an HEP calculation (ex. emergency operating procedures) except for those tied to precursor events such as miscalibrations. Other procedures may be included in the list of procedures based on the Model Owner's judgment.
ISSUE a URE for procedure changes that are determined to have a possible impact on the PRA model. The Site Risk Management Engineer is expected to consult with personnel in the Training and Operations departments and participate when procedure changes that could have a significant impact to plant safety are considered.
4.5.3.
Engineering Ca lculations SCREEN revised and new Site Engineering Calculations on a quarterly basis. The Site Risk Management Engineer will INITIATE a URE if it is determined that a
calculation may impact the PRA model and further evaluation and/or incorporation into the PRA model is required.
5.
DOCUMENTATION 5.1.
PREPARE PRA update documentation according to ER-AA-600-1012, "Risk Management Documentation."
6.
REFERENCES 6.1.
EPRI TR-105396, "PSA Applications Guide," August, 1995 ER-AA-600-1015 Revision 7 Page 12 of 15 4.5.4.
Document the above reviews in a manner that will allow a RME to determine whether a change has been reviewed for impact.
6.2.
ASME RA-S-2002 and addenda, "Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications."
6.3.
IT-AA-101, "Digital Technology Systems (DTS) Quality Assurance Procedure."
6.4.
ER-AA-600-1011, "Risk Management Program."
6.5.
ER-AA-600-1012, "Risk Management Documentation."
6.6.
ER-AA-600-1014, "Risk Management Configuration Control."
6.7.
ER-AA-600-1047, MSPI Basis Document 7.
ATTACHMENTS 7.1. : Sample Updating Requirements Evaluation Form 7.2. : Review of updated PRA Model
ATTACHMENT 1 Sample Updating Requirements Evaluation Form Page 1 of 1 URE E Completed:
URE Resoh/ed By.
Revie%A.ed By Exelon PS A URE Updating Requirement Ealmticr, Completion Date:
Revievu3d Date:
ER-AA-600-1015 Revision 7 I Page 13 of 15 URE t,.~.
station :
Urrit Initiated By Reason Design Change Rooedire! Policy 0 Cal cut ation Date:
0 Impro~.ement 0 6panson 0 Cther IRE Descri ion:
Evaluation Performed By.
Gate :
Evaluation Notes:
i ificance:
Cat r.
PSA Action None
. The PSA model is not i rnpacted bythis UR 0 The PSA model is iupactedandvill be revised, Schedule-o Immediate attention required for applications.
0 Ne>d Periodio Update, consider in applications.
Other - see oorrwnends below.
P SA Action - Comments Model Revision Completed: 0 Document Revision Completed Adritional Comments:
Resolution:-
ATTACHMENT 2 Review of updated PRA model Page 1 of 2 ER-AA-600-1015 Revision 7 Page 14 of 15 The below reviews are of the base full power internal events model. They do not supplant reviews of individual portions of the update such as analysis files, notebook revisions or supporting calculation such as updated maintenance frequencies. These reviews represent the minimum required, additional reviews may be performed at the discretion of the RME.
1
. For a revision to a fault tree's logic structure, review at a minimum the top 20% of the resultant cutsets for validity.
If there is an opposite train or Unit fault tree available, compare the results against each other. For example compare the A train cutsets to the B train cutsets. This type of review is not required for other fault tree changes such as revision to gate or basic event descriptions or names.
2. Review the top 500-600 cutsets from the integrated results. Are the cutsets valid?
3. Review a sampling of non-dominant sequences/cutsets to determine that they are reasonable and make physical sense.
4. Verify that truncation limits result in convergence of results toward a stable value. This applies to all truncation limits used (for example both event tree and fault tree truncation values should be evaluated for convergence in a WinNUPRA model).
5. Review the top 100-150 cutsets against the previous model results. Are the differences explainable by the changes to the model? For example if a specific initiating event frequency dropped by 10%, the associated cutsets may drop out of the top 100. Also if credit for a system or function changes it may shift the results.
- 6. Review the results by initiator against the previous model. Are the difference in ranking and absolute value explainable?
7. Perform an initial draft ranking for at least one valve type. Review against previous results.
8. Perform an initial draft Maintenance Rule risk significance listing. Review against previous results.
- 9. Perform ORAM-Sentinel or PARAGON cases for selected high CDF singles and combinations, selected low CDF singles and combinations. Selected cases should include systems where significant work was performed in the update. For example pick electrical cases where work was done on the LOOP event trees. Review against previous cases.
ATTACHMENT 2 Review of updated PRA model Page 2 of 2 ER-AA-600-1015 Revision 7 Page 15 of 15 10. For sites with separate unit models, compare the dominant sequence frequencies between the two models.
11. Document the above reviews and resolve any identified issues prior to final signoff of the PRA model for use.