ML20154H545
| ML20154H545 | |
| Person / Time | |
|---|---|
| Site: | Arkansas Nuclear  |
| Issue date: | 08/31/1988 |
| From: | Carbonaro J, Samanta P, Wong S BROOKHAVEN NATIONAL LABORATORY |
| To: | NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES) |
| References | |
| CON-FIN-A-3230 BNL-NUREG-52024, NUREG-CR-5200, NUDOCS 8809220046 | |
| Download: ML20154H545 (78) | |
Text
{{#Wiki_filter:.
. l
\ < . i J NUREG/CR 5200 l j BNL NUREG 52024 1 1 l EVALUATION OF RISKS ASSOCIATED i WITH A0T AND STi REQUIREMENTS i AT THE ANO-1 NUCLEAR POWER PLANT j P.K. Samanta, S.M. Wong, and J. Carbonaro t .l August 1988 1 f DEPARTMENT OF NUCLEAR ENERGY, BROOKHAVEN NATIONAL LABORATORY
- UPTON LONG ISLAND NEW YORK 11973 j --
Prepared for Office of Nuclear Regulatory Research j j j .,, ,,s, F; Urnted States Nuclear Regulatory Commission t ;l ) ,) s: Washington, O C 20555 y>. ;[) j a (; & L{ Under Contract No. DE-ACO2 76CHOO016 l -T tU T '1 ('?' t
~) - ,l-.i ..1 5,
! 8809220046 000831 PDR l P ADOCK 05000313 pyg
l NUREG/CR 5200 l BNL NUREG 52024 AN,RG,RX EVALUATION OF RISKS ASSOCIATED WITH A0T AND STI REQUIREMENTS AT THE ANO-1 NUCLEAR POWER PLANT l P.K. Samanta, S.M. Wong, and J. Carbonaro l Reliability and Physical Analysis Group l Department of Nuclear Energy Brookhaven National Laboratory Upton, Long Island, N.Y.11973 l l August 1988 Prepared as Part of the PETS Program Project Manager: J. Boccio Prepared for OlVISION OF REACTOR & PLANT SYSTEMS OFFICE OF NUCLEAR REGULATORY RESEARCH UNITED STATES WUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555 UNDER CONTRACT NO. DE AC02 76CH00016 NRC FIN A 3230
I t l l l { l l l i f I f J l 1 I 1 1 i r n i NOTICE t v nis report was prepared as an account of work sponsored by an arencyof the United l
, States Got ernment. Neither the United States Government nor any agency thereof.or ;
any of their *mployees, makes any marranty, expressed or i "plied, or assumes any - legal liability or responsibihty for any third party's use, or the results of such use,of any information, apparatus, product or process disclosed in this report,or represents that its use by such third party would not infringe prit stely owned rights. ;' he vieus expressed in this report are not necessarily those of the U.S. Nuclear ' Resulatory Commission, Available from ) Superintendent of Documents U.S. Government Printing Office , P.O. Ilox 37082 I Washington, DC 20013 7932 and
) National Technical Information Fr-vice Springfield, Virginia 22161 l
-111-ABSTRACT This report presents an evaluation of the core-melt frequency conttibutions casociated with Allowed Outage Times (A0Ts) and Surveillance Test Intervals (STIs) at Arkansas Nuclear One - Unit 1 (ANO-1).
The results show that the core-melt frequency contributions from present r A0Ts and STIs vary by more than four orders of magnitude (a f actor of 10,000). This wide range of variation indicates the wide range of the risk importance of present A0Ts and STIs. The core-melt contributions from specific A0Ts and STIs can be used to prioritize those components which should be focused on for in-spection activities, personnel training, and reliability program activities that cre involved with surveillance testing and corrective maintenance. -
- - - - . , - y,__---- -
-v-CONTENTS P,ag e, A B S T RA CT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1 1 L I S T O F F I G U RE S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v i i LIST OF TABLES..............................................................ix ACKNOWLEDGEMENT.............................................................xi EXECUTIVE
SUMMARY
.......................................................... 1
- 1. INTRODUCTION.......................................................... 3
- 3. MEASURES OF RISK IMPACTS OF A0T AND STI REQUIRCAENTS. . . . . . . . . . . . . . . . . . 5 2.1 A0T Ri s k M e a s u r e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 2.1.1 Increased Allowed Risk due to Change in A0T. . . . . . . . . . . . . . . 7 2.1.2 Dis cus s ion of A0T Risk Mea s u re. . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 2.1.3 Calculation of AUT Risk Measures.......................... 8 2.2 S T I Ri s k M e a s u r e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 2.2.1 Increase in Risk due to Change in STIs . . . . . . . . . . . . . . . . . . . . 12 2.2.2 Dis cussion on STI Risk Measu re . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 2.2.3 Calculation of STI nisk Measure........................... 13
- 3. ANO-1 PRA AND DETERMINATION OF RISK MEASURES. . . . . . . . . . . . . . . . . . . . . . . . . . 15 3.1 Arkansas Nuclear One - Unit One Probabilistic Risk Assessment.... 15 3.2 ANO-1 Te chnical Spe cif ica tions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 3.3 Scope............................................................ 15 3.4 Calculation of Core-Melt Frequency............................... 16 l
l
- 4. RESULTS OF EVALUATION OF ANO-1 AUT AND STI REQUIREMENTS............... 17 '
4.1 Analysis of Risk Impact of AUT Requirements...................... 17 4.1.1 Risk Impact of Extensions in A0Ts......................... 21 4.1.2 Evaluation of Action Statements........................... 25 4.1.3 Transferring of AUT Requirements to Technical S p e c i f i ca t i o n s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 5 4.2 Analysis of Risk Impact of STI Requirements...................... 26 4.2.1 Risk Impact of Extensions in STIs......................... 27 4.2.2 Transferring of STI Requirements to Supplemental Specifications............................................ 28 l
- 5. S UMMARY AN D CO N C LU S I O N S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 5.1 Risk Implications of Current Requirements........................ 31 l 5.2 Bases for Technical Specification Requirements................... 31 l 5.3 Valid i t y o f Ac tion S t a te me nt s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 5.4 C ha ng e s in A0Ts and STI s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 5.5 Improvement to Current Technical Specifications.................. 32 REFERENCES................................................................. 33 1 1
APPEND!X A. DETAILED DERIVATION OF STI RISK MEASURE........................A-1 l APPENDIX 3. HAINTENANCE REQUIREMENT
SUMMARY
OF ANO-1 SAFETY SYSTEMS. . . . . . . .B-1 APPENDIX C. RISK IMPACT OF A0T REQU IREME NTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-1 ) APPENDIX D.
SUMMARY
OF SURVEILLANCE TEST REQUIREMENTS AND RISK IMPACTS. . . . .D-1 1 l l l l
-vii-LIST OF FIGURES Figure Page
- 1. Yearly A0T Risk Impact of ANO-1 Maintainable Components. . . . . . . . . . . . . . 2
- 11. Risk Impact of ANO-1 Surveillance Test Requirements.................. 2 4.1. Single A0T Risk Impact for ANO-1 Maintainable Components............. 20 4.2. Yearly A0T Kisk Impact of ANO-1 Maintainable Components.............. 20 4.3. Yearly A0T Risk of ANO-1 Maintainable Ccmponents for Factor of Two Increase in A0Ts of Components with Risk Impact Belcw 10 7...... 22 4.4. Single A0T Risk Impact for a Factor of Two Increase in A0Ts of Components With Yearly Risk Impact Below 10 '.................... 23 4.5. Yearly A0T Risk of ANO-1 Maintainable Components for a Factor of Two Increase in A0Ts of Componente With Risk Impact Below 10-"...... 24 4.6. Single A0T Risk of ANO-1 Maintainable Components for a Factor of l Two Increase in A0Ts of Components With Risk Impact Below 10-'...... 24 l
4.7. Risk Impact of ANO-1 Surveillance Test Requirements.................. 28 l 4.8. Change in Risk Impact of Surveillance Test Requirements With a l Factor of Two Increase in the STIs of Tests With Risk Impact Below 10 7.......................................................... 29 l 4.9. Change in Risk Impact of Surveillance Test Requirements With a Factor of Four Increase in the STIs of Tests With Risk Impact Below 10 7.......................................................... 29 1 1 4 , i f i 1 l 1 l
-ix-LIST OF TABLES Table Page 4.1 ANO-1 Maintainable Components With Highest A0T Risk Impact........... 18 4.2 Selected ANO-1 Maintainable Components with Low A0T Risk Impact. . . .. .19 4.3 Surveillance Tests With Highest Risk Impact. . . . . . . . . . . . . . . . . . . . . . . . . . 26 4.4 Selec ted Surveillance Tes ts Wit h Low Risk Impact. . . . . . . . . . . . . . . . . . . . . 2 7 B.1 Maintenance Requirement Summary System: HPIS/HPRS....................B-1 t
B.2 Maintenance Requirement Summary System LPIS / LPRS . . . . . . . . . . . . . . . . . . . . B-2 B.3 Maintenance Pequirement Summary System: Reactor Building Spray.......B-3 B.4 Maintenance Requirement Summary System Emergency Feedwater (EFWS). . .B-3 i B.5 Maintenance Requirement Summary System: Reactor Protection...........B-6 B.6 !!aintenance Requirement Summary System: Secvice Water................B-6 B.7 Maintenance Requirement Summary Systemt Emergency Safety Actuation...B-8 l l B.8 Maintenance Requirement Summary System: 125V DC......................B-8 1 B.9 Maintenance Requirement Summary Systems AC Power.....................B-9 i B.10 Maintenance Requirement Summary System: Battery and Switchgear ' Emergency............................................................B-11 C.1 Risk Impact of A0T Requirements for Maintainable Components High Pressure Inj ection/ Recirculation System. . . . . . . . . . . . . . . . . . . . . . . . .C-1 E.2 Risk Impact of AUT Requirements for Maintainable Components Low Pressure Inj ection/ Recirculation Sys tem. . . . . . . . . . . . . . . . . . . . . . . . . .C-1 B.3 Risk Impact of A0T Requirements for Maintainable Components Reac t o r Build ing Spray Sy s t e m. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C-1 B.4 Risk Impact of A0T Requirements for Maintainable Components l 4 Eme rgency Fe ed wa t e r Sys t em ( E FWS ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . , . . C-2 i i C.5 Risk Impact of AUT Requirements for Maintainable Components
; Reactor Protection System............................... ............C-2 C.6 RiJk Impact of AUT Requirements for Maintainable Components 4 Service Water System.................................................C-3 I
i C.7 Risk Impact of A0T Requirements for Maintainable Components Enginee red Saf egua rd s Actua tion System (ES AS) . . . . . . . . . . . . . . . . . . . . . . . .C-3 i I
-x- ,
LIST OF TABLES (Cont'd) Table Page C.8 Risk Impact of A0T Requirements for Maintainable Components in DC Power System...................................................C-4 C.9 Risk Impact of A0T Requirements for Maintainable Components ; , in AC Power System...................................................B-4 C.10 Risk Impact of A0T Requirements for Maintainable Components in Emergency Cooling System (Battery & Switchgear Rooms).............B-5 D.1 Risk Impacts of Surveillance Test Requirements in High Pressure ; Inj e c tion /Recircula tion Sys t em. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-1 D.2 Impact of Surveillance Test Requirements in Low Pressure Inj e c t ion / Recircula tion Sys t em. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-2 ( D.3 Risk Impacts of Surveillance Test Requiremen;s in Core Flood System...D-3 - l D.4 Risk Impacts of Surveillance Test Requirements in Reactor [
; Bu i ld i n g S p ray Sy s t e m . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-3 r ! D.5 Risk Impact of burveillance Test Requirements in Emergency (
F e ed wa t e r S y s t e m . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D- 4 [r D.6 Risk Impact of Surveillance Test Requirements in Reactor Bu ild ing Coo ling Sys t e m. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-4 ' D.7 Risk Impact of Surveillance Test Requirements in Reactor Protection System....................................................D-5 D.8 Risk Impact of Surveillance Test Requirements in Engineered S a f e g u a rd s A c t u a t i o n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 0- 6 D.9 Risk Impact of Surveillance Test Requirements in Service Water Systems........................................................D-8 D.10 Risk Impact of Surveillance Test Requirements in Class IE AC Power System......................................................D-8 i D.11 Risk Impact of Surveillance Test Requirements in 125V DC System.......D-B : i i
; D.12 Risk Impact of Surveillance Test kequirements in Battery and l Swit chgea r Eme rgency Cooling Sys t em. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-9 1
I D 13 Risk Impact >f Surveillance Test Raquirements in Emergency Feed wa te r biitia tion Cont rol Sys t em. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D-9 ] I , t 1 L
-xi-ACKNOWLEDGEMENTS This stody was performed as a part of the Procedures for Evaluating Techni-cal Specifications (PETS) program under the auspices of the Division of Reactor & Plant Systems of the U.S. NRC.
s The authors wish to acknowledge the NRC Technical Monitor of the program, Mr. Richard C. Robinson und the BNL Program Manager, Dr. John L. Boccio. This report significantly benefited from the insightful comments and suggestions of Dr. William E. Vesely of Science Applications International Corporation. We are also thankful to Mr. R.E. Hall and Dr. R. Fu11 wood of BNL and to Mr. S. Newberry of NRC for their reviews of the report. We also thank Ms. Jeanne Danko for her help in the preparation of this manuscript.
i l 1 l EXECUTIVE
SUMMARY
l l ! l This report provides a risk-based evaluation of two aspects of the techni- l cal specifications (TSs) requirements at the Arkancas Nuclear One - Unit-1 , (ANO-1) nuclear power plant. These two aspects of technical specifications de- l fine the allowed outage times (A0Ts) and the surveillance test intervals (STIs) for the safety system components. The A0T of a component is the period of time during the plant operation in which the component may be inoperable, i.e., if a component is found f ailed, it should be repaired within the defined A0T or otherwise the plant must be brought to a shutdown state without the approval of e waiver request. The STIs define the maximum time intervals between required testing of the standby safety system components. , The establishment of A0Ts and STIs within the TS was primarily based on engineering judgments and many of these requirements are currently considered to be unnecessarily burdensome to the extent that their enforcement may be divert-ing attention from important safety operational aspects of the plant. This re-port uses a risk methodology to identify the risk contributions, which are de-fined below, associated with A0Ts and STIs. Such an evaluation, besides provid-ing a risk perspective, demonstrates the usefulness (or lack of it) of the many requirements in the current form. The operating risk of a plant due to an A0T is the riek associated with the j component being down and unavailable were it needed if an accident occurred. , Measured at core-melt f requency level of a plant, it can define the core-melt probability for the downtime when the component is down for the A0T (called l single downtime risk) and also the cumulative risk f rom projected downtimes I which a component can suf fer during a reference period of one year (called yearly A0T risk). Figure i shows the profile of the yearly A0T risk for the components in the ANO-1 plant measured at core-melt level. The results show tha3)alargepercentage(-80%)haveasmallcore-meltcontribution(begow 10- . Also, 37% of the A0Ts have negligible contributions (below 10- ). A similar profile for single A0T risk shows that about significantcore-meltcontributions(greaterthan10"{0%ofthecomponentshave ), given the component is l down and unavailable to perform its function for the A0T period. l So cat.i io*'i.io** ' cat.: io**i.io-' ,
; e4t.: io ' i. io ' 8'%
car.e io 'i. io ' : ly to - cat.s ioi.io ' ,,,,, U ca t. e i... ... io '
$so i.% '
E ia% t io - *% -
')
/ l .
o% % .- . Cati Catt Cats Cate Catt Cats it a alt not film inspact l Figure 1. Yearly A0T risk impact of ANO-1 maintainable components l
l 1 9 The risk impact of a surveillance test consists of the risk reduction due to the test and risk increase by the test. We consider the risk redue:. ion due
- to the test to determine the risk impact of the test. Any risk caused by the i test will lower the benefits of the test. In considering only the risk reduc-
! tion, we are bounding the net benefits of the test. At the core-melt frequency level, the risk impact of a surveillance test is the decrease in core-melt fre-quency due to the test. Figure 11 shows the decrease in core-malt frequency from current STIs for the surveillance tests in the ANO-1 plant. The l show that 53% of the surveillance tests hav see11 benefits (below 10 Jesults
) and 14% l have significant benefits (greater than 10 g).
t caf. s io ' ,. ,o
- l l cataso *e.eo
- cat.: so ' .. o
- _ !
I e ca u so *,.io ' is% g 3, c at i... .... io o l _ .
. t ! V ya - i+% ,,,, .
l I 14 % 15 % lo -
- n. C a t,s f
Catt C a f. 3 C a f.4 C at. S SvevisLLaimCg ?g3f ergig IWPACf 1 i i
- Figure 11. Risk Impact of ANU-l Surveillance Test Requirements
! r I
j! This wide range of variation in the core-melt f requency contribution f rom ! ] present A0Ts and STIs indicates the wide range of the risk importance of present t j A0Ts and STIs. The core-melt contributions f rom specific A0Ts and STIs can be i used to prioritize those components which should be focused on for inspection i activities, personnel training, and reliability program activities that are j involved with surveillance testing and corrective maintenance. (- Risk considerations can be used to provide a sound basis for the objectives l l and scope of AUTs and ST!s as well as providing a sound basis for acceptable j l values of A0Ts and STIs. From a risk standpoint, the objective of A0Ts is to 1 l allow on-line repair to be performed while at the same time acceptably control- l
! ling the increased risk during the period the component is down. The objective !
I 1 of STis is to allow component f ailures to be detected in order to control risk i while at the same time controlling any risk caused by the test. The analyses in ! the report demonstrate how these objectives can be addressed in determining l l present A0T and STI risks and in assessing proposed modifications. { l t I t I f i ! J
i 1
- 1. INTRODUCTION l
This report provides a risk-based evaluation of two aspects of the techni-
, cal specifications (TSs) requirements at the Arkansas Nuclear One - Unit-1 l (ANO-1) nuclear power plant. These two aspects of technical specifications de- } fine the allowed outage times (A0Ts) and the surveillance test intervals (STIs) l as a part of the limiting conditions of operations (LCOs). The A0T of a compo- l l nent is the period of time during the plant operation in which the component may l l
be inoperable, i.e., if a component is found f ailed, it should be repaired with-in the defined A0T or otherwise the plant mast be brought to a shutdown state 4 without the approval of a waiver request. The STIs define the maximum time l intervals between required testing of the standby safety system components. The ; establishment of A0Ts and STIs within the TS was primarily based on engineering
! judgment. In this report a risk-perspective is provided for these aspects of the technical specifications. 1 The objective of this report is to evaluate the A0T and STI requirements in a nuclear power plant, to provide a methodology for evaluating the requirements f rom a perspective of risk, to demonstrate whether the various requirements are ,
i consistent f rom the point of view of their risk implications, and finally, to l rank order the requirements on a scale of risk.
; Such an evaluation, besides providing a risk perspective demonstrates, the usefulness (or the lack of it) of the many requirements in the current form.
Many elements of the technical specification requirements are currently con-I sidered to be unnecessary as opposed to conducive to the safety of the plant.
; Accordingly, these requirements become burdensome to the utilities to the extent that their enforcement may be diverting attention f rom important safety opera- l tional aspects of the plant. In addition, the bases for a signif j thespecificationswithintheLCOrequirementsarenotexplained.{cantnumberof The result has been inadequate implementation, and, at the same time any necessary changes have been dif ficult. The risk consideration presented here can be used to pro-vide a sound basis for the objective and scope of A0Ts and STIs as well as pro- i viding their acceptable values.
j l The risk impact of A0T and STI requirements are determined using the prob-sbilistic risk assessment (PRA) of the ANO-1 nuclear power Plant performed as a part of the Interim Reliability Evaluation Program (IREP).2 The risk impacts are calculated using the core-melt f requency as the measure of risk, i.e., the core-melt f requency contributions associated with A0Ts and STIs are evaluated. q Other measures at the total risk level such as the expected f atalities, man-
; rems, etc. , also could be used. However, the A0T and STI requirements, in gen-J eral, directly influence the core-melt f requency and extending the analysis at the total risk level (expected f atalities, man-rems, etc.) will not change the relative ordering of the requirements unless the consequence aspect is af fected. , The requirements addressed in the study do not impact the consequence aspect and accordingly, there was no need to perf orm any further analysis to obtain addi-tional insights. The core-melt frequency incorporates various interactions I
associated with and resulting f rom the A0T and STI requirements. j i i __ _ _ _ _ . . , _ ,, _ _ _ . _ _ _ _ _ _ _ _ __ _ _ _ . _ _ , _ _ _ _ . . .
J ) In performing this risk-based evaluation, the objective has been to obtain realistic but conservative results. Foracomprehensiverisk-basejevaluation 7 of technical cpecification elements, many issues must be resolved. The intent of this analysis, however, was to obtain a bounding evaluation of the risk asso-ciated with A0T and STI"requirements. This was obtained considering the impor-cant influencing issues in the risk measures. In addition, the risk measures are chosen to be conservative i.e., the calculated risk contributions are slightly higher than actual due to various assumptions. These bounding evalua- ; tions still allow A0T and STI risks to be ef fectively discriminated while not ;
; requiring justification for detailed data or models. This approach of realistic l j
but conservative measures of risk contributions is considered adequate in ob-l taining a relative ranking of the TS elements. Moreover, the decision required
! to improve technical specifications without undue safety implications is safer I with conservative analyses. These bounding evaluations can provide tech spec i relief and improvement while simplifying the regulatory review process. It must, at the same time, be emphasiz't that in establishing A0Ts and STIs, a more refined, comprehenst,ve analysis must be performed considering various issues im-I pacting their evaluation. The Procedures for Evaluating Technical Specifica-a tions (PETS) program, being conducted by Brookhaven National Laboratory (BNL)
! for Nuclear Regulatory Research (RES) has an objective of defining the analyses requirements in using risk basis for establishing auch requirements. Within the boundary of the analysis, the results obtaia.ed have a signifi-cant bearing on modification. The results can be used in a number of ways in seeking improvements in TSs of nuclear power plants. The risk-based methodology ; using PRAs of nuclear power plants can be used to develop consistent bases for technical specifications relating to A0Ts and STIs, thus resulting in better clarity in the specifications. This evaluation process can be used to seek per-tinent changes to many unnecessarily restrictive A0T and STI requirement = re-sulting in fewer unscheduled shutdowns and requests for one-time extensions or exemptions. Specifications whose risk impacts are found to be insignificant can also be considered for removal f rom current TSs to some other form of control, if necessary. The evaluation can also be used to tighten requirements where the , risk contributions are unacceptably high. , The report is organized as follows: Section 2 provides the measures of ; risk impacts of A0T and ST1 requirements used in this analysis. The determina-tion of these measures using an existing PRA and the limitations are also dis-cussed. Section 3 provides a brief description of the ANO-1 PRA and the techni- ! cal specifications analyzed. The application of risk measures and the results of the study are presented in Section 4. Summary, conclusions, and the utiliza- l tion of the results in the decision making process for improving technical spec-
- ifications are discussed in Section 5. Appendices provide the detailed results l for each maintainable component for which the A0T risk was ovaluated and for l each test requirement whose risk impact was evaluated. Appendix A presents a l j detated derivation of the surveillance test interval risk measure. Appendix B q provides the maintenance requirements for the on-line maintenance performed in the ANO-1 nuclear plant and Appendix C provides both the single and projected yearly A0T risks for each of the maintenances. Appendix D defines the various q surveillance test requirements, the components tested in each test and the risk l impact or benefit of these tests.
l e I
)
i I l t l ~5-
- 2. MEASURES OF RISK IMPACTS OF A0T AND STI REQUIREMENTS In this section the measures of risk impacts of A0T and STI requirements cre defined. The definitions, the development of these measures, the underlying i assumptions and limitations are provided. The utilization of PRAs in calculat-ing these measures is also explained.
2.1 A0T Risk Measure The operating risk of a plant due to an A0T is the risk associated with the ( component being down and unavailable were it needed if an accident occurred. ' The risk can be any risk characteristic such as core-melt frequency or expected , fatalities or syatem unavailability-depending upon the level of definition used. i , These definitions of AUT risks are further explained in Refs. 5 and 6. [ Single Downtime Risk '
\
Let : [ define the core-melt probabilit g or the downtime when the com-
; ponent i is down for the A0T. The quantity r is sometimes called the single downtime or conditional risk since it occurs when the component is known (given) to be down for the one A0T. The risk rf [s the pertinent risk to consider when the cc,mponent is found to be down and a decision needs to be made on the 4 allowable A0T. Therisk(thecore-meltprobabilityhere)rfU when che compo-nent is assumed down for the entire A0T period is given by the simple products A0T r
=C{*(A0T) , (1) 1 where Ci is the (increased) core-melt f requency when the :omponent is down.
The increase in core-melt probability due to the A0T is then: 4 Ar =(Cf-C)*(A0T) , (2) ~l whereCiisthecore-melt frequency when the component i is not known to bc d own. This is the representation of the "dif ferential single downtime risk" and 4 is one of the A0T risk measures calculated in Chapter 4 and also presented in
- Appendix C.
The conditional or single downcime A0T risk definition applies to the situ-4 ation where the component is detected to be down and repair or maintenance is to be performed for the entire A0T period. This definition does not directly ac-i count for the frequency of maintenance or repairl rather, the implicit assump-
] tion in this measure is that the frequency is ine per year, and the component is j unavailable for the entire A0T period. In another point of view, this measure J provides the incremental risk for a component unavailable for one A0T period ! over one year. The actual A0T risk, on the average, may be lower than that cal-
{ culated f rom the conditional risk measure, since, in reality, the average repair time of a component is less than the A0T. l 1
Yearly Downtime Risk The risk rA0T does not cover all the risks associated with the A0T. The other measure of A0T risk is the risk associated with the future occurrences of the component being down. This risk is sometimes called the yearly A0r risk and is the expected cisk which will accumulate over some future time period. Let R be this cumulative risk f rom downtimes which a component i can A0T suf fer during a reference period of one year. This risk Ri accounts for the downtime for a given A0T as well as the number of downtime occurrences. The A0T risk Ri is given by: R = N'C *(A0T) , (3) where N is the number of projected downtime occurrences during a defined time period of 1 year. The number N is an expected number and can be less than or greater than 1. For core-melt probability as the risk measure, R^ is the pro-jected core-melt probability during the downtimes which are expecked to occur. The increase in projected risk is given by AR
=N'(Cf-C)*(A0T) (4)
= (wg )*(C -C )*(A0T) ,
where w is the naintenance f requency (per year) of component i and N=at for a time perios of 1 year. This "dif ferential yearly downtime risk" is calculated and presented in Chapter 4 and Appendix C. The maintenance frequency is usually higher than the failure rate of the component since it accounts for the mainte-nances to be performed for many degraded and incipient failure conditions of the component. The projected risk increase will be higher comp.tred with the dif-ferential single downtice risk when the number of projected downtime occurrences over a year is greater than one and vice versa. This definition of yearly downtime risk increase also assumes that every time the component is taken out for service, the entire A0T period is used. As explained before, the expected A0T risk in a plaat can be lower since many re-pairs can be completed in shorter time periods and the average time is less than the A0T defined. Using the average repair time, one can obtain the expected dif f erential yearly downtime risk as: AR g =w(Cf-C)*d g , (5) where d is the average repair time and is typically less than the A0T for the compenent. This measure is also calculated in Chapter 4. The use of Eqn. (4) or (5) in obtaining the projected yearly downtime risk depends on the interpre-tation provided to the measure. Obviously, Fqn. (5) provides the expected risk and evaluating the risk with the entire AUT (as in Eqn. (4)) gives the risk which is allowed by the AUT.
l l l 2.1.1 Increased Allowed Risk Due to Change in A0T In determining the risk impact of changing an A0T for a componer.t. one can obtain the changes in both the single downtime risk and yearly downtime risk. For a new A0T, termed as NA0T, the single downtime risk can be obtained using Eqn. (1) ast
^
rg =Cf*(NA0T) , cnd the change in the single downtime risk measure is given by r g(A0T+NA0T) = rNA0T _ 7A0T =Cf*(NA0T-A0T) . (6) Similarly, the change in the differential single downtime risk is
' A or g(A0T+NA0T) = or ^ - Ar
=(Cf-C)*(NA0T-A0T) . (7)
Eqns. (6) and (7) present tne additional single downtime risk allowed by a new A0T. The changes in the single downtime risk should be evaluated f or each com-ponent separately since the single downtime risk is a conditional risk and is not additive. The projected yearly downtime risk allowed by a new A0T, NA0T, can be ob-tained using Eqn. (3) as R^ = N*C *(NA0T) ,
, where N, the expected number of outages in a year, is assumed to remain the same under the new A0T. This assumption is conservative when NA0T is greater than A0T since, with longer available times, repairs are expected to be performed adequately - reducing the number of f ailures of the component. ,
1 The change in the dif ferential yearly downtime risk is given by 4Rg (A0T+NA0T) = AR NA0T - AR^ ' (0)
=w(Cf-C)*(NA0T-A0T) g ,
where wt, like N, is assumed to remain unchanged for same arguments. The net ef fect of changing more than one A0T can be obtained by combining the yearly downtime risk. The cumulative impact of changes in A0Ts of n compo-nents can be expressed as i n 4R"(A0T+NA0T) = 1 w g(C
- OAUTg -A0Tg ) . W i=1
l It is calculated in Chapter 4 in presenting the total impact of core-se'It f re-i quency for changes in AUTs of the maintainable components. This measure is the I risk being allowed by the new A0Ts additional to that being allowed by the pre- ] vious A0T. ] I ! 4 2.1.2 _ Discussion of A0T Risk Measure l Two types of A0T dif ferential risks are discussed here: the differential ! single downtime risk, ara 0T, and the projected differential yearly downtime risk, ARA 0T. Both need to be considered since both types of risk will be gen-1 ersted by the A0T. Both risks need to be controlled if A0Ts are to be deter-l mined using risk as a guideline. In practice, one risk will of ten dominate the ! other and the dominating one will control the other. I
]
I f { The risk taeasures are decertained here in a conservative manner by focussing . l on che risk being allowed by an A0T. This resulted in calculating the risk ! l associated with the entire A0T period. In addition, when the A0T is increased, [ i the f requency of maintenance is kept constant, even though it may decrease due t
! to the availability of additional time for more thorough repair. As discussed, '
] these bounding evaluations are suf ficient for our purpose of relative ranking of risks associated with different A0Ts. I 2.1.3 Calculation of A0T Risk Measures ; i r l The determination of A0T risk measures is performed utilizing the PRA of a f plant to calculate the core-melt f requencies C{ and C . C is obtained by i assigning a zero value for the AUT. C{iscalculatedusingthefollowing i inputs: ( , 1. The component i is assumed to be down. This is equisalent to setting the component unavailability equal to 1. t i, 4 2. Other components that must be reconfigured for the repair are identi- l fled and their unavailabilities are modified to represent the recon- t i figured state. [ I I j 3. Other components or system trains that are required to be operable are f { identified and are assumed not to be down for testing or repair, since l that would violate the technical specification limitations. l The representation of reconfigurations and operability requirements of l j other components during maintenance requires a reevaluation of the system fault f d t ree models. Reconfiguration of components may eliminate certain unavailability ( contributions because of the new state of the component. In addition, the re- t quirement of availability of redundant trains and components imply that these i are checked to ensure they are not down. Human errors following previous tent i j will therefote be corrected before the repair is begun and these human errors , 1 are eliminated f or the evaluation. The dependent failures due to human errors ! I will no longer be applicable and are also eliminated. The remainder of the in- ' i puts are the same as that used for PRA calculations for. Using the above input, i the calculation of the core-melt f requency C{ incorporates pertinent system and component interactions. L I l
! r
- k i '
i
- i 1 .
l Representation of the reconfigured state requires an evaluation of human l
- errors asr.ociated with the failure to reconfigure and failure to maintain the !
1 operability requirements. However, the possibility of such errors are con- i
- sidered to be rather low in this study and are net considered. Many times re-
{ dundant trains are tested before a repair is begun and their unavailabilities l l will be lower than the average unavailabilities. In essence, the A0T risk de- i i pends on the effectiveness of the tests. But, this aspect is not included in ! the analysis. ! l l The calculation of input requirements definad above re-quirescertaincautions.goTriskusing'% When a cov; - nava11 ability is equal to 1 in min- I l i imal cut sets, the resulting cut acts anger be minimal and may need to ! ) be transformed to th n~ 'e minimal cut sets truncated at l acertainvalue(10gminimagform.or 10 ,, othe> sber of minimal cut sets may be- ! l come unmanageably large. Ifr.Miw ne used to calculate the risk ; i during A0T, care should bu iken > containing the A0T component are '
! net prematurely truncated. +1y -aM low magnitude containing the A0T l 1 component may become a dotti tehen the component unavailability is j equated to 1. Failure to ae ,, .4 the significant cut sets contain- .
ing the A0T component, when the ' ' :i .ity is set to 1, results in under- ] estimation of the A0T risk. In uoy,7the accident sequence models were j recalculated using the WAMTAP co' ser code to avoid any error in estimation l l either due to truncation or due to changes in minimal cut sets. i 4 l l 2.2 STI Risk Measure 1 l
)
I The risk impact of a test consists of the risk reduction d'te to the test
! and the risk increase caused by the test. The risk reduction of a test of a j component is the reduction in risk due to the ability of the test to detect a j failure that may have occurred during the standby period and may otherwise nave gone undetected. The risk increase due to the test is the risk caused by down- l 3 ,
j times required for the test, test-caused degradation, and test-caused failures. The risk impact or the risk benefit of testing can be interpreted in a probabil- l j istic sense to be the difference in the expected risk before and after the test. We will only consider the benefits of the test to determine the risk impact i of the test. Any risk caused by the test will lower the benefits of the test. I In considering only the benefits, we are bounding the net benefits of the test. l Tests which havo (low benefits) low risk impacts in this bounding evaluation will have even lower impacts when any risks caused by the test are considered.
- The sample bounding approach we use here is conservative and adequate for evalu-
- ation and the relative categorization of the risks associated with STIs.
Risk Benefit of Surveillance Test on a Component l The risk benefits ri of 3 test on single component i can be simply de-i fined to be the risk Rb before the test minus the risk Ra after the test l l r g = R b -R, . (10) i
We shall use core-melt f requency as a risk measure and hence et is the decrease in core-melt f requency due to a single test. Note that the risk impact ri is positive since et is the decrease in risk and is the risk benefit of the test. - Consistent with the bounding approach of the benefits of the test, we shall assume that after the test, the component is in an up state and has an availa- i bility of one (unavailability of zero); R = R(0) (11) where R(0) is the risk (core-melt f requency) evaluated with the component un-availability set to zero, i.e., the component assumed to be up. As stated, Eqn. (11) represents the maximum benefit of the test in that it is the lowest risk that can be achieved af ter the test. In actuality, the com-ponent will have a residual unavailability which is unequal to taro and rep-resents the per cycle contribution. Consider now the risk (core-melt frequency) Rb before the test. If the component is up, the risk is it(0). The probability that the component is up is 1 q where q is the component unavailability. If the component is dowr., the risk is R(1), i.e., the risk evaluated with the component unavailability set to 1; . the likelihood of this occurring is q. The expected value of Rb is thus Rb"( +9( ( } Using Eqns. (11) and (12), the risk impact of the test is then rg = (1 q)R(0) + qR(1)-R(0) (13) or rg = qlR(1)-R(0)) (14) where (R(1)-R(0)J is known in reliability literature as the risk importance or j Birnbaum Importance of the component. Risk Benefit of a Surveillance Test In performing a surveillance test, in many instances, a number of compo-1 nents are tested together. For example, the monthly test of the ilPI pump will l l draw water f rom the BWST tank and will deliver it back to the tank through the 1 rainimum recirculation flow line. Thus, the surveillance test will detect fail-1 ures in all the components in the path and the risk impact of the surveillance j test enould account fo- ' 1 the components and f ailure modes tested. The risk ,
- benefit of a surveillat. test considers all the components tested in a test, aM provides an appropr. .te measure for deciding the ef fectiveness of the test and the associated interval.
4
f I } l l r For n components tested in a test, t e R STI l91(R(1)-R(0)) g g
, (15)
) i=1 1, where qi is the unavailability for the ich component, i J l Ri (1) is the core-melt frequency evaluated with the ich component I assumed down, and l
! l 1
Ri (0) is the core-melt f requency evaluated with the ith component ( assumed up. The risk associated with a surveillance test is measured in terms of its ! j benefit using Eqn. (15) and is presented in Chapter 4 and Appendix D. This mea- ( sure is used to differentiate between risk important and unimportant tests and F is also used to study the ef fect of increasing the test intervals. The risk i benefit of surveillance test on a component, as presented in Eqn. (14), is use- [ ful in obtaining Eqn. (15), but cannot be used for deciding the appropriateness ; of a surveillance test. Consider a surveillance test involving three compo-nents, and consider also that the risk benefit of testing two of the three com- ! ponents is scall, but the risk benefit of testing the third component is signif- f
; icant. This means that the test is risk important as calculated using Eqn. ;
j (15). However, if Eqn. (14) is used, te will appear that test on two of the ' j components is unnecessary, and requirements for the test can be changed. In
- reality, this test will need to be performed because of the third component.
4 ' Use of the risk benefit of a surveillance test as opposed to the benefit asso-ciated with individual component avoids these ambiguities. j i ! 1 The risk benefit of a surveillance test depends upon the interval at which I i the test is performed. Both Eqns. (14) and (15) can be expressed in terms of l l test intervals when qi is approximated as follows: i l } 1 T j l 91"2 i , l I ] where At is the hasard rate of the ich component and T is the test interval. j The risk benefit of a surveillance test can be written using Eqn. (15) as ; I
- n j
R STI
- i=1 i 1()-R(0))
g
. (M) i ]
This expression assumes that component f ailures are all standby time related. l j Treating all f ailures as standby time related will result in a bounding, conser- , j vative estimate of the risk be **it of the surveillance test since it calculates j the maximum risk benefit asse . ^ ' with the test. A detailed derivation of the I j risk benefit of a surve111antA - considering the separation of time-related l 1 Ond demand-related f ailures ano .aer aspects associated with a test is pre- ! l sented in Appendix A. j i l ) i ! i i
l l 2.2.1 Increase in Risk Due to Change 11 STIs The change in the risk benefit of a surveillance test due to a change in the interval at which the test is performed can be obtained, using Eqn. (15), as n AR STI " i=1 i(T-T3 O (1()~i( # 1 l' i 0< 0.1 ; OD n
=(T-T 3 0 1(i Rg (Od i=1 where Tt is the new test interval and To is the current test interval. Here, ARSTI is the decrease in the risk benefit of performing the test. Equiva-lently, ARSTI is the increase in risk from increasing the test interval.
Using the bounding evaluation, 4RSTI is the uppet baund on the risk increase from increasing the test interval. The above expression has an implicit assumption that the hazard rate re-mains unchanged with the change in the test interval, as evidenced by the use of same At for T1 and To . There is reason to believe that unless the component is experiencing wetr-out and the new test interval does not violate the manu-facturer recommended value resulting in degradation of the component, the hazard rate (A) will remain constant. This assumption, if invalid, will introduce non-conservativeness in ARSTI. Another approximation that requires attention is that when test intervals are increased, A Tt 1 may become greater than 0.1 and the approximation for qi will rr. quire higher order terms. 2.2.2 Discussion on STI Rir.k Measure The above formulation of risk impact of surveillance testing in terms of risk benefits associated with the testing does not consider many factor associ-ated with a test. The possibility of degradation due to testing, the ef fect of wear-out of components, separation of standby time related vs demand related f ailure, the test-caused transients resulting in the possibility of unscheduled shutdown can reduce the risk benefit from a test whereas the appropriate con-sideration of relative placement of other teste can further improve the risk benefit. Incorporation of these parameter 0 will require auch more complex evaluation and is f acilitated by the use of computer codes like FRANTIC *. Such detailed evaluations are necessary when considering modifications to risk-jmpor-tant tests and when establishing STIe using risk arguments. Vesely et al. dis-cuss the detailed evaluation approach to define STIs for diesels. The analysis presented above for evalusting the risk benefit of surveillance tests is a con-servative, bounding approxir:4 tion to more complex models and is useful for screening purposes. In many cases, the bounding evaluations are suf ficient to justif y the needed improvements in the tech specs. For example, surveillance tests which have low impacts will have even lower impacts if more preciso evalu-ations are performed and modifications to these ST!s can be performed based on these evaluations. However, the deterraination of the specific tests to be per-formed in a plant and the test strategies f rom risk consideration will require more complex evaluations.
l 2.2.3 Calculation of STI Risk Heasure l The determination of STI risk measure requires the evaluation of the condi-tional risk, in this case core-melt f reauency, assuming the tested components to l be up, R(0), or down, R(1). Both ther.e gaantities can be calculated using the l PRA of a plant. When the rf ak is evaluated at the core-melt level, R(0) is ob-i tained by calculating the core-melt f requency by assigning an unavailability l cqual to 0 to the tested component. R(1) is similarly obtained by assigning an ! unavailability equal to one to the component. Similar calculations are per-formed for each of the components tested in the surveillance test. The calculction of R(1), when the component unavailability is equal to 1, requires care similar to that used for calculsting the A0T risk. Namely, the cut sets generated may need to be transformed to the minimal f orm and the mini-mal cut sets used f or the evaluation must not be truncated so as to eliminate cut sets containing the component in cuestion,
; The additional parameters needed are the unavailability of e ch of the com-ponents being tested by the test and their associated test inters 1. This in-forma
- ion is obtainable from the PRA of the plant 2.3 Differerace Between A0T Risk Impact and STI Risk Im act The dif fereccas between the A0T risk impact and the STI risk impact need to be highlighted. This is important particularly if risk evaluations are to be used to help ju? N fy A0T or STI modifications. The principal dif ferences aret
- 1. A0Ts, in gtneral, increase risk and hence the risk impact is an in-crease in risk.
- 2. STIs, in general, decrease risk and hence the risk impact is decrease in risk.
[
- 3. A0Ts cause the risk to increase (e.g. , the core-melt probability to increase): the risk is the accident f requency time the downtime.
, i
- 4. STIs cause the risk frequency to decrease (e.g., the core-melt fre-quency to decrease).
Even though STIs in general decrease risk, in certain cases they may actually , cause the risk to increase (i.e., the net risk benefits tre negative) owing to I the test's deficiencies. The projected risk inertar;e caused by the A0T can be translated to an average risk frequency increase by dividing by some reference I time period. For example, the increase in projected core-melt probability can ' be translated to an increase in projected core-melt f requency by dividing by one reacto vear. This translation is sometimes useful to have A0T and STI impacts , on the a,re scale. For the projected A0T risk increase using akf we use tho l refetenet timer period of I reactor year to make the scales comparable. l I i l
- 3. ANO-1 PRA AND DETERMINATION OF RISK Mr \SURES '
3.1 Arkansas Nuclear One - Unit One Probabilistic Risk Assessment l The plant analyzed in this report is the Arkansas Nuclear One - Unit 1, J f which is a 836 MWe Pressurized Water Reactor (PWR). The plant is a Babcock and ' Wilcox (06W) design and has been operating since 1977. This study utilized the Probabilistic Risk Assessment (PRA) of the plant ! ,l performed under the Interim Reliability Evaluation Program (IREP). The 1 REP ; analyses represent an integrated plant system analysis. Detailed analyses wera i performed of those systems required to respond to a variety of initiating events , and thoce systems supporting the responding system. The analysis included un- ! ava11 abilities during test and maintenance activities, human errors which could crise in restoring the systems to operability following test and maintenance and , in response to accident situations, and a thorough investigation of support sys- l tem f aults which could af fect oper21on of more than one system. Event tree / 1 f ault tree methodology was used to study the accident sequences that could lead , to core melt. The initiating events considered consisted of eight different ) types of transients and loss-of-coolant accidents of six dif ferent break sizes. ;
; Seismic, fire and flood-related events were not considered. The detailed de- l j scription of the systems, their interfaces, and the sequences leading to core melt are ;,covided in the document "Interim Reliability Evaluation Pgogrant i Analysis of the Arkansas Nuclear One - Unit 1 Nuclear Power Plant".
I i 3.2 ANO-1 Technical Specifications i l
; The ANO-1 technical specifications ossociated with the A0T and STI require-ments of the safety systems were the f ocus of this study. These requirements ) were obtained from the IR8P document . The ANO-1 PRA identified the maintain-able components in the safety systems, the A0T and the requirement of operabili-ty of redundant traino/ components. Appendices B and C summarizes these require-ments for each maintenance act delineated so as to define the input requirements 'f f or the calculation of the conditional core-melt frequency. The STI require- ! ments are presented in Appendix D. Each surveillance test identified in the j ANO-1 PkA was analyzed to determine the additional components being tested. A list of these additional components also is given in the appendix. Test inter-vals of many of the components were obtained f roe the fault exposure times pro-vided in the f ault summary sheets f or the systems. ; 3.3 Scope 4 > l The current LCO requirements, i.e., the A0T requirements, the surveillance l ] test requirements, and the requirement of system operability during maintenances l l are evaluated for their risk impact. The systems evaluated are those studied in
{ the ANO-1 PRA, and include the High Pressure Injection / Recirculation Systve., Low j Pressure Injectien/ Recirculation System, Core Flood System, Reactor Building i Spray System, Emergency Feedwater System, Reactor Building Cooling System Reac-
) tor Prottetion System, Service Water System, Engineered Saf eguards Actuation 1 System, Class IE AC Power System, 125Y DC System, Battery and Switchgear System, I
and Emergency Cooling System, and Emergency Feedwater Initiation Control System. f a
\ .- _ -- - - . ,-
l The system models and the accident sequences defined in the ANO-1 PRA were used for calculation of core-melt f requency and no attempt was made to alter any of ;he models or the data base of the PRA. The models and the data base were utilized and modified as required to re9 resent the testing and maintenance con-dition in the plant. 3.4 Calculation of Core-Melt Frequency l The risk impacts of A0T and STI requirements were calculated at the cort.- i melt f'equency level. 'ho core-melt f requency was calculated using the dominant accider.t sequences idr.atified in the IREP PRA. Care was taken to icelude se-quences that may become dominant due to the unavailgbility of the A0T component. The baseline core-melt frequency obtained is -4x10- and was benchmarked against results of the Battelle Columbus Laboratory (BCL) study on }pplications of Risk Measures at the Arkansas Nuclear One - Unit 1 Power Plant." The re-suits also are consistent with those obtained in the IREP PRA. The ANO-1 PRA provides a very detailed analysis of the recovery actions that may be performed during an accident. The recovery actions are those human actions which restore a f ailed component to service within a specified time frame. In the ANO-1 PRA, each of the events in the significant minimal cut sets l were analyzed for their potential to recover. Based on the analysis, which l depended upon whether the fault is recoverable, the location of the fault and time available for recovery, a probability of non-recovery was assigned. This probability of non-recovery was incorporated to determine the f requency of the minimal cut set. The inclusion of recovery factors significantly reduced the coregelt f requency in the PRA by almost an order of magnitude from 4x10 q to 5x10- after the inclusion of recovery. I In analyzing the risk impacts of A0T and STI requirements the recovery f actor was not included, but its incorporation would further reduce the risk im-pacts obtained. The calculation of various conditional core-melt f requencies C+, R(1), R(0), will be af fected by the recovery f actors ard a reevaluation of the recovery factors will be necessary for their proper incorporation. For example. if a component is already in maintenance, the probability of its re-covery is zero. Also, if the redundant component is under A0T, then the proba-bility of recovery of a component wculd be dif ferent f rom that assumed in the PRA. The justification for not incorporating the recovery factor is that it will provide conservative estimates of the risk inpacts so that decisions on ex-tensions and exemptions will be safer. i
- 4. RESULTS OF EVALUATION OF ANO-1 A0T AND STI REQUIREMENTS In this section, results of the evaluation of A0T and STI requirements are i presented. The components of the safety systems analyzed in the ANO-1 PRA are ovaluated f or the various AUT and STI requirements based on ANO-1 technical cpecification requirements. The impact on risk f rom changing the A07 and STI requirements are discussed and also the implications of the action statenents on current specifications.
4.1 Analysis of Risk Impact of A0T Requirements As discussed in Section 2.0, the A0T risk impact is the incremental risk when a repair is performed on a component for the entire A0T period, and depends upon the state-of-plant during maintenance, the maintenance f requency f or the component, and the A0T. Appendices B and C provide the detailed r=sults of the enalyses. Appendix B identifies the components in each safety system for which on-line maintenances are performed, tha type of maintenance performed, the re-configuration performed, and the requirement of operability of alternate trains or components based on the plant technical specifications. Appendix C presents both the single A0T risk given a downtime and the projected yearly A0T risk in- I corporating the maintenance frequency of the component. A summary of the results on A0T risks for the various maintainable compo-nents is presented in Tables 4.1 and 4.2 and also in Figures 4.1 and 4.2. The tables present, for selected components, the single A0T risk, the projected yearly A0T risk, and the average yearly risk due to repair. The average yearly risk due to repair represents the current repair contribution since it uses the average repair time for the component. The measure is similar to the projected yearly A0T risk except that the average repair time, as opposed to the A0T, is used. For any of the measures used, tne results show a wide variation, spanning over seven decades, in the risk impact of dif ferent A0T requirements. For example, the projected yearly AUT risk varies f rom 6.7E-6 to the order of 1.0E-12 or lower. l Table 4.1 presents the ANO-1 maintainable components with highest projected j A0T risk )ver one year period. The components are ranked by their projected i yearly risks. The table also contains the average repair time and correspond-1 ingly, the average risk due to repair under the current A0T reautrement. For the majority of maintenance conditions, the entire A0T period is not used and the average repair time is considerably less. Accordingly, the average risk due I to rtpair is lower than the projected yearly A0T risk. In that sense, the pro-jected yearly A0T risk calculated in this study is the A0T risk that is allowed I by the requirements. The table shows that the major components of the front-
; line safety systems and the componente in the support system have the highest A0T risk inpact. In these situations, the projected risk is less than 2% of the base-line risk from the core-melt frequency of the plant.
4 The table also presents the single A0T risk, i.e., the increase in risk I when the component is down f or an entire A0T period. As evident from the table, this is typically higher than both the projected yearly A0T risk and the average yearly risk due to repair. This is because the frequency of repair for the
i L Table 4.1. ANO-1 Maintainable Components with Highest A0T Risk Impact r l Average Average Repair Yearly Repair Frequency Risk Single Proj ected A0T Time (Events / Due to A0T Yearly Component (Hrs) (Hrs) Hr) Repair Risk A0T Risk 1 EFW pump P7A 36 7 3.1 E-5 1.3 E-6 2.47 E-5 6.7 E-6 2 CWU VCH4A 24 7 6.2 E-5 1.6 E-6 9.94 E-6 5.4 E-6 3 HP Pump P36C 60 7 3.1 E-5 6.0 E-7 1.88 E-5 5.1 E-6 4 SW Pump P4C 36 7 2.9 E-5 7.6 E-7 1.53 E-5 3.9 E-6 5 Diesel Generator 1 168 25 6.0 E-5 5.8 E-7 7.42 E-6 3.9 E-6 6 CWU VCH48 24 7 6.2 E-5 8.8 E-7 5.52 E-6 3.0 E-6 7 SW Pump P4B 36 7 2.9 E-5 5.6 E-7 1.02 E-5 2.6 E-6 8 Diesel Generator 2 168 25 6.0 E-5 2.7 E-7 3.42 E-6 1.8 E-6 9 EFW MOV CVY-2 36 4 1.8 E-6 1.1 E-7 6.02 E-5 9.5 E-7 10 EFW MOV CVX-1 36 4 1.8 E-6 1.0 E-7 5.90 E-5 9.3 E-7 11 EFW MOV CV2620 36 4 1.8 E-6 1.0 E-7 5.90 E-3 9.3 E-7 12 AC Bus (Trans. X5) 24 24 5.0 E-6 6.2 E-6 1.42 E-5 6.2 E-7 13 AC Bus B6 8 4 5.0 E-6 2.1 E-7 1.14 E-5 5.0 E-7 14 Battery Charger D05 8 8 2.8 E-6 4.5 E-7 1.R3 E-5 4.5 E-7 15 LFW Pump P78 36 7 3.1 E-5 4.7 E-8 8.84 E-7 2.4 E-7 16 Bus RS2 8 8 1.0 E-6 1.9 E-7 2.17 E-5 1.9 E-7 , 17 ESAS C-86 Power Supply 12 4 6.4 E-6 5.7 E-8 3.03 E-6 1.7 E-7 1 18 ESAS C-91 Pownr Supply 12 4 6.4 E-6 5.3 E-8 2.85 E-6 1.6 E-7 19 Bus D01 CB 01228 8 4 1.0 E-6 8.0 E-8 1.83 E-5 1.6 E-7 1 20 Battery Charger D04 8 8 2.8 E-6 1.6 E-7 6.52 E-6 1.6 E-7
Table 4.2. Selected ANO-1 Maintainable Components with Low AUT Risk Impact Average Average Repair Yearly Repair Frequency Risk Single Projected A0T Time (Events / Due to A0T Yearly Component (Hrs) (Hrs) Hr) Repair Risk A0T Risk l 1 HFI Pump P36A 60 7 3.1 E-5 1.1 E-9 3.42 E-8 9.3 E-9 2 RPS Channel A Bypass 4 4 1.4 E-3 1.1 E-9 9.0 E-Il 1.1 E-9 3 RBSS Pump P35A 36 7 3.1 E-5 6.4 F-!! 1.21 E-9 3.3 E-10 4 HP MOV CV1220 60 4 4 E-7 1.9 E-Il 8.28 E-8 2.9 E-10 1 5 LP MOV CV1400 60 4 4 E-7 8.0 E-12 3.42 E-8 1.2 E-10 6 VUC14A 24 4 4 E-7 8.2 E-12 1.40 E-8 4.9 E-Il
; 7 Bus RS4 8 8 1 E-6 3.2 E-11 9.13 E-9 3.2 E-11 I
8 SW MOV 3640 36 4 4 E-7 3.2 E-12 8.28 E-9 2.9 E-Il l 9 RBSS MOV CV2400 36 4 4 E-7 4.0 E-13, 1.03 E-9 3.6 E-12 10 ESAS Logic L135 12 4 1.3 E-6 1.6 E-12 4.13 E-10 4.7 E-12 11 EFW MOV CV2626 36 4 1.8 E-6 s c c t 12 EFW MOV CVY-30 36 4 1.8 E-6 c c c
- 13 A/C Unit VEIA 4 7 6.2 E-5 c c c I
c signifies negligibly small value i 1 4
_1 ._ ___, .. . . . _ . __. _. . ,_. ._ . -. I ' t-n
; SO -
CALi 10*8 t o 10*
- j 40 - C At 2 10*
- to 10 _ I j C AT. 3 10
- I to 10-e I 33 %
h CAT. 4 10*
- to 10* ?
Y 30 - CALS lose then 10 0 2W _ ~ t , s I i 21 % ' 5 to - ,
~
l 1 , l 6 \ l 10 - - l 4 7% - i 5
' I i Cati CAtt C AT. 3 CAto CAES f SINGLE ACT RISK IMPACT f
3 . f Figure 4.1. Single A0T risk impact for ANO-1 maintainable components I i 1 i l l 3 50 I C AT. I 10*
- to 10*
- h i
C AT. 2 10*
- to 10 h 6*
~ ~
l C AT,3 10* #t o 10 8 37 % ( C AT,4 10*' to 10 l , f j g 30
- CAT,5 t0*'to10*' 27 %
~
. l 1
u CAT.sio.. Inon10** . S i s 20 - ' - -- > 5 ' i S *.'. . ; ! W 12 % , , r io i _ s% . . .
' l i
n 0% % / .- ., . g l CAtl cat 2 CAL 3 cat 4 Cats Cats YEARLY ACT RISK IMPACT 1 1i Figure 4.2. Yearly A0T risk impact of ANO-1 maintainable components ! 1 4 d I t _. _ s.r-_.._ . _ _ . - . , , _ . . . . . _ , - .,_..,m.,_..... _ . . . _ _ . _ . . _ _ , . , , , . . _ . _ . . _ . . . , . _ - .
1 l ANO-1 components is lesa than 1. It should also be noted that the ranking of l the ANO-1 components based on the A0T risk will change if single A0T risk is used as the measure. The projected yearly A0T risk of a component is lower be-cause the frequency of maintenance is lower, but these components can pose high risk when down for repair. An example will be the Bus D01 Circuit Breaker 01228 l whose single A0T risk is over two orders of magnitude higher than the projected l l yearly A0T rick. , Table 4.2 presents selected ANO-1 components with low projected yearly A0T l risk across a one year period. The components in this table were selected ran-domly over the systems to show that under the current requirements many compo-nents across the safety gystems pose minimal risk due to their A0Ts. The pro-jected risk is below 10- and the A0Ts of these components could be extended without any undue risk impact on the plant. The extensions ceuld be granted in a manner such that the risk impact will still be low when taking into account the uncertainties of the calculation. The ranking of the maintainable components on their A0T risk impacts de-pei,ds on the incremental risk during the A0T, the f requency of maintenance, and the A0T. The high or low value of the risk impact is attributed to any one or a l combination of the above parameters. An important illustration is provided by l the risk measures obtained for high pressure system pumps P36A and P36C. The A0T risk impact of Pump P36C is much higher than that for Pump P36A. The A0T ) and the maintenance f requency of the pumps being the same, the dif ferenct As j attributed to the conditional core-melt frequencies for these pumps in mainte- I nance. Based on thu PRA model, during the repair of Pump P36A, the high' pressure injection system is able to deliver water to all four RCS cold legs using Pumps P3bB and P36C. However, during the repair of Pump P36C, if two cross over valves (MU1223 and MU1224) are not open, two of the four KCS legs cannot receive water through Pump P36A and P368. This results in a higher value f or the conditional core-melt frequency when Pump P36C is in maintenance. Another interesting comparison will be between EFW Pump P7A and Battery Charger D05. Both components have a comparable single AUT risk even though the A0T for the EFW Pump is over 3 times higher compared to the battery charger. However, the projected yearly A0T risk for the EFW pump is over an order of magnitude higher than the battery charger since its maintenance f requency is over an order of magnitude higher. Similar explanations based on the PRA model and the system designs can be obtained for the quantitative measures of risks obtained for other components. For maintainable components with low risk impact it is interesting to note that all three measures - single A0T risk, projected yearly A0T risk, and the
, average yearly risk due to repair are low. This implies t. hat the increare in j core-melt frequency when any of these components are down is insignificant and other parameters (repair time, maintenance f requency) cannot cause the risk to be significant.
4.1.1 Pisk Impact of Ertens[ons in A0Ts
- Based on the discussion of risk impact of current A0T requirements, it is evid ent that extensions could be granted for many components without undue im-pact on risk. Figures 4.1 and 4.2 show the current risk profiles of A0T l
i
requirements based on single A0T risk and projected yestly A0T risk, respective-ly. Figure 4.1 shows that for 57% of the maintainable components, the single AUT risk is below 10 6 and Figure 4.2 h the projected yearly risk is below 10 9.owsThese that for 79% of figures the same that, demonstrate components, based on risk arguments, there is a wide disparity in current A0T requirements. In this study, the impact of changes in A0T requirements were studied to analyze how the A0T risk profile would be altered. Components with low A0T risk 4 impacts are candidates for extensions f rom the poi The A0Ts of components with risk impacts below 10 were 9t ofincreased view of risk by analysis. a f actor a of two and the resulting risk profiles are presented in Figures 4.3 and 4.4. In this calculation, the other conditions were maintained unchanged in terms of ] The tota operability requirements of alternate trains and components.tive risk increase , i.e.,due to the ex 4 about 0.25% of the baseline risk due to core-melt f requency. A comparison of Figure 4.3 with 4.2 shows that the impact on the risk profile is also minimal. As expected, there is a slight shift towards higher risk categorieo neverthe-less, the risk impacts of 73% of the components are still below 10 ,. However, the impact on single A0T risk, presented in Figure 4.4, shows that about 10% of
, the components have shif ted to the high risk category. The single A0T risks of j components are not additive, but the individual single A0T risks must be taken ,
into consideration in deciding A0Ts. A more conservative approach to A0T exten- l l sion would allow an extensions of a factor of two for components with current i { ' j 1 t i ; ) 50 I j C AT. I 10*' to 10*
- l j _
C AT. 2 10*
- to 10* *
{ C AT. 3 10 to 10*
- l 0 C AT. 4 10*
- to 10'? f
! 30 - C AT. 5 10*' to 10*
- 2s% _
! CAT.6 tesi toon 10 25 % ; q 20 - IS% 18 % - ! O
' I I
$0 - .% . .
0% j 0 l C AT. i C AT. 2 C AT. 3 C AT.4 C AT. S C AT. 6 l YE ARLY A0T RISK IMPACT i ! J Figure 4.3. Yearly A0T risk of ANO-1 maintainable components for ' j factor of two in i impact below 10 prease in A0Ts of components with risk ' i ! l
50 C AL i 10 to 10*
- C AL 210** to 10* 8 40 - ""
g C AT. 3 10" ? to 10* *
$ C AT.4 10 to 10
z 2 C AL S less than 10 2 30 .. 28*4 27'4 - 8 o y g _ 20'4 - 20*4 _ d 5 - 10 - . 5 *4 c - .. CAT.I cA12 C AI 3 cat 4 CALS SINGLE A0T RISK IMPACT l l Figure 4.4. Single A0T risk impact for a factor of two increase in . A0Ts of components with yearly A0T risk impact below 10 #. risk impacts below 10-8 This approach would allow extensions of 52% cf the I maintainable components and the net gumulative risk increase due to the exten- I bions would be of the order of 4x10 , i.e. , 0.01% of the baseline risk due to core-melt frequency. Figures 4.5 and 4.6 show the A0T risk profile with such an l extension and the change in,the risk categorization would oe limited to essen- l tially categories below 10 . The high risk categories would remain unper- l turbed. In this case both single A0T risks and yearly A0T risks would have l insignificant changes. I Various other approaches of changes in A0Ts of the components that would incur small incremental risk to the plant is possible. In the above approaches, a group of components within the safety systems would be allowed extensions, whereas A0Ts of selected components with higher risk impacts would remain un-changed. The majority of the safety systems have few selected components for which the A0T riak impact is higher. An extension of A0Ts of the maintainable components in a safety system can result in higher incremental risk than that obtained in the other two extension approaches discussed above. FC : example, an increase in the A0Ts of the High Pressure System Components by a factor of 2 (from two and half days to five days) would result in a net increase in the pro-jected yectly A0T risk of the order of 5.2 E-6, i.e. , 1.3% of the baseline risk due to core-melt frequency. However, in mny systems, a similar A0T extension can be perfnrmed with minimal impact on risk. A factar of two increase in the A0Ts of the mintainable components in the Low Pres te System would result in a net incremental cumulativt risk of the order of 10-k
SO CAT.I10*8 t o 10*
- 40 C LT. 2 10*' to 10* 8 -
n C AT. 3 10* ?t o IO* ' N C AT 4 10* Sto 10* ? 339, i 30 - CAT S 10*' to 10 3 29 _ g CAT.. ,o.. ,so. ,0.. 5 20 _ l . s. _ g 13 % 1 r 10 _ . v. _ i O*4 f/ / l j o . > C AT. I C AT. 2 C AT. 3 C AT 4 C AT. S C AT. . YEARLY ACT RISK IMPACT 4 Figure 4.5. Yearly A0T risk of ANO-1 maintainable components for a factor of two ingrease in A0Ts of components with risk
- impact below 10-J l SO
} CAT. I 0- e ,, in- 4 l C AT. 2 10*
- to 10* 8 m
40 - C AT. 310* I to 10-e
! $ C AT. 4 10-s to 10* I
, CAT.5 less then 10'8
- 5 2. v.
) 8 23'4 l 5 20 - E r . 10 9 ; s go _ , 6 Y. I '
- O _
C AT. I CAT. 2 C AT.3 CAT.4 C AT. 5
$1NGLE A0T Rt$K IMPACT Figure 4.6. Single A0T risk of ANO-1 maintainable components for a 1
factor of two ingrease in A0Ts of components with risk impact below 10-
4.1.2 Evaluation of Action Statements l l l The action statements for limiting conditions of operations define the l obligatory action if the requirement of the TS are not met. For A0Ts, actions ! cre defined if the componeist is not returned to operational status within the A0T defined. Usually, the action statements will require a change in the opera-tional mode of the plant. For example, if a component in the low-pressure in-jection system train A is found inoperable and not repaired within 48 hrs, the plant should be in hot shutdown condition within the next 12 hrs and if not cor-rected, in the cold shutdown condition within the following 72 hrs. l Based on the risk implications of the AUT requirements, the action state-ments appear unnecessarily severe. For example, the maintenance of LPIS P35A for an additional 60 hrs results in an incremental risk of 3.43x10 , pump . The cxpected f requency of maintenances requiring longer repair times compared to the A0T is lower than the maintenance f requency of 3.1 E-5 events /hr assumed for the pump. The additional risk is thus not expected to be mere than 9.3 E-8. Und e r these circumstances, changes in the operational mode of the plant are unneces-sary and possibly introduce more risk to plant operation than that incurred through allowing additional outage times. Alternate means of risk reduction, through monitoring and testing of alternate failure paths, may further reduce the risk of additional outage times. In addition, the punitive action state-ments may result in incomplete repair of components, thus increasing the fr1i- ! quency of maintenance. Similar risk arguments can be made for many of the ) action statements based un violations of A0Ts. The appropriate action state- I ments for enhancing the long-term safety of the plant would be the requirement I of proper repair to reduce future occurrences of similar problems and assurance l of availability of alternate means of risk reduction. l 4.1.3 Transferring of AOT Requirements From Technical Specifications ; The results of the risk impact of the ANO-1 A0T requirements demonstrate ; that many of the A0T requirements are unieportant. The expected frequency of maintenance of many of these components is low and a large increase in their A0Ts would not impose undue risk. For example, a factor of ten increase in the A0T of ghe RBSS pump will cor. tribute an additional risk of the order of 3.5x10 . These components are candidates f or removal f rom technical specifica-tions to some alternate means of control. A review of Figure the riskimpactof52%ofthemaintainablecomponentsisbelow10g.2showsthat , and these would . not necessarily require the strict control of technical specifications. From a risk control point of view, technical specifications should focus on components and conditions that are significan': contributors to risk. Risk and i reliability analyses provide evidence that if critical combinations of compo-nents are simultaneously unavailable, this may cause a large increase in risk. Current technical specifications do not always control these critical combina-tions of component; which are identifiable through risk analysis. In consider-ing removal of A0T requirement f rom TS, assurances must be provided that outage of critical combinations of safety significant component outages do not overlap. i l l l s k_
4.2 Analysis of Risk Impact of STI Requirements The risk impact of a surveillance test is quantified in terms of the risk ' benefit that result from the test. The risl: benefit of the test is the reduc-tion in risk due to the ability of the test to detect a failure that may have occurred during the standby period and may otherwise have gone undetected. The risk impact depends on a number of parameters. They include f ailure modes of the components tested, the test interval, the failure rates of the compo-nents, and the risk importance of the components tested. The surveillance tests identified in the safety system are analyzed with respect to their risk impacts and the detailed results are presented in Appendix D. A summary of test re-quirements, including the type of test, interval, duration and the list of com-ponents to be tested in each case is also provided. The results of the analysis show a trend similar to that observed for A0T requirements. A significant number of tests provide small risk benefit. The b risk benefit varies from 9.1 E-5 t9 elow 1.0 E-12; 53% of the surveillagce tests have risk benefits below 10- bat 14% have benefit higher than 10 . Table 4.3 presents the surveillance tests with highest risk benefits: in most cases these are due ' a the large number of components being tested. For example, the functiona'. ~est of the room cooler unit tests the chill water unit, the fan, and the associated valves, while the pump flow tests will test the valves in the train along with the pump. The other reasons for the high risk benefit of a surveillance test is the impact on the core-melt frequency due to the component failure, the (silure rate of the component, and the test interval. Table 4.3. Surveillance Tests With Highest Risk Impact TEST RISK TEST TYPE OF TEST FREQUENCY IMPACT
- 1. Room Cooler Unit A Functional Quarterly 9.3 E-5
- 2. EFIC Signal Path DgD2 Proper Operation Monthly 4.7 E-5
- 3. HP Pump P36C Flow Monthly 4.4 E-5 4 Room Cooler Unit B Functional Monthly 4.3 E-5
- 5. EFW Puop P7A Flow Monthly 2.9 E-5
- 6. LP Pump P34B Flow Monthly 2.8 E-5
- 7. SW Pump P4C Vibration & Temp. Monthly 2.5 E-5
- 8. SW CV 3810 Stroke Annual 2.4 E-5
- 9. EFIC Signal Path AC04-BD04 Proper Operation Monthly 2.2 E-5
- 10. Diesel Generator 1 Start Monthly 1.7 E-5
- 11. EFW CV2626 Stroke Quarterly 1.6 E-5
- 12. EFIC Signal Path VCD2 Proper Operation Monthly 1.4 E-5
- 13. LP Pump P34A Flow Monthly 1.4 E-5
- 14. HP Pump P36A Flow Monthly 1.36 E-5
- 15. HP Pump P36B Flow Monthly 1.35 E-5
- 16. RBSS Pump P35A Flow Monthly 1.3 E-5
- 17. RBSS Pump P35B Flow Monthly 1.3 E-5
- 18. SW Pump P4B Flow Monthly 1.3 E-5
- 19. EFW CVY-1 Stroke Quarterly 1.2 E-5
- 20. EFW CV2620 Stroke Quarterly 1.2 E-5
Another important observation is that appropriate testing schedules can be defined to increase the risk benefit or to increase the test interval without affecting the risk benefit. An analysis of the surveillance tests and the asso-ciated components tested (Appendix D) shows some components are tested as part of more than one test and, as these tests are performed sequentially, the maxi-mum benefit from these tests is not achieved. For example, Valve CV14078 is tested for the monthly flow test of each of the pumps, P36C, P348, and P358. The high risk benefit of flew tests of pumps P358 and P34B is due to Valve CV1407B because of its risk importance and high failure rate. One way of maxi-mizing the risk benefit would be to schedule the testing of pumps P36C, P348, and P358 in a staggered manner, thus reducing the test interval by a factor of 3 and consequently increasing the benefit by the same factor. The other approach would be to perform one of the tests in short intervals to detect any failure of the valve, then the other two teste could be extended without af fecting the risk in the plant. Many current surveillance tests can be redefined in this manner to design an integral test schedule for the plant through the insights of risk analyses. Table 4.4 lists selected surveillance tests with minimal risk impacts. These types of tests are currently performed in many of the safety systems and their intervals could easily be extended without affecting risk. Table 4.4. Selected Surveillance Tests With Low Risk Impact TEST RISK TEST TYPE OF TEST FREQUENCY IHPACT
- 1. ESAS Logic A110 Proper Operation Monthly 5.0 E-8
- 2. CV3812 & CV3814 Valve & Interlock Quarterly 2.3 E-8
- 3. EFIC Path A009 Proper Operation Monthly 1.6 E-8
- 4. RPS Relay Cl Proper Operation Monthly 6.2 E-9
- 5. CV2400 Stroke Quarterly 1.2 E-9
- 6. Sensor PT2405 Calibration & Proper Operation Shift 8.8 E-10
- 7. ESAS Logic A122 Proper Operation Monthly 3.7 E-10
- 8. RPS Relay KAl Proper Operation Monthly 1.0 E-12
- 9. RPS Relay KA3 Proper Operation Monthly 5.0 E-13 4.2.1 Risk Impact of Extensions in STIs The risk benefit of each surveillance test will increase with an increase in the test interval. This is because the probability of a standby f ailure dur-ing the increased test interval will be higher and thus the probability of fail-ure detection by the test accordingly will be higher.
Figure 4.7 shows the risk profile of current surveillance test requirements in the ANO-1 plant. The impact of changes in STIs was st interval requirements of tests with risk impact below 10"ydiedFigure by increasing 4.8 shows the the risk profile of surveillance tests with tervals of tests with risk impacts below 10 9. factor of twoonincrease The effect the riskinprofile the in-
is minims 1 except for small rearrangements between the third and fourth cate-gorieg. The incremental risk impact due to such an extension is of the order of lx10 , i.e., -0.25% of the baseline risk due to core-m 1 f requency, and still 50% of the tests will have risk impacts below 10 9.t The risk impacts of many of the surveillance tests are so small that a much larger extension could easily be granted f rom risk considerations. Figure 4.9 presents the risk file with a factor of four extensions in STIs with a risk impact below 10 pro- . l Such an extension would significantly reduce the burden of testing in the plant ) and would not result in an unacceptable risk. i 50
! C AT. I 10*
- to 10
C AT. 2 10*
- to 10
40 - C AT,3 10 to 10*' ~ C AT.4 IO.e ,, go.? 3 5 '/. e
>- 1 0
w 30 - C AT. S less then 10**
- i I
o
> {
$ to -
J,83 le v. ,
$ 14 v. J5J . ,
io . ' 0 ^ ' ' CAT.I cat 2 C AT. 3 C AT.4 C AT. 5 l SURvtlLLANCE TEST RISK IMPACT Figure 4.7. Risk Impact of ANO-1 Surveillance Test Requirements
- l. 2.2 Transferring of STI Requirements From Technical Specifications I
Risk analyses of surveillance test requirements provide insights in decid- ! ing whether unimportant STIs should be transferred to some other form of con- ! trol. As presented in Figures 4.8 and 4.9, a significant increase in the test j intervals of a large fraction of the STIs would have negligible incremental risk j impact. However, risk impact for at least 29% of the tests are significant and assurances are necessary that these tests are performed to detect any failures occurring in the reandby period. In addition, manuf acturer-recommended test in-tervals should not be violated, if they are necessary to naintain the integrity of the component. l 4 1
50 CAT. I 10*' to 10** 40 - C AT. 2 10* ' to 10* 8 _ C A T. 310* ?t o 10*
- 35g
{ C AT. 4 10* 8 to 10*? W 30 - CAT.S leu thea lo e _ b g 22 % 20 ~ ~ 14 % 15 % IS% 10 - - e W , W C AT. i C AT. 2 C AT. 3 C AT. 4 C AT. S SURVglLLANCE ftST RISK IMPACT Figure 4.8. Change in risk impact of surveillance test requirements withafactoroftwojnereaseintheSTIsoftestswith risk impact below 10-50 C AT. 4 IO*' to 10*
- 40 - C AT. I 10*
- to 10* '
C AT. 3 IO* ? to 10*
- g C AT. 4 10* 8 to 10*?
h30 - CAT. S leu then 10*8 - 23 % I* % gto ' '
; l -
E 15 Y. 14 % 10 - n
/'/
,s. ), .
- l ll C AT. I CAT.I C AT. 3 C AT.4 Caf. S SURytlLLANCE ftST RISE IMPACT Figure 4.9. Change in risk impact of surveillance test requirements with a factor of four nerease in the STIs of tests with risk impact below 10-
l i
, l
] The transfer of STIs f rom technical specifications can be performed in a variety of ways. The results of this study indicate that integral tests, i.e., 4 tests of systems or system trains detecting failure modes of a group of compo-I , nents, are more risk effective. Risk insights can be used to develop fewer in-j tegral tests to control the risk and the remaining test requirements can be j moved to other forms of control. Removing the entire STI requirements f rom - technical specifications, where the test interval of risk important tests is ] significantly increased, may require an alternate form of risk control activity. l e.g., condition monitoring of risk important failure modes of selected 4 components. l 3 ' l t 4 i
! l } !
6 I I i 4
)
1 l l l r i I 1 5 1 } 1 l i i , 1 ,
- 5.
SUMMARY
AND CONCLUSIONS In this report AUT and STI requirements of the ANO-1 nuclear power plant safety systems are evaluated from a risk perspective. Measures of risk impacts are defined and it is shown how they can be calculated, using the PRA of the plant. The risk impacts of current A0T and STI requirements are categorized on a risk scale that allows a study of the impact of changes in these requirements. The measure of risk impacts chosen are conservative so that decisions or conclu-sions based on this analysis are safer f rom a regulatory viewpoint. The results provide the basis for the following conclusions on various aspects of technical specification issues. 5.1 Risk Implications of Current Requirements The risk impacts of A0T and STI requirements vary widely on the risk scale. A significant portion of these have small impacts. Approximately fifty-two per-cent of the risk impacts of,both A0T and STI requirements studied in the ANO-1 nuclear plant are below 10-5.2 Bases for Technical Specification Requirements Many items 1duatified in technical specifications, particularly those asso-ciatyd with LCO requirem2nts, do not have valid technical bases. The TSIP re-port has addressed this issue. In many areas of technical specifications the risk-based methodology used in this report can provide the means to establish valid technical bases. A consistent basis for specifications will result in clarity of purpose and better compliance. The process of extensions and changes in the specifications also can be streamlined. 5.3 Validity of Action Statements The results of this study indicate that the risk impact of many of the re-quirements are small and extensions to or relaxation of A0Ts will also impose minimal incremental risks. Thus, action requirements for changes in the opera-tional mode of the plant due to inf requent violation of an A0T are unnecessary and possibly introduce more risk, due to transfer to shutdown mode and return to operational mode. To enhance long-term safety of the plant, these action state-ments can be modified to be requirements for problem detection and correction. Insights based on risk and reliability can form the basis of such modifications. 5.4 Changes in A0Ts and STIs Changes in A0Ts and STIs of risk-unimportant components can be granted without affectir.g the plant risk. Extensions in A0Ts allowing for the adequate repair of components should reduce both the expected f requency of outages and unscheduled shutdowns. Extensions in STIs can be granted with little ef fect on risk, and concomitantly, reduce the burden on the operational staff so that they can focus on activities that are more significant to safety. Reduction in the number of tests will also reduce unst heduled plant shutdowns resulting f rom test-caused transients. Permanent rtanges in these requirements to more accept-able limits will result in reduction of one-time extensions and exemption j
requests. Another alternative is to reduce the requirement of testing at power whereby risk-unimportant surveillance testing are carried out during refueling outages. This approach will also have similar benefits in terms of reducing the operational burden and increasing attention to plant safety. 5.5 Improvement to Current Technical Specifications The evaluation of A0T and STI requirements of a plant has identified that the requirements in technical specifications are not consistent from a risk viewpoint. Risk-based analysis can be used to significantly reduce the number of surveillance test requirements and fewer integral surveillance tests can be defined that would be adequate to maintain the risk level of the plant. A0Ts can be defined from a risk perspective allowing adequate time for repair; and action statements then can be modified to address both the short- and the long-terta safety of the plant. , I l l
REFERENCES f
- 1. Beckham, D.H. et al., "Recommendations for Improving Technical Specifica-I tions," NRR Internal Report, September 1985.
- 2. Kolb, C.J. et al., "Interim Reliabilty Evaluation Programt Analysis of Arkansas Nuclear One - Unit i Nuclear Power Plant," NUREG/CR-2787. June 1982.
! 3. Boccio, J.L. et al., "Procedures for Evaluating Technical Specifications - ; Integrated FY86-87 Program Plan," BNL Technical Report A-3230 5-16-86 May i 1986.
- 4. Samanta, P.K. and Wong, S.M. , "A0T Risk Analysis and Issues Limerick Emergency Coolant Systems," BNL Technical Report A-3230 2-25-85. Feb. 1985.
I 5. Vesely, W.E., "Evaluation of Allowed Outage Times (A0Ts) from a Risk and ; Reliability Standpoint," BNL Technical Report A-3230 6-28-85, June 1985. l
- 6. Samanta, P.K. et al. , "Risk Methodology Guide for A0T and STI Mcdifica-I tions," BNL Technical Report A-3230, 12-02-86, December 1986.
i 7. Rayes, L.G. and Riley, J.C. , "WAM-E User 's Manual," EPRI-NP-4460-CCM, July
. 1986. t I !
1 8. Cinzburg, T. and Powers, J.T., "FRANTIC III - A Computer Code for Time-i l Dependent Reliability Analysis - Vol. I - Methodology Manual, Vol. II -
; User's Manual," BNL Technical Report A-3230 7-01-86, July 1986. )
- 9. Vesoly, W.E. et al., "Evaluation of Diesel Unavailability and Risk Effec-tive Surveillance Test Intervals " NUREG/CR-4810 BNL-NUR74'52022, May 1987. ,
I 10. Davis, T.C. et al., "Applications of Risk Measures at the Arkansas Nuclear i l One - Unit 1 Power Plant," BCL Draft Report, Feb. 1984. i 1 i 1 l I
APPENDIX A DETAILED DERIVATION OF STI RISK MEASURE l ) i _ _ _ _ _ - - _ _ - - -
l i A-1
- APPENDIX A !
l DETAILED DERIVATION OF STI RISK HEASURE , i i l The risk impact of a surveillance test is defined in terms of risk benefit ; j of the test; and a bounding, conservative evaluation approach is presented in ! j the main report (Section 2.2) for quantifying this aspect. In this section, a l
- further detailed derivation of the risk benefit of a surveillance test on a com-ponent is presented to clarify the influence of some of the f actors. This de-rivation will include the following additional considerations
t
- 1. The separation of demand vs standby time-related f ailures.
l l i Component unavailability can be considered to be cooposed of a demand f ailure contribution and a standby time-related f ailure contribution. The de- l {) mand f ailure contribution is associated with a demand on the component and the , component is susceptible to the same f ailure probability every time a demand is l , made on the component. Thus, a surveillance test does not influence this por-l tion of the unavailability. Standby time-relato$ f ailures are detected and cor-l j rected by surveillance tests. The risk benefit of a surveillance test will de- [ j pend on the portion of the component unavailability that is standby time-re- 1 J 1ated. However, the use of this definition requires a proper partition of the ] f ailure data into stamiby time-related and demand-related failure modes. An ! evaluation of each f ailure, as to whether its cause is demand or time related, ; ( is necessary to develop the data base f or precise evaluation of risk benefit of : ] a surveillance test. An example of such detailed data evaluation is presented l l in Ref. 9. l l ! j 2. Human error associated with a test. Surveillance testing of a component is associated with human errors. i.e. , errors which can cause a tested component to be lef t in a f ailed condi- l tion. In many situations, this type of human error can be the dominant contri- , butor to component unavailability. The derivation presented here considers ( human error and it will show that the risk benefit of a surveillance test is not j influenced by the human error, i.e. , its ef fect is negligible. j
- 3. Downtime associated with a test.
Many surveillance tests are associated with downtimes during which the component is unavailable if a demand occurs. The derivation of the risk benefit presented here includes the risk due to such downtimes. However, since the test downtimes are significantly smaller than the test interval, its eff ect on the risk benefit of a test is usually negligible.
- 4. Non-detection probability.
Another consideration in the deteruination of the risk benefit of a test is the possibility of non-detection of component f ailure. The non-detec-tion of component f ailure during a test will reduce the risk benefit of a test. In the derivation presented, the probability of passing a test in a f ailed con-l ditional was assumed to be zero.
A-2
- 5. Test-cause degradation Surveillance testing can cause wear-out of a component, resulting in test-caused degradation. The benefit of surveillance testing will be reduced if the test itself is causing wear-out of the component. When test intervals are increased, the effect of this contribution is expected to diminish. In the de-rivation of the risk benefit presented below, such ef fects are not ennsidermi, i.e., the degradation of the component due to test is assumed negligible. j In carrying out the derivation, the risk before a test (Rb), the risk af ter the test (Ra), and the risk during the test (R ) tare defined separate-I ly to obtain the risk benefit of the test. The risk benefit of a test on a com-I i ponent is:
a r g =R - R, - R (A-1) ] b i Risk Before the Test of Component. Rh :
- l I I The risk posed by a component is due to the possibility that the component l 1s failed. The risk before the test of a component is due to the probability that the component, due to the following three reasons, may already be in a '
f ailed (down) state or may f ail during the test.
- l. From the previous test, the component may have bren lef t in a f ailed condition due to human errors. Let ho define the human error proba-bility associated with a test.
- 2. The component may have f ailed during the standby-time period following i the previous test. The hazard is represented by At, where A is the l l f ailure rate of the component and t is the exposure time (where the ex-pesure is on the average equal to half the test interval, T).
) 3. The component may fail with a probability go, where qo is the desarki-f ailure probability. A component is always susceptible to this l , f ailure probability anytime the component is demanded. 1 Mathematically, this can be expressed as R b = F ," R(1) + P (1-q,)* R(0) + Pp "
- q,
- R(1) (A-2) where 1
Ph"istheprobabilitythat the component is up going into the test, i is the probability that the component le down going j Pi wn = (1-Pup), into the test, go is the demarsi f ailure probability, 1 l i l
A-3 P *qo is the probability that the component will fail due to demand-related failure causes even if it enters the test in an up state, R(0) signifies the risk when the component is in an up state, ard R(1) signifies the risk when the component is in a down state. P" is given by: P = h ,+ (1-h,)At , cnd (A-3) P =1-{h,+(1-h,Mt} , where ho is the human error associated with the test and signifies the proba-bility that the component was left in a f ailed state, f rom the previous test, A is the failure rate of the component, and e is the exposure time equal to half the test interval. T. Using Eqns. (A-2 and A-3), Rb can be expressed ast R b (S#(l'9){h,+(1-h,)At}]R(1)+[1-{h,+(1-h,)At}](1q,)R(0) o o . (A-4) Risk After the Test of a Component, R. The risk following the test of a component is due to the possibility that the coeponent may f ail due to causes not correctable at the test (d emand-r elat ed fcilure), or the test itself may have caused a f ailure or the test may have f ailed to detect a failure. l Mathematically, this can be expressed ast R, = Pdo"
- R(l) * (I~I do )R(0) l where P do is the pr bability that of the component may fail after the test and is given by P
do "D o + (1-h,)q, it is assumed here that the probability of non-detection of f ailure of the com-ponent at the test is negligible.
A-4 Accordingly, Ra can be written ast R, = {h, + (1-h,)q,} R(1) + (1-h,)(1 q,)R(0) (A-5) Risk During the Test. Rt The risk during the test results f rom the test-related downtime associated with the component, i.e., the time pericd for which the component is not avail-able and cannot be returned to emergency safety position if a demaM were to occur. The downtimes associated with a test are:
- 1. Test downtime, i.e., the time for which the componaat !,e unavailable for the performance of the test. In many cases, a demand can override a test and the test downtime unavailability depends on the failure to override.
- 2. Demand-related downtime, d, i.e., the downtime associated with che demaM-related f ailure of the component at test.
Mathematically, R; can be given ast R =
*R(1)+[1-{h,+(1-h)At}}q *
- R(1) (A-6) where the first term is the test downtime contribution, and the secoM term is the demand-related downtime contribution. The nomenclatures are defined as follows:
qt is the unavailability during the test, t is the duration of the test, d is the downtime associated with a demand-related failure, and t is the exposure time equal to half the test interval, T. Risk Impact of a Surveillance Test on a Component The risk impact of the surveillance test on a component is, as defined in Eqn. (A-1). ( r g =R b - R, - R, ( aM using Eqns. (A-4 A-5. and A-6) one obtains. 9 t *t r g = [(1-q ,)(1-h,)At][R(1) - R(0)] - T
*(I)
(1-{h,+(1-h,)At}]q,
- R(1) (A-7) t
_ _ _ _ . 1
l A-5 i Typically, t/T + 0 ani qo, ho < 1, and t r g=At[R(1)-R(0))-[1-{h,+(1-h,)At}]q,a f*R(1) A bounding approximation to the above equation is I r g
- q[R(1) - R(0) (A-8) ,
there q is the component unavailability and is assumed to be purely time-related ' i fcilures, which also eliminates the contribution f rom demand-related downtimes. J t b l i i . i 1 l ! t ) ! i r, I i I 1 I l I i
l t ( t i APPENDIX B l MAINTENANCE REQUIREMENT St!MMARY OF ANO-1 SAFETY SYSTEMS f I I i i i i [ r {
}
I k
Bal Table 8.1, Wintenance Requirement $wmmary
$ystem: HPl$/HFR$
Component Under Type of Components Aligned Away sy stem 4omponent usintenance kalntenance from EA Position Required to be Operable HPI pump P364 Maintomance requiring Close valves: MJ20A & W 184 HPl pues train P3ta, P3tc disassembly Open circuit breater A306 ($F valve CV1227. CV1228 t Volvo: CV1219 Maintenance retwiring Close valves: W1223 HPl pump train P3(a, P3tc ; d i sa s s emb l y W20A ($F valve Cv1227. Cv1228 ( MJ2G Open circuit breakersi 85152 85131 [ Close valve Cyl22019 open open valves MJ23 & MJ24 I valve Cv1220 Raintenance reawiring Close valve : MJ1224 HPl pump P3ta, P3ec alsatteably MJ2CA ($F valve CVl227, Cyl224 Open circuit breakers: 85152 85151 Close valve Cv121919 epen Open valves MJ23 & WJ24 M*) pump P3tc Reintenamco requiring Close valves: MJ20C HPl pump train P364, P3tB d i s a s s eat ly MJitC ($F valve Cv1219. Cv1220 Open circuit breakers A406 valve CV1227 kelntemence reqwiring Close valves neJ202 Hei pump train P364. PJ68 81 s e s s ** b l y MJ23 ($F velee Cv1219, Cyl220 i Wil22) Close Cv1228 Open cirewit breakers: 86151 , 64152 valve Cv1228 Maintomance reawiring Close valves: MJ20C kPI rep train P36s. P3(4 . alsassebly MJ23 ( $F v a l ve C v 1219, Cv 1220 MJ1224 ( Close Cv1227 open circuit breakers: 64152 14131 i mPl pwpo P3(a W latemance reiwirlag Cicse valvest MJite HP: pep train P3t A. P3tc l 41sassently W20e E$F istves Cel219. Cv1220 l Open cirewit t~reakers: a307 Cyl227. Cv1728 A407 nelves Cvl407 or unintemsece reawiring Close tel Cvl40s alsassenbty (tertornes during snwtaan l I l
B-2 Table 's 2 Mainterance Reg Jnt Summary System: LPl!'LPh. Component Urder of Components Aligned Away System / Component Maintenance aca f rom E S Pos i t ion Hoquired to be Operablo Valve CY1440 ulring Circuit breaker BC161 open LP pump train P3EA diso Valve BW68 closed ESF valve Cyl401 Circuit breaker A405 open valve CV1429 Maintenance requiring Circuit breaker 86161 open LP pump train P34A disassembly Velve CV1400 clossd ESF valve CV1401
%dlve BW68 Closed Circuit breaker A405 open Pump P348 Maintenance requiring Circuit breaker A405 open LP pump train P34A disatsembly valve CV1400 closed ESF valve CY1401 Circuit breaker 86161 open Valve BW88 closed Valve CV1405 Maintenance requiring Circuit breaker 86161 opsn LP pump train P34A
. d i sa ss embly Valve OwSB closed ESF valve CVl%01 valve CV1408 closed Circuit breaker B6164 open Valve CV1415 closed Circuit breaker 86163 open Yalve CV1401 Maintenance requiring Circuit breaker B51114 open LP pump train P348 d i s ass emb l y Valve 8wSA closed ESF Valve CV1400 Circuit besaker A305 open valve CV1423 Valve CV1401 closed LP pump train P348 Circuit B51114 open ESF valve CV1400 Valve BwSA Clos 4d Circuit breaker A305 open Pump P34A Malntenance requiring Circuit breaker A305 open LP pump train P34B d i sase emb ly Valve CY1401 closed ESF valve Cv1400 Circuit breaker B51114 open Valve BwdA clos &d Yelve CYl405 Maintenance requiring Circult breaker 651112 open LP pump train P348 Valve DwSA closed ESF valve CV1400 Disassomtiy requiring valve CV1414 closed Circuit breeker B51113 open Valve Cvl407 closed Circuit breaker B5164 open CV1415 Not allowed at po or CN1414 Not allowed at power
- ~ . _ - ~. ~
8-3 Table 8.3. Maintenance Requirement Summary System: Reactor Building Spray Component Under Type of Components Allgr.or! Away System / Component Maintenance Maintenance f rom ES Position Required to be Operable Pump P358 Maintenance requiring valves R85$ oump train P35A d isassembly 851B closed ESF valve CV2401 BW58 closed P350 circuit breaker ogen Pump P35A Maintenance requiring Valves: *~ RSSS pump train P350 disassembly BSIA closed ESF valve CV2400 ; i BWSA c losed ! Circuit breaker A405 open
.l Volvo CV2400 Maintenance requiring Valve BSIB closed RBSS pump train P350 l d i sass embly P350 circuit breaker closed ESF valve CV2400 ,
I Valve CV2401 Maintenance requiring valve BSIA Closed RSSS pump train P350 j disassembly P35A Circuit breaker closed ESF valve Cv2401 l Table B.4 Maintenance Requirement Summary Sys+em: Emergency Feedwater (EFWS) Component Under Type of Components Aligned Away System / Component Maintenance Maintenance from ES Position Required to be Operable Pump P78 Maintenance requiring Close valves: CV2800 EFW pump train P7A disassembly CVX-3 CVX-2 Disable breakers: 5333 A311 .l l Pump P7A Malatenance requiring Close valves: CY2802 EFW pump train P78 disassembly CVX-1 CVX-4 l Disable breakers: Y-1 l Y-2 5533 6181 l velvo Cv2803 Maintenance requiring Clese valves: CV2800 EFW pump train P7A disassembly CVX-2 l CVX-3
; Olsable breakers: A3tl d
S193
$194 I
8-4 Table 8.4 (Cont'd) Component Under Type of Components Aligned Away System / Component Maintenance Maintenance f rom ES Position Required to be Operable valve CV2806 Maintenance requiring Close valves: CV2802 EFW pump train P78 disassembly CVX-4 CV Y- 1 CVY-2 Disable breakers: 6181 6185 Valve CVX-3 Maintenance requiring Close valves: CV2800 EFW pump train P7A disassembly CVX-2 CV2670 Disable breakers X-3 A311 5193 5533 Valve CV2670 Maintenance requiring Close valves: CvX-3 ES valves CV2626, CV2620 d i sas semb ly CVX-4 Disable breakers: 5332 1 i Valve CVX-1 Maintenance requiring Close valves: CV2802 EFW pump train P78 disassembly CVX-4 i CV2620 l Disable breakers: X-1 Y-1 Y-2 6181 5533 valve CV2620 Maintenance requiring Close valves: CVX-1 ES valves CV2670, CV2627 disassembly CVX-2 Disable breakers: 6141 l Va lve CVY-1 Maintenance requiring Close valves: CV2617 Es valve CVY-2 disassembly CV2666 CV2667 Disable breakers: r-2 Valve CVY-2 Maintenance requiring Close valves: CV2617 ES valve CVY-2 d i s a ssembl y (,V2666 CV2667 Disable breakers: Y-2 l Valve CYY-3 Maintenance regylring Disable breakers: Y-1 ES valve CyY-4 d i sa ss embl y Y-2 l l l l l l \
B-5 Table B.4 (Cont'd) Component Under Type of Components Aligned Away Sy stem / Component Maintenance Maintenance from ES Position Required to be Operable Valve CVY-4 Maintenance requiring Olsable breakers: Y-1 va lve CVY-3 d i sas s emb ly Y- 2 valve CVX-4 Maintenance requiring Close valves: CY2637 EFW pump train P78 d i sa ss emb ly CV2802 CVX-l Disable breakers X-4 5533 6181 Y-1 Y-2 Valve CYX-2 Maintenance requiring Close valves: CV2626 EFW pump train P7A disassembly CVX-3 Cv2800 Disable breakers: X-2 5533 5193 A311 valve CY2626 Maintenance requiring Close valves CV2620 ESF valve CV2670, CY2627 disassembly CVX-2 Disable breaker: 5335 Valve CV2627 Maintenance requiring Disable breaker: 6335 ESF valve CV2626, CV2620 d i s a s s emb l y Close valves: CVX-4 CV2670 Valve 2813 Maintenance requiring Close valves: CYX-2 EFW pump train P7A
, l s a s s emb l y CVX-3 Cv2800 Disable breakers: 5333 5533 A3tl 5193 Valve Cv2814 Mainte. nance requiring Close valves: Cya-4 EFW pump train P78 disasse9bly CVX-1 CY2802 Disable breakers: 5333 5533 6181 Y-l Y-2
l l B Table B.S. Maintenance Requirement Summary System Reactor Protection Component Under Type of Components Aligned Away Syr.t om/Compes.ent Maintenance Maintenance from ES Position Required to be Operable Channel A Bypass On-line maintenance None 3 remaining channels Channel B Bypass on-line maintenance None 3 remaining channels Channel C Bypass On-line maintenance None 3 remaining channels Channel 0 Bypass On-line maintenance None 3 romalning channels 1 Table 0.6 Melntenance Requirement Summary Systems Service Water Component Under Type of Components Aligned Away System / Component Maintenance Maintonince from ES Position Required to be Operable Pump P4C Maintenance requir 90 Valve SW2C $W loop pump 48 d isassembly CBA402 i P40 (breaker disabled) Pump P48 Maintenance requiring Valve SW2B $W loop pump 40 d i sassembly CBA303 P48 (breaker disabled) CV3804 Maintenance on valve valve SW-86E RBSS SW loop 2 (Cv3805) Intervals SW-21A Breaker A-305 (P35A) CV3805 Maintenance on valve valve SW-61E RBS$ SW loop 1 (CV3804) Intervals 5W-210 Breaker A-404 (P35E) Cv3840 Maintenance on valve valve SW-86E LP SW loop 2 (Cv3841) Intervals $W-388 Breaker A-305 (P34A) CV3841 Melntenance on valve valve SW-61E LP $W loop 1 (CV3540) Intervals $ W-38A Breaker A-405 (P348)
B-7 Table 8.6 (Cont'd) Component Under Type of Components Aligned Away System / Component Maintenance Malntenance from ES Position Required to be Operable CY3642 Maintenance on valve CV3642 (breaker disabled) --- externals CV3642 Maintenance on valve CV3642 (breaker disabled) --- externals CV3640 Maintenance on valve CY3640 (breaker disabled) --- externals CV3643 Maintenance on valve Cv3643 (breaker disabled) --- externals Cv3645 Maintenance en valve CV3645 (breaker disabled) --- externals Cv3006 Maintenance on valve CV3806 (breaker disabled) DG2 SW loop (CV3807) externals CV3807 Maintenaace on valve CV3807 (breaker disabled) DG1 SW loop (CV3806) externals CV3808 Maintenance on valve valve SW-18A SW loop to P368 and P36C Internals .SW-37A SW-014 CV3809 Maintenance on valve Valve SW-188 SW loop to P36A and P36C Internals SW-378 SW-016 CV3810 Maintenance on valve valve SW-18C SW loop to P36A and P368 Internals SW-37C SW-017
B-8 Table 8.7 Maintenance Requlroment Summary System Emergency Safety Actuation Component Under Type of Components Aligned Away Sy stem / Component Kalntenance Maintenance from ES Position Required to be Operable Logic Li-1 Replacement L1-1 Romalnging channels C86 Power Supply Power supply restoratloo L1-1, L1-13, L1-19, L1-35 C-91 power supply Logic L1-13 Replacement L1-13 Remaining channels Logic L1-19 Replacement L1-19 Remaining channels Logle L1-35 Replacement L1-35 Remaining channelm Logic L2-1 Replacement L2-1 Remaining channels C91 Pener Supply Power supply restoratico L2-1, L2-12, L2-18, L2-34 C-86 power supply Logic L2-12 Replacement L2-12 Remaining channels Logic L2-18 Replacement L2-18 Remaining channels Logic L2-34 Replacement L2-34 Remaining channels ! Table 8.8 Malntenance Requirement Summary l Systems 125V DC 1 1 I Component Under Type of Components Aligned Away System / Comp onent i Maintenance Haintenance from ES Position Required to be Operable Battery D07 Cleans replace electrolyte Bus D01 Battery D06 DC Bus D02, RA2 Diesel Generator DG2 inv. Y22, Y22 Bus DOI Disassembly of DOS Battery charger DOS Battery 006 DC Bus D02, RA2 i l Olesel Ger.arator DG2 Inv. Y22, Y22 Bus R$1 Olsassembly of Inv. Y11 Circuit breaker 0152A Circuit breaker 5141* Circuit breaker 51418 l Bus R$3 Olsassembly of Inv. Y13 Circuit breaker OtS28 Circuit breaker 5145A Circuit breaker 51458
B-9 Table B.8 (Con t 'd ) Component Under Type of Components Aligned Away Sy stem / Component Mainterance Malntenance f rom ES Position Required to be Operable Battery DO6 Clean; replace electrolyte Bus D02 6 ' tery D07
?" Bus D01, RA1 Ulosel Generator DGI inv. Yll, Y13 Bus D02 Disassembly of DO4 Battery Charger D04 Battery D07 DC Bus D01, RAl Diesel Generator DG1 inv. Yll, Y13 Bus RS2 Disassembly of Inv. Y122 Circuit breaker 0242A Circuit breaker 612tA Circuit breaker 61218 Bus RS4 Disassembly of I n v. Y24 Circuit brosker 02428 Circuit breaker 6145A Circuit breaker 61458 Table B.9 Maintenance Requirement Summary System: AC Power Component Under Type of Components Aligned Away S y st em/ Comp onent Maintenance Maintenance from ES Position Regulred to bo Operable Diesel Gwnerator DG1 Disassembly of DG1, its Circuit breaker 308 Diesel generator DG2 subsystems ce breaker 308 4.16 kV switchgear A3 MU pump P36C 460V switchgear B5 DH pump P348 Transformer X5 R8S pump P350 MCC B51 SW pump P4C MCC 856 Startup transformer X4 MCC 852 Unit aux, transf ormer x2 Bus 86 Bus 861 Bus 862 Diesel Generator DG2 Disassembly of DG2, its Circuit breaker 408 Diesel generator DG1 subsystems or breaker 408 4.16 kV switchgear A4 MU pump P36A 48UV switchgear B6 DH pump P34A Transf ormer X6 RBS pump P35A MCC B61 SW pump P40 MCC B62 Startup transformer X3 Unit sur. transf ormer X2 Bus 85 Bus 951 Bus B52
B-10 Table B.9 (Cont'd) Component Under Type of Components Aligned Away Sy s t em/ Component Halntenance Maintenance f rom ES Position Required to be Operable l Bus B5 Disassembly of transf ormer Transformer X5 Diesel generator DG2 X5, or circuit breaker Circuit breaker 301 Bus 86 301 and 512 Circuit breaker 512 Bus 86 Disassembly of transformer Transformer X6 Diesel generator DGI X6, or circult breaker Circuit broaker 401 Bus B5 401 and 612 Circuit breaker 612 Bus B51 Disassembly of circuit Circuit breaker 521 Diesel generator DG2 breaker 521 Bus B6 Bus B61 Bus 852 Disassembly of circuit Circuit breaker 532 Diesel generator DG2 breaker 532 Bus B53 Bus 86 Bus B62 Bus B61 Olaassembly of circuit Circuit breaker 621 Diesel generator DG1 breaker 621 Bus BS Bus B51 l Dus B62 Disassembly of Circuit breaker 614 Diesel generator DGl I breaker 641 circuit Bus B5 But 852 Circuit Breaker 309 Disassembly of circuit Cfreult breaker 309 Diesel generator DG1 l breaker 309 Diesel generator DG Circuit breaker 409 Circuit Breaker 409 Disassembly of circuit Circuit breaker 409 Diesel generator DGI breaker 409 Diesel generator DG Circuit breaker 309
8-11 Table 8.10. Maintenance Requirement Summary System: Battery and Switchgear Emergency Cooling Component Under Type of Components Aligned Away System / Component Maintenance Maintenance l from ES Position Required to be Operable A/C unit VEls Maintenance requiring Disable circuit breaker 5516 A/C unit VEIA d i sass embl y A/C Unit VEIA Maintenance requiring Disable circuit breaker 5515 A/C unit VE18 d i s ass emb ly Chill Water Unit VCH48 Maintenance requiring Close valves: $W6018 Alternate cooling loop disassembly SW6028 (VCH4A, VUC2D, VUCl4A) AC2008 SW loop 2 AC2068 Olsable circuit breaker 5254 Chill Water Unit VCH4A Maintenance requiring Close valves: SW601A Alternate coollng loop d i s ass embly SW602A (VCH48, VUC28, VUC140) AC200A SW loop 1 AC206A Disable circuit breaker 6254 Ventilation Unit Maintenance requiring Close valves: AC410 Alternate cooling loop Cooler YUC2D d i sass embl y AC4 50 SW loop 1 Olsable circuit breaker 6246 Ventilation Unit Maintenance requiring Close valves: AC418 Alternate cooling loop Cooler VUC28 d i sa s s emb ly AC4 58 SW loop 2 Disable circuit breaker 5246 Ventilation Unit Maintenance requiring Close valves: AC202A Alternate cooling loop Cooler VUCl4A d i s a ss embl y AC204A SW loop 2 Olsable circuit breaker 6135 ventilation Unit Maintenance requiring Close valves: AC2020 Alternate cooling loop Cooler VUCl40 d i s ass emb l y AC2040 SW loop 1 Disable circuit breaker 5136 CV6034 Maintenance requiring Close valves: Sn601A Alternate cooling loop d i sa s s embl y SW500A Cv6036 SW605A Olsable circuit breaner 6254 CV6036 Maintenance requiring Close valves: SW6018 Alternate cooling loop t d i s as s emb l y SW5008 Cv6034 SW6058 Olsable circuit breaker 5254 a ts
l l APPENDIX C RISK IMPACT OF A0T REQUIREMENTS t
C-1 Table C.I. Risk Impact of A07 Requirements for Maintelnable Components High Pressure injection / Recirculation System Component increase in incremental Malnt. Yearly Malnt. Under ACT Core-Melt Risk Due to Frequency Risk Designator Maintenance (hr) Frquency a ' owntime (Events /hr) increase P (C,-C ,) (C{-C,)(A07) (us,) (w,T)(C+-C )(A0T) (per year) , HM-1 HPl Pump 36C 60 2.?4 E-3 1.88 E-5 3.1 E-5 5.1 E-6 HM-2 HPI Pump 368 60 1.50 E-5 1.03 E-7 3.1 E-5 2.8 E-8 hM-3 HPl Pump 36A 60 5.00 E-6 3.43 E-8 3.1 E-5 9,3 E-9 HM-4 MOV CV 1227 60 3.00 E-5 2.06 E-7 4.0 E-7 7.2 E-10 HM-5 MOV CV 1228 60 3.00 E-5 2.06 E-7 4.0 E-7 7.2 E-10 HM-6 MOV CV 1219 60 1.20 E-5 8.22 E-8 4.0 E-7 2.9 E-10 HM-7 MOV CV 1220 60 1.20 E-5 8.22 E-8 4.0 E-7 2.9 E-10 Table C.2. Risk Impact of A07 Requirements for Maintainable Components Low Pressure injection / Recirculation System Component increase In incremental Maint. Yearly Maint. Under Core-Melt R'sk Due to Frequency Risk Designator Maintenance A0T Frquency a Downtime (Events /hr) increase (br) (C , -C ) (C+-C )(AOT) (w,) (w,T)(C+-C )(A07) (per year) LM-1 LPI Pump 34B 60 5.10 E-5 3.49 E-7 3.1 E-5 9.5 E-8 LM-2 LPI Pump 34A 60 5.00 E-5 3.43 E-7 3.1 E-5 9.3 E-8 LM-3 MOV CV 1406 60 7.90 E-5 5.41 E-7 4.0 E-7 1.9 E-9 LM-4 MOV CV 1865 60 7.20 E-5 4.93 E-7 4.0 E-7 1.7 E-9 LM-5 MOV CV la28 60 5.00 E-5 3.43 E-7 4.0 E-7 1.21 1 LM-6 MOV CV 1429 60 5.00 E-5 3.43 E-7 4.0 E-7 1.2 L 9 LM-7 MOV CV 1400 60 6.00 E-6 4.11 E-8 4.0 E-7 1.4 E-10 LM-8 MOV CV 1401 60 5.00 E-6 3.43 E-8 4.0 E-7 1.2 E-10 Table C.3. Risk Impact of A0T Requirements for Maintainable Components Reactor Building spray System Component increase in incremental Maint. Yearly Maint. Under Core-Melt Risk Due to Frequency Risk Designator Maintenance A07 Frequency a Downtime (Events /hr) increase (hr) (C+-C,) (C+-C,1 ( A07) (w,) (w,7)(C+-C ,)(A07) (,or year) BM-1 RBS Pump 35A 36 3.0 E-7 1.23 E-9 3.1 E-5 BM-2 RBS Pump 350 3.3 E-10 36 3.0 E-7 1.23 E-9 3.1 E-5 3.3 E-10 BM-3 MOV CV 2400 36 3.0 E-7 1.2) E-9 4.0 E-7 3.6 E-12 BM-4 MOV CV 2401 36 3.0 E-7 1.23 E-9 4.0 E-7 3.6 E-12
*T is defined as 1 reactor year in hrs.
C-2
. Table C.4 Risk Impact of A0T Requirements for Maintalnable Components Emergency Feedsator Systom (EFhS)
Component increase in incremental Maint. Yearly Melnt. Under A0T Core-Melt Risk Due to Frequency Risk Designator Maintenance (hr) Frguency a Downtime (Events /hr) Increase (C, C ) (C{-C)(A0T) (w,) (w,T)(C{-C,)(A0T) (per year) EM-1 EFW Pump P7A 36 5.13 E-3 2.48 E-5 3.1 E-5 6.7 E-6 EM-2 MOV CVY-2 36 1.4 5 E-3 6.00 E-6 1.8 E-6 9.5 E-7 EM-3 MOV CVX-1 36 1.4 3 E-3 5.88 E-6 1.8 E-6 9.3 E-7 EM-4 MOV CV2620 36 1.43 E-3 5.88 E-6 1.8 E-6 9.3 E-7 EM-5 EFW Pump P78 36 2.15 E-4 8.e4 E-7 3.1 E-5 2.4 E-7 EM-6 MOV CVY-1 36 2.21 E-4 9.10 E-7 1.8 E-6 f.4 E-8 EM-7 MOV CVX-4 36 1.87 E-4 7.68 E-7 f.8 E-6 1.2 E-8 EM-8 MOV CV2627 36 1.87 E-4 7.68 E-7 1.8 E-6 1.2 E-8 EM-9 WV CV2670 36 1.01 E-4 4.15 E-7 1.8 E-6 6.5 E-9 EM-10 CV CVX-3 36 9.80 E-5 4.03 E-7 1.8 E-6 6.4 E-9 EM-11 MOV CVY-3 36 C C C c EM-12 MOV CVY-4 36 c c c c EM-13 MOV CVX-2 36 c c c c EM-14 M0V CY2626 36 c c c c EM-15 MOV CY2813 36 c c c c EM-16 MOV CV2814 36 C C c c EM-17 MOV CV2803 36 C c c c EM-18 MOV CV2806 36 c c c c EM-19 MOV CV2800 36 C C c c EM-20 MOV CV2802 36 c c c c Table C.S. Risk impact of ACT Requirements for Maintalnable Components Reactor Protection System I increase incremental Component in Risk Due Maint. Yearly Maint. Under ACT Core-Melt to Given Frequency Risk Designator Maintenance (Hr) Freguency a Downtime (Events /Hr) increase 1 (C,-C,) (C{-C)(A0T) (w,) (wT)(C{-C)(A0T) (,or rear) RM-1 Channel A bypass 4 2.00 E-7 9.13 E-11 1.4 E-3 1.1 E-9 Re-2 Channel 8 bypass 4 2.00 E-7 9.13 E-11 1.4 E-3 1.1 E-9 RM-3 Channel C bypass 4 2.00 E-7 9.13 E-11 1.4 E-3 1.1 E-9 i RM-4 Channel 0 bypass 4 2.00 E-7 9.13 E-11 1.4 E-3 1.1 E-9 l l
C-3 Table C.6 Risk Impact of A0T Requirements for Maintainable Components Service Water System incremental Component increase In Risk From a Malnt. Yearly Malnt. Under A0T Core-Melt Given Frequency Risk Designator Malntenance (hr) Fr equency a Downtire (Events /Hr ) increase (C+-C ) Q,) 6, T ) (C+-C,) (A0T ) (C{-C )(A0T) (,or yea,> SM-1 SW Pump P4C 56 3.70 E-3 1.53 E-5 2.9 E-5 3.9 E-6 SM-2 SW Pump P4B 36 2.50 E-3 1.03 E-5 2.9 E-5 2.6 E-6 SM-3 CV 3810 36 2.74 E-3 1.10 E-5 4.0 E-7 4.0 E-6 SM-4 CV 3645 36 1.41 E-5 5.80 E-6 4.0 E-7 2.0 E-8 SM-5 CV 3643 36 1.05 E-3 4.32 E-6 4.0 E-7 1.5 E-8 SM-6 CV 3806 36 3.86 E-4 1.60 E-6 4.0 E-7 5.6 E-9 SM-7 CV 3807 36 1.68 E-4 6.90 E-7 4.0 E-7 SM-8 2.4 E-9 CV 3841 36 5.10 E 5 2.10 E-7 4.0 E-7 7.4 E-10 SM-9 CV 3840 36 5. 00 E+ 5 2.00 E-7 4.0 E-7 7.2 E-10 SM-10 CV 3809 36 1.50 E-5 6.20 E-8 4.0 E-7 2.2 E-10 SM-11 CV 3808 36 5.00 E-6 2.00 E-8 4.0 E-7 7.2 E-11 SM-12 CV 3642 36 2.00 E-6 8.22 E-9 4.0 E-7 2.9 E-11 SM-13 CV 3640 36 2.00 E-6 8.22 E-9 4.0 E-7 2.9 E-11 SM-14 CV 3804 36 3.00 E-7 1.23 E-0 4.0 E-7 3.6 E-12 SM-15 CV 3805 36 3.00 E-7 1.23 E-9 4.0 E-7 3.6 E-12 Table C.7 Risk Impact of A0T Requlroments for Maintainable Components Engineered Saf eguards Actuation System (ESAS) Component increase in Maint. Yearly Maint. Under Core-Melt incremental Frequency Risk Desip-) tor Maintenance ACT Frquency Risk (E vents /Hr ) increase Dir) (C , C ) (C+-C ) (A07) u,) O T)(CJ-C )(A0T) (per year) ESM-1 C86 Power Supply 12 2.17 E-3 2.97 E-6 6.4 E-6 1.7 E-7 ESM-2 Ly le L1-1 12 2.17 E-3 2.97 E-6 1.3 E-6 3.4 E-8 ESM-3 C91 Power Supply 12 2.06 E-3 2.82 E-6 6.4 E-6 1.6 E-7 ESM-4 Logic L2-1 12 1.95 E-3 2.67 E-6 1.3 E-6 3.0 E-8 ESM-5 Logle Lt-13 12 7.30 E-5 1.00 E-7 1.3 E-6 1.1 E-9 ESM-6 Logle L2-12 12 7.30 E-5 1.00 E-7 1.3 E-6 1.1 E-9 ESM-7 Logic L1-19 12 1.00 E-6 1.37 E-8 1.3 E-6 f.6 Eall ESM-8 Logic L2-18 12 1.00 E-6 1.37 E-8 1.3 E-6 1.6 E-11 ESM-9 Logle L1-35 12 3.00 E-7 4.11 E-10 1.3 E-6 4.7 E-12 ESM-10 Logle L2-34 12 3.00 E-7 4.11 E-10 1.3 E-6 4.7 E-12
C-4 Table C.8. Risk Impact of A0T Requirements for Maintalnable Components in DC Power System incremental Melnt. Component increase In Risk from Frequency Yearly Maint. Under Core-Melt a Given (Events / Risk Designator Maintenance A0T Freguency Downtime Hr) increase thr) (C, C ,) (C{-C,)(A07) (w,) (u,T)(C{-C,)(A0T) (per year) DM-1 BC DOS 8 2.00 E-2 1.83 E-5 2.8 E-6 4.5 E-8 W-2 Bus RS2 8 2.35 E-2 2.15 E-5 1.0 E-6 1.9 E-7 CN-3 BC 004 8 7.30 E-2 6.68 E-6 2.8 E-6 1.6 E-7 m-4 C8 01228 or 8 2.00 E-2 1.83 E-5 1.0 r.6 1.6 E-7 CB 56228 DM-5 C8 022A or 8 7.30 E-2 6.68 E-6 1.0 L $ 5.9 E-8 C8 6143A CN-6 Bus R$1 8 6.23 E-3 5.69 E-6 1.0 E-t 5.0 E-8 CH-7 Battery 006 8 1.64 E-3 1.50 E-6 2.0 E-c 2.6 E-8 DM-8 Battery 007 8 1.26 E-3 1.15 E-6 2.0 E-6 2.0 E-8 Bus 001 CN-9 Bus RS3 8 1.06 E-4 9.68 E-8 1.0 E-6 8.5 E-10 CN-10 Bus RS4 8 4.00 E-6 3.65 E-9 1.0 E-6 3.2 E-ll Table C.9 Risk impact of ACT Requirements for Malntalnable Components in AC Power System Compon..? Increase in incremental Yearly [ Maint. Under A0T Core-Melt Risk From a Maint. Risk l t Designator Mainteoance (hrs.) Frejuoncy Given Downtime Frequency increase (0, C ,) (C{-C,)(A0T) (w,) (w,T)(C+-C )(A0T) (per year) ACM-1 Diesel G+nerator DGl 168 3.83 E-4 7.35 E-6 6.0 E-5 3.86 E-6 ACN-2 Diesel (,enerator DG2 168 f.81 E-4 3.47 E-6 6.0 E-5 1.82 E-6 ACM-3 AC Bus 85' 24 5.13 E-3 1.41 E-5 5.0 E-6 2.05 E-6 ACN-4 AC But 86 (X6) 24 4.12 E-3 1.13 E-5 5.0 E-6 4.94 E-7 ACN-5 001 C9 168 3.83 E-4 7.35 E-6 1.0 E-6 6.44 E-8 I ACN 6 AC ib 95 (CS) 8 5.13 E-3 4.69 E-6 1.0 E-6 4.11 E-8 ACN-7 AC E m B6 (CB) 8 4.12 E-3 3.76 E-6 1.0 E-6 3.29 E-8 ACM-8 002 C8 168 1.81 E-4 3.47 E-6 1.0 E-6 3.04 E-8 ACN-9 AC Bus C62 8 3.72 E-3 3.40 E-6 1.0 E-6 2.98 E-8 ACN-10 AC is is 851 8 3.46 E-3 3.16 E-6 1.0 E-6 2.77 E-8 ACN-11 AC Bus 861 8 2.96 E-3 2.70 E-6 1.0 E-6 2.37 E-8 ACN-12 AC Bus B52 8 2.50 E-3 2.28 E-6 1.0 E-6 2.00 E-8 ACM- 13 Circuit Breaker 309 24 7.38 E-4 2.02 E-6 1.0 E-6 f.77 E 8 ACN- 14 Circuit Breaker 409 24 7.38 E-4 2.02 E-6 1.0 E-6 1.77 E-8
' Bus maintenance is maintenance on "upstream" components.
C-5 Table C.10 Risk impact of A0T Requirements for Melntainable Ceeponents in Emergency Cooling System (Battery & Switchgear Rooms) Component increase in incremental Yearly Malnt. Under Core-Melt Risk From a Maint. Risk Des ignator Maintenance ACT' Frquency Given Downtime Frequency increase (hrs.) (C C) (C+-C )(A0T) hag ) (w,T)(C+-C,)(A07) (per year) ECM-1 C.W.V. VCH4 A 24 3.62 E-3 9.9 E-6 6.2 E-5 5.4 E-6 R ECM-2 C.W.U. VCH48 24 2.05 E-3 5.6 E-6 6.2 E-5 3.0 E-6 ECM-3 MOV CY6034 24 3.62 E-3 9.9 E-6 1.8 E-6 1.6 E-7 ECM-4 MOV CY6036 24 2.05 E-3 5.6 E-6 1.8 E-6 8.8 E-8 ECM-5 YUC 20 24 3.62 E-3 9.9 E-6 4.0 E-7 3.5 t-8 ECM-6 vuc 28 24 2.05 E-3 5.6 E-6 4.0 E-7 1.9 E-8 ECM-7 VUC 140 24 9.80 E-5 2.7 E-7 4.0 E-7 9.5 E-10 ECM-8 VUC 14A 24 5.00 E-6 1.4 E-8 4.0 E-7 4.9 E-11 ECM-9 A/C Unit VEIA 24 e c 6.2 E-5 c ECM-10 A/C Unit VE10 24 c c 6.2 E-5 c
'The A0Ts for components in this system are not defined in technical specifications and are assumed to be 24 hrs.
,~ m
APPENDIX D
SUMMARY
OF SURVEILLANCE TEST REQUIREMENTS AND RISK IMPACTS 1
\
D-1 Table D.1 Risk impacts of Surveillance Test Requirements in High Pressure injection / Recirculation Gystem Component Aligned Component Additional Away from Expected Expected Risk Test Undergoing Type of Congonent ES Test Test impact D:signator Test Test Tested Position Frequency Duration of Test H2-T1 Pump P36C & Flow BW1X None Annual I hr 6.8 E-5 SW CV3810 Stroke CV14088 BW2X MU18C SW CV3810 l SW CV18C l HP-T2 Pump P36C Flow BW1X None Monthly 30 min. 4.4 E-5 CY14088 BW2 MU180 HP-T3 SW CV3810 Stroke SW CV18C None Annual 10 min. 2.4 E-5 HP-T4 Pump P36A & Flow BW1X None Annual I hr 1.37 E-5 SW CV3808 Stroke CV1407A BW3X MU18A SW CV3808 SW Cv018A HP-T5 Pump P36A Flow BW1X None Monthly 30 min. l.36 E-5 CY1407A BW3x MUISA HP-T6 Pump P368 & Flow BWlX None Annual I hr 1.36 E-5 SW CV3809 Stroke CV1407A BW3x MU16 MU17 MU188 SW CV389 SW CV188 HP-T7 Pump P368 Flow BW1X None Monthly 30 min. 1.36 E-5 CV1407A BW3x MU16 1 NU17 MU188 HP-T8 CY1277 Stroke None None Quarterly S min. 3.8 E-7
#-T9 CV1228 Stroke None None Quarterly S min. 3.8 E-7 j HP-TIO CV1219 Stroke None None Quarterly 5 min. 1.9 E-7 HP-Til CV1220 Stroke None None Quarterly S min. 1.9 E-7 HP-T12 SW CV3808 Stroke None None Quarterly 5 min. 1.0 E-7 W-T13 SW CV3809 Stroke None None Quarterly $ min. 2.0 E-9 1
i
}
l l 1
D-2 Table D.2 Impact of Surve111ance Test Requirements In Low Pressure injection / Recirculation System Component Aligned Component Additional Away from Expected Exp ected Risk Test Undergoing Type of Componen t ES Test Test impact Designator Test Test Tested Position Frequency Duration of Test LP-T1 Pump P348 & Flow BW1X DH88 opened Annual 1 1/2 hr 7.9 E-5 SW CY3840 Stroke CY140SB DH10 opened BW4B CV1429 BWBB SW 228 DH2B SW 38A DH3A HX E358 CV1429 SW CY3841 SW Cv038A LP-T2 Pump P348 Flow BW1X DH88 opened Monthly 3/4 hr 2.8 E-5 CV14088 DH10 opened BW48 CV1429 BW88 DH2B DH38 HX E350 CY1428 LP-T3 Pump P34A & Flow BW1X DH8A opened Annual 1 1/2 hr 1.5 E-5 SW Cv3841 Stroke CY1408A DH10 opened BW4A CV1428 BW8A SW-22A DH3A SW-388 HX E35A CV1428 SW CV3840 SW CY038B LP-T4 Pump P34A Flow BW1X DH8A opened Monthly 3/4 hr 1.4 E-5 CV14088 DH10 opened BW4A CV1428 BWSA DH3A HX E35A Cv1428 LP-75 SW CY3821 Stroke None SW 38A Monthly 3/4 hr 1.0 E-6 SW 22B LP-T6 SW CY3822 Stroke None SW 388 Monthly 3/4 hr 1.0 E-6 SW 22A LP-T7 SW CY3840 Strok e SW CV38A SW 22B Annual 3/4 hr 7.6 E-7 86X 63X LP-T8 SW Cv3841 S troke SW CY388 SW 22A Annual 3/4 hr 7.6 E-7 61X 64X LP-79 SW Cv3802 Stroke None $W 38A Monthly 3/4 hr 8.1 E-7 LP-TIO SW CV3803 Stroke None $W 388 Monthly 3/4 hr 8.1 E-7 LP-Til CV1405 Stroke None None Monthly 5 mln. 7.2 E-7 LP-Tl2 CYl406 Stroke None None Monthly 5 min. 6.9 E-7
/
l 1 D-3 Table 0.3 Risk impacts of Survelllance Test Requirements in Core Flood System Component Aligned Comp onent Additional Away from Exp ected Expected Risk Test Undergoing Type of Component ES Test Test impact D:signator Test Test Tested Position Frequency Duration of Test CT-1 CFT-2A instrumentation None None 8 hrs C 1.6 E-8 Ch eck CT-2 CFT-2A instrumentation None None 8 hrs c 1.6 E-8 Ch eck Table D.4 Risk impacts of Surveillance Test Requirements in Reactor Bullding Spray System Component Comp onent
, Aligned Additicnol /Anay from Exp ected Exp ected Risk Test Undergoing Type of Comp onent ES Test Test impact Designator Test Test Tested Position Frequency Durat ion of Test RB-Tl Pump P35A Flow BW1X CV2401 Monthly 30- 1.3 E-5 CV1407A 852A 45 min.
Bw4A BS3X BW5A DH9 Bn6A SW-21A BSIA BS2A BS3X OH9X DH10X RB-T2 Pump P358 Flow 6WlX Monthly CV2400 30- 1.3 E-5 CVl4088 BS2B 45 min. 8W48 BS3X BW50 OH9 Sw68 SW-2f8 BS18 8528 BS3X OH9X DH10X R8-73 Pump P35A' 6e l th ou t (CV1407A, BelX) 2.4 E-9 RB-T4 Pump P358' (a l t hou t 2,4 E-9 (CV1406B, BWlX) RB-T5 CV24DO $trok e None None Quarterly None 1.2 E-9 R8-T6 CV2401 Stroke None None Quarterly None 1.2 E-9
'Tc:st impact os purp P35A, P358 are high due to CV1407A, CV1408A, and BWlX. These valvues are test HP and LP pump tests. These tests, even though cannot be perf ormed, show the additlocal alnimal risk Impact of tests RB-T! and R8-T2 I
D-4 o Table 0.5 Risk impact of Surveillance Test Requirements in Emergency Foodwater System Coeronent Aligned Component i Add i tional Away from Exp ect ed Exp ect ed Risk Test Undergoing Type of Comp onent ES Test Test impact Des ignator Test Test Tested Position Frequency Duration of Test EF-Tl Pump P7A Flow CS19 CVX-1 Monthly I hr 2.9 E-5 CS98 CVX-4 CS99 CV2802 CYY-3 CVY-4 CVY-1 CVY-2 EF-T2 CV2626 Stroke None None Quarterly 5 min. 1.6 E-5 EF-T3 CV2620 Stroke None None Quarterly 5 min. 1.2 E-5 EF-T4 CVY-1 Stroke None None Quarterly 5 min. l.2 E-5 EF-T5 Puep P78 Flow C$l9 CVX-2 Monthly I hr 9.6 E-6 CS98 CVX-3 CS99 CV2800 EF-T6 CVX-2 Stroke None None Quarterly 5 min. 7.8 E-6 EF-T7 CvX-l Stroke None None Quarterly 5 min. 6.2 E-6 EF-T8 CV Y-2 Stroke None None Quarterly 5 min. 2.0 E-6 EF-79 CV2670 Stroke None None Quarterly 5 min. 1.7 E-6 EF-TIO CV2627 Stroke None None Quarterly 5 min. 1.7 E-6 EF-T12 CVX-3 Stroke None None Quarterly 5 min. 8.2 E-7 EF-T13 CVX-4 $troke None None Quarterly 5 min. 8.2 E-7 Table 0.6 Risk impact of Survelliance Test Requirements in Reactor Building Cooling $ystem Component Aligned Component Additional Away from Expected Erpected Risk Test Undergoing Type of Comp onent ES Test Test impact Des ignator Test Test Tested Position Frequency Duration of Test RC-Tl CV3812 Valys & CV3814 Rad. CV3812 Quarterly 5 min. 2.3 E-8 Interlock Det 814R CV3814 RC-T2 CV3813 Valve & CV3815 Red. CV3813 Quarterly 5 min. 2.0 E-8 Interlock Det 815R CV3815
D-5 Table 0.7 Risk Impact of Surveillance Test Requirements in Reactor Protection System I Cogonent Aligned Cog onent Additional Away from Expected Expected R!sk Test Undergoing Type of Cog onent ES Test Test impact Designator Test Test Tested Position Frequency Duration of Test RP-T1 Breaker CCA Proper Op'eration None None hathly C 1.7 E-6 RP-T2 Breaker CC8 Proper Operation None None Monthly C 1.7 E-6 RP-T3 Breaker Cl Proper Operation None None P>nthly C 8.5 E-7 RP-T4 Breaker C2 Proper Operation None None Monthly C 8.5 E-7 RP-TS Breater 01 Proper Operation None None Monthly C 8.S E-7 RP-76 Braaker 02 Proper Operation None None Monthly C 8.S E-7 ftP-77 Relay CCA Proper Operation None None Monthly C l.2 E-8 RP-T8 Relay CC8 Proper Operation None None Monthly C l.2 E-8 RP-79 Relay C1 Proper Operation None None Monthly C 6.2 E-9 RP-TIO Relay Cl Proper Operation None None Monthly C 6.2 E-9 RP-Til Relay DI Proper Operation None None Monthly C 6.2 E-9 RP-712 Relay 02 Proper Operation None None Monthly C 6.2 E-9 RP-713 Gate Driver E2 Proper Operation Rectifier E2 None Monthly C S.0 E-9 RP-Tid Gate Driver E3 Proper Operation Rectifier E3 None Monthly C S.0 E-9 RP-TIS Gate Driver E4 Proper Operation Rectifier E3 None Monthly C S.0 E-9 RP-T16 Gate Delver F2 Proper Operation Rectifier F2 None Monthly C S.0 E-0 RP-T 17 Gate Driver F3 Proper Operation Rectifler F3 None Monthly C 5.0 E-9 RP-TI8 Gate Driver F4 Proper Operation Rectifier F4 None Monthly C S.0 E-9 RP-719 Relay E2 Proper Operation None None Monthly C S.2 E-fl RP-T20 Relay E3 Proper Operation None None Monthly C S.2 E-11 RP-T21 Relay E4 Proper Operation None None Monthly C S.2 E-fl RP-T22 Relay F2 Proper Operatloe None None Monthly C S.2 E-11 RP-723 Relay F3 Proper Operation None None Monthly C 5.2 E-11 RP-T24 Relay F4 Proper Operation None None Monthly C S.2 E-Il RP-T25 Relay M Proper Operation None None Monthly C 1.0 E-12 RP-T26 Relay M1 Proper Operation None None Monthly C 1.0 E-12 RP-T27 Relay KA2 Proper Operation None None Monthly C 1.0 E-12 RP-T28 Relay G 1 Proper Operation None None Monthly C 1.0 E-12 RP-729 Relay G2 Proper Operation None None Monthly C 1.0 E-12 RP-730 Relay RCl Proper Operation None None Monthly C 1.0 E-12 RP-T31 Relay KDI Procer Operation None None Monthly C 1.0 E-12 RP-732 Relay KD2 Proper Operatloe None None Monthly C l.0 E-12 PP-733 Relay M3 Proper Operation None None Monthly C S.0 E-13 RP-734 Relay KA4 Proper Operatloe None None Monthly C S.0 E-13 RP-735 Relay G3 Proper Operation None None Monthly C S.O E-13 RP-T36 Relay G4 Proper Operation None None Monthly C S.0 E-13 RP-737 Relaf KC3 Proper Operation e ane None Monthly C S.0 E-13 RP-738 Relay rC4 Proper Operation None None Monthly C S.0 E-13 RP-739 Relay K03 Proper Operation None None Monthly C S.0 E-13 FF-740 Relay KD4 Proper Operstloe None None Monthly C S.0 E-13
D-6 Table 0.8 Risk impact of . Surveillance Test Requirements in Engineered Saf eguards Actuation Component Aligned Component AdditJonal Away from Expected Exp ected A. k Test Undergoing Type of Component ES Test Test impact Designator Test Test Tested Position Frequency Duration of Test ES-Tl Logic Ll.1 Proper Operation None None Monthly p None 8.3 E-7 Cher.nel 1 ES-72 Logic L2-1 Proper Operation None None Monthly None 3.7 E-7 Channel 2 ES-T3 Blstable A108 Calibration & None None Monthly None 1.8 E-7 Proper Operation ES-74 81 stable A208 Callbration & None None Monthly None 1.8 E-7 Proper Cperation ES T5 Bistable A308 Callbration & None None Monthly None Proper Operation 1.8 E-7 ES-T6 Pressure Sensor 1020 Callbration & Buff. Amp.Al-6 None Each Shift None 1.2 E-7 Proper Operation E$-77 Pressure Sensor 1022 Calibration & Buff. Amp.A206 None Each Shift Nono 1.2 E-7 Proper Operation t ES-T8 Pressure sensor 1040 Callbration & Buff. Amp.A306 None Each Shift None 1.2 E 7 l Proper Operation l l ES-79 Channel Open Circuit None None Shift None 1.1 E-7 l l ES-710 Logic Buffer A110 Proper Operation None None Monthly None 5.0 E-8 ES-Til Logic Buffer A210 Proper Operation None None Monthly None 5.0 E-8 E$aT12 Logle Buf f er A310 Proper Operation None None Monthly None 5.0 E-8 ES-TI) Bistable All9 Calibration & Bistable Al20 None Monthly None 4.5 E-6 l Proper Operation , E$-714 Bistable A219 Calibration & Bistable A220 None Monthly None 4.S E-8 1 Proper Operation E S-f l S Blstable A319 Calibration & 81 stable A320 None Mon tP.ly None 4.5 E-8 Proper Operation
l D-7 Table D.8 Risk impact of Surveillance Test Requirements in Engineered Safeguards Actuation l Component , Aligned Component Additional Away from Expected Expected Risk Test Undergoing Type of Component ES Test Test impact Designator Test Test Tested Position Frequency Duration of Test ; ES-T16 Channel 2 Open Circuit None None Each Shift None 4.8 E-8 t ES-T17 Logic L2-12 Proper Operation None None Monthly None 3.6 E-8 : Channel 4 ! ES-718 Logic Li-13 Proper Operation None None Monthly None 3.4 E-8 l Channel 3
- ES-fl9 Power Supply Ca li brat ion Channels 1.3 None Monthly None 2.6 E-8 !
! 5.7 l j ES-T20 Ca li brat ion Channels 2.4 None Monthly None 1.2 E-8 6,8 j ES-T21 Channel 4 Open Circuit None None Each $hift None 4.7 E-9 [ l ES-T22 Channel 3 None None Each Shift N:no 4.5 E-9 I ES-T23 Logic Buffer All6 Proper Operation None None Monthly None 2.8 E-9 ) ES-T26 L % le Butfor A216 Proper Operation None None Monthly None 2.8 E-9 ES-T2S Logic Butfor A316 Proper Operation None None Monthly None 2.8 E-9 ES-726 Pressure Sensor Calibration and None None Each $hift None 8.8 ES-727 Pressure Sensor Calibration and Buff.Amo.All7 None Each Shlft None 8.8 E-10 1 PT2406 Proper Operation i l ES-T28 Pressure $ensor Calibration and Buff. Amp.A2t? None Each Shift None 6.8 E-IO j PT2407 Proper Operation ES ~29 Logic Suffer A122 Proper Operation Buff.Amo.A317 None Monthly None 3.7 E-10 I j ES-T30 Logic Suffer A222 Proper Operation None %ne Nathly None 3.7 E-10 1 j ES-731 Logle Buffer A322 Proper Operation None None Monthly None 3.7 E-10 i ES-732 Logle Buffer A123 Proper Operation None None Monthly None 3.7 E-10 J ES-T33 Logic Buffer A322 Proper Operation None None Monthly None 3.7 E-10 1 . ES-734 Logic Buffer A323 Proper Operation None None Nathly None 3.7 E-10 1 l i i i
D-8 Table D.9 Risk impact of Surveillance Test Requirements in Service Water Systems Cogonent Aligned Cogonent Additional Away from E xp ected E xpected Risk Test Undergoing Type of Cog onent ES Test Test impact Designator Test Test Tested Position Freq uer.cy Duration of Test
$w-Tl Pump P4C Ylbration and None None None None 2.5 E-5 Temperature SW-72 Pump P48 Vibration and None None None None Temperature 1.3 E-5 Table D.10 Risk impact of Surveillance Test Requirements in Class IE AC Power Systm Cogonent Aligned Component Additional Away from Expected Expected Risk Test Undergoing Type of Cogonent ES Test Test impact Designator Test Test Testeo Position Frequency Duration of Test EP-Tl Diesel Generator I start SW CV3806 0G1 Monthly 5 min. 1.72 E-5 SW 019A EP-T2 Olesel Generator 2 Start SW CV3807 DG2 Monthly 5 min. 8.35 E-6 SW 019d Table D.11 Risk In' pact of Surveillance Test Requirements in 125V DC System Cog onent Aligned Com onent Additional Away from E xp ect ed Espected Risk Test underpolng Type of Component E$ Test Test impact Des ignator Test Test Tested Position Frequency Duration of Test 0C-71 Battery 006 Measure of None None Quarterly None 2.4 (-6 Indiv; dual Cell DC-T2 Battery D07 Measure of hone Nons Quarterly None 2.3 (-6 Individual Cell
- _ _ _ _ _ _ _ _ _ _ _ _ l
/ D-9 Table 0.12 Risk Impact of Surveillance Test Requirements in Battery and Switchgear Emergency Cooling System Cogonent Aligned Component Additional Away from Expected Expected Risk Test Undergoing Type of Cogonent ES Test Test Imact 0*signator Test Test Tested Position Fr eq uency Duration of Test e$-71 Room Cooler Unit Functional VCH4A None Monthly Not 9.1 E-5 VUC20 Known VUC14A AC209A AC410 AC440 AC450 AC202A AC203A AC204A B$-72 Room Cooler Unit Functional VCH48 None Monthly Not 4.3 E-5 VUC2B Known VUC140 AC2099 AC418 AC448 AC450 AC2028 AC2030 AC204S Tamle 0.13 Risk lepect of Surveillance Test Regulrecents in Emergency Feedvater initiation Controtsystem Cog onent Aligned Conconent Additional Away from E xp ected Expected Risk fest Undergoing Type of Cog onent E$ Test Test imoact Oosignator Test Test Tested Position Frequency Duration of Test El-T1 Path 0 012 Prooer Operation Logle 140, 150, None Monthly None 4.7 E-5 180,I90,220,250 El-72 Path AC04-8004 Proper Operation Logics on Paths None Monthly None 2.2 E=$ El-73 Path VCO2 Proper Coeration Logic 170, 210, None Monthly None 1.4 E $ 240,280, 340 E1 74 Path AC6-606 Proper coeration Logic 4AC,480 None Monthly None 9.6 E-6 El-TS Path A804-COO 4 Proper Operation Logics on Path None Monthly None 8.3 E-6 El-76 Path CSY2 Proper Operation Logle DC18 None Monthly None 7.5 E-6 El-77 Path OgD2 Proper Operation Bistable ICO,110, None $hlft Non9 2.9 E-6 Butf.Ag 60,70 Sensor 20,30
D-Il Tab e 0.13 Cont'd Component Aligned Component Add i t iona l Away from E xp ected Expected Risk Test Undergoing Type of Component ES Test Test impact dos tgnator Test Test Tested Position Frequency Duration of Test El-T24 Path A009 Proper Operation Logle OA,l A,2A None Monthly None 7.4 E-8 El-725 Path 8009 Proper Operatfor. Logic 00,18,28 None Monthly None 1.6 E-6 El-T26 Path C009 Proper Operation Logle OC,10,2C None Monthly None 1.6 E-8 El-727 Path VCSI Proper Operation Bistable 9C. None Shift None 1.4 E-8 Buff. Amp.5C, Sensor 1C El-T28 Path A009 Proper Operation Buf f. Amp. A5, None shift None 9.1 E-9 A6, Pressure Sensor APA. APS El-T29 Path 0009 Proper Operation Buff. Amp. 85, None Shift Nome 9.1 E-9 86, Pressure Sensor BPA, BPS El-730 Path C009 Proper Operation Buff.mmo. 15, None Shift None 9.1 E-9 16, Pressure Sensor CPA. CP8 El-T31 Path VC61 Proper Operation Bistable 12C None Shift None 8.4 E-9 Sensor 6C
**l.,*"** , w . =vc6.u ..uwo. , co .. . . . . . .w . i . v ., r ,os. .., . . . ., ~
II.'".E SISLIOGRAPHIC DATA SHEET NUREG/CR- 5200 u s .=i,. wet.o . o ,.. .n,.u BNL/NUREG-52024
.............,6.
......6..
EVALUATION OF RISKS ASSOCIATED WITH A0T AND STI REQUISEMENTS AT THE ANO-1 NUCLEAR POWER PLANT
.....,co..... .,-o.4..
June la88
. o . t . . . .o. t e .sw . D
.19a s, es .. 4 P.K. Samanta. S.M. Wong and J. Carbonaro August 1988
............4.....................u,,,<,c. ...o.6,,........i....
Brookhaven National Laboratory .,,,,g...,,,,.. D:pertment of Nuclear Energy Upton. N.Y. 11973 FIN A-3230
..v.*...........,.............,5....u.,,e. ............*,
Division of Reactor & Plant Systems Office of Nuclear Regulatory Research i U.S. Nuclear Regulatory Coenission .....sw...., Washington. D.C. 20555
.. , ,......... o,..
4 .: i ..c , .m . This report presents an evaluation of the core-melt frequency contributions associated with Allowed Outage Times (A0Ts) and Surveillance Test Intervals (ST!s) at Arkansas Nuclear One - Unit I (ANO-1). The results show that the core-melt frequency contributions from present A0Ts and STIs vary by more than f our orders of magnitude (a f actor of 10.000). This wide range of variation indicates the wide range of the risk importance of present A0Ts and STIs. The core-melt contributions f rom specific A0Ts and ST!s can be used to prioritize those components which should be focused on for inspection activities, personnel training. and reliability program activities that are iftvolved with surveillat.ce testing .ind corrective maintenance. .. .w . .,... .....,....s.....x.. 3..
. .,.,.g ,.;i .
Allowed outage times Probabilistic risk assessment Surveillance test intervals Unlimited Technical specifications e u e s , , u . .. Risk-based technical specifications s .. ,
- 4. , ,, ,,
. .n o . ... un ne u es... Unclassified
- s. . ,
Unc m ..las=tfied a .*....
4'
. s
- 3,
$2 P
, , j-s' s
' 0555139217 1 1ANipolay NRC-0 ARM-ADM ' t OIV IOlA '. Ptl3LICATIONS syc3 ,
, RhES-PD' NUREG +
d-210 wasstNGiaN OC 20555 s
.I s
c l l 1 4 k a
~
^- . f .L}}