ML17039A524

02/09/17 Slides for NRC Public Meeting with NEI to Discuss NEI 16-16, Guidance for Addressing Digital Common Cause Failure and Its Relationship with Appendix D of NEI 96-07

ML17039A524
Person / Time
Site:	Nuclear Energy Institute
Issue date:	02/09/2017
From:	Nuclear Energy Institute
To:	Office of Nuclear Reactor Regulation
Holonich J J
References
NEI 16-16, NEI 96-07
Download: ML17039A524 (19)

Text

Table top exercise -Auxiliary/Support System Replacement Using NEI 16-16 and Appendix DMEETING BETWEEN THE U.S. NUCLEAR REGULATORY COMMISSION STAFF AND THE NUCLEAR ENERGY INSTITUTE TO DISCUSS NEI 16-16, "GUIDANCE FOR ADDRESSING DIGITAL COMMON CAUSE FAILURE" AND ITS RELATIONSHIP WITH APPENDIX D OF NEI 96-07February 9, 2017 *Washington DC 1

Discussion Topics

• Control room chiller controls upgrade example will be discussed*Demonstration of NEI 16-16 approach for analysis of CCF malfunction results

-CCF malfunctions can be bounded by previous deterministic plant analyses-Can be found acceptable when performing 10 CFR 50.59 evaluations

• NRC and Industry achieve a common understanding of the issues associated with 50.59 Evaluation Questions 1, 2, 5, and 6 related to digital changes

• Overall goal is to align on methods to efficiently implement the majority of Digital upgrades under 50.59 2

Overview of Digital Upgrade

• Existing chiller controls are 1970 vintage are obsolete and required significant maintenance to maintain.

• Both the chiller controls and chillers are being replaced. The HVAC air handling units are separate from the chillers and are not being replaced.

• Chiller replacements would significantly improve MCR HVAC reliability. Several reliability improvements have been designed into the digital control system such

as: -Freeze protection which are not available in old analog systems.

-Elimination of manual actions required to restart chiller if power is lost more that 60 seconds.

-Time delay for compressor restart to prevent cycling on power interrupts (allows time for power stability).

-A design that will allow the chiller to operate in a limited condition when certain process values enter off-normal conditions and still provide cooling.

-Variable anti-cycle time based on how long the chiller was running prior to stopping and how long the chiller has been stopped.

• The new chiller controls were selected due to extensive successful operating history and reliability in the commercial world with modern multi input control algorithm that has extensive operating history in an existing application that is not inherently special.

3 NEI 16-16 CCF Susceptibility Analysis

• The industry position is that CCF is not always credible

• However, for the purposes of the discussion, and this example today, the Chiller Controls Example is based on a NEI 16-16 CCF susceptibility analysis that determined that a CCF was credible.

[NEI 16-16 Section 4.1]

• The details related to performing the CCF susceptibility analysis will not be discussed today

• The results of the CCF susceptibility analysis indicate that a credible CCF of both chillers could result in maximum cooling by both chillers or no cooling at all by either chiller

-Both scenarios will be evaluated and analyzed 4

NEI 16-16 Analysis of CCF Malfunction Result

• For this example, it is determined that the CCF can be caused only by a CCF source whose likelihood is significantly less than the likelihood of a single failure. (This would actually be determined through an assessment of defensive measures during the CCF Susceptibility Analysis). Therefore, the CCF is considered beyond design basis.

[NEI 16-16 Section 4.1.2.2.3]

• If a credible CCF is beyond design basis, the following analysis methods and acceptance criteria are applied [NEI 16-16 Section 4.2.2.1]:

-Design basis or best estimate methods. Best estimate methods can employ realistic and nominal initial plant conditions and equipment performance, relaxed acceptance criteria, no other assumed equipment failures, credit for beneficial control system action, and allow conclusions based on qualitative expert judgment or quantitative analysis.

-Mitigating systems (also referred to as systems used to cope with the CCF) can be safety related, or non-safety related with suitable attributes

-Bounding is based on previously analyzed AOOs or PAs 5

NEI 16-16 Analysis of CCF Malfunction Result

• For the Chiller Controls example, Best Estimate methods will be used, with realistic or nominal conditions, such as [NEI 16-16 Section 4.2.2.1.2]:

-Average summer outdoor temperature, versus worst case-Average summer ultimate heat sink temperature (cooling water to the chillers), versus worst case

-Relaxed temperature limits for the control room area (104 degrees versus 90 degrees) 6 NEI 16-16 Bounded Criteria

• The plant level end result due to a CCF malfunction is considered bounded if all the following criteria are met [NEI 16-16 Section 4.2.1]: 1.If the same type of transient or accident is already included in the deterministic safety analyses of the FSAR (e.g., excess feedwaterevent), 2.If only systems previously described in the FSAR are credited for mitigation, and 3.If there is no more than a minimal reduction in margin to the critical safety limit(s) in the applicable transient or accident from Item 1, above (e.g.,

departure from nucleate boiling ratio or containment pressure).For a CCF in a support system whose function is required for the operation of a component, system or function that is directly credited in an FSAR safety analysis, the plant level end result is considered bounded if those directly credited systems are still capable of performing their credited safety function

.7 Chiller Controls ExampleAnalysis of CCF Malfunction Result

• Chillers are a support system whose function is required for the operation of a component, system or function that is directly credited in an FSAR safety analysis (e.g., RPS, ESFAS).

• The "fail on" heat removal case has no adverse impact on MCR equipment and personnel beyond creating uncomfortably cool conditions. Heaters are provided in the MCR HVAC system for controlling humidity within limits, and the heater controls are independent of the chiller controls.

• The "fail off" heat removal case should consider eventual overheating of equipment located in the MCR envelope, including equipment required for achieving and maintaining safe shutdown. In the event that a total loss of heat removal by the chillers occurs, the control room operators will detect an increase in temperature by feel or by surveillance of MCR room temperature or MCR return air temperature indications, which are independent from the chiller controls.

8 Chiller Controls ExampleAnalysis of CCF Malfunction Result

• Whether the plant is at power or the I&C failure is assumed to occur during a transient or accident, only the chillers are affected by the CCF that would be caused by controller failure. Air handling units and dampers remain unaffected, and are available for supplying outdoor air so that the MCR temperature is kept near the seasonal outdoor air temperature (best estimate), and one or more MCR doors can be opened to exhaust hot air.

• Operators can open safe shutdown equipment cabinet doors to reduce the local temperature rise caused by self-heating. Under these conditions, the equipment required for safe shutdown is not expected to reach their specified temperature limits (best estimate).

9 Chiller Controls ExampleAnalysis of CCF Malfunction -Conclusion

• As a support system, the chillers are a system whose function is required for the operation of a component, system or function (in this case, control room equipment) that is directly credited in an FSAR safety analysis.

• Analysis of the CCF Malfunction Results indicate that the plant level end result is considered bounded, as those directly credited systems are still capable of performing their credited safety function. [NEI 16-16 Section 4.2.1]

10 Chiller Controls Upgrade50.59 Evaluation 11 OBJECTIVE*NRC and Industry achieve a common understanding of the issues associated with Evaluation Questions 1, 2, 5, and 6 related to digital changes 12 Chiller Controls Replacement Background

• Safety-related control room chillers

• Current chillers have analog controls with a proposed activity to replace with new chillers that have identical digital controls on both trains

• UFSAR provides the following failure information related to the chillers:FMEA Conclusion -Loss of one chiller train will result in starting of redundant chiller train

• No discussion of control room chillers in Chapter 15 Accident Analysis 13 50.59 Evaluation Question 1

• Does the proposed activity result in more than a minimal increase in the frequency of occurrence

of an accident previously evaluated in the UFSAR?-The control room chillers are not an initiator of any accident previously evaluated in the UFSAR, nor could the proposed activity create a credible scenario where the chillers could become an accident initiator

-Therefore, the proposed activity to upgrade the chillers cannot result in more than a minimal increase in accident frequency 14 50.59 Evaluation Question 2

• Does the proposed activity result in more than a minimal increase in the likelihood of occurrence of a malfunction of an SSC important to safety previously evaluated in the UFSAR?-Evaluation Question 2 considers malfunctions currently described (previously evaluated) in the UFSAR

-A CCF of the chiller controls in not currently described within the chiller FMEA or any other place in the UFSAR

-A CCF of the chiller controls (new malfunction) will be addressed in Evaluation Question 6 15

• Does the proposed activity create a possibility for an accident of a different type

than previously evaluated in the UFSAR

?-As stated for Question 1, the chillers are not an initiator of any accident analyzed in the UFSAR, nor could the proposed activity create a credible scenario where the chillers could become an accident initiator

-Thus, the proposed activity cannot create the possibility for an accident of a different type 1650.59 Evaluation Question 5 50.59 Evaluation Question 6

• Does the proposed activity create a possibility for a malfunction of an SSC important to safety with a different result than any previously evaluated in the UFSAR

?-A chiller controls CCF creates a new malfunction that would cause simultaneous loss of both chillers

-Loss of both chillers (system level malfunction result) is not currently described in the UFSAR

-The end result on the plant is not different (plant level result is bounded) 17 Summary 18*Demonstrated of NEI 16-16 approach for analysis of CCF malfunction results

-CCF malfunctions can be bounded by previous deterministic plant analyses

-Can be found acceptable when performing 10 CFR 50.59 evaluations

• Discussed issues associated with 50.59 Evaluation Questions 1, 2, 5, and 6 related to digital changes with goal of NRC and Industry achieving a common understanding

• The industry position is that CCF is not always credible

• Overall goal is to align on methods to efficiently implement the majority of Digital upgrades under 50.59 Q&A?19