RS-17-007, Request for Improvements in NRC SPAR Model and RASP Handbook Use

Request for Improvements in NRC SPAR Model and RASP Handbook Use

ML17013A161
Person / Time
Site:	Dresden
Issue date:	01/12/2017
From:	Fewell J Exelon Generation Co
To:	Bill Dean Document Control Desk, Office of Nuclear Reactor Regulation
References
IR 2016010, RS-17-007
Download: ML17013A161 (5)

Text

Exelon Generation 4300 W1nf1eld Road Warrenville. IL 60555 www exe loncorp com RS-17-007 January 12, 2017 Mr. William M. Dean Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Washington, DC 20555-0001

Subject:

Request for Improvements in NRG SPAR Model and RASP Handbook Use

Reference:

Letter from J. F. Lara (NRG) to B. C. Hanson (Exelon Generation Company, LLC (EGG)), "Dresden Nuclear Power Station, Unit 3 - NRG Report 05000249/2016010 and Preliminary White Finding,"

dated December 5, 2016 In the referenced letter, the NRG documented a finding preliminarily determined to be of White significance concerning the Dresden, Unit 3 High Pressure Coolant Injection (HPCI) system.

The finding is related to a June 27, 2016, failure of the HPCI auxiliary oil pump (AOP). Exelon Generation Company, LLC (EGG) acknowledges that the NRG followed its processes to reach a preliminary significance of White. However, those processes - namely, the existing Standardized Plant Analysis Risk (SPAR) modeling and Risk Assessment of Operational Events (RASP) Handbook- drove the NRG to obtain risk results that are unnecessarily conservative and unrepresentative of actual risk. As explained below, other recent examples of findings that the NRG evaluated have also resulted in unnecessarily conservative risk significance results.

The NRG has long embraced the use of Probabilistic Risk Assessment (PAA) methods to enhance safety, increase the efficient use of resources, and eliminate unnecessary conservatism and unnecessary burdens on licensees. 1 In furtherance of the NRC's policy on the use of PAA, EGG requests several improvements to NRG SPAR modeling and the RASP Handbook, which are detailed in this letter. The improvements would provide the NRG greater flexibility in use of the SPAR models and the RASP Handbook to achieve more accurate risk outcomes, ultimately resulting in NRG risk tools that produce more realistic risk characterizations of plant events and performance deficiencies. Moreover, the enhancements would bolster safety by eliminating unnecessary conservatisms and fostering the more efficient use of both agency and industry resources.

1 NRC Policy Statement, "Use of Probabilistic Risk Assessment Methods in Nuclear Regulatory Activities," 60 Fed. Reg. 42,622 (Aug. 16, 1995).

January 12, 2017 U.S. Nuclear Regulatory Commission Page2 EGC is committed to maintaining a clear focus on issues important to safety. To that end, we are taking this opportunity to identify some areas in the Significance Determination Process (SOP) that are causing the NRC and industry to unduly focus resources on issues of low safety significance. These observations have been developed during the analysis phase of several actual SOP cases within the EGC fleet over the past several years. EGC agrees with the NRC that the goal of risk-informed regulation is to allow the NRC and the industry to best focus attention on issues most important to safety. The NRC's Reactor Oversight Process has brought a welcomed objectivity to the assessment of inspection findings and event assessment through the application of a risk-informed approach. However, some of the NRC's practices in applying risk techniques hampers their full utilization and leads to unnecessary diversion of resources to issues of little or no safety significance. These practices include undue reliance on inadequately detailed SPAR models and conservatism in the RASP Handbook.

For the examples below, these practices greatly overestimated the risk significance of the performance deficiencies and caused both the NRC and the industry to expend effort not commensurate with safety significance. These SDPs include the December 2016 Dresden White finding concerning the HPCI AOP, the pending finding concerning an electromatic relief valve (EMRV) failure at an EGC station located in NRC Region I, and the August 2013 Nine Mile Point White finding concerning the loss of shutdown cooling. In one of these cases, the SOP was ultimately resolved as being of low safety significance, but only after expenditure of undue effort. Based on our experiences, EGC proposes four specific recommendations for your consideration in an effort to enhance the realism of the SOP:

1. Use the Best Available Model: When the SPAR model and the licensee's PAA model differ significantly and the licensee's peer reviewed PAA model is more detailed, the licensee's PAA model should be used to determine the risk significance of a performance deficiency.

In many cases, a licensee's PAA model is more detailed, refined, and representative of the as-built, as-operated plant than the SPAR model. Further, many of these models have been through a detailed peer review process consistent with Regulatory Guide 1.200; thereby, establishing the technical adequacy of the model. When the SPAR model lacks the detail available in the licensee's PAA, the licensee's peer reviewed PAA model should be used to determine the risk significance of the performance deficiency as it provides a better tool than the necessarily simplified SPAR model. We fully respect the NRC's need to perform independent assessments, but using a less accurate tool is not the solution. The SOP process could easily be amended to allow a meeting to be held with the NRC's and licensee's risk experts early in the SOP process to discuss the applicability of the SPAR model to the issue at-hand before a decision is made on safety significance. Over time, this may allow the NRC to better understand the licensee's PAA model, potentially increasing the efficiency of risk-informed licensing reviews. EGC would be interested in piloting this approach at any of its plants.

January 12, 2017 U.S. Nuclear Regulatory Commission Page3

2. Realistically Treat Failure Events: The RASP Handbook should be enhanced to provide sufficient guidance for treating the failure of an auxiliary or sub-system, similar to the HPCI AOP, whose mission time (on the order of seconds) is substantially shorter than the HPCI system mission time (24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />) it supports.

Current PAA models are necessarily binary in their consideration of failures of modeled components (success/failure). Unfortunately, in the real world, "failures" do not always neatly fall into such simple categorizations. The RASP Handbook drives the NRG PAA Analyst to treat all performance deficiencies in a binary form by fitting them into the construct of the PAA model.

This can lead to a misleading characterization of the significance of an event. Improved guidance is needed to better characterize the relationship between the observed condition and related components, system functions, and operator actions. In the case of the Dresden HPCI system, the AOP caught fire during in-service testing after the HPCI pump successfully reached steady-state operation. The fire was then extinguished before affecting the HPCI pump. The AOP is only required to start the HPCI pump but not required for the pump's continuous operation. The only possible impact from failure of the AOP once the HPCI pump was started would be preventing restart of the HPCI pump if it were secured or tripped after steady-state operation is achieved. However, by only having two ways of classifying equipment failure in the RASP Handbook, failure of the AOP after the HPCI pump reached steady-state was equated to failure of the HPCI pump to run. This is analogous to the situation where the starter motor of a car breaks after the car is running and then concluding "the car won't run" even though it is already running. As a result, the risk significance of the performance deficiency was substantially overestimated, and a White finding was issued.

3. Rely on Fact-Based Common Cause Failure (CCF) Treatment: The RASP Handbook guidance should be enhanced to allow the as-found conditions and extent of condition to factor into the determination of CCF multipliers.

When determining the risk significance of equipment failure, it is important to question the potential for CCF. The current RASP Handbook guidance represents a bounding quantitative application of common cause factors, and often controls the risk significance of the performance deficiency. In some cases where the failure mechanism/extent of condition cannot be known, simplified approaches are warranted. In situations where the failure mechanism is known and the extent of condition can be clearly assessed, it would be more appropriate to use the actual as-found condition to assess significance. At an EGG station located in NRG Region I, one of five EMRVs was found failed during shutdown due to missing hinge pin lock star washers.

Investigation of the extent of condition identified the other four EMRVs had the washers in place and would have operated as designed. In this case, using the guidance in the RASP Handbook, rather than the as-found condition of the valves and other supporting information available, the CCF probability was increased from that used in the base model by approximately two orders of magnitude, with a similar increase in core damage frequency. The RASP Handbook essentially uses a "guilty until proven innocent beyond a reasonable doubt" philosophy with no consideration of how to modify such a significant risk penalty if found innocent.

January 12, 2017 U.S. Nuclear Regulatory Commission Page4

4. Eliminate the Arbitrary Human Reliability Analysis Minimum Probability: The RASP Handbook should not prescribe a minimum joint human error probability (HEP) of 1E-6 for all circumstances. Additional guidance should be provided to assess HEP in cases where operating crew failure is "practically inconceivable" in order to avoid arbitrary assignment of safety significance based on a prescriptive assumption.

The RASP Handbook drives the NRC PAA Analyst to assume a "floor" value for human actions of 1E-6, regardless of the benignity of the circumstances. This assumption, by itself, can be the entire cause of a safety significant finding by setting the minimum risk level to be above the Green-White SDP threshold. It is inappropriate for an arbitrary "limit," selected in the abstract and independent of the situation being assessed, to drive safety significance. Some consideration must be given to situations where procedures, cues, training, timing, and circumstances indicate that human failure is not a credible contributor to risk.

Nine Mile Point, Unit 1 experienced a loss of shutdown cooling due to a trip of the operating Shutdown Cooling (SDC) pump. Because there were many systems available for event mitigation, the risk significance was based on the reliability assigned to operator recognition and response. The RASP Handbook states that, "a joint human error probability of less than 1E-6 should not be used for any circumstance." This guidance should be revised to allow HEP values below 1E-6 in certain cases where failure is "practically inconceivable," such as when there is an abundance of time, a variety of independent cues, straightforward actions with clear procedures, adequate personnel, and direct relevant training. In the Nine Mile Point, Unit 1 example, for the core to have been damaged, two dozen sequential annunciated alarms would have had to be ignored or incorrectly evaluated, and two separate crews of licensed operators would have had to fail to recognize and respond to the loss of SDC until the core was uncovered. Although the SDP of this event was finalized as Green, using floor values of HEP could elevate the risk significance of operational events, particularly during shutdown conditions.

In each of these cited cases, the limitations of the current models and guidance led to overstated significance and inefficient expenditure of NRC and industry resources. As the NRC and the industry continue to benefit from the application of risk-informed methods, it is vital to continue enhancing the realism of the processes in order to focus on truly safety significant situations: not those driven by model limitations, assumptions, or arbitrary rules. These particular events highlight areas where the current NRC guidance caused the significance of performance deficiencies to be substantially overestimated. Accordingly, we suggest it would be appropriate to modify the White finding at Dresden and consider this perspective as the NRC evaluates matters in the future including those identified in this letter. EGC would be happy to discuss these four recommendations with you at your convenience.

January 12, 2017 U.S. Nuclear Regulatory Commission Page 5 This letter does not contain any new regulatory commitments. If you have any questions, please contact Patrick Simpson, Licensing Manager, at (630) 657-2823.

Res~ectf ully, -

Cetey ~ew II ~

Senior Vice President Regulatory Affairs Exelon Generation Company, LLC cc: NRC Document Control Desk Regional Administrator, NRC Region I Regional Administrator, NRC Region Ill Senior Resident Inspector, Dresden Nuclear Power Station