Adaptation of NRC Risk Model for AOT Determinations

1. Adaptation of NRC Risk Model for AOT Determinations Douglas Clark B&W Technical Services Y-12 April 28th, 2010

2. Goals To explain : How LCO completion times are based on the Allowed Outage Time (AOT) for safety-systems. How the Risk Increase (?R) impacts the AOT. How the AOT Risk Contribution is the relative risk of the event Why the relative risk is acceptable

3. Background Risk. The quantitative or qualitative expression of possible loss that considers both the probability that an event will occur and the consequences of that event. (DOE-STD-3009-94) Risk (Rem/yr) = Frequency (/yr) ? Consequences (Rem) For Safety-Significant SSCs (SS-SSCs) Guidance for hazard and accident analysis is not based on probabilistic risk assessment (PRA). (DOE-STD-3009-94) Preparers (and subsequent reviewers) cannot expect the level of detail associated with a quantitative risk assessment in a hazard analysis, as the hazard analysis is focused on systematically assessing what can go wrong in a facility as opposed to deriving mathematical expressions of risk. Risk is qualitative (e.g., engineering judgment) for SS-SSCs.

4. Basic Concepts Allowed Outage Time (AOT): When a component goes down, there generally is a risk increase due to loss of function of the component. The AOT specifies the period in which a component can be down to restore its operation. (NUREG/CR-6141) AOT is the LCO Action Completion Time. AOT Risk Contribution: For a given AOT, the risk contribution (e.g., ?R) is calculated by multiplying the risk impact by the AOT. There are two risk contributions: Single-event Yearly The AOT Risk Contribution is the relative risk of the event.

5. Risk Contribution associated with an AOT

6. Risk Contributions from various AOTs

7. AOT Risk Contribution � Example 1 NO COMPENSATORY ACTIONS the SSC cannot perform its safety function. HEUMF LCO 3.6 Condition A �A RCSB, in rack storage, is not secured to the storage rack� Action A.1 �Secure the RCSB to the storage rack� Completion Time: 4 hr (4.6E-4 yr) Event of Concern: Earthquake displacing 10+ RCSBs Risk increase (?R): 1E-2/yr ? 0.1 Rem = 1E-3 Rem/yr AOT yearly risk contribution: 1E-3 Rem/yr ? 4.6E-4 yr � 5E-7 Rem

8. AOT Risk Contribution � Example 2 COMPENSATORY ACTIONS Event Frequency Reduced, No Consequence Mitigation HEUMF LCO 3.2 Condition A �FPS 2, 4A, 4B, 4C, and/or 4D is not OPERABLE� Action A.2 �Initiate and maintain FIRE PATROLS �� Action A.3 �Restore the affected FPS to OPERABLE status.� Completion time: 92 days Event of Concern: Large Area Fire Risk increase (?R): 1E-5 ? 0.01 ? 6.6 Rem = 7E-7 Rem/yr AOT yearly risk contribution: 7E-7 Rem/yr ? 0.25 yr � 2E-7 Rem

9. AOT Risk Contribution � Example 3 COMPENSATORY ACTIONS Mitigation & frequency reductions, less overall system reliability HEUMF LCO 3.2 Condition D �The Diesel Fire Pump is not OPERABLE for reasons other than those in Conditions B or C� Action D.1 �Ensure the Electric Fire Pump is available� Action D.2 �Restore the Diesel Fire Pump to OPERABLE�� Completion time: 184 days Event of Concern: Large Area Fire Risk increase (?R): 6E-7 Rem/yr AOT yearly risk contribution: 6E-7 Rem/yr ? 0.5 yr � 3E-7 Rem

10. HEUMF Completion Times For consistency, the Risk Based AOTs were simplified into 5 basic completion times: 4 hours (for Safety-Class SSCs) 24 hours 7 days 92 days 184 days Each of the completion times was based on the corresponding level (color) from the Risk Contribution

11. HEUMF Completion Times (continued) 24 hours The risk of the HEUMF design basis fire is ~ 7E-5 Rem/yr. This AOT gives a risk contribution of ~ 2E-7 Rem. The risk of a NPH event at the HEUMF is ~ 1E-3 Rem/yr. This AOT gives a risk contribution of ~ 5E-7 Rem. 7 days This outage time corresponds to the frequency of a loss of offsite power during the design basis accident. 92 days This outage time corresponds to the loss of all SS-SSCs and is the frequency of a fire ? the probability that compensatory actions will not detect and minimize the fire ? the maximum consequences of a fire � 7E-7 Rem/yr. This AOT gives a risk contribution of ~ 2E-7 Rem.

12. 184 Day Completion Time The design basis life of the HEUMF is 50 years (18,263 days) The HEUMF has redundant/diverse systems, e.g.; the FPS and SCS serve redundant functions For conditions which have the redundant function available (and checked through compensatory actions) or for failures which constitute a significant failure of the device, the AOT should be representative of the risk posed by that system. If the FPS has a failure probability of 0.01 and the SCS has a failure probability of 0.01 then the probability of both failing simultaneously is 0.0001. Removing one of these systems results in a probability of failure of 0.01. Therefore the frequency of the event (anticipated in the life of the facility) shall be reduced by a corresponding factor. (i.e., 0.01). 0.01 ? 18,263 days � 184 days

13. 184 Day Completion Time (continued) The 184 day completion time is the maximum AOT (i.e., single-event AOT). The yearly AOT risk contribution is the maximum AOT times the anticipated frequency of entering the condition. For HEUMF systems, the anticipated failure of components that would result in entering the LCO is < 10-2 /yr. Therefore the yearly AOT risk contribution is < 2 days. This outage time corresponds to: the frequency of a large area fire ? the probability that remaining system will fail ? the consequences of the design basis fire � 1E-6 Rem/yr. This AOT gives a risk contribution of ~ 5E-7 Rem. The 184 days was subsequently analyzed to see if this completion time were reasonable and prudent.

14. Comparing AOT Risk Contributions Are 5E-7 and 3E-7 AOT Risk Contributions reasonable? NRC Regulatory Guide 1.177, Section 2.4 indicates that an AOT has only a small quantitative impact on plant risk at certain levels An AOT risk contribution ��less than 5.0E-7 is considered small for single TS AOT change.� The NRC based the 5E-7 upon a core damage failure probability of 1E-4 that was increased to 1E-3 during a 5 hour outage. The HEUMF is much less dynamic than a nuclear reactor, but the total relative risk contributions are of a similar order of magnitude although the durations of the allowable outages are much different due to the inherent safety of HEUMF operations.

15. Completion Times and Spare Parts There are essentially two options: Have all necessary spare parts on hand Be able to diagnose, order, receive, and install parts within the completion time. There is significant cost avoidance with the second option. Cost/Benefit Ratios dictate that we look to see if completion times are reasonable. Example: CAAS parts Vendor has 120 day lead time for all orders Therefore if completion time is < 120 days, all spares must be on-hand.

16. Summary Guidance for hazard and accident analysis is not based on probabilistic risk assessment (PRA). All AOT risk contributions are qualitatively assessed to be less than 1E-6 Rem. HEUMF Completion times were standardized into five major types. 4 hours (for Safety-Class SSCs) 24 hours 7 days 92 days 184 days These completion times represent high Benefit/Cost ratios and result in significant cost avoidance for the HEUMF.

17. Questions

18. Backup material

19. Control of the AOT Risk Per NUREG/CR-6141, the single-event AOT risk contribution is the contribution when the AOT is activated (i.e., LCO is entered). The yearly AOT risk contribution is the average contribution from expected occurrences of the AOT. Both need to be controlled. Intentional entries into LCO conditions for maintenance are intended to increase reliability of the systems. This imparts the �Reliability Effect of Maintenance� as described in NUREG/CR-6141. Given the level of risk associated with the AOTs for HEUMF, the reliability effect of maintenance offsets the increased risk from the outage associated with that maintenance. Therefore the expected occurrences of the AOT that impact the overall AOT risk are linked to the reliability of the system.

20. Disclaimer This work of authorship and those incorporated herein were prepared by Contractor as accounts of work sponsored by an agency of the United States Government. Neither the United States Government nor any agency thereof, nor Contractor, nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, use made, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial product, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation, or favoring by the United States Government or any agency or Contractor thereof. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or any agency or Contractor thereof.