1. Practical Examples of RIDM Application in the NPP Operation Stanislav Husťák Nuclear Research Institute Řež plc, Czech Republic Reliability and Risk Department INFRA 43564 - Risk informed decision making on nuclear power plant safety Technical Assistance Information Exchange Instrument & State Nuclear Regulatory Committee of Ukraine 27 – 28 January 2011, Kyiv, Ukraine

2. 2 Presentation Outline  Examples presented for NPP Dukovany or NPP Temelín  PSA projects  Types of applications performed  Support for plant licensee submittals  Recent requests for Technical Specifications changes  Conclusions

3. 3 Nuclear Power Plants in the Czech Republic  NPP Dukovany –VVER-440/213 –four almost identical units (2 twin units), uprated to 460-500 MW e –commissioned in 1985-1987 –a lot of safety modifications of original design  NPP Temelín –VVER-1000/320 –two units, 1015 MWe each –commissioned in 2000, 2002  The Czech Regulatory Authority –State Office for Nuclear Safety (SÚJB)

4. 4 PSA Projects  NPP Dukovany –Living PSA project  developed and maintained in Nuclear Research Institute (NRI) Řež  regularly updated to reflect the current state of the plant and knowledge  a framework for all PSA related activities at NPP Dukovany  model reviewed by IAEA IPSART mission and the Czech Regulatory Authority  NPP Temelín –PSA project  developed and maintained by the plant  Utility guidelines for PSA –work procedure PP 0317r01 “PSA” –methodology guideline Me 0457r02 “Basis for Using Safety Monitor” –methodology guideline Me 0451r02 “Data Collection for PSA”

5. 5 Living PSA Project for NPP Dukovany  General objectives –identification of design weaknesses –development of Living PSA model –basis and platform for PSA applications –support for RIDM  The current scope –Level 1 & Level 2, all release categories –all plant operational modes  shutdown operation is included only in Level 1 –internal event & hazards (area events) –human induced external events –risk from reactor core as well as from spent fuel pool  FDF = CDF + fuel damage frequency in spent fuel pool  The current activities –completion of the scope

6. 6 Main Modeling Features  Computer code & model database –RiskSpectrum ® PSA  Platform for PSA applications –integrated Level 1+ model  no separate PSAs for hazards or shutdown operation  conditional probabilities for LERF and other release categories –specific models for odd & even unit in one RiskSpectrum database  cross-connected models via models of shared equipment for twin unit  effects of IE on the neighbor unit taken into account –all model modifications consider the usage in PSA applications  IE frequency handling to account for point-in-time (instantaneous) risk  symmetric models to account for different locations of IE occurrence –configuration management  a lot of system alignments possible to set  easy to obtain zero maintenance state

7. 7 Main PSA Applications for NPP Dukovany  Assessment of plant modifications –evaluation of proposed design or operational changes  evaluation of the benefit  risk impact & ranking  proposal of alternatives  verification of the impact on the safety –final modeling in the frame Living PSA after implementation –recommendations based on PSA outputs  Risk monitoring –outage planning and evaluation of operation  Event analysis –support for the Czech Regulatory Authority  Support for accident management –identification of the scenarios to be covered with EOPs & SAMGs –recommendations of EOP changes based on PSA outputs  evaluation of the benefit

8. 8 Main PSA Applications (cont.)  Evaluation of Technical Specifications –Allowed Outage Time (AOT) adequacy –support for AOT extension  including OLM (relocation of scheduled maintenance to power operation) –support for STI extension  Equipment categorization –based on PSA importance measures –to differentiate plant components for Plant Life Management (PLIM)  Risk informed inservice inspection (RI-ISI) –pilot study on primary circuit loops of reactor coolant system (RCS)  Training of the maintenance staff –to recognize the involvement & outputs of risk monitor  coordination of the outage, OLM DG

9. 9 Risk Monitoring  Safety Monitor™ –used in NPP Dukovany and NPP Temelín –regularly updated due to Living PSA model changes  in the case NPP Dukovany –used off-line  Outage planning –outage assessment two months in advance –changes are proposed when instantaneous risk exceeds given criteria –feedback to the plant based on actual inputs  Evaluation of operation –quarterly reports to the Czech Regulatory Authority –monthly internal reports  Support for licensee initiated changes –monitoring the risk during OLM DG

10. 10 Risk Monitoring (cont.)  Illustrative chart of Safety Monitor™ output

11. 11 Risk Monitoring (cont.)  Example of Safety Monitor™ output from NPP Temelín

12. 12 Support for Plant Licensee Submittals  Technical Specification changes –the most frequent licensee initiated change –AOT extension –STI extension  especially to utilize new outage scheme  Recent utility requests for TS changes –supported by risk-informed approach for justification of change  evaluated according to principles of regulatory instructions VDMI  high level legislation for use of PSA or RIDM is still missing –AOT extension for DG out of service –STI extension for comprehensive ESFAS test with actuation devices –change of conditions for RCS pressure hydrotests  lowering of the minimum allowed RCS temperature  a specific type of TS change different from AOT or STI extension

13. 13 AOT Extension for NPP Dukovany  Issue of AOT adequacy –initiated by the utility in 2000  additional evaluations in the following years –a broad spectrum of LCO‘s evaluated (95 cases)  full-power operation (> 55% N nom ) mainly –comparison of single AOT risk with acceptance criteria  Level 1 risk measure only  all evaluated cases for single LCO events meets US NRC criterion ICCDP < 5 x 10 -7 –without additional failures or multiple LCO events  no specific guideline or acceptance criteria were given by the Czech regulatory body at that time –results were used as a support for justification of some AOT extensions to facilitate corrective maintenance, e.g.:  AOT for 2/4 hydro accumulators out of service from 4 hrs to 72 hrs  AOT for both reserve power supply lines out of service from 1 hr to 4 hrs  AOT for demi water 1 MPa (secondary circuit makeup) removed

14. 14 Outage Pattern Comparison for NPP Dukovany  New outage scheme –fully implemented after 2008  The goal of the evaluation –risk impact on overall CDF change  justification using US NRC RG 1.174 criteria would be expected when the output shows a risk increase –recommendations to reduce the risk Outage Type Typical Length Current SchemeNew Outage Scheme short outage (1/5 of the core reloaded) 32 days 3 times in 4 years 20 days 6 times in 8 years 32 days once per 8 years in the middle of the 8 year period long outage (complete refueling) 63 days once per 4 years 63 days once per 8 years

15. 15 Outage Pattern Comparison (cont.)  Main assumptions –the dependency of equipment reliability on preventive maintenance frequency is not expected  frequency of preventive maintenance of some equipment is going to be reduced to once per three years –typical outage configurations for the current and proposed state compared  Considered issues –validity of support analyses for the shorter duration of the outage  higher decay heat after core reloading –change of IE frequencies for outage duration  proportional change of time dependent IE frequencies  new analyses for IE frequencies dependent on manipulations –avoidance of risk impact overestimation due to conservatism  the equivalent conservative assumptions for the current and the proposed state applied

16. 16 Outage Pattern Comparison (cont.)  Positive risk impact due to: –shorter duration of POS with high instantaneous risk  i.e. operation with low level of water in RCS prior refueling pool flooding –more RCS loops available for RCS normal makeup  especially in case of RCS draindown –reduced number of heavy load transports per eight year period  Negative risk impact due to: –significantly increased time between tests of ECCS check valves  The overall (net) risk impact is positive –all types of outages considered (weighted) –all POS’s considered in impact assessment  average durations of at power operation is prolonged  Recommendations from evaluation –monitor the effect of reduced frequency of preventive maintenance –monitor the risk profile during outage –change of makeup discharge lines alignment during outage  to assure their availability without need of local manual opening of MOVs

17. 17 AOT Extension for DG - NPP Dukovany  Up to 15 days at power operation –to allow on-line (at power) maintenance (OLM) of DG  Support analyses –PSA analyses  negligible risk increase due to OLM –both single AOT risk and overall risk  additional failures during OLM were considered  AOT extension acceptable –additional deterministic evaluations  OLM DG approved by the Czech Regulatory Authority –the following conditions are required  only once per year (only 1 division of DG under OLM)  full availability of reserve power supply & passive ECCS  tests of diesel sequencer (ELS) & DGs before OLM  risk monitoring & fulfilment of quantitative risk criteria during OLM –otherwise shutdown to Mode 5  follow-up evaluation to be submitted to the Regulatory Authority

18. 18 STI Extension for ESFAS – NPP Dukovany  Relocation of comprehensive ESFAS test with actuation devices –digital ESFAS is implemented –test relocated only to extended refueling outage once per 4 years  some small parts of actuation paths are covered only by that test –compensatory measures  to improve efficiency of the remaining tests  System analyses –assessment against ESFAS reliability & availability targets  with new test intervals for some I&C components –probabilistic criteria are fulfilled  PSA calculations –compensatory measures taken into an account –overall neutral risk impact  STI extension approved by the Czech Regulatory Authority

19. 19 Change of Conditions for RCS Hydrotests - NPP Dukovany  Lowering of the minimum allowed RCS temperature –by 30 to 80°C depending on the reactor unit and type of the test  to avoid long cooldown following an unsuccessful hydrotests  Deterministic analyses –new p-T curves for minimum allowed RCS temperature for hydrotests  based on RPV integrity assessment  results of qualified non-destructive testing for RPV material were used –set of comparatory analyses for the current and proposed operation  PTS or cold overpressurization –due to potential inadvertent actions during hydrotests –T-H analyses and subsequent RPV integrity assessments  to find differences in ability and time to reach given limit for potential brittle fracture  LOCA during hydrotests –T-H analyses to find differences in time windows for operator‘s actions

20. 20 Change of Conditions for RCS Hydrotests (cont.)  PSA analyses –quantification of the risk impact of the RCS temperature decrease  unavailability of ESFAS signals vs. longer time windows for operator actions following LOCA  insignificantly shorter time windows for operator actions following potential inadvertent actions resulting in cold overpressurization  HRA output was crucial in both cases –small risk increase far below a limit  even using very conservative assumptions to emphasize negative effects of the change  risk impact calculated separately for the 1 st unit and the remaining units –sensitivity analyses  to assess additional model uncertainty  to show possible level of conservatism  Approved by the Czech Regulatory Authority –the following condition is required  availability of at least two ECCS divisions

21. 21 Conclusions  Application of PSA in the frame of RIDM –is able to compare alternatives –helps to better understand the risk associated with the particular change –considers the effect of the change in much larger context  it may reveal unexpected impact  convolution of positive and negative effects to find the net impact  The risk-informed approach for evaluation of changes appears be viable option in the Czech Republic –the scope of issues, which could be subject of risk-informed evaluation, still broadens –it also helps to reduce unnecessary burden on the plant without compromising the safety

22. Thank you for your attention www.ujv.cz