success criteria and time windows

IAEA.PNRA.05.05 Stetkar & Associates 1

THERMAL / HYDRAULIC ANALYSES, SUCCESS CRITERIA, TIME WINDOWS

byJohn W. Stetkar

Presented toNational Training Course on Probabilistic Safety Assessment

Islamabad, PakistanMay 2 - 6, 2005

IAEA Project C7-PAK/9/028-001


TIME WINDOWS

• OFFSITE POWER RECOVERY

• LOSS OF HVAC / ROOM HEATUP

• POST-INITIATOR OPERATOR ACTIONS


OFFSITE POWER RECOVERY


LOSS OF OFFSITE POWER

• INTEGRAL MODEL FOR POWER FAILURE AND RECOVERY

• OFFSITE POWER RECOVERY CURVE

• ELECTRIC POWER RECOVERY TIME WINDOWS

• INITIATING EVENT FREQUENCIES

• PSA MODEL IMPACTS


ELECTRIC POWER RECOVERY

• "BASELINE" PSA MODEL DETERMINES UNAVAILABILITY OF ONSITE POWER IF DIESEL GENERATORS MUST RUN FOR ENTIRE 24-HOUR MISSION TIME

• DIESEL GENERATORS MUST ACTUALLY RUN ONLY UNTIL OFFSITE POWER IS RESTORED

• PLANT CAN SURVIVE BLACKOUT FOR SOME TIME

– WHEN DO DIESEL GENERATORS FAIL?

– WHEN IS OFFSITE POWER RESTORED?

– HOW MUCH TIME IS AVAILABLE TO RESTORE POWER DURING EACH SCENARIO?


INTEGRAL MODEL FOR ELECTRIC POWER FAILURE AND RECOVERY

Q(T) = ∫0

24

ΦF(t) * [ 1 - ΦR(t + T) ] dt

where

Q(T) = Unavailability of power for longer than T hours during the 24-hour period after a loss of offsite power event at time t = 0.

ΦF(t) = Frequency of onsite power failure between times t and t + dt.

ΦR(t + T) = Fraction of power failures that are recovered within T hours after time t.


INTEGRAL MODEL FOR ELECTRIC POWER FAILURE AND RECOVERY

The term [1 - ΦR(t + T)] quantifies the fraction of power failures that are NOT recovered within T hours after failure of onsite power at time t.

The complete integral quantifies the total likelihood that onsite power fails and is not recovered within a time window of T hours during the 24-hour period after loss of offsite power at time t = 0.


ELECTRIC POWER RECOVERY FACTOR

RE = ∫0

24

ΦF(t) * [ 1 - ΦR(t + T) ] dt

∫0

24

ΦF(t) dt

where

RE = Unavailability of power after accounting for possible recovery within a time window of T hours, divided by the baseline unavailability of power from the diesel generators during the nominal 24-hour mission time before recovery is included in the model.


ELECTRIC POWER RECOVERY MODELS

• ONSITE POWER FAILURE FUNCTION ΦF(t) DETERMINED BY DIESEL GENERATOR MODELS

• PSAs TYPICALLY DO NOT INCLUDE CREDIT FOR REPAIRS OF FAILED DIESEL GENERATORS

• POWER RECOVERY FUNCTION ΦR(t + T) DETERMINED BY OFFSITE POWER RECOVERY CURVES

• RECOVERY TIME WINDOW (T) DETERMINED BY EVENT SEQUENCE MODELS AND THERMAL / HYDRAULIC ANALYSES


DIESEL GENERATORSPOWER UNAVAILABILITY OVER TIME

• FAILURES AT TIME t = 0

– FAILURE TO START

– UNAVAILABILITY DUE TO MAINTENANCE

– UNAVAILABILITY DUE TO TESTING

– UNAVAILABILITY DUE TO PRE-INITIATOR HUMAN ERROR

• FAILURES AFTER TIME t = 0

– FAILURE TO RUN

– LOSS OF FUEL AFTER DAY TANK IS DRAINED

– ROOM HEATUP


OFFSITE POWER RECOVERY CURVES

• AVOID DETAILED MODELS FOR TRANSMISSION LINES, GRID CONNECTIONS, SWITCHYARDS

• DETAILED MODELS ARE TYPICALLY OPTIMISTIC, COMPARED WITH ACTUAL EXPERIENCE

• PLANT-SPECIFIC LOSS OF OFFSITE POWER EXPERIENCE TYPICALLY VERY LIMITED

• DERIVE RECOVERY CURVES FROM REGIONAL TRANSMISSION LINE OUTAGE DATA

• USE GENERIC EXPERIENCE FOR "SANITY CHECK"



• SIMPLIFIED MODEL FROM REGIONAL TRANSMISSION LINE OUTAGE DATA

• ONLY FORCED OUTAGES

• OMIT DURATIONS LESS THAN ~ 5 MINUTES– SINGLE LINE AUTOMATIC SWITCHING– TIME TO RECONNECT POWER TO ONSITE BUSES

• TRANSMISSION LINE CORRIDORS– VOLTAGES AND ROUTING NEAR PLANT– COMMON RIGHT-OF-WAY– SIMILAR DIRECTIONAL ROUTING



• MODEL EACH CORRIDOR AS A SINGLE LINE

• DERIVE UPPER BOUND CURVE FROM "N" INDEPENDENT CORRIDORS

– 95TH PERCENTILE RECOVERY

– CONSERVATIVE IF TRUE INDEPENDENCE APPLIES

• DERIVE LOWER BOUND CURVE FROM FULL CORRELATION OF ALL CORRIDORS

– 5TH PERCENTILE RECOVERY

– ACCOUNTS FOR REGIONAL / GRID IMPACTS



RecoveryFraction 95th Percentile

Median

5th Percentile

Time


ELECTRIC POWER RECOVERYTIME WINDOWS

• DC BATTERY LIFE

• PLANT THERMAL / HYDRAULIC RESPONSE

– STEAM GENERATOR DRYOUT

– CORE UNCOVERY

• PSA SCENARIOS / SUCCESS CRITERIA

– REACTOR COOLANT PUMP SEAL FAILURE

– BLEED-AND-FEED COOLING

– HIGH PRESSURE / LOW PRESSURE INJECTION

– CONTAINMENT COOLING


LOSS OF OFFSITE POWERDURATION-BASED INITIATING EVENTS

• SIMPLIFIED APPROACH

• DISCRETE TIME INTERVALS FOR DURATION OF OFFSITE POWER FAILURE

• ALLOCATE INITIATING EVENT FREQUENCY ACCORDING TO CRITICAL EVENT DURATION TIME WINDOWS (e.g., FOUR INITIATING EVENTS)

– LESS THAN 30 MINUTES

– 30 MINUTES - 1 HOUR

– 1 HOUR - 2 HOURS

– MORE THAN 2 HOURS


LOSS OF OFFSITE POWERDURATION-BASED INITIATING EVENTS


– DIESEL GENERATOR OPERATING MISSION TIMES

– AVAILABLE SYSTEMS

– OPERATOR ACTIONS

• FAULT TREE HOUSE EVENTS FOR RECOVERY CONDITIONS


LOSS OF HVAC / ROOM HEATUP


LOSS OF VENTILATION / ROOM COOLING

• USUALLY MOST IMPORTANT FOR ELECTRICAL / ELECTRONICS EQUIPMENT

– SWITCHGEAR ROOMS

– PROTECTION / CONTROL / LOGIC CABINET ROOMS

– MAIN CONTROL ROOM

• MECHANICAL EQUIPMENT IN SMALL ENCLOSED ROOMS

• VERY IMPORTANT FOR SOLID-STATE EQUIPMENT

– ENCLOSED CABINETS

– ENCLOSED ROOMS FOR FIRE / FLOODING HAZARDS

– UPGRADES / BACKFIT DESIGNS


LOSS OF VENTILATION / ROOM COOLING

• ROOM HEATUP ANALYSES

• EQUIPMENT THERMAL FRAGILITY ANALYSES

• RECOVERY TIME WINDOWS

• RECOVERY SUCCESS CRITERIA



ROOM HEATUP ANALYSES

• REALISTIC ANALYSES OFTEN NOT AVAILABLE

• DESIGN-BASIS CALCULATIONS

– CONSERVATIVE HEAT LOADS

– ASSUMPTIONS ABOUT RECOVERY

• PSA MODELS REQUIRE TEMPERATURE VS. TIME AFTER LOSS OF VENTILATION

• SIMPLIFIED CALCULATIONS PROVIDE REASONABLE ESTIMATES

• ACTUAL TESTS


EQUIPMENT THERMAL FRAGILITY ANALYSES

• FAILURE LIKELIHOOD AS A FUNCTION OF TEMPERATURE

• TYPICALLY NOT AVAILABLE FROM MANUFACTURER

• POSSIBLE INFORMATION

– QUALIFICATION TEMPERATURE

– RATED OPERATING TEMPERATURE

– MAXIMUM PERMISSIBLE OPERATING TEMPERATURE

• CONSTRUCT FRAGILITY CURVES FROM AVAILABLE INFORMATION


VENTILATION RECOVERY SUCCESS CRITERIA

• EXTENSION OF ROOM HEATUP ANALYSES

• RECOVERY OPTIONS

– OPEN DOORS

– PORTABLE FANS

– ALTERNATE CHILLED WATER / FORCED COOLING

• SIMPLE LOCAL ACTIONS MAY NOT BE ADEQUATE IF ALL COOLING IS FAILED FOR THE WHOLE BUILDING


VENTILATION RECOVERY TIME WINDOWS

• PROBABILITY DISTRIBUTION FOR TIME UNTIL EQUIPMENT FAILURE

– ROOM HEATUP CURVES

– EQUIPMENT THERMAL FRAGILITY CURVES

• TIME WINDOWS FOR OPERATOR ACTIONS

• SEQUENTIAL IMPACTS AS ROOMS HEAT UP

– PSA EQUIPMENT

– OPERATOR ACTION DEPENDENCIES


POST-INITIATOR OPERATOR ACTIONS


HUMAN ERROR RATETIME-RELIABILITY CORRELATION

• ANALYSIS OF POST-INITIATOR DYNAMIC ACTIONS

• TWO CONTRIBUTIONS TO HUMAN ERROR

– COGNITIVE: ACCOUNTS FOR IDENTIFICATION, DIAGNOSIS, EVALUATION, AND DECISION ERRORS DURING COGNITIVE PHASE OF RESPONSE

– IMPLEMENTATION: ACCOUNTS FOR MISOPERATION OF EQUIPMENT DURING EXECUTION PHASE OF RESPONSE ("SLIP" ERRORS)


MODEL FOR COGNITIVE RESPONSE ANDIMPLEMENTATION ACTIONS

Td Ta

Tm

T0

T0 = ANNUNCIATION (OR OTHER COMPELLING SIGNAL) OF ABNORMAL EVENT

Tm = ESTIMATED MAXIMUM ALLOWABLE TIME TO COMPLETE COGNITIVE AND REQUIRED IMPLEMENTATION ACTIONS TO SATISFY PSA SUCCESS CRITERIA ("AVAILABLE TIME WINDOW")

Td = ESTIMATED ALLOWABLE TIME FOR CORRECT DIAGNOSIS THAT PERMITS SUFFICIENT TIME TO COMPLETE IMPLEMENTATION ACTIONS BEFORE Tm

Ta = ESTIMATED TIME TO PERFORM REQUIRED ACTIONS AFTER CORRECT DIAGNOSIS


TIME WINDOWS

• INITIATION TIME (T0) AND TOTAL AVAILABLE TIME WINDOW (Tm)

– SCENARIO-SPECIFIC THERMAL-HYDRAULIC ANALYSES

– SCENARIO-SPECIFIC SIMULATOR RUNS

– FSAR OR DESIGN-BASIS ANALYSES

– SIMPLIFIED ENGINEERING CALCULATIONS


IMPLEMENTATION TIME

• IMPLEMENTATION TIME (Ta)

– EQUIPMENT MANIPULATIONS

– RESPONSE TIME FOR LOCAL ACTIONS

– ACTIVE CONTROLS (TIME TO COOL DOWN, REDUCE PRESSURE, ETC.)

– TASK ANALYSES, WALKDOWNS

– DISCUSSIONS WITH PLANT OPERATORS

success criteria and time windows

Documents

initiator operator actions

offsite power duration

electric power failure

offsite power

diesel generators

onsite power

power failures

hour period