ML022410004

Attachment 1 and Attachment 2, Regularory Issue Summary 2002-14, Proposed Changes to the Safety System Unavailability Performance Indicators

ML022410004
Person / Time
Issue date:	08/28/2002
From:	Beckner W NRC/NRR/DRIP/RORP
To:
Sanders S
References
OMB 3150-0195 RIS-02-014
Download: ML022410004 (37)

See also: RIS 2002-14

Text

Attachment 1

RIS 2002-14

Attachment 1, Section 2.2, Mitigating Systems Cornerstone, of NEI 99-02, Regulatory

Assessment Performance Indicator Guideline (Draft)

1

DRAFT NEI 99-02 MSPI 8/28/20028/23/20028/9/2002

1

MITIGATING SYSTEM PERFORMANCE INDEX

2

Purpose

3

The purpose of the mitigating system performance index is to monitor the performance of

4

selected systems based on their ability to perform risk-significant functions as defined herein. It

5

is comprised of two elements - system unavailability and system unreliability. The index is used

6

to determine the significance of performance issues for single demand failures and accumulated

7

unavailability. Due to the limitations of the index, the following conditions will rely upon the

8

inspection process for determining the significance of performance issues:

9

10

1. Multiple concurrent failures of components

11

2. Common cause failures

12

3. Conditions not capable of being discovered during normal surveillance tests

13

4. Failures of non-active components

14

15

Indicator Definition

16

Mitigating System Performance Index (MSPI) is the sum of changes in a simplified core damage

17

frequency evaluation resulting from changes in unavailability and unreliability relative to

18

baseline values.

19

20

Unavailability is the ratio of the hours the train/system was unavailable to perform its risk-

21

significant functions due to planned and unplanned maintenance or test on active and non-active

22

components during the previous 12 quarters while critical to the number of critical hours during

23

the previous 12 quarters. (Fault exposure hours are not included; unavailable hours are counted

24

only for the time required to recover the trains risk-significant functions.)

25

26

Unreliability is the probability that the system would not perform its risk-significant functions

27

when called upon during the previous 12 quarters.

28

29

Baseline values are the values for unavailability and unreliability against which current changes

30

in unavailability and unreliability are measured. See Appendix F for further details.

31

32

The MSPI is calculated separately for each of the following five systems for each reactor type.

33

34

BWRs

35

 emergency AC power system

36

 high pressure injection systems (high pressure coolant injection, high pressure core spray, or

37

feedwater coolant injection)

38

 heat removal systems (reactor core isolation cooling)

39

 residual heat removal system (or their equivalent function as described in the Additional

40

Guidance for Specific Systems section.)

41

2

DRAFT NEI 99-02 MSPI 8/28/20028/23/20028/9/2002

 cooling water support system (includes risk significant direct cooling functions provided by

1

service water and component cooling water or their cooling water equivalents for the above

2

four monitored systems)

3

4

PWRs

5

 emergency AC power system

6

 high pressure safety injection system

7

 auxiliary feedwater system

8

 residual heat removal system (or their equivalent function as described in the Additional

9

Guidance for Specific Systems section.)

10

 cooling water support system (includes risk significant direct cooling functions provided by

11

service water and component cooling water or their cooling water equivalents for the above

12

four monitored systems)

13

14

Data Reporting Elements

15

The following data elements are reported for each system

16

17

 Unavailability Index (UAI) due to unavailability for each monitored system

18

 Unreliability Index (URI) due to unreliability for each monitored system

19

20

During the pilot, the additional data elements necessary to calculate UAI and URI will be

21

reported monthly for each system on an Excel spreadsheet. See Appendix F.

22

23

24

Calculation

25

The MSPI for each system is the sum of the UAI due to unavailability for the system plus URI

26

due to unreliability for the system during the previous twelve quarters.

27

28

MSPI = UAI + URI.

29

30

See Appendix F for the calculational methodology for UAI due to system unavailability and URI

31

due to system unreliability.

32

33

Definition of Terms

34

A train consists of a group of components that together provide the risk significant functions of

35

the system as explained in the additional guidance for specific mitigating systems. Fulfilling the

36

risk-significant function of the system may require one or more trains of a system to operate

37

simultaneously. The number of trains in a system is generally determined as follows:

38

39

 for systems that provide cooling of fluids, the number of trains is determined by the number

40

of parallel heat exchangers, or the number of parallel pumps, or the minimum number of

41

parallel flow paths, whichever is fewer.

42

43

3

DRAFT NEI 99-02 MSPI 8/28/20028/23/20028/9/2002

 for emergency AC power systems the number of trains is the number of class 1E emergency

1

(diesel, gas turbine, or hydroelectric) generators at the station that are installed to power

2

shutdown loads in the event of a loss of off-site power. (This does not include the diesel

3

generator dedicated to the BWR HPCS system, which is included in the scope of the HPCS

4

system.)

5

6

Risk Significant Functions: those at power functions, described in the Additional Guidance for

7

Specific Systems, that were determined to be risk-significant in accordance with NUMARC 93-

8

01, or NRC approved equivalents (e.g., the STP exemption request.) The system functions

9

described in the Additional Guidance for Specific Systems must be modeled in the plants

10

PRA/PSA. of risk-significant SSCs as modeled in the plant-specific PRA. Risk metrics for

11

identifying risk-significant functions are:

12

13

Risk Achievement Worth > 2.0, or

14

Risk Reduction Worth >0.005, or

15

PRA cutsets that account for 90% of core damage frequency90% of core damage

16

frequency accounted for.

17

18

Risk-Significant Mission Times: The mission time modeled in the PRA for satisfying the risk-

19

significant function of reaching a stable plant condition where normal shutdown cooling is

20

sufficient. Note that PRA models typically analyze an event for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, which may exceed the

21

time needed for the risk-significant function captured in the MSPI. However, other intervals as

22

justified by analyses and modeled in the PRA may be used.

23

24

Success criteria are the plant specific values of parameters the train/system is required to achieve

25

to perform its risk-significant function. Default values of those parameters are the plants design

26

bases values unless other values are modeled in the PRA.

27

28

Clarifying Notes

29

Documentation

30

31

Each licensee will have the system boundaries, active components, risk-significant functions and

32

success criteria readily available for NRC inspection on site. Additionally, plant-specific

33

information used in Appendix F should also be readily available for inspection.

34

35

Success Criteria

36

37

Individual component capability must be evaluated against train/system level success criteria

38

(e.g., a valve stroke time may exceed an ASME requirement, but if the valve still strokes in time

39

to meet the PRA success criteria for the train/system, the component has not failed for the

40

purposes of this indicator because the risk-significant train/system function is still satisfied).

41

Important plant specific performance factors that can be used to identify the required capability

42

of the train/system to meet the risk-significant functions include, but are not limited to:

43

 Actuation

44

o Time

45

4

DRAFT NEI 99-02 MSPI 8/28/20028/23/20028/9/2002

o Auto/manual

1

o Multiple or sequential

2

 Success requirements

3

o Numbers of components or trains

4

o Flows

5

o Pressures

6

o Heat exchange rates

7

o Temperatures

8

o Tank water level

9

 Other mission requirements

10

o Run time

11

o State/configuration changes during mission

12

 Accident environment from internal events

13

o Pressure, temperature, humidity

14

 Operational factors

15

o Procedures

16

o Human actions

17

o Training

18

o Available externalities (e.g., power supplies, special equipment, etc.)

19

20

21

22

System/Component Interface Boundaries

23

24

For active components that are supported by other components from both monitored and

25

unmonitored systems, the following general rules apply:

26

27

 For control and motive power, only the last relay, breaker or contactor necessary to

28

power or control the component is included in the active component boundary. For

29

example, if an ESFAS signal actuates a MOV, only the relay that receives the ESFAS

30

signal in the control circuitry for the MOV is in the MOV boundary. No other portions

31

of the ESFAS are included.

32

33

 For water connections from systems that provide cooling water to an active component,

34

only the final active connecting valve is included in the boundary. For example, for

35

service water that provides cooling to support an AFW pump, only the final active valve

36

in the service water system that supplies the cooling water to the AFW system is

37

included in the AFW system scope. This same valve is not included in the cooling water

38

support system scope.

39

40

Water Sources and Inventory

41

42

Water tanks are not considered to be active components. As such, they do not contribute to URI.

43

However, periods of insufficient water inventory contribute to UAI if they result in loss of the

44

risk-significant train function for the required mission time. Water inventory can include

45

operator recovery actions for water make-up provided the actions can be taken in time to meet

46

5

DRAFT NEI 99-02 MSPI 8/28/20028/23/20028/9/2002

the mission times and are modeled in the PRA. If additional water sources are required to satisfy

1

train mission times, only the connecting active valve from the additional water source is

2

considered as an active component for calculating URI. If there are valves in the primary water

3

source that must change state to permit use of the additional water source, these valves are

4

considered active and should be included in URI for the system.

5

6

Monitored Systems

7

8

Systems have been generically selected for this indicator based on their importance in preventing

9

reactor core damage. The systems include the principal systems needed for maintaining reactor

10

coolant inventory following a loss of coolant accident, for decay heat removal following a

11

reactor trip or loss of main feedwater, and for providing emergency AC power following a loss

12

of plant off-site power. One risk-significant support function (cooling water support system) is

13

also monitored. The cooling water support system monitors the risk significant cooling functions

14

provided by service water and component cooling water, or their direct cooling water

15

equivalents, for the four front-line monitored systems. No support systems are to be cascaded

16

onto the monitored systems, e.g., HVAC room coolers, DC power, instrument air, etc.

17

18

Diverse Systems

19

20

Except as specifically stated in the indicator definition and reporting guidance, no credit is given

21

for the achievement of a risk-significant function by an unmonitored system in determining

22

unavailability or unreliability of the monitored systems.

23

24

Common Components

25

26

Some components in a system may be common to more than one train or system, in which case

27

the unavailability/unreliability of a common component is included in all affected trains or

28

systems. (However, see Additional Guidance for Specific Systems for exceptions; for example,

29

the PWR High Pressure Safety Injection System.)

30

31

Short Duration Unavailability

32

33

Trains are generally considered to be available during periodic system or equipment

34

realignments to swap components or flow paths as part of normal operations. Evolutions or

35

surveillance tests that result in less than 15 minutes of unavailable hours per train at a time need

36

not be counted as unavailable hours. Licensees should compile a list of surveillances/evolutions

37

that meet this criterion and have it available for inspector review. In addition, equipment

38

misalignment or mispositioning which is corrected in less than 15 minutes need not be counted

39

as unavailable hours. The intent is to minimize unnecessary burden of data collection,

40

documentation, and verification because these short durations have insignificant risk impact.

41

42

If a licensee is required to take a component out of service for evaluation and corrective actions

43

for greater than 15 minutes (for example, related to a Part 21 Notification), the unavailable hours

44

must be included.

45

46

6

DRAFT NEI 99-02 MSPI 8/28/20028/23/20028/9/2002

Treatment of Demand /Run Failures and Degraded Conditions

1

2

1. Treatment of Demand and Run Failures

3

Failures of active components (see Appendix F) on demand or failures to run, either

4

actual or test, while critical, are included in unreliability. Failures on demand or failures

5

to run at any other timewith the reactor shutdown must be evaluated to determine if the

6

failure would have resulted in the train not being able to perform its risk-significant at

7

power functions, and must therefore be included in unreliability. Unavailable hours are

8

included only for the time required to recover the trains risk-significant functions and

9

only when the reactor is critical.

10

11

2. Treatment of Degraded Conditions

12

13

a) Capable of Being Discovered By Normal Surveillance Tests

14

Normal surveillance tests are those tests that are performed at a frequency of a

15

refueling cycle or more frequently.

16

17

Degraded conditions, even ifwhere no actual demand existed, that render an

18

active component incapable of performing its risk-significant functions are

19

included in unreliability as a demand and a failure. The appropriate failure mode

20

must be accounted for. For example, for valves, a demand and a demand failure

21

would be assumed and included in URI. For pumps and diesels, if the degraded

22

condition would have prevented a successful start demand, a demand and a failure

23

is included in URI, but there would be no run time hours or run failures. If it was

24

determined that the pump/diesel would start and load run, but would fail

25

sometime during the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> run test or its surveillance test equivalent, the

26

evaluated failure time would be included in run hours and a run failure would be

27

assumed. A start demand and start failure would not be included. If a running

28

component is secured from operation due to observed degraded performance, but

29

prior to failure, then a run failure shall be counted unless evaluation of the

30

condition shows that the component would have continued to operate for the risk-

31

significant mission time starting from the time the component was secured.

32

Unavailable hours are included for the time required to recover the risk-

33

significant function(s).

34

35

Degraded conditions, or actual unavailability due to mispositioning of non-active

36

components that render a train incapable of performing its risk-significant

37

functions are only included in unavailability for the time required to recover the

38

risk-significant function(s).

39

40

Loss of risk significant function(s) is assumed to have occurred if the established

41

success criteria has not been met. If subsequent analysis identifies additional

42

margin for the success criterion, future impacts on URI or UAI for degraded

43

conditions may be determined based on the new criterion. However, URI and

44

UAI must be based on the success criteria of record at the time the degraded

45

condition is discovered. If the degraded condition is not addressed by any of the

46

7

DRAFT NEI 99-02 MSPI 8/28/20028/23/20028/9/2002

pre-defined success criteria, an engineering evaluation to determine the impact of

1

the degraded condition on the risk-significant function(s) should be completed

2

and documented. The use of component failure analysis, circuit analysis, or event

3

investigations is acceptable. Engineering judgment may be used in conjunction

4

with analytical techniques to determine the impact of the degraded condition on

5

the risk-significant function. The engineering evaluation should be completed as

6

soon as practicable. If it cannot be completed in time to support submission of the

7

PI report for the current quarter, the comment field shall note that an evaluation is

8

pending. The evaluation must be completed in time to accurately account for

9

unavailability/unreliability in the next quarterly report. Exceptions to this

10

guidance are expected to be rare and will be treated on a case-by-case basis.

11

Licensees should identify these situations to the resident inspector.

12

13

b) Not Capable of Being Discovered by Normal Surveillance Tests

14

These failures or conditions are usually of longer exposure time. Since these

15

failure modes have not been tested on a regular basis, it is inappropriate to include

16

them in the performance index statistics. These failures or conditions are subject

17

to evaluation through the inspection process. Examples of this type are failures

18

due to pressure locking/thermal binding of isolation valves, blockages in lines not

19

regularly tested, or inadequate component sizing/settings under accident

20

conditions (not under normal test conditions). While not included in the

21

calculation of the index, they should be reported in the comment field of the PI

22

data submittal.

23

24

25

Credit for Operator Recovery Actions to Restore the Risk-Significant Function

26

27

1. During testing or operational alignment:

28

Unavailability of a risk-significant function during testing or operational alignment need not

29

be included if the test configuration is automatically overridden by a valid starting signal, or

30

the function can be promptly restored either by an operator in the control room or by a

31

designated operator1 stationed locally for that purpose. Restoration actions must be

32

contained in a written procedure2, must be uncomplicated (a single action or a few simple

33

actions), must be capable of being restored in time to satisfy PRA success criteria and must

34

not require diagnosis or repair. Credit for a designated local operator can be taken only if

35

(s)he is positioned at the proper location throughout the duration of the test for the purpose of

36

restoration of the train should a valid demand occur. The intent of this paragraph is to allow

37

licensees to take credit for restoration actions that are virtually certain to be successful (i.e.,

38

probability nearly equal to 1) during accident conditions.

39

40

1 Operator in this circumstance refers to any plant personnel qualified and designated to perform

the restoration function.

2 Including restoration steps in an approved test procedure.

8

DRAFT NEI 99-02 MSPI 8/28/20028/23/20028/9/2002

The individual performing the restoration function can be the person conducting the test and

1

must be in communication with the control room. Credit can also be taken for an operator in

2

the main control room provided (s)he is in close proximity to restore the equipment when

3

needed. Normal staffing for the test may satisfy the requirement for a dedicated operator,

4

depending on work assignments. In all cases, the staffing must be considered in advance and

5

an operator identified to perform the restoration actions independent of other control room

6

actions that may be required.

7

8

Under stressful, chaotic conditions, otherwise simple multiple actions may not be

9

accomplished with the virtual certainty called for by the guidance (e.g., lifting test leads and

10

landing wires; or clearing tags). In addition, some manual operations of systems designed to

11

operate automatically, such as manually controlling HPCI turbine to establish and control

12

injection flow, are not virtually certain to be successful. These situations should be resolved

13

on a case-by-case basis through the FAQ process.

14

15

2. During Maintenance

16

Unavailability of a risk-significant function during maintenance need not be included if the

17

risk-significant function can be promptly restored either by an operator in the control room or

18

by a designated operator3 stationed locally for that purpose. Restoration actions must be

19

contained in a written procedure4, must be uncomplicated (a single action or a few simple

20

actions), must be capable of being restored in time to satisfy PRA success criteria and must

21

not require diagnosis or repair. Credit for a designated local operator can be taken only if

22

(s)he is positioned at a proper location throughout the duration of the maintenance activity

23

for the purpose of restoration of the train should a valid demand occur. The intent of this

24

paragraph is to allow licensees to take credit for restoration of risk-significant functions that

25

are virtually certain to be successful (i.e., probability nearly equal to 1). The individual

26

performing the restoration function can be the person performing the maintenance and must

27

be in communication with the control room. Credit can also be taken for an operator in the

28

main control room provided (s)he is in close proximity to restore the equipment when

29

needed. Under stressful chaotic conditions otherwise simple multiple actions may not be

30

accomplished with the virtual certainty called for by the guidance (e.g., lifting test leads and

31

landing wires, or clearing tags). These situations should be resolved on a case-by-case basis

32

through the FAQ process.

33

34

3. Satisfying PRA success criteriaRisk Significant Mission Times

35

Risk significant operator actions to satisfy pre-determined train/system risk-significant

36

mission times can only be credited if they are modeled in the PRA.

37

38

Swing trains and components shared between units

39

40

3 Operator in this circumstance refers to any plant personnel qualified and designated to perform the

restoration function.

4 Including restoration steps in an approved test procedure.

9

DRAFT NEI 99-02 MSPI 8/28/20028/23/20028/9/2002

Swing trains/components are trains/components that can be aligned to any unit. To be credited

1

as such, their swing capability should be modeled in the PRA to provide an appropriate Fussell-

2

Vesely value.

3

4

Unit Cross Tie Capability

5

6

Components that cross tie monitored systems between units should be considered active

7

components if they are modeled in the PRA and meet the active component criteria in Appendix

8

F. Such active components are counted in each units performance indicators.

9

10

Maintenance Trains and Installed Spares

11

12

Some power plants have systems with extra trains to allow preventive maintenance to be carried

13

out with the unit at power without impacting the risk-significant function of the system. That is,

14

one of the remaining trains may fail, but the system can still perform its risk significant function.

15

To be a maintenance train, a train must not be needed to perform the systems risk significant

16

function.

17

18

An "installed spare" is a component (or set of components) that is used as a replacement for other

19

equipment to allow for the removal of equipment from service for preventive or corrective

20

maintenance without impacting the risk-significant function of the system. To be an "installed

21

spare," a component must not be needed for the system to perform the risk significant function.

22

23

24

For unreliability, spare active components are included if they are modeled in the PRA.

25

Unavailability of the spare component/train is only counted in the index if the spare is substituted

26

for a primary train/component. Unavailability is not monitored for a component/train when that

27

component/train has been replaced by an installed spare or maintenance train.

28

29

Use of Plant-Specific PRA and SPAR Models

30

31

The MSPI is an approximation using some information from a plants actual PRA and is

32

intended as an indicator of system performance. Plant-specific PRAs and SPAR models cannot

33

be used to question the outcome of the PIs computed in accordance with this guideline.

34

35

Maintenance Rule Performance Monitoring

36

37

It is the intent that NUMARC 93-01 be revised to require consistent unavailability and

38

unreliability data gathering as required by this guideline.

39

40

10

DRAFT NEI 99-02 MSPI 8/28/20028/23/20028/9/2002

ADDITIONAL GUIDANCE FOR SPECIFIC SYSTEMS

1

This guidance provides typical system scopes. Individual plants should include those systems

2

employed at their plant that are necessary to satisfy the specific risk-significant functions

3

described below and reflected in their PRAs.

4

Emergency AC Power Systems

5

Scope

6

The function monitored for the emergency AC power system is the ability of the emergency

7

generators to provide AC power to the class 1E buses upon a loss of off-site power while the

8

reactor is critical, including post-accident conditions. The emergency AC power system is

9

typically comprised of two or more independent emergency generators that provide AC power to

10

class 1E buses following a loss of off-site power. The emergency generator dedicated to

11

providing AC power to the high pressure core spray system in BWRs is not within the scope of

12

emergency AC power.

13

14

The electrical circuit breaker(s) that connect(s) an emergency generator to the class lE buses that

15

are normally served by that emergency generator are considered to be part of the emergency

16

generator train.

17

18

Emergency generators that are not safety grade, or that serve a backup role only (e.g., an

19

alternate AC power source), are not included in the performance reporting.

20

21

Train Determination

22

The number of emergency AC power system trains for a unit is equal to the number of class 1E

23

emergency generators that are available to power safe-shutdown loads in the event of a loss of

24

off-site power for that unit. There are three typical configurations for EDGs at a multi-unit

25

station:

26

27

1. EDGs dedicated to only one unit.

28

2. One or more EDGs are available to swing to either unit

29

3. All EDGs can supply all units

30

31

For configuration 1, the number of trains for a unit is equal to the number of EDGs dedicated to

32

the unit. For configuration 2, the number of trains for a unit is equal to the number of dedicated

33

EDGs for that unit plus the number of swing EDGs available to that unit (i.e., The swing

34

EDGs are included in the train count for each unit). For configuration 3, the number of trains is

35

equal to the number of EDGs.

36

37

Clarifying Notes

38

The emergency diesel generators are not considered to be available during the following portions

39

of periodic surveillance tests unless recovery from the test configuration during accident

40

conditions is virtually certain, as described in Credit for operator recovery actions during

41

11

DRAFT NEI 99-02 MSPI 8/28/20028/23/20028/9/2002

testing, can be satisfied; or the duration of the condition is less than fifteen minutes per train at

1

one time:

2

3

 Load-run testing

4

 Barring

5

6

An EDG is not considered to have failed due to any of the following events:

7

8



spurious operation of a trip that would be bypassed in a loss of offsite power event

9



malfunction of equipment that is not required to operate during a loss of offsite power event

10

(e.g., circuitry used to synchronize the EDG with off-site power sources)

11

 failure to start because a redundant portion of the starting system was intentionally disabled

12

for test purposes, if followed by a successful start with the starting system in its normal

13

alignment

14

Air compressors are not part of the EDG boundary. However, air receivers that provide starting

15

air for the diesel are included in the EDG boundary.

16

17

If an EDG has a dedicated battery independent of the stations normal DC distribution system,

18

the dedicated battery is included in the EDG system boundary.

19

20

If the EDG day tank is not sufficient to meet the EDG mission time, the fuel transfer function

21

should be modeled in the PRA. However, the fuel transfer pumps are not considered to be an

22

active component in the EDG system because they are considered to be a support system.

23

24

25

26

BWR High Pressure Injection Systems

27

(High Pressure Coolant Injection, High Pressure Core Spray, and Feedwater Coolant

28

Injection)

29

30

Scope

31

These systems function at high pressure to maintain reactor coolant inventory and to remove

32

decay heat following a small-break Loss of Coolant Accident (LOCA) event or a loss of main

33

feedwater event.

34

35

The function monitored for the indicator is the ability of the monitored system to take suction

36

from the suppression pool (and from the condensate storage tank, if credited in the plants

37

accident analysis) and inject into the reactor vessel.

38

39

Plants should monitor either the high-pressure coolant injection (HPCI), the high-pressure core

40

spray (HPCS), or the feedwater coolant injection (FWCI) system, whichever is installed. The

41

turbine and governor (or motor-driven FWCI pumps), and associated piping and valves for

42

turbine steam supply and exhaust are within the scope of these systems. Valves in the feedwater

43

line are not considered within the scope of these systems. The emergency generator dedicated to

44

12

DRAFT NEI 99-02 MSPI 8/28/20028/23/20028/9/2002

providing AC power to the high-pressure core spray system is included in the scope of the

1

HPCS. The HPCS system typically includes a "water leg" pump to prevent water hammer in the

2

HPCS piping to the reactor vessel. The "water leg" pump and valves in the "water leg" pump

3

flow path are ancillary components and are not included in the scope of the HPCS system.

4

Unavailability is not included while critical if the system is below steam pressure specified in

5

technical specifications at which the system can be operated.

6

7

Train Determination

8

The HPCI and HPCS systems are considered single-train systems. The booster pump and other

9

small pumps are ancillary components not used in determining the number of trains. The effect

10

of these pumps on system performance is included in the system indicator to the extent their

11

failure detracts from the ability of the system to perform its risk-significant function. For the

12

FWCI system, the number of trains is determined by the number of feedwater pumps. The

13

number of condensate and feedwater booster pumps are not used to determine the number of

14

trains.

15

16

BWR Heat Removal Systems

17

(Reactor Core Isolation Cooling or Isolation Condenser)

18

19

Scope

20

This system functions at high pressure to remove decay heat following a loss of main feedwater

21

event. The RCIC system also functions to maintain reactor coolant inventory following a very

22

small LOCA event.

23

24

The function monitored for the indicator is the ability of the RCIC system to cool the reactor

25

vessel core and provide makeup water by taking a suction from either the condensate storage

26

tank or the suppression pool and injecting at rated pressure and flow into the reactor vessel.

27

28

The Reactor Core Isolation Cooling (RCIC) system turbine, governor, and associated piping and

29

valves for steam supply and exhaust are within the scope of the RCIC system. Valves in the

30

feedwater line are not considered within the scope of the RCIC system. The Isolation Condenser

31

and inlet valves are within the scope of Isolation Condenser system. Unavailability is not

32

included while critical if the system is below steam pressure specified in technical specifications

33

at which the system can be operated.

34

35

36

Train Determination

37

The RCIC system is considered a single-train system. The condensate and vacuum pumps are

38

ancillary components not used in determining the number of trains. The effect of these pumps on

39

RCIC performance is included in the system indicator to the extent that a component failure

40

results in an inability of the system to perform its risk-significant function.

41

13

DRAFT NEI 99-02 MSPI 8/28/20028/23/20028/9/2002

1

BWR Residual Heat Removal Systems

2

Scope

3

The functions monitored for the BWR residual heat removal (RHR) system are the ability of the

4

RHR system to remove heat from the suppression pool, provide low pressure coolant injection,

5

and provide post-accident decay heat removal. The pumps, heat exchangers, and associated

6

piping and valves for those functions are included in the scope of the RHR system.

7

8

Train Determination

9

The number of trains in the RHR system is determined by the number of parallel RHR heat

10

exchangers.

11

12

PWR High Pressure Safety Injection Systems

13

Scope

14

These systems are used primarily to maintain reactor coolant inventory at high pressures

15

following a loss of reactor coolant. HPSI system operation following a small-break LOCA

16

involves transferring an initial supply of water from the refueling water storage tank (RWST) to

17

cold leg piping of the reactor coolant system. Once the RWST inventory is depleted,

18

recirculation of water from the reactor building emergency sump is required. The function

19

monitored for HPSI is the ability of a HPSI train to take a suction from the primary water source

20

(typically, a borated water tank), or from the containment emergency sump, and inject into the

21

reactor coolant system at rated flow and pressure.

22

23

The scope includes the pumps and associated piping and valves from both the refueling water

24

storage tank and from the containment sump to the pumps, and from the pumps into the reactor

25

coolant system piping. For plants where the high-pressure injection pump takes suction from the

26

residual heat removal pumps, the residual heat removal pump discharge header isolation valve to

27

the HPSI pump suction is included in the scope of HPSI system. Some components may be

28

included in the scope of more than one train. For example, cold-leg injection lines may be fed

29

from a common header that is supplied by both HPSI trains. In these cases, the effects of testing

30

or component failures in an injection line should be reported in both trains.

31

32

Train Determination

33

34

In general, the number of HPSI system trains is defined by the number of high head injection

35

paths that provide cold-leg and/or hot-leg injection capability, as applicable.

36

37

For Babcock and Wilcox (B&W) reactors, the design features centrifugal pumps used for high

38

pressure injection (about 2,500 psig) and no hot-leg injection path. Recirculation from the

39

containment sump requires operation of pumps in the residual heat removal system. They are

40

14

DRAFT NEI 99-02 MSPI 8/28/20028/23/20028/9/2002

typically a two-train system, with an installed spare pump (depending on plant-specific design)

1

that can be aligned to either train.

2

3

For two-loop Westinghouse plants, the pumps operate at a lower pressure (about 1600 psig) and

4

there may be a hot-leg injection path in addition to a cold-leg injection path (both are included as

5

a part of the train).

6

7

For Combustion Engineering (CE) plants, the design features three centrifugal pumps that

8

operate at intermediate pressure (about 1300 psig) and provide flow to two cold-leg injection

9

paths or two hot-leg injection paths. In most designs, the HPSI pumps take suction directly from

10

the containment sump for recirculation. In these cases, the sump suction valves are included

11

within the scope of the HPSI system. This is a two-train system (two trains of combined cold-leg

12

and hot-leg injection capability). One of the three pumps is typically an installed spare that can

13

be aligned to either train or only to one of the trains (depending on plant-specific design).

14

15

For Westinghouse three-loop plants, the design features three centrifugal pumps that operate at

16

high pressure (about 2500 psig), a cold-leg injection path through the BIT (with two trains of

17

redundant valves), an alternate cold-leg injection path, and two hot-leg injection paths. One of

18

the pumps is considered an installed spare. Recirculation is provided by taking suction from the

19

RHR pump discharges. A train consists of a pump, the pump suction valves and boron injection

20

tank (BIT) injection line valves electrically associated with the pump, and the associated hot-leg

21

injection path. The alternate cold-leg injection path is required for recirculation, and should be

22

included in the train with which its isolation valve is electrically associated. This represents a

23

two-train HPSI system.

24

25

For Four-loop Westinghouse plants, the design features two centrifugal pumps that operate at

26

high pressure (about 2500 psig), two centrifugal pumps that operate at an intermediate pressure

27

(about 1600 psig), a BIT injection path (with two trains of injection valves), a cold-leg safety

28

injection path, and two hot-leg injection paths. Recirculation is provided by taking suction from

29

the RHR pump discharges. Each of two high pressure trains is comprised of a high pressure

30

centrifugal pump, the pump suction valves and BIT valves that are electrically associated with

31

the pump. Each of two intermediate pressure trains is comprised of the safety injection pump, the

32

suction valves and the hot-leg injection valves electrically associated with the pump. The cold-

33

leg safety injection path can be fed with either safety injection pump, thus it should be associated

34

with both intermediate pressure trains. This HPSI system is considered a four-train system for

35

monitoring purposes.

36

37

38

39

PWR Auxiliary Feedwater Systems

40

Scope

41

The AFW system provides decay heat removal via the steam generators to cool down and

42

depressurize the reactor coolant system following a reactor trip. The AFW system is assumed to

43

be required for an extended period of operation during which the initial supply of water from the

44

condensate storage tank is depleted and water from an alternative water source (e.g., the service

45

water system) is required. Therefore components in the flow paths from both of these water

46

15

DRAFT NEI 99-02 MSPI 8/28/20028/23/20028/9/2002

sources are included; however, the alternative water source (e.g., service water system) is not

1

included.

2

3

The function monitored for the indicator is the ability of the AFW system to take a suction from

4

the primary water source (typically, the condensate storage tank) or, if required, from an

5

emergency source (typically, a lake or river via the service water system) and inject into at least

6

one steam generator at rated flow and pressure.

7

8

The scope of the auxiliary feedwater (AFW) or emergency feedwater (EFW) systems includes

9

the pumps and the components in the flow paths from the condensate storage tank and, if

10

required, the valve(s) that connect the alternative water source to the auxiliary feedwater system.

11

Startup feedwater pumps are not included in the scope of this indicator.

12

13

Train Determination

14

The number of trains is determined primarily by the number of parallel pumps. For example, a

15

system with three pumps is defined as a three-train system, whether it feeds two, three, or four

16

injection lines, and regardless of the flow capacity of the pumps. Some components may be

17

included in the scope of more than one train. For example, one set of flow regulating valves and

18

isolation valves in a three-pump, two-steam generator system are included in the motor-driven

19

pump train with which they are electrically associated, but they are also included (along with the

20

redundant set of valves) in the turbine-driven pump train. In these instances, the effects of testing

21

or failure of the valves should be reported in both affected trains. Similarly, when two trains

22

provide flow to a common header, the effect of isolation or flow regulating valve failures in

23

paths connected to the header should be considered in both trains.

24

25

PWR Residual Heat Removal System

26

Scope

27

The functions monitored for the PWR residual heat removal (RHR) system are those that are

28

required to be available when the reactor is critical. These typically include the low-pressure

29

injection function (if risk-significant) and the post-accident recirculation mode used to cool and

30

recirculate water from the containment sump following depletion of RWST inventory to provide

31

post-accident decay heat removal. The pumps, heat exchangers, and associated piping and valves

32

for those functions are included in the scope of the RHR system. Containment spray function

33

should be included if it is identified in the PRA as a risk-significant post accident decay heat

34

removal function. Containment spray systems that only provide containment pressure control are

35

not included.

36

37

38

39

Train Determination

40

The number of trains in the RHR system is determined by the number of parallel RHR heat

41

exchangers. Some components are used to provide more than one function of RHR. If a

42

component cannot perform as designed, rendering its associated train incapable of meeting one

43

16

DRAFT NEI 99-02 MSPI 8/28/20028/23/20028/9/2002

of the risk-significant functions, then the train is considered to be failed. Unavailable hours

1

would be reported as a result of the component failure.

2

Cooling Water Support System

3

Scope

4

The function of the cooling water support system is to provide for direct cooling of the

5

components in the other monitored systems. It does not include indirect cooling provided by

6

room coolers or other HVAC features.

7

8

Systems that provide this function typically include service water and component cooling water

9

or their cooling water equivalents. Pumps, valves, heat exchangers and line segments that are

10

necessary to provide cooling to the other monitored systems are included in the system scope up

11

to, but not including, the last valve that connects the cooling water support system to the other

12

monitored systems. This last valve is included in the other monitored system boundary.

13

14

Valves in the cooling water support system that must close to ensure sufficient cooling to the

15

other monitored system components to meet risk significant functions are included in the system

16

boundary.

17

18

19

20

Train Determination

21

The number of trains in the Cooling Water Support System will vary considerably from plant to

22

plant. The way these functions are modeled in the plant-specific PRA will determine a logical

23

approach for train determination. For example, if the PRA modeled separate pump and line

24

segments, then the number of pumps and line segments would be the number of trains.

25

26

Clarifying Notes

27

Service water pump strainers and traveling screens are not considered to be active components

28

and are therefore not part of URI. However, clogging of strainers and screens due to expected or

29

routinely predictable environmental conditions that render the train unavailable to perform its

30

risk significant cooling function (which includes the risk-significant mission times)are included

31

in UAI.

32

33

Unpredictable extreme environmental conditions that render the train unavailable to perform its

34

risk significant cooling function should be addressed through the FAQ process to determine if

35

resulting unavailability should be included in UAI.

36

37

Attachment 2

RIS 2002-14

NEI 99-02, Appendix F, Methodologies For Computing the Unavailability Index, the

Unreliability Index and Determining Performance Index Validity (Draft).

DRAFT NEI 99-02 MSPI 8/28/20028/23/20028/9/2002

F-1

APPENDIX F

1

2

METHODOLOGIES FOR COMPUTING THE UNAVAILABILITY

3

INDEX, THE UNRELIABILITY INDEX AND DETERMINING

4

PERFORMANCE INDEX VALIDITY

5

This appendix provides the details of three calculations, calculation of the System

6

Unavailability Index, the System Unreliability Index, and the criteria for determining

7

when the Mitigating System Performance Index is unsuitable for use as a performance

8

index.

9

System Unavailability Index (UAI) Due to Changes in Train Unavailability

10

Calculation of System UAI due to changes in train unavailability is as follows:

11

UAI

UAItj

j
1

n

Eq. 1

12

where the summation is over the number of trains (n) and UAIt is the unavailability index

13

for a train.

14

Calculation of UAIt for each train due to changes in train unavailability is as follows:

15

)

(

max

BLt

t

p

UAp

p

t

UA

UA

UA

FV

CDF

UAI











,

Eq. 2

16

where:

17

CDFp is the plant-specific, internal events, at power Core Damage Frequency,

18

FVUAp is the train-specific Fussell-Vesely value for unavailability,

19

UAP is the plant-specific PRA value of unavailability for the train,

20

UAt is the actual unavailability of train t, defined as:

21

quarters

12

previous

the

during

hours

Critical

critical

while

quarters

12

previous

the

during

hours

e

Unavailabl

t

UA

22

and,

23

UABLt is the historical baseline unavailability value for the train determined

24

as described below.

25

UABLt is the sum of two elements: planned and unplanned unavailability. Planned

26

unavailability is the actual, plant-specific three-year total planned unavailability

27

for the train for the years 1999 through 2001 (see clarifying notes for details).

28

This period is chosen as the most representative of how the plant intends to

29

perform routine maintenance and surveillances at power. Unplanned

30

unavailability is the historical industry average for unplanned unavailability for

31

DRAFT NEI 99-02 MSPI 8/28/20028/23/20028/9/2002

F-2

the years 1999 through 2001. See Table 1 for historical train values for

1

unplanned unavailability.

2

Calculation of the quantity inside the square bracket in equation 2 will be discussed at the

3

end of the next section. See clarifying notes for calculation of UAI for cooling water

4

support system.

5

6

System Unreliability Index (URI) Due to Changes in Component Unreliability

7

Unreliability is monitored at the component level and calculated at the system level.

8

Calculation of system URI due to changes in component unreliability is as follows:

9

)

(

1

max

BLcj

Bcj

m

j

pcj

URcj

p

UR

UR

UR

FV

CDF

URI











Eq. 3

10

Where the summation is over the number of active components (m) in the system, and:

11

CDFp is the plant-specific internal events, at power, core damage frequency,

12

FVURc is the component-specific Fussell-Vesely value for unreliability,

13

URPc is the plant-specific PRA value of component unreliability,

14

URBc is the Bayesian corrected component unreliability for the previous 12

15

quarters,

16

and

17

URBLc is the historical industry baseline calculated from unreliability mean values

18

for each monitored component in the system. The calculation is performed in a

19

manner similar to equation 4 below using the industry average values in Table 2.

20

Calculation of the quantity inside the square bracket in equation 3 will be discussed at the

21

end of this section.

22

Component unreliability is calculated as follows.

23

URBc
PD 
Tm

Eq 4

24

where:

25

PD is the component failure on demand probability calculated based on data

26

collected during the previous 12 quarters,

27

is the component failure rate (per hour) for failure to run calculated based on

28

data collected during the previous 12 quarters,

29

and

30

Tm is the risk-significant mission time for the component based on plant specific

31

PRA model assumptions. Add acceptable methodologies for determining mission

32

time.

33

34

DRAFT NEI 99-02 MSPI 8/28/20028/23/20028/9/2002

F-3

NOTE:

1

For valves only the PD term applies

2

For pumps PD +
Tm applies

3

For diesels PD start + PD load run +
Tm applies

4

5

The first term on the right side of equation 4 is calculated as follows.1

6

PD

(Nd  a)

(a  b  D)

Eq. 5

7

where:

8

Nd is the total number of failures on demand during the previous 12 quarters,

9

D is the total number of demands during the previous 12 quarters (actual ESF

10

demands plus estimated test and estimated operational/alignment demands. An

11

update to the estimated demands is required if a change to the basis for the

12

estimated demands results in a >25% change in the estimate),

13

and

14

a and b are parameters of the industry prior, derived from industry experience (see

15

Table 2).

16

In the calculation of equation 5 the numbers of demands and failures is the sum of all

17

demands and failures for similar components within each system. Do not sum across

18

units for a multi-unit plant. For example, for a plant with two trains of Emergency Diesel

19

Generators, the demands and failures for both trains would be added together for one

20

evaluation of PD which would be used for both trains of EDGs.

21

In the second term on the right side of equation 4,
is calculated as follows.

22

(Nr  a)

(Tr  b)

Eq. 6

23

where:

24

Nr is the total number of failures to run during the previous 12 quarters,

25

Tr is the total number of run hours during the previous 12 quarters (actual ESF run

26

hours plus estimated test and estimated operational/alignment run hours. An

27

update to the estimated run hours is required if a change to the basis for the

28

estimated hours results in a >25% change in the estimate).

29

and

30

1 Atwood, Corwin L., Constrained noninformative priors in risk assessment, Reliability

Engineering and System Safety, 53 (1996; 37-46)

DRAFT NEI 99-02 MSPI 8/28/20028/23/20028/9/2002

F-4

a and b are parameters of the industry prior, derived from industry experience (see

1

Table 2).

2

In the calculation of equation 6 the numbers of demands and run hours is the sum of all

3

run hours and failures for similar components within each system. Do not sum across

4

units for a multi-unit plant. For example, a plant with two trains of Emergency Diesel

5

Generators, the run hours and failures for both trains would be added together for one

6

evaluation of
which would be used for both trains of EDGs.

7

Fussell-Vesely, Unavailability and Unreliability

8

Equations 2 and 3 include a term that is the ratio of a Fussell-Vesely importance value

9

divided by the related unreliability or unavailability. Calculation of these quantities is

10

generally complex, but in the specific application used here, can be greatly simplified.

11

The simplifying feature of this application is that only those components (or the

12

associated basic events) that can fail a train are included in the performance index.

13

Components within a train that can each fail the train are logically equivalent and the

14

ratio FV/UR is a constant value for any basic event in that train. It can also be shown that

15

for a given component or train represented by multiple basic events, the ratio of the two

16

values for the component or train is equal to the ratio of values for any basic event within

17

the train. Or:

18

FVbe

URbe
FVURc

URPc
FVt

URt
Constant

19

and

20

FVbe

UAbe
FVUAp

UAp
Constant

21

Note that the constant value may be different for the unreliability ratio and the

22

unavailability ratio because the two types of events are frequently not logically

23

equivalent. For example recovery actions may be modeled in the PRA for one but not the

24

other.

25

Thus, the process for determining the value of this ratio for any component or train is to

26

identify a basic event that fails the component or train, determine the failure probability

27

or unavailability for the event, determine the associated FV value for the event and then

28

calculate the ratio. Use the basic event in the component or train with the largest failure

29

probability (hence the maximum notation on the bracket) to minimize the effects of

30

truncation on the calculation. Exclude common cause events, which are not within the

31

scope of this performance index

32

Some systems have multiple modes of operation, such as PWR HPSI systems that operate

33

in injection as well as recirculation modes. In these systems all active components are not

34

logically equivalent, unavailability of the pump fails all operating modes while

35

unavailability of the sump suction valves only fails the recirculation mode. In cases such

36

DRAFT NEI 99-02 MSPI 8/28/20028/23/20028/9/2002

F-5

as these, if unavailability events exist separately for the components within a train, the

1

appropriate ratio to use is the maximum.

2

Determination of systems for which the performance index is not valid

3

The performance index relies on the existing testing programs as the source of the data

4

that is input to the calculations. Thus, the number of demands in the monitoring period is

5

based on the frequency of testing required by the current test programs. In most cases this

6

will provide a sufficient number of demands to result in a valid statistical result.

7

However, in some cases, the number of demands will be insufficient to resolve the

8

change in the performance index (1.0x10-6) that corresponds to movement from a green

9

performance to a white performance level. In these cases, one failure is the difference

10

between baseline performance and performance in the white performance band. The

11

performance index is not suitable for monitoring such systems and monitoring is

12

performed through the inspection process.

13

This section will define the method to be used to identify systems for which the

14

performance index is not valid, and will not be used.

15

The criteria to be used to identify an invalid performance index is:

16

If, for any failure mode for any component in a system, the risk increase

17

(CDF) associated with the change in unreliability resulting from single

18

failure is larger than 1.0x10-6, then the performance index will be

19

considered invalid for that system.

20

The increase in risk associated with a component failure is the sum of the contribution

21

from the decrease in calculated reliability as a result of the failure and the decrease in

22

availability resulting from the time required to affect the repair of the failed component.

23

The change in CDF that results from a demand type failure is given by:

24

25

CR

Mean

p

UAp

p

comp

similar

N

pc

URc

p

T

T

UA

FV

CDF

D

b

a

UR

FV

CDF

MSPI

Repair

1











Eq. 7

26

27

Likewise, the change in CDF per run type failure is given by:

28

29

CR

p

UAp

p

comp

similar

N

r

m

pc

URc

p

T

T

UA

FV

CDF

T

b

T

UR

FV

CDF

MSPI

Repair

Mean









Eq. 8

30

DRAFT NEI 99-02 MSPI 8/28/20028/23/20028/9/2002

F-6

In these expressions, the variables are as defined earlier and additionally

1

TMR is the mean time to repair for the component

2

and

3

TCR is the number of critical hours in the monitoring period.

4

The summation in the equations is taken over all similar components within a system.

5

With multiple components of a given type in one system, the impact of the failure on

6

CDF is included in the increased unavailability of all components of that type due to

7

pooling the demand and failure data.

8

The mean time to repair can be estimate as one-half the Technical Specification Allowed

9

Outage Time for the component and the number of critical hours should correspond to the

10

1999 - 2001 actual number of critical hours.

11

These equations are be used for all failure modes for each component in a system. If the

12

resulting value of CDF is greater than 1.0x10-6 for any failure mode of any component,

13

then the performance index for that system is not considered valid.

14

15

Definitions

16

17

Train Unavailability: Train unavailability is the ratio of the hours the train was

18

unavailable to perform its risk-significant functions due to planned or unplanned

19

maintenance or test during the previous 12 quarters while critical to the number of critical

20

hours during the previous 12 quarters. (Fault exposure hours are not included;

21

unavailable hours are counted only for the time required to recover the trains risk-

22

significant functions.)

23

Train unavailable hours: The hours the train was not able to perform its risk significant

24

function due to maintenance, testing, equipment modification, electively removed from

25

service, corrective maintenance, or the elapsed time between the discovery and the

26

restoration to service of an equipment failure or human error that makes the train

27

unavailable (such as a misalignment) while the reactor is critical.

28

Fussell-Vesely (FV) Importance:

29

The Fussell-Vesely importance for a feature (component, sub-system, train, etc.) of a

30

system is representative of the fractional contribution that feature makes to the to the total

31

risk of the system.

32

The Fussell-Vesely importance of a basic event or group of basic events that represent a

33

feature of a system is represented by:

34

0

1

R

R

FV

i



35

DRAFT NEI 99-02 MSPI 8/28/20028/23/20028/9/2002

F-7

Where:

1

R0 is the base (reference) case overall model risk,

2

Ri is the decreased risk level with feature i completely reliable.

3

In this expression, the second term on the right represents the fraction of the reference

4

risk remaining assuming the feature of interest is perfect. Thus 1 minus the second term is

5

the fraction of the reference risk attributed to the feature of interest.

6

The Fussell-Vesely importance is calculated according to the following equation:

7

m

j

j

n

j

j

i

C

C

FV

,1

0

,1

1



,

8

where the denominator represents the union of m minimal cutsets C0 generated with the

9

reference (baseline) model, and the numerator represents the union of n minimal cutsets

10

Ci generated assuming events related to the feature are perfectly reliable, or their failure

11

probability is False.

12

Critical hours: The number of hours the reactor was critical during a specified period of

13

time.

14

Component Unreliability: Component unreliability is the probability that the component

15

would not perform its risk-significant functions when called upon during the previous 12

16

quarters.

17

Active Component: A component whose failure to change state renders the train incapable

18

of performing its risk-significant functions. In addition, all pumps and diesels in the

19

monitored systems are included as active components. (See clarifying notes.)

20

Manual Valve: A valve that can only be operated by a person. An MOV or AOV that is

21

remotely operated by a person may be an active component.

22

Start demand: Any demand for the component to successfully start to perform its risk-

23

significant functions, actual or test. (Exclude post maintenance tests, unless in case of a

24

failure the cause of failure was independent of the maintenance performed.)

25

Post maintenance tests: Tests performed following maintenance but prior to declaring the

26

train/component operable, consistent with Maintenance Rule implementation.

27

Run demand: Any demand for the component, given that it has successfully started, to

28

run/operate for its mission time to perform its risk-significant functions. (Exclude post

29

maintenance tests, unless in case of a failure the cause of failure was independent of the

30

maintenance performed.)

31

EDG failure to start: A failure to start includes those failures up to the point the EDG has

32

achieved rated speed and voltage. (Exclude post maintenance tests, unless the cause of

33

failure was independent of the maintenance performed.)

34

DRAFT NEI 99-02 MSPI 8/28/20028/23/20028/9/2002

F-8

EDG failure to load/run: Given that it has successfully started, a failure of the EDG

1

output breaker to close, loads successfully sequence and to run/operate for one hour to

2

perform its risk-significant functions. This failure mode is treated as a demand failure for

3

calculation purposes. (Exclude post maintenance tests, unless the cause of failure was

4

independent of the maintenance performed.)

5

EDG failure to run: Given that it has successfully started and loaded and run for an hour,

6

a failure of an EDG to run/operate. for its mission time to perform its risk-significant

7

functions. (Exclude post maintenance tests, unless the cause of failure was independent of

8

the maintenance performed.)

9

Pump failure on demand: A failure to start and run for at least one hour is counted as

10

failure on demand. (Exclude post maintenance tests, unless the cause of failure was

11

independent of the maintenance performed.)

12

Pump failure to run: Given that it has successfully started and run for an hour, a failure of

13

a pump to run/operate. for its mission time to perform its risk-significant functions.

14

(Exclude post maintenance tests, unless the cause of failure was independent of the

15

maintenance performed.)

16

Valve failure on demand: A failure to open or close is counted as failure on demand.

17

(Exclude post maintenance tests, unless the cause of failure was independent of the

18

maintenance performed.)

19

Clarifying Notes

20

Train Boundaries and Unavailable Hours

21

Include all components that are required to satisfy the risk-significant function of the

22

train. For example, high-pressure injection may have both an injection mode with

23

suction from the refueling water storage tank and a recirculation mode with suction from

24

the containment sump. Some components may be included in the scope of more than one

25

train. For example, one set of flow regulating valves and isolation valves in a three-pump,

26

two-steam generator system are included in the motor-driven pump train with which they

27

are electrically associated, but they are also included (along with the redundant set of

28

valves) in the turbine-driven pump train. In these instances, the effects of unavailability

29

of the valves should be reported in both affected trains. Similarly, when two trains

30

provide flow to a common header, the effect of isolation or flow regulating valve failures

31

in paths connected to the header should be considered in both trains

32

Cooling Water Support System Trains

33

The number of trains in the Cooling Water Support System will vary considerably from

34

plant to plant. The way these functions are modeled in the plant-specific PRA will

35

determine a logical approach for train determination. For example, if the PRA modeled

36

separate pump and line segments, then the number of pumps and line segments would be

37

the number of trains. A separate value for UAI and URI will be calculated for each of the

38

systems in this indicator and then they will be added together to calculate the MSPI.

39

DRAFT NEI 99-02 MSPI 8/28/20028/23/20028/9/2002

F-9

1

Active Components

2

For unreliability, use the following criteria for determining those components that should

3

be monitored:

4

 Components that are normally running or have to change state to achieve the risk

5

significant function will be included in the performance index. Active failures of

6

check valves and manual valves are excluded from the performance index and will be

7

evaluated in the NRC inspection program.

8

 Redundant valves within a train are not included in the performance index. Only

9

those valves whose failure alone can fail a train will be included. The PRA success

10

criteria are to be used to identify these valves.

11

 Redundant valves within a multi-train system, whether in series or parallel, where the

12

failure of both valves would prevent all trains in the system from performing a risk-

13

significant function are included. (See Figure F-5)

14

 All pumps and diesels are included in the performance index

15

Table 3 defines the boundaries of components, and Figures F-1, F-2, F-3 and F-4 provide

16

examples of typical component boundaries as described in Table 3. Each plant will

17

determine their system boundaries, active components, and support components, and

18

have them available for NRC inspection.

19

Failures of Non-Active Components

20

Failures of SSCs that are not included in the performance index will not be counted as a

21

failure or a demand. Failures of SSCs that cause an SSC within the scope of the

22

performance index to fail will not be counted as a failure or demand. An example could

23

be a manual suction isolation valve left closed which causes a pump to fail. This would

24

not be counted as a failure of the pump. Any mispositioning of the valve that caused the

25

train to be unavailable would be counted as unavailability from the time of discovery.

26

The significance of the mispositioned valve prior to discovery would be addressed

27

through the inspection process.

28

29

Baseline Values

30

The baseline values for unreliability are contained in Table 2 and remain fixed.

31

The baseline values for unavailability include both plant-specific planned unavailability

32

values and unplanned unavailability values. The unplanned unavailability values are

33

contained in Table 1 and remain fixed. They are based on ROP PI industry data from

34

1999 through 2001. (Most baseline data used in PIs come from the 1995-1997 time

35

period. However, in this case, the 1999-2001 ROP data are preferable, because the ROP

36

data breaks out systems separately (some of the industry 1995-1997 INPO data combine

37

DRAFT NEI 99-02 MSPI 8/28/20028/23/20028/9/2002

F-10

systems, such as HPCI and RCIC, and do not include PWR RHR). It is important to note

1

that the data for the two periods is very similar.)

2

Support cooling baseline data is based on plant specific maintenance rule unplanned and

3

planned unavailability for years 1999 to 2001. (Maintenance rule data does not

4

distinguish between planned and unplanned unavailability. There is no ROP support

5

cooling data.)

6

The baseline planned unavailability is based on actual plant-specific values for the period

7

1999 through 2001. These values are expected to remain fixed unless the plant

8

maintenance philosophy is substantially changed with respect to on-line maintenance or

9

preventive maintenance. In these cases, the planned unavailability baseline value can be

10

adjusted. A comment should be placed in the comment field of the quarterly report to

11

identify a substantial change in planned unavailability. To determine the planned

12

unavailability:

13

1. Record the total train unavailable hours reported under the Reactor Oversight Process

14

for 1999 through 2001.

15

2. Subtract any fault exposure hours still included in the 1999-2001 period.

16

3. Subtract unplanned unavailable hours

17

4. Add any on-line overhaul hours and any other planned unavailability excluded in

18

accordance with NEI 99-02. 2

19

5. Add any planned unavailable hours for functions monitored under MSPI which were

20

not monitored under SSU in NEI 99-02.

21

6. Subtract any unavailable hours reported when the reactor was not critical.

22

7. Subtract hours cascaded onto monitored systems by support systems.

23

8. Divide the hours derived from steps 1-6 above by the total critical hours during 1999-

24

2001. This is the baseline planned unavailability

25

Baseline unavailability is the sum of planned unavailability from step 7 and unplanned

26

unavailability from Table 1.

27

28

29

2 Note: The plant-specific PRA should model significant on-line overhaul hours.

DRAFT NEI 99-02 MSPI 8/28/20028/23/20028/9/2002

F-11

Table 1. Historical Unplanned Maintenance Unavailability Train Values

1

(Based on ROP Industrywide Data for 1999 through 2001)

2

3

4

SYSTEM

UNPLANNED UNAVAILABILITY/TRAIN

EAC

1.7 E-03

PWR HPSI

6.1 E-04

PWR AFW (TD)

9.1 E-04

PWR AFW (MD)

6.9 E-04

PWR AFW (DieselD)

7.6 E-04

PWR (except CE) RHR

4.2 E-04

CE RHR

1.1 E-03

BWR HPCI

3.3 E-03

BWR HPCS

5.4 E-04

BWR RCIC

2.9 E-03

BWR RHR

1.2 E-03

Support Cooling

No Data Available Use plant specific Maintenance

Rule data for 1999-2001

5

DRAFT NEI 99-02 MSPI 8/28/20028/23/20028/9/2002

F-12

Table 2. Industry Priors and Parameters for Unreliability

1

2

3

Component

Failure

Mode

a a

b a

Industry

Mean

Value b

Source(s)

Motor-operated

valve

Fail to open

(or close)

5.0E-1

2.4E+2

2.1E-3

NUREG/CR-5500, Vol.

4,7,8,9

Air-operated

valve

Fail to open

(or close)

5.0E-1

2.5E+2

2.0E-3

NUREG/CR-4550, Vol. 1

Fail to start

5.0E-1

2.4E+2

2.1E-3

NUREG/CR-5500, Vol.

1,8,9

Motor-driven

pump, standby

Fail to run

5.0E-1

5.0E+3h

1.0E-4/h

NUREG/CR-5500, Vol.

1,8,9

Fail to start

4.9E-1

1.6E+2

3.0E-3

NUREG/CR-4550, Vol. 1

Motor-driven

pump, running

or alternating

Fail to run

5.0E-1

1.7E+4h

3.0E-5/h

NUREG/CR-4550, Vol. 1

Fail to start

4.7E-1

2.4E+1

1.9E-2

NUREG/CR-5500, Vol. 1

Turbine-driven

pump, AFWS

Fail to run

5.0E-1

3.1E+2

1.6E-3/h

NUREG/CR-5500, Vol. 1

Fail to start

4.6E-1

1.7E+1

2.7E-2

NUREG/CR-5500, Vol.

4,7

Turbine-driven

pump, HPCI or

RCIC

Fail to run

5.0E-1

3.1E+2h

1.6E-3/h

NUREG/CR-5500, Vol.

1,4,7

Fail to start

4.7E-1

2.4E+1

1.9E-2

NUREG/CR-5500, Vol. 1

Diesel-driven

pump, AFWS

Fail to run

5.0E-1

6.3E+2h

8.0E-4/h

NUREG/CR-4550, Vol. 1

Fail to start

4.8E-1

4.3E+1

1.1E-2

NUREG/CR-5500, Vol. 5

Fail to

load/run

5.0E-1

2.9E+2

1.7E-3 c

NUREG/CR-5500, Vol. 5

Emergency

diesel generator

Fail to run

5.0E-1

2.2E+3h

2.3E-4/h

NUREG/CR-5500, Vol. 5

4

5

DRAFT NEI 99-02 MSPI 8/28/20028/23/20028/9/2002

F-13

a. A constrained, non-informative prior is assumed. For failure to run events, a = 0.5 and

1

b = (a)/(mean rate). For failure upon demand events, a is a function of the mean

2

probability:

3

4

Mean Probability

a

5

0.0 to 0.0025

0.50

6

>0.0025 to 0.010

0.49

7

>0.010 to 0.016

0.48

8

>0.016 to 0.023

0.47

9

>0.023 to 0.027

0.46

10

11

Then b = (a)(1.0 - mean probability)/(mean probability).

12

13

b. Failure to run events occurring within the first hour of operation are included within

14

the fail to start failure mode. Failure to run events occurring after the first hour of

15

operation are included within the fail to run failure mode. Unless otherwise noted, the

16

mean failure probabilities and rates include the probability of non-recovery. Types of

17

allowable recovery are outlined in the clarifying notes, under Credit for Recovery

18

Actions.

19

20

c. Fail to load and run for one hour was calculated from the failure to run data in the

21

report indicated. The failure rate for 0.0 to 0.5 hour5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> (3.3E-3/h) multiplied by 0.5 hour5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />,

22

was added to the failure rate for 0.5 to 14 hours1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br /> (2.3E-4/h) multiplied by 0.5 hour5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

23

DRAFT NEI 99-02 MSPI 8/28/20028/23/20028/9/2002

F-14

Table 3. Component Boundary Definition

Component

Component boundary

Diesel

Generators

The diesel generator boundary includes the generator body, generator

actuator, lubrication system (local), fuel system (local), cooling components

(local), startup air system receiver, exhaust and combustion air system,

dedicated diesel battery (which is not part of the normal DC distribution

system), individual diesel generator control system, circuit breaker for supply

to safeguard buses and their associated local control circuit (coil, auxiliary

contacts, wiring and control circuit contacts, and breaker closure interlocks) .

Motor-Driven

Pumps

The pump boundary includes the pump body, motor/actuator, lubrication

system cooling components of the pump seals, the voltage supply breaker,

and its associated local control circuit (coil, auxiliary contacts, wiring and

control circuit contacts).

Turbine-

Driven Pumps

The turbine-driven pump boundary includes the pump body, turbine/actuator,

lubrication system (including pump), extractions, turbo-pump seal, cooling

components, and local turbine control system (speed).

Motor-

Operated

Valves

The valve boundary inc1udes the valve body, motor/actuator, the voltage

supply breaker (both motive and control power) and its associated local

open/close circuit (open/close switches, auxiliary and switch contacts, and

wiring and switch energization contacts).

Air-Operated

Valves

The valve boundary includes the valve body, the air operator, associated

solenoid-operated valve, the power supply breaker or fuse for the solenoid

valve, and its associated control circuit (open/close switches and local

auxiliary and switch contacts).

1

DRAFT NEI 99-02 MSPI 8/28/20028/23/20028/9/2002

F-15

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

Figure F-1

23

Diesel Engine

Control and

Protection System

Starting Air

System Receiver

Combustion Air

System and

Supply

Jacket

Water

Fuel Oil

System

Fuel Oil Day

Tank

Generator

Exciter and

Voltage

Regulator

Exhaust

System

Governor and

Control System

Lubrication

System

EDG

Breaker

ESFAS/Sequencer

DC Power

Cooling Water

Class 1E Bus

EDG Boundary

Isol.

Valve

Fuel Storage and

Transfer System

DRAFT NEI 99-02 MSPI 8/28/20028/23/20028/9/2002

F-16

1

2

Figure F-2

3

4

5

Controls

Breaker

Motor Operator

Motor Driven Pump Boundary

Pump

ESFAS

DRAFT NEI 99-02 MSPI 8/28/20028/23/20028/9/2002

F-17

Figure F-3

1

2

Controls

Breaker

Motor Operator

MOV Boundary

ESFAS

DRAFT NEI 99-02 MSPI 8/28/20028/23/20028/9/2002

F-18

1

2

Figure F-4

3

4

Controls

Turbine

Turbine Driven Pump Boundary

Pump

ESFAS

DRAFT NEI 99-02 MSPI 8/28/20028/23/20028/9/2002

F-19

1

T

A

N

K

Figure F-5

Active

Components

Active

Components

Non-active

Components