ML14058A057
| ML14058A057 | |
| Person / Time | |
|---|---|
| Site: | Oconee  |
| Issue date: | 02/19/2010 |
| From: | Mitman J T Office of Nuclear Reactor Regulation |
| To: | James L M Office of Nuclear Reactor Regulation |
| Shared Package | |
| ML14055A421 | List:
|
| References | |
| FOIA/PA-2012-0325 | |
| Download: ML14058A057 (14) | |
Text
v.Mitman, JeffreyFrom:Sent:To:
Subject:
Attachments:
Mitman, Jeffrey Y'" i4 .Friday, February 19, 2J106:07 PMJames, LoisRE: ACTION: please provide BC with latest version of the Oconee Risk Comparison paper byCOB 2/19/10OFI -Delta Risk Assessment of Planned Mods(3).doc; Assessment of Planned Mods toOconee.doc Lois, here are the latest version of the delta risk documents.
JeffFrom: James, Lois ,Sent: Friday, February 19, 2010 10:58 AMTO: Mitman, Jeffrey
Subject:
ACTION: please provide BC with latest version of the Oconee Risk Comparison paper by COB 2/19/10Jeff,Please provide me with the latest version of the Oconee Risk Comparison paper that you have beenreviewing/working with Walt Rogers. I am not sure it this will come up next week, but I would like to have it justin case.Lois1 OFI -Delta Risk Assessment of Planned Mods(3).doc OFIItUS-*Y
-C Rt-AT' -WTIONAssessment of Planned Modifications to Oconee's Risk ProfileExecutive SummaryDuke Power Company has recently initiated several modifications to the Oconee Nuclear Site(ONS) to decrease the risk profile of the site. The purpose of this review is to characterize the riskbenefits of these planned modifications and to contrast them with the potential risk benefit fromincreasing the flood protection of the shutdown facility (SSF) on the ONS. The analysis wasperformed using the Oconee SPAR model. The modifications considered include:* Additional SSF protection against external floods* Additional tornado missile protection for:o main control room (MCR)o west penetration roomo borated water storage tank (BWST) partial protection
- Additional internal events protection, by adding:o protected service water pump (PSW) for secondary side heat removalo main steam isolation valves (MSIV)" Additional high energy line break (HELB) protection from PSW and MSIVs for:" main feedwater (MFW)o auxiliary steam lineo main steam line (MSL) breaks" Additional fire protection from PSW and MSIVs for:o turbine generator o MFWAs indicated by the above list of modifications, the new PSW system will have risk loweringbenefits from internal events (e.g., turbine trips and steam generator tube ruptures) but it will alsolower the risk from HELBs and fires. Likewise, the new MSIVs will lower risk not only frominternal events but also from HELBs and fires.The risk reductions from these modifications can be compared to the risk reduction fromincreasing the flood protection of the SSF from a Jocassee Dam failure and other external floods.These valves are summarized in Table. 1 below. The details on the derivation of these values aregiven in the subsequent discussion.
Table IRisk Comparison of ONS Modifications Estimated RiskModification Reduction (delta CDF per year)Increase SSF Flood Protection 1.5E-4Total of Currently PlannedModification (sum of values below) 8.1E-5Tornado 6.8E-6Internal Events 1.4E-5HELB 1.OE-5Fire 5.OE-51 of 9 OFI -Delta Risk Assessment of Planned Mods(3).doc Discussion of Probabilities SSFThe SSF protects the ONS units from several different initiating events. However, the event ofinterest in this analysis is a flooding event which incapacitates the onsite and offsite AC electrical power systems and the turbine-driven auxiliary feedwater system (TDAFW).
The most likelycause of this flood is a Jocassee Dam failure.
The SSF is capable of cooling the core bymaintaining sufficient water on the secondary side of the once-through steam generators (OTSGs).
- However, if the flood waters rise above the flood-wall surrounding the SSF, it too willfail. Currently, the flood wall will protect the SSF to a flood depth of 7.5 feet above site groundelevation.
The risk from a flood can be expressed as:CDFf = IEFfX CCDPf (eq. 1-1)Where:CDFf = core damage frequency from floodIEFf = initiating event frequency of floodCCDPf = conditional core damage probability given a floodThe CCDPI can be expressed as the sum of the probability of failure of the SSF from the floodovertopping the SSF flood wall and probability of the SSF failing from all other causes or:CCDPf= Pfp+Po (eq. 1-2)Where:Pfp = probability of failure of SSF due to failure of SSF floodprotection P. = probability of failure of SSF from all other causesBased on the Duke's only inundation study of record for the Jocassee Dam', the probability of aJocassee Dam failure overtopping the SSF floodwall is 1.0. This inundation study gives anestimated flood height between 12.5 and 16.8 feet at the ONS from a random sunny day failureand a random failure combined with a probable maximum participation respectively.
The DukeIndividual Plant Examination for External Events (IPEEE) estimates the probability of failure forthe SSF from all other causes Ps 0.27 .Thus the above calculations become:CCDPf = Pl, + P. (eq. 1-3)Where:PfP= 1.0P0 = 0.27CCDPf= 1.0+0.27'"Jocassee Hydro Project Dam Failure Inundation Study," December, 1992.2 Duke Power Company, "IPEEE Submittal,"
December 21, 1995. The quantified probability isdue mostly to human errors arising from several manual operator actions that need to becompleted in order for the SSF to be successful to Mode 3.2 of 9 OFI -Delta Risk Assessment of Planned Mods(3).doc
- However, probabilities are always in the range of 0.0 to 1.0. Therefore, the CCDPf can be nogreater than 1.0. Thus:CCDPf = 1.0 (eq. 1-4) -To calculate the core damage frequency from a flood, we need to determine the initiating eventfrequency of a flood event using Equation 1-1 above. The NRC staff has estimated the failureprobability of the Jocassee Dam as 2.OE-4 per year. The analyst assumed that there are noother significant contributors to the total flood frequency other than the Jocassee Dam failure.Restating Equation 1-1 and substituting in the now known values, the core damage frequency isfound:CDFf IEFfX CCDPf (eq. 1-1)Where:IEFf 2.OE-4 per yearCCDP= 1.0Or:CDFr = 2.OE-4 X 1.0= 2.OE-4 per yearTo calculate the change (delta) in risk from a modification which improves the flood resistance capability of the SSF, we must determine the new core damage frequency from a modified SSF.This change is risk is expressed as:ACDF = CDFi- CDFm (eq. 1-5)Where:CDFm = IEFm X CCDPm (eq. 1-6)Where the subscript "m" stands for the modified SSF values, and the core damage frequency foran unmodified plant (CDF1) is solved above. As the proposed modification has no impact on theJocassee Dam itself, the initiating event frequency does not change, or:IEFm = lEFt (eq. 1.:7)= 2.OE-4 per year -We can u&sb a modified Equation 1-3 to determine the conditional core damage probability of themodified SSF.3 of g OFI -Delta Risk Assessment of Planned Mods(3).doc "OF;C=AL UPE ONLY -8)U,.,,-,ELTED ilFrMr TIlN,CCDPm = Prpm + Po (eq. 1-8)Where:Pfm = probability of failure of SSF from failure due to failure of SSFflood protection after modification P, = the probability of failure of the SSF from other causesremains unchanged
= 0.27The expectation of the modification is that it will protect the SSF from flooding by increasing theheight of the flood-wall, harden the SSF ventilation systems and by installing a water-tight door.The weak link in this arrangement is the water-tight door, which is calculated to have a failureprobability of 7.4E-3 per demand.3 Thus:b)(7)(F)(eq. 1-8)Making the appropriate substitutions into Equation 1-6 yields a modified core damage frequency of:(b)(7)(F)
(eq. 1-6)And from equation 1-5, we can solve for the change in risk from the modification:
(b)(7)(F)
(eq. 1-5)' US NRC-RES/EPRI, "Fire PRA Methodology for Nuclear Power Facilities,"
NUREG/CR-6850, Rev. 0, 11/2005, Table 11-3.4 of 9 OFI -Delta Risk Assessment of Planned Mods(3).doc flFFICIAL U31 S -RFI A.TED '.INFORM.ATIONI TornadoThese modifications add additional protection to the main control room, the west penetration room and partial protection for the BWST. Without the modifications, the tornado core damagefrequency (CDF) contribution is estimated at)1.3E-5 per year. Therefore, the maximum riskreduction can never exceed] 1.3E-5. tHowev~w, a number ot accident sequences will not bechanged with these modifications.
1 hese sequences are estimated to contribute 5.5E-6 to coredamage. Assuming for the sequences-that are affected, the modifications provide an order ofmagnitude improvemept-The core damage frequency from the altered accident sequences isrevised downward from) 7.47E-6 to 7.47E-7.
- he overall risk improvement is in the range of:ACDFt = CDFtb -CDFta (eq. 2-1)Where:ACDFt = delta risk from tornado modifications core damage risk from tornados base case ICDFtb = (from Oconee SPAR model)= 1.3E-5 per yearCDFw = core damage risk from tornados after modifications CDFtb = CDFt- CDFtu, (eq. 2-2)Where:CDFtuc = core damage risk from tornados in unchanged sequences
= 5.5E-6 per yearCDFt, = core damage risk from tornados in changed sequences
= CDFtb -CDFIuc (eq. 2-3)= (1.3E-5 -5.5E-6) per year= 7.5E-6 per yearCDFtc,= core damage risk from tornados in changed sequences aftermodification CDFtX 0.1= 7.5E-6X0.1
= 7.5E-7 per yearCDFta= CDFtuc + CDFca (eq. 2-4)= (5.5E-6 + 7.5E-7) per year= 6.3E-6 per yearACDFt = CDFtb -CDFta (eq. 2-1)= (1.3E-5 -6.3E-6) per year= 6.8E-6 per year5 of 9 OFI -Delta Risk Assessment of Planned Mods(3).doc Internal EventsThe following calculations will use the "Bimbaum" risk importance measure of various systems,where Birnbaum is defined as the difference between the risk with the component failed and therisk with the component successful.
B= F(1)- F(0) 4 (eq. 3-1)Where:B = Birnbaum of component iF(1) = Risk with the failure probability of component i set to 1.0F(0) = Risk with the failure probability of component i set to 0.0Protected Service Water SystemDuke is installing a new motor driven pump capable of providing secondary side heat removal toall three Oconee units. This system is called the Protected Service Water System. It will takesuction from the CCW header and inject into each units steam generators.
It Will have numerouspower sources:
Keowee underground, normal power and from the Lee Station via a dedicated line.Oconee currently has a secondary side heat removal system called the tornado pump. Thispump is in the internal events model. It is credited in a large number of different accidentsequences.
The PRA model indicates it has a Birnbaum of 2.OE-5 (test and maintenance for thepump). The NRC has never considered this estimate to be credible.
The NRC estimates the truebaseline Birnbaum for the tornado pump as:Bt, = F(1)- F(0) (eq. 3-1)Where:Btp = Birnbaum of tornado pumpF(1) = Risk with tornado pump set to 1.0 (failed)Ro X Q (eq. 3-2)Where:Ro = Baseline risk from PRA model= 2.OE-5 per yearQ =?????= 0.5F(1) = 2.0E-5 per yearX 0.5-1.OE-5 per yearF(0) = Risk with tornado pump set to 0.0 (successful)
= R0XQ2 (eq. 3-3)Where:4 SAPHIRE Basics Course Book, January 2006, page 108.6 of 9 OFI -Delta Risk Assessment of Planned Mods(3).doc 0 riF UF O-1Y M E--- OEWR IW R E D INFO111ATK Q2 = ????= 2.2E-2F(O) = 2.OE-5 per year X 2.2E-2-4.4E-7 per year131p F(1) -F(0) (eq. 3-1)= (1.OE-5 -4.4E-7) per year-9.6E-6 per yearDuke is replacing the tornado pump with a more robust system called the protected service water(PSW) system, This system will be composed of a motor-driven pump which takes suction fromthe CCW header and is capable of discharging into all six of the Oconee steam generators.
It willhave numerous power sources from the Keowee Hydro Plant (both under and above ground) andthe Lee Station via a dedicated transformer.
This new system will be far more reliable and its availability/reliability should be on the order of amotor-driven auxiliary feedwater (MDAFW) train. To estimate the current value of this new PSWsystem, the current mitigating system performance indicator (MSPI) data for MDAFW system wasused:Probability Component of failure7E-4 = test and maintenance (T&M) probability for system1 E-3 = fails to start (FTS) probability 1.2E-4 = fails to run (FTR) probability for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (= 5E-6
- 24)7E-4 = motor operated valve (MOV) fail to open probability 2.5E-3 = total estimated failure probability for the PSW system (sumof above values)Total failure probability of the new PSW system is, therefore, estimated at 2.5E-3.Fhe new PSW system is estimated to have an overall risk improvement in the range of[I don't know what the next calculation is calculating!)
2.0E-5 (2.2E-2 -2.5E-3) + 9.6E-64E-7 + 9.6E-61.4E-5High Energy Line Break Protection Also, there is another facet of the internal events that has not been captured.
It deals with HELB.Previous analysis has not fully recognized turbine building HELB. There are three break types ofconcern -main feedwater (MFW) break failing safety-related 4160 VAC, auxiliary steam headerfailing safety-related 4160 VAC, and main steam line (MSL) break.The assumptions for each of these three line breaks are as follows:7 of 9 OFI -Delta Risk Assessment of Planned Mods(3).doc For a MFW break, the break occurs in the vicinity of the 4160 VAC, the main turbine controlcircuitry and main turbine bypass valves, and that the standby shutdown facility (SSF) fails.* For an auxiliary steam line break, the SSF does not fail.* For a MSL break, the break occurs in the vicinity of the 4160 VAC and fails the SSF.[Walt, for the MSL and aux steam breaks, does the 4160 and main turbine controls also fail?][Walt, do all of the IEFs come from NUREG/CR-5750?]
MFW line break failing 4160 VAC3.4E-3 = frequency of an MFW line break0.2 = probability break is close to 4160 buses1.6E-2 = probability of failure of emergency feedwater (EFW) crosstie and manual operation of TDAFW1.1E-5 = conditional core damage probability (CCDP) of a MFW linebreak without new PSW and main steam line isolation valves (MSIV)2.7E-8 = CCDP given an MFW line break with new PSW and withoutnew MSIVs1.4E-8 = CCDP given an MFW line break with PSW & MSIVs (creditSSF as high dependent HRA (0.5 failure probability))
Auxiliary steam line break failing 4160 VAC9.9E-3 = frequency of auxiliary steam line break1.8E-2 = probability break affects 4160 buses1.7E-3 = probability break affects the EFW cross tie and manualoperation of TDAFW and SSF3.OE-7 = CCDP given an auxiliary steam line break withoutPSW/MSIVs given this result further analysis is notnecessary
-excludeMain steam line breakThe MSL break is the most difficult scenario because it requires the most assumptions.
Thereare two effects of concern.
The first is a direct piping interaction with turbine building supportscausing building failure and steam/condensate effects on equipment below.Without any rigorous evaluation, the analysis assumes the probability of a building failure givenMSL break is 1% (1E-2). There is a 50% probability the MSL break occurs in the turbine buildingand a 50% probability it occurs in the auxiliary building.
The probability of an MSL break is 1.OE-2 from NUREG/CR-5750.
1.0E-2 = frequency of an MSL break0.5 = probability bi'eak occurs in the turbine building1.OE-2 = probability break causes a building failure5.OE-5 = CCDP without new PSW/MSIVs 3.8E-8 = CCDP given the PSW (2.5E-3) and new MSIVs (.3)Caution:
THIS MUST BE VIEWED AS JUST A VERY BROAD SCOPING ASSESSMENT 8 of 9 OFI -Delta Risk Assessment of Planned Mods(3).doc uOFutI. u ONLY -SECURiIY-RELAT."
FireThe fire analyses are ongoing and continue to be fluid. The PSW system and the MSIVs will alsoprovide additional protection for fires. This analysis indicates that the greatest benefit of thesemodifications will probably occur with turbine building fires. It is for these fires that damage thenormal/emergency electrical distribution system or turbine bypass control circuits that thePSW/MSIVs will provide the greatest benefit.
First, it must be understood that fire damage thatcauses severe and rapid depressurization of the secondary side and also fails the SSF. Theprimary-side cooldown empties the pressurizer and potentially challenges the power-operated relief valves (PORV) and the safety relief valves (SRV) as the primary side heats up. This is avery broad evaluation and does not try to capture all the details needed in such an analysis
-justthat a rapid depressurization causes a SSF failure.Two fire types will be considered:
- 1) large unsuppressed TG fires and 2) MFW pump fires. Noteall fire frequencies are derived from IMC 0609, Appendix F.Turbine generator fire1.7E-3 = frequency of a large oil fire0.28 = probability of not suppressing the fire within 60 minutes0.1 = probability the fire affects the turbine bypass valves failingthe SSF4.8E-5 = CCDP given a large turbine generator fire without the newPSW1.2E-7 = CCDP with new PSW3.6E-8 = CCDP with PSW and MSIVs (with MSIV closure SSF stillviable)MFW pump fire3.3E-4 = frequency of fire from Spanish fire and approximate historical data2.0 = number of pumps2.OE-2 = probability of auto water suppression failure0.3 = probability of SSF failure4.OE-6 = CCDP given a MFW pump fire without new PSW1.OE-8 = CCDP given a MFW pump fire with new PSWThis gives an estimated 5E-5 risk improvement due to PSW and MSIVs from fire. -SummaryThe total additional protection from the ongoing Oconee modifications is the sum of the abovecalculations which is summarized in the table below.Tornado 6.8E-6Internal Events 1.4E-5HELB at least 1.OE-5Fire 5.OE-5TOTAL 8.1E-59 of 9 Aof Planned MoFirst this is my perspective only -it does not in any way reflect any other individual's or groupsviews either internal or external to the NRC. The modifications I am considering in this reviewinclude:" PSW: A motor driven pump capable of providing secondary side heat removal to all threeunits. This pump would take suction from the CCW header and have numerous powersources -Keowee underground, normal & the Lee Station via a dedicated transformer.
Thisis the PSW System." MSIV: Main Steam Isolation Valves" Tornado Protection:
" CR walls from tornado missiles" West Penetration Room wall for tornado missiles" Partial Protection of the BWST from tornado missilesTornado -Without the modifications the tornado CDF contribution is10.3E-5 Therefore, themaximum risk reduction can never exceed 1.3E-5. However, a njjwnew-6o55 accident sequences will not be changed with these modifications.
This is estimated at 55E-6 This is derived froman inspection of the top 250 cutsets and making a judgment whether the cutest will remain validor be significantly altered by the modifications discussed above. The accompanying Xcelspreadsheet indicates in red which cutsets would be unaffected.
Assuming for the sequences that are affected by the modifications, there will be a CDF improvemept of a magnitude.
Thealtered accident sequences numerical result is mvised downward from 7.47E-6 to 7.47E-7 Thiswould place the risk improvement in the range or)6.75E-6.
Internal Events -The internal events model already includes a secondary side heat removalsystem referred to as the Tornado Pump. It is credited in a large number of different accidentsequences.
It has a Birnbaum Importance Measure of 2.04E-5 (T&M for the PUMP). I havenever considered the system as very credible and the true baseline CDF involving this systemas-is is probably more on the order of:2.04E-5 * (0.5 -2.2E-2) = 9.75E-6 which is higher than presently calculated.
A Birnbaum provides the new CDF, given the basic event for the Importance
- Measure, is alwaysfailed (failure probability of 1.0). Another way of looking at the result is as one large cutset:2.04E-5 {all other basic events in the cutset}
- 1.0 {failure probability of Tornado Pump}= 2.04E-5 {CDF)In the nominal case the T&M basic event failure probability is12.2E-2.
6o the CDF in thenominal case would be:2.04E-5
- 2.2E-2 = 4.5E-7 As previously stated the licensee's nominal failure probability is too low and I am using 0.5.Therefore, the nominal case is more on the order of2.04E-5
- 0.5 = 1.02E-5Or 1.02E-5 -4.5E-7 = 9.75E-6 higher than assumed by the licenseeNow, this new system will be far more reliable and its availability/reliability should be on theorder of a MDAFW train. Using current MSPI data the failure probability can be estimated at:6.9E-4 (T&M)1E-3 (FTS)5E-6
- 24 (FTR)7E-4 (MOV)(b)(7)(F) or 2.5E-3. The overall risk improvement would be in the range oI{irnprovement over the licensee's nominal failure probability for the l'ornado Pumpl(b)(7)(F)
{additional improvement over where I assume the nominal case to really be}. Or:(b)(7)(F)
Also, there is another facet of the internal events that has not been captured.
It deals withHELB. Previous analysis has not fully recognized Turbine Bldg HELB. There are three breaktypes of concern -MFW break failing 4160 VAC, Aux Steam Header failing 4160, Main SteamBreakAssuming MFW breaks in the vicinity of the safety related 4160 VAC buses fail turbine controlcircuitry
/bypass valves -this fails the SSF For MSLB assume all piping sections would fail SSF-For AUX SLB none fail SSFMFWLB failing 4160 VAC3.40E-03
[MFWLB]
- 0.2 [close to 4160 VAC]
- 1.60E-02
[EFW cross tie and manualoperation of TDAFVV] = 1.09E-05 CDF without PSW/MSIVs With PSW the CDF drops to 2.72E-08 CDF {1.09E-5
- 2.5E-3(PSW failure probability))
& 1.36E-08 with PSW & MSIVs (credit SSF as hi dependent HRA (.5 failure Pr)). WithMSIVs in place the unrestricted cooldown is abated allowing the SSF to become a viablemitigation strategy.
Unfortunately, there will be an over-riding human dependency failureprobability
{two major human actions outside the MCR -(1) placing into service andoperating the SSF & (2) opening the manual EFW cross tie valves and locallystarting/operating the TDAFW pump) that will be significantly higher than the SSFhardware failures.
This indicates a 1 E-5 CDF improvement Aux Steam failing 4160 VAC9.90E-03
[AUX SLB]
- 1.80E-02
[portion able to affect 4160 buses]
- 1.70E-03
[EFWcross tie and manual operation of TDAFW & SSF] = 3.03E-07 CDF without PSW/MSIVs given this result further analysis is not necessary
-excludeThe MSLB in the Turbine Bldg is the most difficult with limited basiwp.which to derive a riskevaluation.
There are two effects of most concern -direct piping interaction with Turbine Bldgsupports causing building failure and steam/condensate effects on equipment below.Without any rigorous evaluation set the Pr of building failure given MSLB @ 0.01 -1%50% inside Turbine Bldg vs. Aux Bldg & outsideUsp 1 E-2 [MSLB frequency (Cr-5750)]
as the total MSLB frequency 1.OOE-02
- 0.5
- 2.5E-3 (PSW failure Pr)
= 3.75E-08 with PSW & MSIVsFire -The fire analyses are ongoing and very fluid. I will indicate that the greatest benefit ofthese modifications will probably ocurr with Turbine Bldg fire. It is in these fires that damage tothe normal/emergency electrical distribution system or turbine bypass control circuits that thePSW/MSIVs will provide the greatest benefit.
First it must be understood that fire damage thatcauses severe, rapid depressurization of the secondary side fails the SSF. The primary sidecool down empties the Pzr and potentially challenges the PORvs/SRVs as the primary heats up.This is a very broad evaluation and does not try to capture all the details needed in such ananalysis
-just -rapid depressurization means SSF failure.Two fire types will be considered:
Large unsuppressed TG fire & MFW Pump fire.1 -TG Fire [fire frequencies derived from 0609, Appendix F]1.70E-03/yr (large oil fire)
- 0.28 (inability to suppress within 60 minutes)
- 0.1 (affects 4160 buses -judgment/guess) given a fire of this magnitude it causesTurbine Bypass Valves to open failing SSF = 4.76E-05 CDF without PSW4.76E-5
- 2.50E-03 (PSW failure)
= 1.19E-07 CDF with PSW1 .19E-7
- 0.3 = 3.57E-08 CDF with PSW & MSIVs -with MSIV closure SSF stillviable4.76E-5 -3.57E-8 = 4.75E-5 CDF Improvement 2 -MFW Pump FireUse 3.30E-04 fire/pump using Spanish Fire & approx historical data for frequency 3.3E-4 fire/pump
- 2 pumps
- 0.02 Auto Water Suppression failure
- 0.3 SSFfailure = 3.96E-06 CDF without PSW 3.96E-6