4.0 Summary of Major DCISC Review Topics, 17th Annual Report - July 1, 2006 thru June 30, 2007
4.8 Risk Assessment and Management
4.8.1 Overview and Previous Activities
PG&E has developed in-house capability to perform risk assessments and periodically updates its Probabilistic Risk Assessment (PRA) to incorporate changes in plant configuration and, if appropriate, operations. The PRA Group has been updating the original 1995 risk assessment which included the sum of internal, seismic, fire and shutdown risks. The 1995 core damage frequency (CDF) was 1.12x10-4 per year, and the revised risk is lower at 9.72x10-5 per year – a 13% decrease. Much of the reduction is due to implementation of the Maintenance Rule and resultant increased equipment reliability and PRA modeling improvements. The reduced overall risk permits more flexibility in scheduling on-line maintenance. The NRC criteria are based on a 1.0x10-6 per year risk threshold for on-line maintenance, and DCPP will have more room within that threshold to perform additional maintenance on line.
PG&E controls its risk from on-line maintenance procedurally. For On-Line Maintenance the PRA Group prepares a Risk Profile on a weekly, monthly and fuel cycle basis. The PRA Group works very closely with personnel performing the On-Line Maintenance risk assessment, and the program has been working well.
The On-Line Maintenance (OLM) model has been used by Operations and Maintenance as an on-line planning tool for various operations and maintenance activities. DCPP is now using ORAM Sentinel (Outage Risk and Management) instead of OLM. Using ORAM, the PRA Group has increased allowable outage times (AOTs) for the Auxiliary Feedwater Pump and identified more sources of water. Similarly, AOTs have been increased for the EDGs, startup power, and CCWPs. AOTs have decreased for the SI, Charging and RHR pumps and have decreased significantly for the SSPS, which represents the highest-risk AOT.
Although the DCISC did not review it during the 2005-2006 reporting period, the Probabilistic Risk Assessment (PRA) Program has appeared satisfactory in previous reporting periods. The DCISC will continue to review PRA including the model updates and upgrades as they are completed.
4.8.2 Current Period Activities
The DCISC did not review Probabilistic Risk Assessment (PRA) items per se during the current reporting period but did review the following related item:
Outage Risk Analyzer – Maintenance (ORAM)
The DCISC Fact-finding Team (FFT) met with Nathan Barber, Reactor Engineering Group Engineer, at its October 25-26, 2006 Fact-finding Meeting (Volume II, Exhibit D.3, Section 3.3) to review DCPP’s use of Outage Risk Analyzer – Maintenance (ORAM).
ORAM is a work-station-based logic program incorporating DCPP Probabilistic Risk Assessment (PRA) data which is used to determine the risk of various plant equipment outage combinations during plant operation. DCPP has Train Level System, Structure & Component (TLS) codes for its risk-significant work items, typically equipment that is to be out-of-service (OOS) for maintenance. ORAM reads the TLS Codes and assesses risk using PRA tables and Safety Function Assessment Trees (SFATs). ORAM output consists of risk colors (green/yellow/orange/red) assigned based on quantitative PRA criteria as well as Key Safety Assessment (KSA) scores.
Operations Shift Manager approval is required for the following situations which will show Orange risk:
- Risk configurations resulting in a KSA score > 8
- PRA Allowed Outage Time (AOT) < Threshold PRA
- PRA AOT < Planned Work Duration
- Trip risk item with Trip Mitigation Equipment OOS
Plans showing Red risk color must be reviewed and approved by the PRA Group. DCPP runs ORAM each day with the daily work plan. Because ORAM is used for safety-related applications, it is included in the DCPP Software Quality Assurance Program.
The FFT reviewed a sample ORAM risk chart for the outage of Emergency Diesel Generator (EDG) 1-3 and Residual Heat Removal (RHR) Pump 1-1. Overall risk was Orange for an outage time of 183.0 hours, whereas each individual equipment outage was Yellow. The Core Damage Frequency was 6.499E-005 per reactor year. The risk chart appeared to be a useful tool to assure plant risk is minimized and with acceptable limits.
ORAM is also used to calculate outage risk assessment. The FFT reviewed an Outage Risk Assessment chart. The chart graphed Core Damage Risk per Hour against time for various plant equipment configurations. In this example, relatively higher risk was shown for the two mid-loop operations following shutdown and prior to startup. The highest risk was calculated to be in the range of 1E-09 to 1E-08 per hour (acceptable) for the duration of mid-loop operation. The risk for other outage operations was less than 1E-15 per hour.
In the second quarter of 2007 DCPP plans to replace ORAM with a new program, Safety Monitor, from the Electric Power Research Institute (EPRI). DCPP is presently testing the program and verifying interfaces. It can calculate risk from more than two components OOS, whereas ORAM is limited to two. It also has the capability to include environmental (e.g., controlled burning near off-site power lines) and test factors and allows for a more accurate assessment of trip risks. Safety Monitor can perform risk calculations based on the full DCPP PRA.
DCPP is currently working on its quantitative PRA shutdown model which is scheduled to be complete in late 2008. (The Fire Protection PRA is expected to be complete by the end of 2007). When completed, the updated quantitative shutdown model will be incorporated into Safety Monitor and used for shutdown risk assessment. In the meantime, the quantitative ORAM shutdown model will continue to be used.
DCPP’s use of the Operating Risk Analyzer – Maintenance (ORAM) for determining the risk of equipment outages for maintenance during operation and for risk estimates during outages appears appropriate. It determines when management approvals are required for relatively higher risk plant evolutions. DCPP will be replacing ORAM with Safety Monitor which has more capabilities and which will provide more accurate and detailed shutdown risk assessments.
4.8.3 Conclusions and Recommendations
- Conclusion:
- Although the DCISC did not review Probabilistic Risk Assessment (PRA) per se during the 2006-2007 reporting period, the Program has appeared satisfactory in previous reporting periods. DCPP’s use of PRA-based Outage Risk Analyzer – Maintenance (ORAM) appeared appropriate. The DCISC will continue to review PRA including the model updates and upgrades as they are completed.
- Recommendations: None