Seismic PRA Insights and Lessons Learned

Transcription

1 PSA 2015 International Topical Meeting On Probabilistic Safety Assessment and Analysis April 26-30, Sun Valley, ID Session 20-2: Seismic II, Paper Seismic PRA Insights and Lessons Learned Presentation: A. Maioli Co-authors: Westinghouse Electric Company A. Maioli, J. Beckton, E. Carson, R. Solano, C. Worrell, Jack Benjamin & Associates M. McCann Stevenson & Associates TK Ram 1

2 Purpose Share insights and lessons-learned across a variety of SPRA performed or being performed for several operating nuclear power plants, as well as the AP1000 a plants currently under construction. SPRA models are in support of a variety of plant needs ranging from plant startup, to risk-informed applications and response to NTTF 2.1. Different needs and goals Different challenges are encountered. 2 a. AP1000 is a trademark or registered trademark of Westinghouse Electric Company LLC, its affiliates and/or its subsidiaries in the United States of America and may be registered in other countries throughout the world. All rights reserved. Unauthorized use is strictly prohibited. Other names may be trademarks of their respective owners.

3 SPRA Plant Response Model Desirable Traits: Capable of quantifying seismic CDF and LERF Full Level 2 logic for a couple of models Optimize model size and complexity Integration, or at least compatibility, with Internal Events PRA One-top/all-hazard is preferred Number of ad-hoc logic refinement needed 3

4 Use of Internal Events PRA Insignificant aspects of Internal Events PRA may be significant for the Seismic PRA Internal operator actions using screening values More significant consequential LOOP Challenged simplified modeling (i.e., credit was not taken for fail safe in non LOOP scenarios in case of loss of power/signals) New component failures Guaranteed failure of non-seismic equipment resulting in almost guaranteed LOOP New mutually exclusive combinations The hardest cutstes to find those that are not there. Minor logic modification for concentrated LOCA 4

5 SPRA Model Software Code Evolution (FRANX 4.2) A blessing and a curse (but mostly a blessing) Large and gross insertion of logic using the Create One Top Model feature. Limited ability to modify or optimize this logic. Multiple injection of similar gate/fragilities Example 300% increase in number of injected gates from FRANX compared to XINIT Impacting truncation levels (already challenged) Optimized injection makes model and cutsets review more complicated 5

6 Non-Safety Related (NSR) Components Approach 1: Fail all NSR components Simplicity (faster model) Reduced resolution of the model (always generates a LOOP) Potentially masks insights in the low ground motion levels Potentially problematic as reduces options for seal LOCA mitigation In general reduces Defense in Depth strategy (AP1000) Approach 2: Sensitivity studies to identify important NSR components Meaningful insights that would have been masked Allows pinpointing subset of critical NSR equipment that can be addressed with more detailed fragility analysis Model complication Significant increase in cutsets and double-counting of LOOP (numerically increasing CDF by up to 40% in some cases) 6

7 Surrogate Element Threshold: 0.1g/OBE Threshold: HCLPF leading to <1% Seismic CDF Very fragile components - Non-safety/non-seismic Modeling approach - Assumed failed (either at top event level or individual basic event) - Very simplified/conservative fragilities (may lead to double-counting of LOOP scenarios) HCLPF* Specific fragility analysis - Initial list from walkdowns - Refined based on component importance via PSA model evolution When used appropriately the surrogate element can save a lot of fragility work. Keep it in the model as flag for appropriateness of screening levels 7 Very robust components - Valves - Components screened via NP-6041 Modeling approach - Single surrogate to CD - Multiple surrogate at system levels - Multiple surrogate at individual basic event level - Iterative approach (i.e., the lower the CDF the more fragilities) *Assuming beta around 0.4

8 Extended Mission Time Considerations 24 hours typical of Internal Events Some Seismic sequences may be important beyond 24 hours Catastrophic events (likely due to large earthquakes) are independent of mission time (direct CD/LERF) Offsite power non-recovery requiring extended EDG operation Ensure equipment needed for EDG operation beyond 24 hours is included in SEL, addressed by fragility and modelled as failure of EDG Mission time parameter change sensitivity too limited (i.e., does not address need for non modeled operator actions beyond 24 hours) Add step-fragility associated with need for diesel refueling Sensitivity on g level associated with step fragility No LOOP recovery even at low g level distorting plant fragility at low g level Sensitivities on crediting LOOP recovery at low g levels 72 hours mission time re-baseline in impractical and adds significant uncertainties associated with system/equipment recovery Unless the internal events PRA is built already on 72hrs mission time (AP1000) 8

9 Modeling Relay Chatter Relay Identification process Complete SEL Seismic Class I items in SEL Planned scope reduction to maintain the program feasible. Non SC-I items are either non credited or assigned a very low fragility and modeled conservatively as completely correlated. This balances the limitation of not looking at relaysinduced failure Contacts identification (10sK+) Cannot perform circuit analysis on all contacts from all relays Unique relays (1000+) 9

10 Modeling Relay Chatter Relay Screening Process Unique relays (1000+) Importance Groups (IG) IG1 = Relays from Nonnuclear safety (NNS) locations ASSUMED not to negatively affect Safety components IG2 = Safety relays found in locations (e.g., cabinets) not in the SEL and impacting safety equipment SEL increase IG3 10 IG3 = Need further assessment Screening Groups (SG) SG1 = not vulnerable to chatter (e.g., solid state) AP1000 SG2 = Chatter assessment included in parent component SG3 = chatter acceptable based on function. SG4 = Initial HCLPFs are provided

11 Modeling Relay Chatter Relay Screening Modeling SG1 SG2 SG3 SG4 Not modelled (no functional impact) Not modelled if parent component is already modelled (exception for relays potentially inducing ISLOCA) 11 More laborintensive group as it requires circuit analysis). Not modelled Modelled explicitly in iterative fashion: 1. Full correlation full failure for all relays with same HCLPF 2. Address leading relays for functionality 3. Refined fragilities estimates 4. Break correlation based on location

12 Modeling Relay Chatter Insights Relay chatter currently seen in all S-PRA to date (both directly done and peer reviewed) among significant risk contributors Lock out relays DG relays Some conservatism observed in fragility estimates (vertical input) Recently completed EPRI High Frequency Study to provide updated information on capacity side Operator actions rarely credited but possible to address some relay chatter issue. 12

13 Modeling Seismic-Induced Fires and Floods Current methodology for seismic-induced fires and floods based on IPEEE find and fix approach Disconnect between NP-6041 and evolution in fires/floods PRAs for fire and flood source identification Evolution in the approach still under-way (NRC Reccomendation 3) SEL still not to include full list of fire/flood sources from FPRA and IFPRA Fire/flood sources processed for initial generic screening Sources retained from initial screening can be added to SEL and to walkdown to evaluate specific seismic vulnerabilities Simplified modeling for sources that do not screen out 13

14 Modeling Seismic-Induced Fires and Floods Simplified modeling Fires/Floods fragilities still a technology gap No fragilities for fire failure mode Functional fragility should be limiting Also for flooding the failure mode may be inconsistent Anchorage failure for tank or HX not necessarily leading to pressure boundary breach Functional fragilities used initially or with reduction factor Pseudo ignition probability Treatment of correlations Exception to full correlation assumption is needed Fire/Flood scenario development Use impact mapping from internal fire (e.g., propagation path) or fire (cable database) 14

15 Modeling Seismic-Induced Fires and Floods Simplified modeling Fire/Flood barriers Seismic degradation not considered Equipment specifically added for fires/flood mitigation added to SEL. Combination of fire/flood/seismic PSF potentially ballooning the HRA task. 15

16 Modeling LERF/Level 2 Simplifying assumptions (e.g., direct to CD) way more significant in Level 2 than in CDF space Expert panel (SG design, piping design, support design, TH) convened to support modeling of scenario with SG failure not going directly to CD and LERF Extreme flexibility of piping Difference between onset of failure and complete failure Complete/catastrophic failure different than assuming support is not there anymore A lot of margin but difficult to estimate SERF into LERF Power dependency impacting multiple isolation valves In general, Level 2 metrics are closer to Level 1 metric 16

17 Seismic Risk Technical Elements Quantification What is the most appropriate way to present/report seismic risk contributors? Modelling approach (seismic initiator and fragility basic events) makes it difficult to breakdown by scenario types (e.g., LOCA) because CDF/LERF is not stable in one-top vs. sequence quantification Main-stream PSA codes challenged by failure of rare events approximation Explicit modeling of complement to success logic used to support quantification Importance measures are affected by the success portion in the cutsets. When discrete modeling method used, intervals are needed to appropriately capture CDF vs. acceleration Importance measures (and most critical cutsets) are broken in pieces with relative importances Improving important basic events do not budge the model Some manual corrections are needed for importances associated with bins with CCDP maxed to

18 Seismic Risk Technical Elements Quantification More refined propagation of uncertainties 18