Risk Informed Safety Margin Characterization for Effective Long Term Nuclear Power Plant Safety Management

Transcription

1 Risk Informed Safety Margin Characterization for Effective Long Term Nuclear Power Plant Safety Management Stephen M. Hess Electric Power Research Institute 300 Baywood Road West Chester, Pennsylvania, United States of America Abstract. Maintenance of safety margins has served as a foundational principle of plant operation and regulation since the advent of commercial nuclear power. As the current generation of operating nuclear power plants (NPPs) ages, the enhanced capability to evaluate and manage safety margins will be a critical element in their continued safe operation. Additionally, operating commercial NPPs continue to undergo design and operational changes to support cost effective long term operation such as power up-rates and extended operating cycles. These operational enhancements also have the potential to impact plant safety margins. Thus, a critical element to achieve safe long-term NPP operation will be the development and application of a robust method to perform safety margin evaluations in a manner that is technically accurate and economically efficient. This paper presents an approach that meets these objectives by describing the successful pilot application of the Risk-Informed Safety Margin Characterization (RISMC) framework to analyze and obtain important insights into a significant issue in NPP safety risk management. This pilot effort demonstrated that the RISMC framework can be used to identify important contributors to plant safety margins, both positive and negative, from which useful information can be obtained to support the development of strategies to enhance NPP safety. Additionally, the research also demonstrated that this approach can be applied using a reasonable level of resources and within a timeframe that supports effective NPP decision-making. 1. Introduction The concept of safety margin is one that is familiar from the design of structures in the civil engineering profession. In this approach, a system is designed to possess a capacity which is specified to be sufficient to withstand any load that the system is envisioned to experience during all anticipated service conditions (including normal, transient and potential accident conditions). In this probabilistic framework, this means that the likelihood of the load exceeding the system capacity is acceptably small. However, during the design and licensing of the current fleet of commercial NPPs, actual data from which estimates of the actual capacities and loads for plant structures, systems and components (SSCs) could be developed were either not available or considered to be impractical or too expensive to obtain. Thus, alternative methods were devised to ensure sufficient safety margins were built into the plant design and operational framework. The first modification to overcome this limitation was to specify plant designs that were very conservative from an engineering perspective. This design conservatism resulted in utilizing SSCs that are capable of performing at levels that are significantly better than what is required to support normal operation, envisioned plant transients or design basis accidents. The second modification addressed the issue from a regulatory perspective by specifying a hard safety limit which is set at a level that is significantly below the designed system capacity. However, over time NPP operation has the potential to impact the original specified design margins. This can occur in several ways. First, plant operation over the course of its lifetime can change the expected value or the shape of the distribution function for the SSC load, capacity or both. For

2 example, aging of plant materials can result in decreased resiliency of the system to withstand perturbations; thus causing the capacity curve to shift to the left over time. Additionally, operational changes made to enhance plant economics also can impact safety margins. For example, increased fuel burnups and plant power uprates can result in operation of plant SSCs at higher stress levels (i.e. closer to their design tolerances) and result in a shift of the load curve to the right. We note that not all actions that are taken over a plant s operating life will necessarily result in decreases in safety margins. For example, some PWR NPPs have installed dedicated reactor coolant pump (RCP) seal injection systems. For these plants the likelihood of an RCP seal loss of coolant accident (LOCA) is greatly reduced and thus the safety margins are enhanced over what they were in the initial design. As another example, improved analytical methods and supporting operational data can provide improved estimates of actual SSC performance; thus shifting the expected value of the load curve to the left. As a final example, the implementation of condition based maintenance technologies (such as vibration monitoring or lubricating oil analysis) provide an effective means of identifying degraded conditions of rotating equipment at an incipient stage. As a result, these technologies can influence the actual safety margins by decreasing the variance of the distribution of the load function; thus providing a higher degree of confidence that adequate safety margins are being maintained. These concepts are illustrated schematically in Figure 1. Potential Impacts of LTO on Safety Margins 1 Probability Density Ops Enhancements Power Uprates Inc. Fuel Burnups Load Safety Limit Capacity Design Changes SSC Aging Applied Load SSC Capacity Applied Load / SSC Capacity (Arbitrary Units) Figure 1: RISMC framework applied to NPP long term operational decision making. As discussed in the previous paragraph, ensuring adequate NPP safety margins has served as a foundational principle of NPP safety since the advent of commercial nuclear power. This need to ensure adequate safety margins led to the specification of limiting conditions for operation (LCOs) in the plant Technical Specifications. In addition, regulators have consistently included consideration of the potential impact on safety margins as part of their reviews. However, plant enhancements being contemplated by NPP operators for long term operation (e.g. power uprates, increased fuel burnups, etc.) have the

3 potential to impact the plant safety margins that were specified in the plant s original licensing basis. The situation is complicated by the possibility that, although an individual design or operational change may not result in a significant erosion of any safety margin, the cumulative effect of multiple changes may result in a challenge to them. Because of the additional uncertainties inherent in long term NPP decisions, it is greatly desired to develop and apply a methodology that can effectively and efficiently evaluate the impacts and uncertainties associated with these decisions. 2. Summary of Current Status of Risk Informed Safety Margin Research Over the past 10 years, both NPP regulators and operators have investigated the application of a Risk Informed Safety Margin Characterization (RISMC) approach to evaluate the impact of NPP LTO decisions on these margins. Due to space limitations, in this section we provide a very brief summary of the current state of this research. A more complete summary can be found in references [1, 2] Regulatory Sponsored Research In anticipation of the possibility of NPPs extending their licensed operational lifetimes, the Nuclear Energy Agency Committee on the Safety of Nuclear Installations (NEA/CSNI) formed a working group to evaluate the potential impacts of NPP life extension, aging, and operational changes on plant safety margins. This task group consisted of senior scientists and engineers responsible for nuclear safety technology representing regulatory authorities from several nations. In 2007 they published a report on development of a Safety Margins Action Plan (SMAP) [3] that was intended to address five activities: 1) Develop a working definition of safety margins and related concepts. 2) Develop a process for the assessment of safety margins. 3) Identify appropriate methods for safety margin evaluation. 4) Identify methods for safety margin quantification. 5) Prepare a CSNI guidance document on safety margins for use by NPP regulatory authorities. The primary objective of the SMAP Task Group was to investigate methods to perform a regulatory analysis of the impact on safety margins of potential NPP modifications or operational changes that could be implemented to support extended plant operation. In their evaluation, this group identified several potential limitations of the existing probabilistic risk assessment (PRA) approach. For the purpose of their analyses, the primary figure of merit for regulatory evaluation was considered to be the frequency at which a safety margin could be exceeded. To address the issues identified during their research, the proposed methods developed by the SMAP Task Group extended the use of PRA methods to the full risk space so that it would possess the capability to address (at least) the full set of licensing objectives considered in the NPP licensing basis. The working group proposed that the set of conditions specified in the U.S. 10CFR50.59 licensing basis be applied as a starting point for evaluating the applicability of proposed changes that could impact NPP safety margins. To achieve this objective, the SMAP Task Group proposed the following modifications to make the process applicable to the evaluation of safety margins for the purpose of regulatory review. Expand the selected set of initiating events (IEs) to analyze a comprehensive set of IEs beyond

4 design basis accidents and abnormal operational occurrences. Expand the analysis scope to include SSCs and operator actions credited in the PRA and expand the scope of consequences to address potential failure modes. In both cases, the extent of what would need to be included in the analysis would be dependent upon the particular application being considered and thus could represent a significant expansion of the risk space from that addressed in a typical PRA. The 10CFR50.59 questions concerning changes in consequences should be interpreted in terms of changes in exceedance probabilities. Since the publication of the original SMAP Task Force report in 2007 (see [3]) a number of proof of concept pilot applications have been conducted by various researchers. Due to space limitations, we will not discuss these here. References to them can be found in our previous work cited in [2]. However, in [2] we identify several issues that remain open with regard to the RISMC methodology. These include: (1) the need to take account of both epistemic and aleatory uncertainties with an adequate level of realism in the thermal-hydraulic analyses and probabilistic risk assessment (PRA) calculations, (2) the amount of effort and resources that are needed to conduct the RISMC analysis and (3) the issue of the computational power that is needed to perform the required calculations. 2.2 Industry and U.S. Department of Energy Sponsored Research To meet the challenges of extended NPP operation, the United States Department of Energy (DOE), the Idaho National Laboratory (INL) and the Electric Power Research Institute (EPRI) are performing coordinated research to evaluate and address the technological challenges that could impact the safe and economic operation of the existing NPP fleet over the postulated extended operating time horizons. This has led to the identification of five specific research pathways in the DOE sponsored Light Water Reactor Sustainability (LWRS) program [4]: 1) nuclear materials aging and degradation, 2) advanced light water reactor fuel development, 3) risk-informed safety margin characterization (RISMC), 4) advanced instrumentation and control technologies, 5) economy and efficiency. The research in these pathways is being performed as a collaborative effort between the DOE LWRS program which is being managed by INL and the Long Term Operation (LTO) initiative sponsored by EPRI. Similar to the approach taken by the SMAP research effort discussed in the previous section, the RISMC research efforts being conducted by EPRI and INL are being performed within the framework of case studies. However, the objectives for the analyses are somewhat different than in the regulatory sponsored SMAP effort. From an industry perspective, a critical criterion for the approach to be useful to NPP decision-makers is that the method must not be too labor-intensive, costly or time consuming to apply. Thus, a primary objective of the RISMC case studies in the LTO / LWRS research program is to attempt to obtain estimates of the costs and benefits that the method could provide to support NPP decision-making. Second, the performance of RISMC case studies was identified as a useful framework to guide the development of the RELAP-7 next generation systems analysis code (NGSAC) being developed by INL.

5 Thus, it is desired that the case studies selected for analysis can be performed using conventional safety and risk assessment tools that can serve as a benchmark against which the results obtained from separate RELAP-7 analyses can be compared. To achieve these objectives, a number of potential case studies were evaluated for use as the initial test case. Because a loss of (all) feedwater (LOFW) event addresses an important event relevant to NPP safety and requires significant modeling (both deterministic and probabilistic), it was determined that this event would provide a useful demonstration effort to evaluate the extent that the RISMC framework could be applied in a manner that would support effective NPP risk management decision making. In the next section we describe the results obtained from this pilot assessment. 3. Application of RISMC to Loss of Feedwater Event During 2011, a comprehensive RISMC analysis was conducted on a LOFW event at a hypothetical Westinghouse 4-loop pressurized water reactor (PWR) with a large dry containment. The particular NPP design that was analyzed consisted of four model D5 steam generators (SGs) and included both motor driven and turbine drive auxiliary feedwater (AFW) systems. The plant design analyzed in this case study also included high head centrifugal charging pumps (CCPs) and intermediate high head safety injection systems (HPSI). The assessments were conducted using the MAAP-4 accident analysis code. Again, due to the space limitations, only highlights from this analysis will be presented in this paper. More complete information can be obtained in references [5, 6]. For this case study, the loss of feedwater (LOFW) event with subsequent failure of all auxiliary feedwater (AFW) was evaluated. The key output parameter is core damage with the critical event being the determination of whether core damage will occur. This is indicated by determination of whether the feed and bleed (F&B) cooling mode is initiated within a time window where the available combination of injection systems and number of opened power operated relief valves (PORVs) successfully can cool the core and prevent core damage. For this study, the applicable core damage metric was taken as the fuel peak cladding temperature (PCT). A distribution was constructed for the temperature at which core damage occurs (i.e. the system capacity in the RISMC framework). Important parameters that impact the prediction of PCT (the load function) such as time of reactor trip, time the reactor coolant pumps (RCPs) are tripped, time at which the operators initiate F&B cooling, etc. were identified and distributions were constructed to represent the uncertainties in these parameter values. Stochastic sampling from the load parameters was used to generate a set of calculations to characterize the overall PCT load distribution. This calculated distribution was then compared to the values sampled from the PCT capacity distribution to generate a probability density of the system load vs. capacity which was used to assess the overall probability that the load does not exceed the capacity (i.e. the probability that the transient is successfully addressed using F&B cooling). A review of prior analyses for LOFW events was performed to identify the most important parameters likely to influence whether core damage would occur for these events. This assessment included a review of prior thermal-hydraulic / severe accident simulations, review of the applicable emergency operating procedures (EOPs), and a review of representative PRA accident sequence analyses

6 for this event. The parameters included in this RISMC analysis were as follows: power level at start of event steam generator (SG) levels and masses time of reactor trip number of PORVs opened for F&B operation number of available trains of safety injection (SI) and closed cooling water pumps (CCPs) HPSI pump flow characteristics near shutoff head Pressurizer PORV flow characteristics time of AFW failure RCP trip (i.e. whether or not it occurred and at what time during the event if it did) time reactor feed initiated (SI actuation) PCT threshold for core damage For each of these parameters, various data sources, including US Licensee Event Reports, applicable emergency operating procedure (EOP) guidance and representative plant PRA analyses and results, were examined to permit construction of a representative probability density function (either discrete or continuous) for each parameter. The uncertainty distributions for nine of these parameters were sampled using a Latin Hypercube Sampling (LHS) technique. Because of the nature of the distributions for three of the parameters (i.e. number of PORVs opened for F&B operation, number of trains of HPSI and CCP available, and RCP trip) the uncertainties associated with these parameters were explicitly considered using an event tree structure. The event tree branch pathways also were used to set the initial conditions for each set of simulation runs. (Note the event tree used in this analysis and additional details of the analysis are provided in reference [6] which is publicly available from the EPRI website: Each sample set consisted of 100 LHS samples. For each of these samples a MAAP-4 simulation run was performed. Eleven sample sets were defined for the various combinations of number of PORVs opened, number of trains of HPSI and CCP available, and whether the RCPs were tripped. Hence, 1100 MAAP-4 simulation runs were performed during the conduct of this analysis. The primary results obtained are summarized in Table 1. This table shows that for cases where only HPSI is available, the margin is negative. This provides an indication that the PRA success criterion (which typically is an assumption) may be non-conservative for this situation. For cases where CCP only is available, the analytical margin is strongly positive indicating that there is a large measure of conservatism in these PRA assumptions. In this particular application, the overly conservative PRA success criterion that a pressurizer PORV be manually opened for success with CCP injection greatly dominates the results (by a factor of ~1000 in the calculated change in conditional core damage probability ( CCDP)). Thus, the net impact of this analysis is a calculated increase in margin of ~5E-3 (again as measured by CCDP). Figures 2 and 3 (next page) present these same results in graphical format. In these figures the load distribution is shown as a histogram (blue) and the capacity distribution is shown in red. Note that Figures 2 and 3 display the same data using different y-axis scaling formats for the load distributions. Figure 2 displays the results using linear scaling and Figure 3 using logarithmic scaling. Thus, as indicated in the safety margin summary provided in Table 1, the instances of the load exceeding the capacity are quite small.

7 Case Conditional Core Damage Probability (CCDP) CCDP RISMC PRA HPI Only Cases 5.57E E E-6 CCP Only Cases E E-03 Combined Cases 5.33E-3 Table 1: LOFW safety margin analysis results summary. Figure 2: RISMC load capacity results obtained for LOFW analysis linear scale. Figure 3: RISMC load capacity results obtained for LOFW analysis logarithmic scale.

8 4. Conclusions and Future Work The evaluation and maintenance of plant safety margins will be important elements in enabling the long term safe and efficient operation of the current fleet of commercial NPPs. An important element of achieving this objective is the development and application of a robust method to perform safety margin evaluations in a manner that is both technically justifiable and economically efficient. In this paper we discussed a pilot application of the RISMC method to a LOFW event that demonstrated this approach could successfully achieve both of these objectives. In particular, this pilot effort demonstrated that a RISMC assessment can be performed using a reasonable level of resources and within a timeframe that supports effective NPP decision-making. As a result of this successful application of the RISMC approach it was determined that it would be beneficial to apply the approach to a situation of more direct relevance to NPP LTO decision making. As mentioned earlier, many NPP operators desire to maximize the capabilities of their installed NPP assets. One such method of accomplishing this is to implement (with appropriate regulatory approvals) extended power uprates (EPUs). Since these applications have the potential to impact plant safety margins, it is believed that the RISMC approach is a logical candidate to assess this impact. Thus, EPRI has initiated a RISMC demonstration project that will evaluate the changes in critical safety margins associated with a hypothetical EPU applied to a large boiling water reactor (BWR) design that employs a Mark-I containment with the plant subject to a station blackout (SBO) event. This study is in the very early stages of performance and the planned activities are indicated in Table 2. It is anticipated that preliminary results will be obtained during the fall of 2012 with final results and conclusions published in the summer of Task ID SBO-01 SBO-02 SBO-03 SBO-04 SBO-05 SBO-06 SBO-07 SBO-08 Task Description Identify list of parameters to include in model. Develop uncertainty distributions for modeled parameters. Develop base case MAAP model. Develop MAAP / DAKOTA linkages and sampling protocols. Conduct sampling analysis. Evaluate results / identify need for enhanced thermal-hydraulic modeling. Conduct additional analyses with enhanced modeling (as necessary). Evaluate / report results (EPRI Technical Report). Table 2: Planned RISMC activities for BWR EPU SBO study. REFERENCES [1] S. M. Hess, et al., Framework for Risk Informed Safety Margin Characterization, EPRI Report , 2009, Electric Power Research Institute, Palo Alto, CA, USA [2] S. M. Hess, D. Vasseur and R. Youngblood, Recent Trends in Risk-Informed Safety Margin

9 Characterization, Proceedings of the American Nuclear Society PSA2011 Topical Meeting, 2011, American Nuclear Society, La Grange Park, IL, USA [3] Safety Margins Action Plan (SMAP) Final Report, NEA/CSNI/R(2007)9, 2007, Organization for Economic Cooperation and Development [4] Light Water Reactor Sustainability Program Plan Fiscal Year 2009, Idaho National Laboratories, Idaho Falls, ID, September 2008 [5] R. R. Sherry, J. R. Gabor, Risk Informed Safety Margin Characterization: Trial Application to a Loss of Feedwater Event, Proceedings of the American Nuclear Society PSA2011 Topical Meeting, 2011, American Nuclear Society, La Grange Park, IL, USA [6] R. R. Sherry, J. R. Gabor and D. E. True, Technical Framework for Management of Safety Margins Loss of Main Feedwater Pilot Application. EPRI Report , 2011, Electric Power Research Institute, Palo Alto, CA, USA