# Presentation: 168162

## Mitigating System Performance Index

- (What it means to you)

## MSPI 

- Purpose of training:
- To review the reason for MSPI
- To learn key MSPI concepts
- To apply concepts during inspections
- To review the Bases Document
- To assist with the Temporary Instruction

**Notes:**
[Read slide]

## Reason for Change

- Problems with current Safety System Unavailability Performance Indicator
- Desire to be more risk-informed
- Balances need for maintenance (availability) with equipment performance (reliability)
- Eliminates cascading cooling water system problems

## Monitored Systems

| BWRs | PWRs |
| --- | --- |
| High pressure coolant injection/core spray  | HPSI (high pressure safety injection)  |
| RCIC or isolation condenser  | AFW (auxiliary or emergency feedwater)  |
| RHR (residual heat removal)  | RHR (may include containment spray) |
| EAC (emergency AC power)  | EAC |
| Cooling Water Support Systems  | Cooling Water Support Systems |

## Other Outcomes from MSPI

- Most licensees made PRA model updates to address Peer Review F&Os
- PRA model updates addressed:
- Errors
- Non-conservative modeling
- Assumptions that could not be justified
- NRC’s SPAR model were enhanced to:
-  Update initiating event frequencies and equipment    	failure rates
-  Address longstanding issues

## What is MSPI ?

**What is MSPI ?**

## Key Definitions

***Unavailability:***** The fraction of time that a system or train is out-of-service for testing and/or maintenance.**
***Unreliability:***** Probability that a component will not function successfully for its specified mission time.  This is determined on a component level. **
**	**

## Overview - Implementation Training

## System Boundary

- Defines the portions of the system which could result in Unavailability time.
- Bases document contains simplified drawings – use PI&Ds for inspection activities.
- Tanks are NOT included in the boundary; however, the contents of the tank may impact Unavailability.

## Example 1

- The CDBI team determines that the setpoint for CST to suppression pool swapover will result in significant vortexing in the HPCI system.  The setpoint can’t be increased –not enough volume in the CST.  Suction is swapped to the suppression pool to satisfy TS operability requirements. The suction pathways from suppression pool and CST are in the system boundary.

## Example 1

- Unreliability
- No impact – no failures of monitored components occurred.
- Unavailability
- No impact since the alternate suction source could be included in the boundary.  For PWRs, removing the CST from service may be a problem if credit for SW not taken in the AFW system – get ready for an FAQ!
- Finding
- Evaluated through SDP, significance determined from impact of air on pump operability.

## System Boundary

- Designated Trains or Segments
- Defines where the Unavailability time will be charged.
- Shared components between trains count against ALL trains (or segments).
- Segment Approach
- Used in some cooling water systems due to complexity of system (TMI – AFW also)
- Special rules for segments – additional training available

## Success Criteria

- PRA values
- Design (default; however should have a statement)
- Different than design – important to know these values when performing data verification.
- Note: Calculations which support design or different values are included as the success criteria.
- Failure to meet MSPI-defined success criteria will result in a demand failure to be counted in the URI calculation.

## Example 2

- As stated in the MSPI Bases Document, the success criteria for an EDG start is 20 seconds.  The TS surveillance requires the EDGs to start within 10 seconds.  During a surveillance, the A EDG started in 11.8 seconds.  The licensee found “whiskers” on one contact and replaced the control board within 30 minutes from the failed surveillance.

**Notes:**
[Read the slide.]

## Example 2

- Unreliability
- No failure will be recorded because the EDG did start automatically within 20 seconds. Had the licensee stopped timing the start after the 10 seconds or stopped the startup process, the failure to start would count.
- Unavailability
- 30 minutes, regardless of whether the failure to start counts as unreliability or not.
- Finding
- The performance deficiency is evaluated through the SDP.

## Example 3

- During a surveillance run, a diesel tripped on high jacket water temperature approx 1.5 hours into the run. The hi temp trip was spurious in that it was an indication problem. This trip would be bypassed for an 'S' signal.  On a LOOP, procedures instruct operators to try to start the diesel using slave relay K603, which gives the diesel an 'S' start signal.

**Notes:**
[Read the slide]

## Example 3

- Unreliability
- The Success Criteria for the diesel includes the ability to start during a LOCA and/or LOOP.  The inability to automatically start on a LOOP and/or run is considered a failure on demand (either start, load-run, or run failure - depending on time of failure) and would count as a URI hit.
- The NEI guidance states that “In no case can a postulated action to recover a failure be used as a justification to exclude a failure from the count."

## Monitored Components

- Defines the set of components whose failure will impact the Unreliability index.
- Boundaries of _components_ are defined in NEI 99-02.
- Example – breakers, circuits, internal cooling

## Monitored Components

- Not all components are monitored for UR.
- Manual valves, FCVs, check valves, throttle valves
- Auxiliary equipment, such as room cooling
- Components that do not change state in order to achieve monitored function (not containment isolation)
- Components excluded on low Birnbaum IAW 99-02.
- However, as discussed earlier, these may contribute to UA.

## Example 4

- While preparing to perform a surveillance test on the RHR system, an operator noticed that RH-3443 unexpectedly had a maintenance tag on it and was in the closed position.  The valve should have been locked open to support operability.  The operator contacts the control room and after reviewing the situation, is directed to open the valve an hour later.  The licensee determines that the valve was closed 32 days ago.  Valve 3443 is in boundary but not monitored.

**Notes:**
[Read the slide]

## Example 4

- Unreliability
- No affect on MSPI.  A monitored component did not fail.
- Unavailability
- 1 hour (time of discovery to time it was corrected.)
- Finding
- The fault exposure time (32 days) will be used in the SDP assessment.

## Example 5

- During a surveillance test on the RHR system,  the "B" RHR pump starts; however discharge flow is significantly lower than expected.  An operator noted  that RH-3443 (manual maintenance valve) was unlocked in a mid position causing the reduced flow. Valve 3443 is in boundary but not monitored. The pump is placed in PTL until an engineering evaluation is completed.

## Example 5

- Unreliability
- Case 1:  No damage was caused by the reduced flow.  NO demand failure.  Pump (component) was always capable of meeting it’s function.
- Case 2:  Some damage is detected  and is fixed.  The licensee later concludes that the damage did not need to be fixed – that the pump could function even with this damage.  NO demand failure.   (Challenge!!!)
- Case 3: Damage which rendered the pump (component) incapable of performing its function.  A demand failure will count.  A non-monitored component (valve) _caused_ failure of a monitored component (pump).

## Example 5

- Unavailability
- For all 3 cases, the system was unavailable from the time of discovery to the pump’s return to service – as UNPLANNED.
- Finding
- Normal process using fault exposure hours from last manipulation of the valve.

## Unavailability Concepts

- Spare trains do NOT count in UA
- Major overhauls (if planned) are “added/subtracted” from the baseline
- Operability determinations will determine whether maintenance is Planned or  Unplanned
- Complexity of Operator Recovery will determine whether down time is counted toward UA

## Example 6 

- Unit 1 emergency service water system has 3 pumps.  Normally Pump "A" and "B" are in standby condition and will automatically start on demand.  Pump "O" is shared between units but will not automatically start unless specifically aligned to a unit.  Pump "A" has a bearing problem.  It takes operators 45 minutes to align Pump "O" to Unit 1.  Pump "A" is out of service for 6 days and is then realigned (Pump "O" taken out).

**Notes:**
[Read slide]

## Example 6 

- Unreliability
- This depends on the severity of the bearing problem (we’ll discuss this later)
- Unavailability
- 90 minutes only for Train "A."  During the 6 days Pump A is out of service, Pump A is considered the spare (two pumps are always available except during the realignment time.)
- Finding
- No new insights

## Example 7

- During this quarter, 30 hours of planned maintenance was included in the planned maintenance baseline for the SI system.
- As of today, the licensee has used 15 hours of planned maintenance time.
- An operator discovers a small oil leak on the "A" SI pump.  The licensee determines that the pump is capable of meeting it’s mission time with the leak - but they want to fix it.  It will take 10 hours to repair and return to service.

**Notes:**
[Read slide]

## Example 7

- To Count as Planned:
- We agree with operability call
- The additional 10 hours have no effect on UA (10+15 = 25,  25<30)
- Total UA time would be 30 hours (30 + 0)
- To Count as Unplanned:
- We disagree with their operability call
- Total unavailability time (planned + unplanned) would be 40 hours (30 + 10 )

## Example 8

- The licensee repairs the oil leak on the "A" SI pump.  No other maintenance was performed.  During the post maintenance test, a fitting starts to leak slightly.  The operators shut down the pump and maintenance tightens the fitting.  The PMT is started again; however, this time, the pump trips due to a breaker fault.  Because the pump was still inoperable, the licensee does not declare this an MSPI failure.

**Notes:**
[Read slide]

## Example 8

- Unreliability – failure of the first PMT is not considered a failure because it demonstrated the maintenance was not complete.  The second failure counts because it was unrelated to the maintenance performed.
- Unavailability – the time to fix the breaker is considered UNPLANNED maintenance.

## Example 9

- The licensee discovers a significant leak on the  "B" RHR room cooler.  The licensee does not need room cooling to support operability but due to the proximity of the work, places the "B" RHR pump in PTL and racks out the breaker.  An extra operator has been assigned to restore the pump (rack in the breaker) if necessary.  The licensee estimates that restoration can occur within 5 minutes – which meets the success criteria time stated in the MSPI bases document.

**Notes:**
[Read slide]

## Example 9

- No Unavailability time will be charged to the RHR system!!
- If the licensee has an approved procedure, and it is uncomplicated, and does not need diagnosis or repair.
- Restoration activity will be completed within designated time frame.
- Challenge the licensee if:
- Restoration activities include more complicated human actions such as lifting leads, clearing tags, landing wires - if the licensee is insistent - FAQ!
- Racking in breakers at various locations (becomes more complicated).  Some plants were smart....Palo Verde AFW is not needed for 45 minutes....so they can restore from lots of maintenance activities.

**Notes:**
[Read slide]

## Unreliability Concepts 

- Operability Evaluations can be important.
- Failure to start or run could be ANTICIPATED failures (in addition to actual failures)
- Use Operating Experience to support your position!
- Analysis may be performed to prove _current_  operability – however,  past operability is based on operating parameters in effect at the time of the failure.

## What is a Failure?

- Count only failures that occur within the monitored component boundary.
- A failure will be counted only if the monitored component incurred physical damage or was physically degraded such that it could not perform is risk-significant function.
- All other conditions and situations that render the pump/train/system inoperable or incapable of performing its function will not be counted as a failure of the monitored component.

## Example 10 

- During a surveillance, the "B" RHR pump overheats and the licensee stops the surveillance and places the pump in PTL.  The licensee determines that SW valve 3443 was not fully open after maintenance 32 days ago. Engineering determines pump is currently ok and the pump is returned to service once the valve is opened.   Valve 3443 is in boundary but not monitored.  However, cooling is considered part of the supercomponent (pump).   An operability evaluation concludes the pump was always operable with this reduced cooling flow.

## Example 10

- Unreliability
- If we accept past operability call, no impact on Unreliability.
- If the past operability call is incorrect, (pump could not meet mission time), this will be a run failure.
- Unavailability
- Regardless of the unreliability call, the train was unavailable for 1 hour.
- Finding
- Uses the 32 days in the SDP evaluation.

## Example 11 

- Same example ("B" RHR pump overheating and placed in PTL) except engineering personnel determines that the current calculations show a required cooling flow of 25 gpm.  The as-found was likely 10 gpm.  The licensee sharpens their pencil and develops another calculation which accepts a lower flow rate.  The pump is declared operable.

## Example 11

- Unreliability
- If the Success Criteria states design basis requirements were used and the calculation for the cooling water flow was a calculation of record, then this is an Unreliability hit (Current calculations show pump would not meet mission time.)   Note – licensee can change bases document but the change will NOT occur until next quarter.
- If the Success Criteria is silent on a specific value (or no licensing basis record of calc), then licensee can use engineering judgement to determine availability (i.e., would not count as a failure.)

## Questions?

- (short break)

## Training on Temporary Instruction (and subsequent PI verification)

- Complete TI by 12/31/06
- Recommend completing TI prior to performing Supplemental Inspections
- Consists of Three Sections:
- Credit for Unavailability
- Verification of Unavailability Data
- Verification of Unreliability Data

## Slide 42

## Outcome Data

- Index will be the sum of the UAI and URI
- Color based on outcome
- PLE = Performance Limit Exceeded
- Indicates that although the sum of UAI and URI may be Green, performance of a component is significantly less than expected industry  performance.

## Temporary Instruction

- Credit for Unavailability
- Confirming known operator or automatic actions in surveillances.
- Verification of Unavailability Data
- Baseline planned unavailability hours.
- Actual planned and unplanned unavailability data.
- Except Cooling (and IC), consists of manipulation of ROP data.
- Verification of Unreliability Data
- Failure to start (failure on demand) or Failure to run.
- Not verifying # demands or run hours.

**Notes:**
[read slide]

## Verification of UA – Baseline Information

- Start with total train unavailable hours for ROP CY02-04.
- (-) fault exposure hours still included in the CY02-04.
- (-) unplanned unavailable hours.
- (+) on-line overhaul hours and planned unavailability excluded in SSU.
- (+) planned unavailable hours for functions not monitored in SSU.
- (-) unavailable hours reported when the reactor was not critical.
- (-) cascaded support systems unavailability.
- Divide the hours derived by the total critical hours during 2002-2004.

## Verification of UA - Actual Performance 

- Same steps as with Baseline Planned except using CY 2005 and CY 2006 information
- CY 2005 and CY 2006 data need verification – same method as SSU verification

## Verification of UA – Cooling Systems

- Cooling water system(s) and Isolation Condenser
- More work – no baseline ROP data available.
- On a sampling basis, review related work history information, maintenance rule information, corrective action program documents,  and surveillance testing to determine periods of time where the licensee _planned_ to make the cooling water system unavailable.

## Verification of UR Data

- Information obtained through review of  condition reports, operability determinations and system health notebooks (or similar)
- Determine number of failures to start and failures to run.
- (Note: challenge operability evaluations!)

## Margin Management of  MSPI outcomes

- Baseline Planned Unavailability time
- Must notate that a change in maintenance philosophy occurred that resulted in different baseline information.
- Overhauls MUST be removed after 12 quarters!
- Not counted until quarter AFTER changes are made.

## Managing MSPI Outcomes

- PRA success criteria
- Change/Remodel PRA
- Must reassess Monitored Components and Fussell-Vesely values
- Specific Parameters
- Changes in values (such as flow rates or timing of initiation) need to be technically justified through calculations
- Not counted until quarter AFTER changes are made.

## Managing MSPI Outcomes

- Operability Calls
- An _Inoperability_ call directly impacts URI
- An _Inoperability_ call results in unplanned UA.
- Challenge the licensee using YOUR engineering judgment, Part 9900, and Operating Experience

## Questions?

- RI Contact:  Chris Cahill
- RII Contact:  Walt Rogers
- RIII Contact:  Ann Marie Stone
- RIV Contact:  Mike Runyan
- Headquarters:  John Thompson