Information Notice 2000-13: Review of Refueling Outage Risk
UNITED STATES
NUCLEAR REGULATORY COMMISSION
OFFICE OF NUCLEAR REACTOR REGULATION
WASHINGTON, D.C. 20555-0001
September 27, 2000
| NRC INFORMATION NOTICE 2000-13: | REVIEW OF REFUELING OUTAGE RISK |
Addressees
All holders of operating licenses for nuclear power reactors.
Purpose
The U.S. Nuclear Regulatory Commission (NRC) is issuing this information notice to inform addressees of a review of refueling outage risk performed by the senior reactor analysts in NRC Region IV. Addressees are expected to review the information for applicability to their facilities and consider actions, as appropriate, to avoid similar problems. However, suggestions contained in this information notice are not NRC requirements; IN 2000-13
Discussion
To enhance the efficiency and effectiveness of the assessment and inspection of outage activities, the NRC Region IV senior reactor analysts and resident inspectors reviewed 19 refueling outages. The reviews provided a comprehensive understanding of the overall risk of each refueling outage from separate, but equally important, perspectives: configuration risk and modification risk impact. A compilation of these reviews was provided to all Region IV reactor licensees (ADAMS Accession No. ML003746119). The NRC has decided that all NRC reactor licensees should have this information notice.
This information notice requires no specific action or written response. If you have any questions about the information in this notice, please call or email one of the technical contacts listed below or the appropriate Office of Nuclear Reactor Regulation (NRR) project manager.
| | /RA/Marvin M. Mendonca FOR Ledyard B. Marsh, Chief
Events Assessment, Generic Communications and Non-Power Reactors Branch
Division of Regulatory Improvement Programs
Office of Nuclear Reactor Regulation |
| Technical contacts: | Jeffrey L. Shackelford, RIV
817-860-8144
E-mail: jls2@nrc.gov | William B. Jones, RIV
817-860-8147
E-mail: wbj@nrc.gov |
(ADAMS Accession Number ML003752328)
ATTACHMENT 1
Refueling Outage Risk - An Operational Perspective
J.L. Shackelford and W.B. Jones
Senior Reactor Analysts
United States Nuclear Regulatory Commission
Abstract
An operational overview of 19 refueling outages at United States nuclear power plants was performed. The overview included an assessment of the risk methodology used by licensees to plan and implement a refueling outage. Data were collected with respect to the overall risk of the outage from both a configuration risk as well as a modification risk perspective. The results of these reviews were factored into the Nuclear Regulatory Commission's inspection planning activities associated with the outages. The collected data were analyzed for significant patterns and operational insights.
Introduction
During calendar year 1999, the NRC Region IV senior reactor analysts (SRAs) implemented a special initiative to improve the Region's approach to the inspection and assessment of outage activities. This initiative entailed detailed reviews of outage schedules, licensee outage risk assessments, and the proposed major modification activities for each refueling outage which was conducted in Region IV during the year. The purpose of the reviews was to gain a comprehensive understanding of the overall risk of each refueling outage from two separate, but equally important, perspectives; configuration risk and modification impact risk. In this context, configuration risk refers to the real-time risk associated with the specific plant configurations which are entered during the course of a refueling outage. In contrast, the modification impact risk is more closely associated with the potential risk associated with a modification from an online perspective (i.e., the importance of the modification with respect to its potential contribution to plant risk following startup independent of the configuration risk).
These reviews were conducted primarily through a combination of site visits, document reviews, and teleconferences and involved personnel from the licensees' risk and outage planning organizations. The NRC resident inspection staff were also involved in the overall process and the results of the reviews were integrated into the NRC's inspection planning for the outages. A total of 19 refueling outages at 13 reactor sites were reviewed. This included 16 outages at pressurized water reactors (PWRs) and three outages at boiling water reactors (BWRs). These reviews covered the full range of reactor vendors (i.e., Babcock & Wilcox, Westinghouse, Combustion Engineering, and General Electric).
The results of this effort yielded important benefits in a number of areas. Of primary importance, this initiative resulted in a more efficient and focused inspection effort on the part of NRC inspectors during the individual outage inspections. By defining the most important plant configurations and maintenance activities, the results of the outage reviews highlighted the most risk-significant attributes of the outages. This enabled the NRC inspection staff and regional management to concentrate their efforts in the most important areas involving inspection and regulatory oversight. However, in addition to the inspection related benefits, the results of this initiative yielded a considerable amount of data related to outage risk as well as outage risk assessment and management across the full range of reactor types. The information which was collected was integrated and analyzed by the Region IV SRAs. The results are summarized in the remainder of this report and in the accompanying tables and figures. The names of the individual plants have been omitted from the summary information.
Overview of outage risk assessment methods
Each of the licensees performed some type of systematic risk assessment or safety review for their respective refueling outage. In general, these reviews were performed by the risk assessment staff at the site and were coordinated with the outage planning and scheduling organizations. The reviews were generally incorporated into outage risk assessment reports and forwarded to licensee management for review and approval. Where necessary, contingency measures were identified with respect to potentially risk significant configurations. The final results of the licensee risk assessments were provided to the plant operations staff for use during the actual conduct of the outage.
In three of the 19 outages, a purely qualitative approach to outage risk assessment was performed (i.e., no quantitative estimates of risk were developed). These licensees employed the guiding principles contained in NUMARC 91-06, "Guidelines for Industry Actions to Assess Shutdown Management," December 1991, as a foundation for planning the outage. In the remaining 16 outages, some form of quantitative assessment was performed in conjunction with the qualitative considerations contained in the NUMARC guidelines. Of the total 13 sites which were assessed, 11 sites employed a combination of quantitative and qualitative approaches while two sites used a strictly qualitative approach. All the sites incorporated the NUMARC 91-06 guidelines in their planning activities.
With respect to the quantitative approaches, four of the 16 outages used a plant-specific shutdown model in assessing outage risk. The remaining 12 outages employed a proprietary industry product which provided generic modeling of various outage configurations. This generic modeling was then modified with some elements of plant and outage specific data to provide a "semi-quantitative" assessment of the outage risk. Of the 11 sites employing quantitative approaches, three sites used a plant-specific shutdown model and the remaining 8 sites used the proprietary industry software. A full description of the methodology and scope of the modeling which was used is beyond the scope of this effort. However, in general, the quantitative approaches employed modeling considerations related to the specific outage configurations entered and used modified estimates of the initiating event frequencies and human error rates which were used in their at-power models.
Outage risk insights
Quantitative results
For each of the outages which employed a quantitative approach to risk assessment, the following data were obtained: 1) scheduled or predicted (cumulative) risk, 2) actual (cumulative) risk, and 3) peak risk (per hour). A summary of the data which were collected is shown in Table 1.
With respect to the cumulative risk data, (both predicted and actual) an extremely wide range of values were observed with respect to the outage risk. When pooled, the data (associated with the actual risk) for the PWRs showed a cumulative mean core damage probability (CDP) of approximately 1.2E-04 for the outage. However, the values ranged from a low of 1.5E-06 to a high of 6.6E-04 with a standard deviation of 2.0E-04. (Twelve data points were used in the analysis.) These same wide ranges of values were observed with respect to the data associated with the predicted cumulative risk. The mean value for the PWR peak risk (in units of cdp/hr) was 1.6E-06/hr. As with the cumulative risk data, a wide range of values were observed with a high of 5.0E-06/hr, a low of 2.0E-08/hr and a standard deviation of 2.1E-06/hr.
The data for the BWR plants included only three observations. Additionally, one of the BWR units experienced unexpected complications due to fuel integrity issues which significantly extended the duration of the outage. Similar to the PWR data, a wide range of values existed in the cumulative and peak risk estimates associated with the BWR outage observations. Notwithstanding these issues related to data quality, the mean actual risk was estimated to be approximately 8.6E-07 with a high and low of 1.7E-06 and 2.0E-08 respectively. The peak risk was estimated at about 1.2E-08/hr with a range of 3.3E-10/hr to 3.1E-08/hr.
Even if the data are further segregated such that the results of those licensees which used a plant-specific shutdown model are treated separately, similar disparities exist. It should be noted that even with respect to a given multi-unit site, no two outages are identical. However, most of the outages which were assessed were of a generally similar nature and duration. Thus, these extremely wide disparities in quantitative results are unlikely the result of true differences in the risk of the outage but rather represent an artifact of different modeling assumptions and data issues.
Notwithstanding the variability across plants with respect to the actual value of the risk estimates, some generalizations regarding the quantitative results are possible. There was a close agreement (within plants) with respect to the predicted versus the actual cumulative risk. This would suggest that within a given analysis, the quantitative results are somewhat stationary and repeatable. Additionally, even though the absolute values of the risk estimates (both cumulative as well as those for a given configuration) vary widely across plants, the general character and shape of the risk profiles were similar. This would suggest that the quantitative approaches were effective at identifying the relative risk of different outage configurations. A more detailed discussion of the general risk profiles seen in the outage reviews is provided in the following sections of this report.
Risk profile of a typical PWR outage
As mentioned earlier, a total of 16 PWR outages across 10 reactor sites were assessed. As shown in Table 1, the mean scheduled outage duration was approximately 36 days and the mean actual duration was about 37 days. The longest outage was 54 days and the shortest was 27 days with the standard deviation being approximately 7 days. These data suggest that most licensees had accurately planned and predicted the outage duration and that significant schedule impacts were generally minimized. This represented at least the 7th refueling outage for each of the affected units and for some units, this was as high as the 13th outage. Further, for multi-unit sites, the actual level of outage experience would represent a multiple equal to the number of units at the site. (i.e., The 7th refueling outage for a plant at a two unit site would represent closer to 14 outages worth of experience.)
The majority of the PWR outages which were assessed employed an early "hot" midloop or reduced inventory configuration. This was almost exclusively an economic consideration in that the early midloop allowed for earlier entry into the steam generators to perform the required inspection activities. In order to eliminate the midloop, licensees would have been required to delay the steam generator entry until after the reactor vessel was defueled. This would have had the net effect of making the steam generator inspections "critical path" (i.e., the driving factor for the outage duration) in many instances thereby increasing the overall length of the outage. Even with the implementation of the early midloop, the steam generator inspection activities constituted the critical path for many of the refueling outages which were assessed. For the vast majority of the PWR outages, either the steam generator inspections or the actual refueling activities themselves constituted the critical path for the outage.
Of the PWR outages employing a midloop or reduced inventory configuration, 9 of the 15 outages did so with a concurrent unavailability of either an emergency diesel generator or the performance of significant switchyard maintenance. At least one outage employed a midloop configuration with concurrent switchyard and emergency diesel maintenance. However, each of the outages prescribed a number of contingencies and other strict controls during midloop activities. These controls generally followed the NUMARC guidance with respect to protecting trains of equipment, comprehensive pre-evolution briefings, establishment of diverse means of level indications, and in some cases, the addition of temporary emergency power supplies.
With respect to the time of entry into the midloop configurations, data were collected relative to the scheduled as well as the actual time after shutdown before midloop conditions were achieved. Additionally, information associated with the estimated time-to-boil while at midloop was collected. As shown in Table 1, the average scheduled time after shutdown before entering midloop was about 84 hours with the actual value being closer to 93 hours. (The most aggressive schedule planned a midloop configuration 68 hours after shutdown.) The average estimated time-to-boil for the reduced inventory/midloop configurations was about 15 minutes (assuming a loss of shutdown cooling or inventory control) with a high and low estimate of 24 minutes and 9 minutes respectively.
Given that the primary reason for entering the early, hot midloop was to shorten the overall outage duration, it is interesting to note that the data show a slightly negative correlation (
= -0.26) between the actual outage duration and the delay before entering midloop. In other words, those plants which employed an early entry into the midloop configuration were observed to have outages of slightly longer duration relative to those plants that delayed the entry into the midloop configuration. For example, the plant that waited the longest before entering midloop (150 hours) realized a total outage duration of 32 days (slightly below the average) whereas one of the facilities that had the most aggressive midloop schedule (68 hours) had a duration of 38 days (slightly above average). The reasons for this relationship are not clear; however, these data suggest that further reviews of the relationship between scheduling of the midloop configuration with respect to the overall outage duration may be warranted. A graphical representation of this relationship is shown in Figure 1.
As noted earlier, the quantitative estimates of both the cumulative outage risk as well as the peak risk associated with various outage configurations varied greatly among the plants which were assessed. However, if one uses those plants which employed a plant-specific shutdown model as a representative benchmark, then a rough approximation of the risk of a midloop configuration can be obtained. From the data, it was noted that the peak risk associated with the early hot midloop configuration was in the 1.0E-04/yr to 5.0E-04/yr range (i.e., instantaneous core damage frequency). Further, the "typical" early midloop lasted for approximately 22 hours. Thus, using these assumptions, the conditional core damage probability of the early midloop may be on the order of about 1.3E-06. This may be a somewhat conservative estimate in that one of the plants which was used to benchmark this data employed a relatively conservative approach to midloop operations compared to some of the other plants. (This particular plant ensured that no emergency diesel generator or switchyard work was allowed and many of the standby systems were started prior to midloop to avoid "fail-to-start" equipment vulnerabilities.)
Figure 2 shows a graphical representation of the risk profile associated with a typical PWR refueling outage. Initially, the risk is relatively low due to the high reactor coolant inventory and the availability of all electric power sources and decay heat removal systems. The risk then experiences a prompt jump when the steam generator tubes are voided, thereby eliminating the availability of secondary heat removal as a decay heat removal mechanism. The risk can be seen to reach its peak as reactor coolant inventory is reduced during the midloop configuration. Risk is gradually reduced as inventory is restored following the midloop and decay heat levels abate. Once the core is offloaded, the risk of in-vessel core damage is eliminated during the interval when the reactor fuel is in the spent fuel pool and the risk of spent fuel pool boiling represents the primary radiological risk of the outage. Following the reload of the fuel, the risk then rises in an inverse relationship with respect to inventory levels and reaches a somewhat lower (due to reduced decay heat levels) late peak during the "back-end" midloop to restore the steam generators.
Risk profile of a typical BWR outage
The risk profile of a typical BWR outage is somewhat different from that seen in the PWR case. In general, the refueling activities associated with a BWR are more time-intensive and full core offloads are not generally performed. Thus, the risk of in-vessel core damage remains throughout the outage. The risk profile associated with the BWR outage shows an inverse relationship with respect to inventory levels and decreases gradually throughout the outage due to dissipating decay heat levels. Several "spikes" in the typical profile can be seen during swaps of the shutdown cooling system and cavity draining evolutions. These spikes are primarily the result of human errors during these processes. A representative profile of a BWR outage is shown in Figure 3.
Operational issues observed during the conduct of the refueling outages
Significant modifications and maintenance activities
As mentioned in the introduction, the primary purpose of the outage review effort was to collect information related to outage risk from both a configuration risk perspective as well as from the standpoint of major maintenance and modifications on important plant equipment for use in the inspection planning process. For each of the outages, a compilation of the most important modifications and major maintenance activities was obtained. A summary of these items is presented in Table 2.
As shown in the table, the majority of the significant maintenance activities did not involve actual modifications to the plants. Rather, most of the important work activities involved equipment replacements, primarily on a "like-for-like" basis. Some exceptions to this were noted, particularly in the case of battery replacements which involved replacing the existing batteries with equipment of a newer design. In general, however, the equipment replacements were implemented to address aging considerations associated with the existing components. As seen in Table 2, many of these activities involved the replacement of relatively risk significant components.
The prevalence of equipment replacement activities (to address aging considerations) versus plant improvements via the modification process is likely a result of the maturity of the nuclear industry as a whole. It was noted that the average (operational) age of the plants which were assessed was just over 15 years. The most common plant change which was observed were emergency core cooling system injection line modifications implemented as a result of NRC Information Notice 97-76, "Degraded Throttle Valves in Emergency Core Cooling Systems from Cavitation Induced Erosion Following a Loss of Coolant Accident", dated October 30, 1997.
Operational Issues
The NRC inspection reports for each of the outages were reviewed. Additionally, interviews and debriefings were conducted with the resident inspectors for selected outage inspections in order to understand the most important operational issues and challenges which occurred during the outages. A compilation of these observations is shown in Table 3.
As can be seen in the Table, two loss of shutdown cooling events and one inadvertent entry into reduced inventory occurred in the 19 outages which were assessed. Additionally, three switchyard control issues were noted, two of which occurred during midloop operations. Other operational problems included issues related to spent fuel pool cooling alignments, fuel handling errors, improper valve and equipment lineups, and other work control errors. Each of these issues is documented in the NRC inspection report for the associated facility.
While the risk significance of several of the issues was assessed from a quantitative perspective, the majority of the issues were evaluated qualitatively. None of the issues which are documented in the table were characterized as risk significant by the NRC in the inspection, assessment, and enforcement process. (The highest estimate of the conditional core damage probability of the issues which were assessed quantitatively was in the low 1.0E-07 range.) With respect to the loss of shutdown cooling and inadvertent entry into reduced inventory events, a high level of redundancy and diversity was observed in the available core cooling and inventory control systems at the time of the events. This served to mitigate the overall risk significance of these events. However, because less mitigation equipment is required by NRC regulations to be operable during shutdown conditions, these events would have been of significantly higher "potential" risk significance if it were postulated that only the minimum set of required equipment had been available at the time of the event. This observation underscores the importance of the industry's voluntary efforts to minimize shutdown risk by exceeding the existing regulatory requirements.
Further, human error along with weak or deficient procedures were the causes (or at least contributing factors) for almost all the operational issues that were observed. Additionally, the majority of these problems occurred relatively late in the outage. This was seen to be a factor in mitigating the risk significance of several of these issues, particularly those involving a loss of shutdown cooling and the inadvertent entry into reduced inventory in that decay heat levels had dissipated considerably.
With respect to the early midloop configurations, there were no significant negative observations from an NRC inspection perspective for the outages which were assessed. Thus, even though the midloop configurations represented a relatively higher level of operational risk than other outage configurations, the increased attention and awareness afforded to this evolution most likely decreased the potential for human errors. In addition, the NRC placed special emphasis on these higher risk configurations. For several of the midloop configurations, particularly those that involved emergency diesel generator outages or switchyard work, the NRC conducted management level teleconferences with the licensees to emphasize the Agency's concern with the elevated risk. Further, the NRC generally conducted around-the-clock inspection coverage of the midloop and other elevated risk configurations.
Summary and conclusions
The results of this initiative indicate that the use of formal risk assessment in outage planning and outage management is widespread throughout the nuclear industry. For each of the outages which were assessed in this effort, some type of structured risk assessment or safety review was performed. Further, the results of these assessments were generally reviewed and approved by site management and used by the planning, scheduling and operations organizations at the sites to plan and execute the refueling outages. Of the sites which were reviewed, about 23% of the sites employed a plant-specific shutdown model in their assessment approach while about 62% used a proprietary industry product for their modeling. The remaining 15% of the sites used a purely qualitative approach to outage risk assessment and outage management. Further, all the sites incorporated the NUMARC 91-06 guidelines in their planning activities.
With respect to the quantitative results, a wide range of values were observed in the estimates of both the cumulative outage risk and the peak risk. While it is true that no two outages which were assessed were identical, many commonalities were observed in terms of both outage duration and actual plant configurations. Thus, these disparities in the quantitative results are not likely the result of true differences in the actual risk of the outage but rather represent differences in modeling and other related data issues. There was a relatively close agreement (within plants) with respect to the predicted versus the actual cumulative risk. This would suggest that within a given analysis, the quantitative results are somewhat stationary and repeatable. Also, the general shape of the risk profile was consistent across plants (for a given reactor type). This suggests that the quantitative approaches were effective at identifying the relative risk of different outage configurations. Thus, it appears that while the actual value of the risk estimates for a given plant may not be reliable in an absolute sense, the relative risk of the given plant configurations may be more consistently identified.
Because of a paucity of data and the anomalous nature of one of the data points, no valid conclusions of a quantitative nature regarding the BWR outages were possible. However, for the PWR population, the average (actual) outage duration was about 37 days with a standard deviation of about 7 days. The average (scheduled) duration was about 36 days. This suggests that, overall, most licensees had effectively planned and implemented their outage schedules. Additionally, there was a high level of refueling outage experience among the licensees which were reviewed. (i.e., This was at least the 7th refueling for each of the sites, whereas some of the multi-unit sites had performed more than 20 refuels.) Thus, one possible conclusion is that the maturity of the industry has contributed to effective scheduling and outage management.
With respect to the PWR outages, 94% of those assessed employed an early hot midloop or reduced inventory configuration. Further, 53% of the PWR sites entered the midloop/reduced inventory configuration with concurrent emergency diesel generator or switchyard maintenance. The average time after shutdown prior to entering midloop was a little over 3 1/2 days, with the most aggressive schedule being about 2 1/2 days after shutdown. The time to boil during midloop ranged from about 9 to 24 minutes with an average of about 15 minutes. Analysis of the data showed no real advantage in terms of outage duration savings by earlier entry into the midloop configuration. (i.e., Those plants with the most aggressive schedule for entering midloop did not, on the average, experience shorter outages than those with longer delays in entering midloop.) However, this relationship may not be statistically significant, and further review in this area may be warranted. Further, even though the quantitative estimates of risk varied greatly among the plants, the best estimate of the conditional core damage probability of a typical midloop configuration was about 1.3E-06 based on the data collected. The annual (at-power) core damage frequency for the plants which were assessed was in the low to mid 1.0E-05/yr range. Thus, given that the typical midloop configuration lasted about 22 hours, it is interesting to note that these plants accumulated the equivalent of about 10% of their annual at-power risk in essentially one day of midloop operation. (These results are presented for illustration purposes and are not intended to imply a direct comparison between the shutdown and at-power modeling approaches.)
For the vast majority of the PWR outages, either the steam generator inspections or the actual refueling activities themselves constituted the critical path for the outage. Further, the majority of the significant maintenance activities performed during the refueling outages did not involve actual modifications to the plants, but rather involved equipment replacements, primarily on a like-for-like basis. Many of these replacement activities were associated with relatively risk significant components. The prevalence of replacement activities versus modifications may be attributable to the age of the American nuclear power industry in that it was observed that the average operational age of the plants which were assessed was just over 15 years.
From an operational perspective, two loss of shutdown cooling events and one inadvertent entry into reduced inventory occurred in the 19 outages which were assessed. Additionally, three switchyard control issues were noted, two of which occurred during midloop operations. There were other operational considerations related to issues involving improper spent fuel pool cooling alignments, fuel handling errors, improper valve and equipment lineups, and other work control errors. From a safety perspective, none of the issues were characterized as risk significant by the NRC in the inspection, assessment, and enforcement process. However, evidence suggests that these issues may have been of much greater risk significance if only the minimum required set of equipment had been available at the time of the events. Finally, most of the events which were observed involved human errors or deficient procedural guidance.
References
NRC Information Notice 97-76, "Degraded Throttle Valves in Emergency Core Cooling Systems from Cavitation Induced Erosion Following a Loss of Coolant Accident", 10/30/97
NRC Inspection Report Nos:
50-313,368/98-10, 99-01,99-03, 99-14
50-483/99-09
50-445,446/99-07, 99-15, 99-18
50-275,323/99-03, 99-14, 99-17
50-285/99-13
50-528,529,530/99-06, 99-19, 99-20
50-458/99-03, 99-05
50-416/99-17, 99-18
50-361,362/99-01, 99-03, 99-04, 99-06
50-498,499/99-06, 99-11, 99-18
50-382/99-02, 99-05
50-482/99-03, 99-06
50-397/99-10, 99-13
NUMARC 91-06,"Guidelines for Industry Actions to Assess Shutdown Management", December 1991,
Table 1 - Selected Outage Data
| PWR OUTAGES |
| PLANT NAME | Outage Duration | | Total Risk Estimate | | Time to Boil | Time after S/D before ML | | Peak Risk/hr | |
| | Scheduled | Actual | Scheduled | Actual | (ML/RI) | Scheduled | Actual | | |
| | | | | | min. | hr. | | | |
| PWR 1 | 28 | 30 | 2.1e-06 | 1.5e-06 | 17 | 72 | 110 | 2.0e-08 | |
| PWR 1A | 48 | 43 | 7.7e-06 | 5.7e-06 | 21 | 104 | 96 | 3.2e-08 | |
| PWR 2 | 25 | 35 | 1.7e-05 | 2.0e-05 | 12 | 80 | 102 | 3.7e-07 | |
| PWR 3 | 36 | 35 | 2.4e-04 | 3.7e-04 | 10 | 76 | 108 | 4.9e-06 | |
| PWR 3A | 32 | 33 | 6.7e-04 | 6.6e-04 | 15 | 79 | 102 | 1.6e-06 | |
| PWR 4 | 24 | 31 | 4.0e-04 | 1.5e-04 | 15 | 96 | 120 | 5.0e-06 | |
| PWR 4A | 31 | 32 | 1.5e-04 | 1.4e-04 | 13 | 132 | 150 | 5.0e-06 | |
| PWR 5 | 32 | 40 | Note 1 | Note 1 | 24 | 120 | 148 | Note 1 | |
| PWR 6 | 46 | 38 | Note 1 | Note 1 | 18 | 68 | 69 | Note 1 | |
| PWR 6A | 37 | 36 | Note 1 | Note 1 | 15 | 72 | 72 | Note 1 | |
| PWR 7 | 60 | 54 | 2.9e-06 | 2.5e-06 | 16 | 78 | 76 | 2.3e-08 | |
| PWR 7A | 55 | 43 | 2.9e-06 | 2.4e-06 | 16 | 78 | 60 | 2.1e-08 | |
| PWR 8 | 28 | 32 | 4.1e-05 | 4.1e-05 | 9 | 68 | 71 | 8.0e-07 | |
| PWR 8A | 28 | 27 | 4.0e-05 | 4.1e-05 | 10 | 72 | 74 | 8.0e-07 | |
| PWR 9 | 38 | 42 | Note 1 | Note 1 | 12 | 96 | 81 | Note 1 | |
| PWR 10 | 34 | 36 | 2.2e-05 | 2.2e-05 | n/a | n/a | n/a | 2.2e-07 | |
| |
| n | 16 | 16 | 12 | 12 | 16 | 16 | 16 | 12 | |
| Mean | 36.4 | 36.7 | 1.3e-04 | 1.2e-04 | 15.2 | 83.8 | 93.4 | 1.6e-06 | |
| Standard Deviation | 10.7 | 6.6 | 2.1e-04 | 2.0e-04 | 4.2 | 20.9 | 28.9 | 2.1e-06 | |
| High | 60 | 54 | 6.7e-04 | 6.6e-04 | 24 | 132 | 150 | 5.0e-06 | |
| Low | 24 | 27 | 2.1e-06 | 1.5e-06 | 9 | 50 | 55 | 2.0e-08 | |
| |
| BWR OUTAGES | | | | | | | | | |
| PLANT NAME | Outage Duration | | Total Risk Estimate | | | | | Peak Risk/hr | |
| | Scheduled | Actual | Scheduled | Actual | | | | | |
| |
| BWR 1 | 32 | 49 | 4.5e-08 | 2.0e-08 | | | | 6.0e-09 | |
| BWR 2 | 29 | 92 | 4.5e-08 | Note 2 | | | | 3.3e-10 | |
| BWR 3 | 38 | 37 | 1.7e-06 | 1.7e-06 | | | | 3.1e-08 | |
| |
| n | 3 | 3 | 3 | 2 | | | | 3 | |
| Mean | 33.0 | 59.3 | 6.0e-07 | 8.6e-07 | | | | 1.2e-08 | |
| Standard Deviation | 4.6 | 28.9 | 9.6e-07 | 1.2e-06 | | | | 1.6e-08 | |
| High | 38 | 92 | 1.7e-06 | 1.7e-06 | | | | 3.1e-08 | |
| Low | 29 | 37 | 4.5e-08 | 2.0e-08 | | | | 3.3e-10 | |
| |
| Note 1 - Qualitative approach used |
| Note 2 - Data not available |
Table 2
Major Modifications and Maintenance Activities
| SITE | Major Modifications and Maintenance Activities |
| PWR 1 | Main steam isolation valve actuator replacement, emergency feedwater pump replacement, magne-blast breaker replacements |
| PWR 1A | Service water pump replacement, refueling level indication modification, vital AC upgrade, reactor coolant pump seal replacement |
| PWR 2 | Battery replacements, steam generator electrosleeving, emergency service water pump motor replacement, main feedwater check valve replacements |
| PWR 3 | Emergency core cooling system injection line modifications, emergency diesel generator start circuit modifications, midloop level indication modifications, battery replacements |
| PWR 3A | Turbine-driven auxiliary feedwater pump impeller replacement, emergency core cooling system injection line modifications, emergency diesel generator start circuit modifications, midloop level indication modifications |
| PWR 4 | Emergency core cooling system injection line modifications, auxiliary salt water pump motor replacement, containment fan cooler motor replacements, RCCA guide tube split pin replacements |
| PWR 4A | Containment fan cooler motor replacements, main transformer bank replacement, centrifugal charging pump replacement |
| PWR 5 | Diesel driven auxiliary feedwater pump vacuum drag modification on condensate storage tank, letdown isolation valve modifications, 161/345 kV transformer autotap modifications |
| PWR 6 | High pressure safety injection line modifications, low pressure safety injection and containment spray injection valve replacements |
| PWR 6A | 1E battery replacement, high pressure safety injection line modifications, low pressure safety injection and containment spray injection valve replacements |
| PWR 7 | Emergency diesel generator tank liner replacement, component cooling water heat exchanger retubing, TH reduction activities |
| PWR 7A | Emergency diesel generator tank liner replacement, component cooling water heat exchanger retubing, TH reduction activities |
| PWR 8 | Emergency diesel generator governor replacement, emergency auxiliary building fan motor replacement |
| PWR 8A | Emergency diesel generator governor replacement |
| PWR 9 | Startup transformer replacement, static uninterruptible power supply replacement |
| PWR 10 | Emergency service water containment isolation valve modification, reactor coolant pump seal package maintenance, non-safety swing battery charger addition |
| BWR 1 | Standby service water basin draining, recirculation pump seal replacement |
| BWR 2 | Reactor core isolation cooling injection point modification, emergency diesel generator air compressor replacements, safety relief valve actuator logic modification |
| BWR 3 | High pressure core spray electrical panel modifications |
Table 3
Operational Issues
| SITE | Operational Issues |
| PWR 1 | Failure of reactor coolant pump anti-rotation device necessitated natural circulation cooldown |
| PWR 1A | Inadvertent entry into reduced inventory, switchyard access control weakness during midloop |
| PWR 2 | Work control errors - pulling the wrong fuse for accumulator fill line valve, valve misalignment caused 2000 gallon refueling water storage tank spill |
| PWR 3 | Dropped reactor coolant pump motor |
| PWR 3A | |
| PWR 4 | Loss of level indication during midloop, inadvertent spent fuel pool pump trip and unmonitored rise in spent fuel pool temperature, partial loss of offsite power due to maintenance error |
| PWR 4A | Weak protection of single source of offsite power, poor control of switchyard work, refueling cavity drained without venting pressurizer |
| PWR 5 | Loss of shutdown cooling, improper alignment of spent fuel pool cooling |
| PWR 6 | |
| PWR 6A | Inadvertent discharge of nuclear cooling water (via relief valve) to containment sump |
| PWR 7 | Loss of shutdown cooling |
| PWR 7A | Inadequate shutdown cooling vent path resulted in personnel spraydown, poor communications during draindown, failure to adequately monitor shutdown cooling flow due to instrument uncertainty issues |
| PWR 8 | Feedwater pump caused steam generator level transient during shutdown, fuel bundle placed in incorrect storage location in spent fuel pool, local leak rate test caused an erroneous indication of lowering level during flood up to midloop |
| PWR 8A | Core alteration performed without containment integrity |
| PWR 9 | Switchyard work control issue during midloop |
| PWR 10 | Mode change without performing all required source range nuclear instrumentation checks, improper fuel handling issues, core alterations without containment integrity |
| BWR 1 | Inadvertent isolation of service water to auxiliary building |
| BWR 2 | 3 inadvertent engineered safeguard feature actuations, fuel handling error |
| BWR 3 | Failure to maintain reactor level below reactor core isolation cooling trip setpoint, inadvertent de-energization of core spray minimum flow valve, incorrectly assembled fuel bundles |
Figure 1 - Outage Duration vs. Time Before Entering Midloop
Page Last Reviewed/Updated Tuesday, March 09, 2021