Index | Site       Map | FAQ | Facility       Info | Reading       Rm | New | Help | Glossary | Contact UsProtecting People and the EnvironmentUNITED STATES NUCLEAR REGULATORY COMMISSION -   About NRC    - The     Commission 
  - Statutory Authority 
  - Strategic Plan 
  - Budget &      Performance 
  - Organization & Functions 
  - Locations 
  - History 
  - Values 
  - Policymaking 
  - Radiation Protection 
  - Fire Protection 
  - How We Regulate 
  - Grants 
  - Civil Rights 
  - 
- NuclearReactors    - Operating Reactor Locations 
  - Reactor Quick Links 
  - Power Reactors 
  - Research and Test     Reactors 
  - Operating Reactors 
  - Operator Licensing 
  - New Reactors 
  - Operator     Licensing for New Reactors 
  - Reactor Safety Research 
  - Advisory Comm (ACRS) 
  - Decommissioning     of Nuclear Facilities 
  - 
- NuclearMaterials    - Fuel Cycle Facility Locations 
  - Uranium     Recovery Locations 
  - Materials Quick Links 
  - Special Nuclear Material 
  - Source Material 
  - Byproduct Material 
  - Med, Academic & Ind Uses 
  - Source Materials Facilities 
  - Uranium Recovery 
  - Fuel Cycle Facilities 
  - Materials     Transportation 
  - Materials Research 
  - Advisory Comm (ACMUI) 
  - Decommissioning     of Nuclear Facilities 
  - Materials     Environmental Reviews 
  - 
- RadioactiveWaste    - Waste Quick Links 
  - Low-Level Waste 
  - Waste Incidental to     Reprocessing 
  - Incidental Waste Criteria 
  - High-Level Waste 
  - Uranium Mill Tailings 
  - LLW Disposal 
  - HLW Disposal 
  - Spent Fuel Storage 
  - Spent Fuel Transport 
  - Waste Research 
  - 
- NuclearSecurity    - Security     Spotlight 
  - NRC     Responsibilities 
  - Domestic Safeguards 
  - Radioactive Material Security 
  - Facility Protection 
  - Nuclear Material Control 
  - International Safeguards 
  - Information Security 
  - Emergency     Preparedness 
  - &; 
- Public Meetings&   Involvement    - Public Meeting Schedule 
  - Commission     Schedule 
  - Conferences & Symposia 
  - Documents for Comment 
  - Brochures & Fact Sheets 
  - Involving Stakeholders 
  - Info Quality Guidelines 
  - Rulemaking Process 
  - Licensing 
  - Enforcement 
  - Hearing Process 
  - Hearing Applications 
  - 

Home       > Electronic Reading       Room       > Document       Collections       > General       Communications       > Information       Notices       > 2000       > IN 2000-13

UNITED STATESNUCLEAR REGULATORY COMMISSIONOFFICE OF NUCLEAR REACTOR REGULATIONWASHINGTON, D.C. 20555-0001

September 27, 2000
NRC INFORMATION NOTICE 2000-13:REVIEW OF REFUELING OUTAGE RISK- Addressees 
- Purpose 
- Discussion 
Addressees
All holders of operating licenses for nuclear power reactors.
Purpose
The U.S. Nuclear Regulatory Commission (NRC) is issuing this information notice to inform addressees of a review of refueling outage risk performed by the senior reactor analysts in NRC Region IV. Addressees are expected to review the information for applicability to their facilities and consider actions, as appropriate, to avoid similar problems. However, suggestions contained in this information notice are not NRC requirements; IN 2000-13
Discussion
To enhance the efficiency and effectiveness of the assessment and inspection of outage activities, the NRC Region IV senior reactor analysts and resident inspectors reviewed 19 refueling outages. The reviews provided a comprehensive understanding of the overall risk of each refueling outage from separate, but equally important, perspectives: configuration risk and modification risk impact. A compilation of these reviews was provided to all Region IV reactor licensees (ADAMS Accession No. ML003746119). The NRC has decided that all NRC reactor licensees should have this information notice.

This information notice requires no specific action or written response. If you have any questions about the information in this notice, please call or email one of the technical contacts listed below or the appropriate Office of Nuclear Reactor Regulation (NRR) project manager.
/RA/Marvin M. Mendonca       
FOR

Ledyard B. Marsh, ChiefEvents Assessment, Generic Communications       and Non-Power Reactors BranchDivision of Regulatory Improvement       ProgramsOffice of Nuclear Reactor Regulation
Technical contacts:Jeffrey L. Shackelford, RIV 817-860-8144 E-mail:     jls2@nrc.govWilliam B. Jones, RIV 817-860-8147 E-mail:   wbj@nrc.govAttachments:1. Refueling       Outage Risk - An Operational Perspective2. List of Recently       Issued NRC Information Notices(ADAMS Accession Number ML003752328)
ATTACHMENT 1
Refueling Outage Risk - An Operational Perspective
J.L. Shackelford and W.B. JonesSenior Reactor AnalystsUnited States Nuclear Regulatory Commission
- Abstract 
- Introduction 
- Overview   of outage risk assessment methods 
- Outage   risk insights    - Quantitative     results 
  - Risk     profile of a typical PWR outage 
  - Risk     profile of a typical BWR outage 
- Operational   issues observed during the conduct of the refueling outages    - Significant     modifications and maintenance activities 
  - Operational     Issues 
- Summary   and conclusions 
- References 
Abstract
An operational overview of 19 refueling outages at United States nuclear power plants was performed. The overview included an assessment of the risk methodology used by licensees to plan and implement a refueling outage. Data were collected with respect to the overall risk of the outage from both a configuration risk as well as a modification risk perspective. The results of these reviews were factored into the Nuclear Regulatory Commission's inspection planning activities associated with the outages. The collected data were analyzed for significant patterns and operational insights.
Introduction
During calendar year 1999, the NRC Region IV senior reactor analysts (SRAs) implemented a special initiative to improve the Region's approach to the inspection and assessment of outage activities. This initiative entailed detailed reviews of outage schedules, licensee outage risk assessments, and the proposed major modification activities for each refueling outage which was conducted in Region IV during the year. The purpose of the reviews was to gain a comprehensive understanding of the overall risk of each refueling outage from two separate, but equally important, perspectives; configuration risk and modification impact risk. In this context, configuration risk refers to the real-time risk associated with the specific plant configurations which are entered during the course of a refueling outage. In contrast, the modification impact risk is more closely associated with the potential risk associated with a modification from an online perspective (i.e., the importance of the modification with respect to its potential contribution to plant risk following startup independent of the configuration risk).

These reviews were conducted primarily through a combination of site visits, document reviews, and teleconferences and involved personnel from the licensees' risk and outage planning organizations. The NRC resident inspection staff were also involved in the overall process and the results of the reviews were integrated into the NRC's inspection planning for the outages. A total of 19 refueling outages at 13 reactor sites were reviewed. This included 16 outages at pressurized water reactors (PWRs) and three outages at boiling water reactors (BWRs). These reviews covered the full range of reactor vendors (i.e., Babcock & Wilcox, Westinghouse, Combustion Engineering, and General Electric).

The results of this effort yielded important benefits in a number of areas. Of primary importance, this initiative resulted in a more efficient and focused inspection effort on the part of NRC inspectors during the individual outage inspections. By defining the most important plant configurations and maintenance activities, the results of the outage reviews highlighted the most risk-significant attributes of the outages. This enabled the NRC inspection staff and regional management to concentrate their efforts in the most important areas involving inspection and regulatory oversight. However, in addition to the inspection related benefits, the results of this initiative yielded a considerable amount of data related to outage risk as well as outage risk assessment and management across the full range of reactor types. The information which was collected was integrated and analyzed by the Region IV SRAs. The results are summarized in the remainder of this report and in the accompanying tables and figures. The names of the individual plants have been omitted from the summary information.
Overview of outage risk assessment methods
Each of the licensees performed some type of systematic risk assessment or safety review for their respective refueling outage. In general, these reviews were performed by the risk assessment staff at the site and were coordinated with the outage planning and scheduling organizations. The reviews were generally incorporated into outage risk assessment reports and forwarded to licensee management for review and approval. Where necessary, contingency measures were identified with respect to potentially risk significant configurations. The final results of the licensee risk assessments were provided to the plant operations staff for use during the actual conduct of the outage.

In three of the 19 outages, a purely qualitative approach to outage risk assessment was performed (i.e., no quantitative estimates of risk were developed). These licensees employed the guiding principles contained in NUMARC 91-06, "Guidelines for Industry Actions to Assess Shutdown Management," December 1991, as a foundation for planning the outage. In the remaining 16 outages, some form of quantitative assessment was performed in conjunction with the qualitative considerations contained in the NUMARC guidelines. Of the total 13 sites which were assessed, 11 sites employed a combination of quantitative and qualitative approaches while two sites used a strictly qualitative approach. All the sites incorporated the NUMARC 91-06 guidelines in their planning activities.

With respect to the quantitative approaches, four of the 16 outages used a plant-specific shutdown model in assessing outage risk. The remaining 12 outages employed a proprietary industry product which provided generic modeling of various outage configurations. This generic modeling was then modified with some elements of plant and outage specific data to provide a "semi-quantitative" assessment of the outage risk. Of the 11 sites employing quantitative approaches, three sites used a plant-specific shutdown model and the remaining 8 sites used the proprietary industry software. A full description of the methodology and scope of the modeling which was used is beyond the scope of this effort. However, in general, the quantitative approaches employed modeling considerations related to the specific outage configurations entered and used modified estimates of the initiating event frequencies and human error rates which were used in their at-power models.
Outage risk insightsQuantitative results
For each of the outages which employed a quantitative approach to risk assessment, the following data were obtained: 1) scheduled or predicted (cumulative) risk, 2) actual (cumulative) risk, and 3) peak risk (per hour). A summary of the data which were collected is shown in Table 1.

With respect to the cumulative risk data, (both predicted and actual) an extremely wide range of values were observed with respect to the outage risk. When pooled, the data (associated with the actual risk) for the PWRs showed a cumulative mean core damage probability (CDP) of approximately 1.2E-04 for the outage. However, the values ranged from a low of 1.5E-06 to a high of 6.6E-04 with a standard deviation of 2.0E-04. (Twelve data points were used in the analysis.) These same wide ranges of values were observed with respect to the data associated with the predicted cumulative risk. The mean value for the PWR peak risk (in units of cdp/hr) was 1.6E-06/hr. As with the cumulative risk data, a wide range of values were observed with a high of 5.0E-06/hr, a low of 2.0E-08/hr and a standard deviation of 2.1E-06/hr.

The data for the BWR plants included only three observations. Additionally, one of the BWR units experienced unexpected complications due to fuel integrity issues which significantly extended the duration of the outage. Similar to the PWR data, a wide range of values existed in the cumulative and peak risk estimates associated with the BWR outage observations. Notwithstanding these issues related to data quality, the mean actual risk was estimated to be approximately 8.6E-07 with a high and low of 1.7E-06 and 2.0E-08 respectively. The peak risk was estimated at about 1.2E-08/hr with a range of 3.3E-10/hr to 3.1E-08/hr.

Even if the data are further segregated such that the results of those licensees which used a plant-specific shutdown model are treated separately, similar disparities exist. It should be noted that even with respect to a given multi-unit site, no two outages are identical. However, most of the outages which were assessed were of a generally similar nature and duration. Thus, these extremely wide disparities in quantitative results are unlikely the result of true differences in the risk of the outage but rather represent an artifact of different modeling assumptions and data issues.

Notwithstanding the variability across plants with respect to the actual value of the risk estimates, some generalizations regarding the quantitative results are possible. There was a close agreement (within plants) with respect to the predicted versus the actual cumulative risk. This would suggest that within a given analysis, the quantitative results are somewhat stationary and repeatable. Additionally, even though the absolute values of the risk estimates (both cumulative as well as those for a given configuration) vary widely across plants, the general character and shape of the risk profiles were similar. This would suggest that the quantitative approaches were effective at identifying the relative risk of different outage configurations. A more detailed discussion of the general risk profiles seen in the outage reviews is provided in the following sections of this report.
Risk profile of a typical PWR outage
As mentioned earlier, a total of 16 PWR outages across 10 reactor sites were assessed. As shown in Table 1, the mean scheduled outage duration was approximately 36 days and the mean actual duration was about 37 days. The longest outage was 54 days and the shortest was 27 days with the standard deviation being approximately 7 days. These data suggest that most licensees had accurately planned and predicted the outage duration and that significant schedule impacts were generally minimized. This represented at least the 7th refueling outage for each of the affected units and for some units, this was as high as the 13th outage. Further, for multi-unit sites, the actual level of outage experience would represent a multiple equal to the number of units at the site. (i.e., The 7th refueling outage for a plant at a two unit site would represent closer to 14 outages worth of experience.)

The majority of the PWR outages which were assessed employed an early "hot" midloop or reduced inventory configuration. This was almost exclusively an economic consideration in that the early midloop allowed for earlier entry into the steam generators to perform the required inspection activities. In order to eliminate the midloop, licensees would have been required to delay the steam generator entry until after the reactor vessel was defueled. This would have had the net effect of making the steam generator inspections "critical path" (i.e., the driving factor for the outage duration) in many instances thereby increasing the overall length of the outage. Even with the implementation of the early midloop, the steam generator inspection activities constituted the critical path for many of the refueling outages which were assessed. For the vast majority of the PWR outages, either the steam generator inspections or the actual refueling activities themselves constituted the critical path for the outage.

Of the PWR outages employing a midloop or reduced inventory configuration, 9 of the 15 outages did so with a concurrent unavailability of either an emergency diesel generator or the performance of significant switchyard maintenance. At least one outage employed a midloop configuration with concurrent switchyard and emergency diesel maintenance. However, each of the outages prescribed a number of contingencies and other strict controls during midloop activities. These controls generally followed the NUMARC guidance with respect to protecting trains of equipment, comprehensive pre-evolution briefings, establishment of diverse means of level indications, and in some cases, the addition of temporary emergency power supplies.

With respect to the time of entry into the midloop configurations, data were collected relative to the scheduled as well as the actual time after shutdown before midloop conditions were achieved. Additionally, information associated with the estimated time-to-boil while at midloop was collected. As shown in Table 1, the average scheduled time after shutdown before entering midloop was about 84 hours with the actual value being closer to 93 hours. (The most aggressive schedule planned a midloop configuration 68 hours after shutdown.) The average estimated time-to-boil for the reduced inventory/midloop configurations was about 15 minutes (assuming a loss of shutdown cooling or inventory control) with a high and low estimate of 24 minutes and 9 minutes respectively.

Given that the primary reason for entering the early, hot midloop was to shorten the overall outage duration, it is interesting to note that the data show a slightly negative correlation ( = -0.26) between the actual outage duration and the delay before entering midloop. In other words, those plants which employed an early entry into the midloop configuration were observed to have outages of slightly longer duration relative to those plants that delayed the entry into the midloop configuration. For example, the plant that waited the longest before entering midloop (150 hours) realized a total outage duration of 32 days (slightly below the average) whereas one of the facilities that had the most aggressive midloop schedule (68 hours) had a duration of 38 days (slightly above average). The reasons for this relationship are not clear; however, these data suggest that further reviews of the relationship between scheduling of the midloop configuration with respect to the overall outage duration may be warranted. A graphical representation of this relationship is shown in Figure 1.

As noted earlier, the quantitative estimates of both the cumulative outage risk as well as the peak risk associated with various outage configurations varied greatly among the plants which were assessed. However, if one uses those plants which employed a plant-specific shutdown model as a representative benchmark, then a rough approximation of the risk of a midloop configuration can be obtained. From the data, it was noted that the peak risk associated with the early hot midloop configuration was in the 1.0E-04/yr to 5.0E-04/yr range (i.e., instantaneous core damage frequency). Further, the "typical" early midloop lasted for approximately 22 hours. Thus, using these assumptions, the conditional core damage probability of the early midloop may be on the order of about 1.3E-06. This may be a somewhat conservative estimate in that one of the plants which was used to benchmark this data employed a relatively conservative approach to midloop operations compared to some of the other plants. (This particular plant ensured that no emergency diesel generator or switchyard work was allowed and many of the standby systems were started prior to midloop to avoid "fail-to-start" equipment vulnerabilities.)

Figure 2 shows a graphical representation of the risk profile associated with a typical PWR refueling outage. Initially, the risk is relatively low due to the high reactor coolant inventory and the availability of all electric power sources and decay heat removal systems. The risk then experiences a prompt jump when the steam generator tubes are voided, thereby eliminating the availability of secondary heat removal as a decay heat removal mechanism. The risk can be seen to reach its peak as reactor coolant inventory is reduced during the midloop configuration. Risk is gradually reduced as inventory is restored following the midloop and decay heat levels abate. Once the core is offloaded, the risk of in-vessel core damage is eliminated during the interval when the reactor fuel is in the spent fuel pool and the risk of spent fuel pool boiling represents the primary radiological risk of the outage. Following the reload of the fuel, the risk then rises in an inverse relationship with respect to inventory levels and reaches a somewhat lower (due to reduced decay heat levels) late peak during the "back-end" midloop to restore the steam generators.
Risk profile of a typical BWR outage
The risk profile of a typical BWR outage is somewhat different from that seen in the PWR case. In general, the refueling activities associated with a BWR are more time-intensive and full core offloads are not generally performed. Thus, the risk of in-vessel core damage remains throughout the outage. The risk profile associated with the BWR outage shows an inverse relationship with respect to inventory levels and decreases gradually throughout the outage due to dissipating decay heat levels. Several "spikes" in the typical profile can be seen during swaps of the shutdown cooling system and cavity draining evolutions. These spikes are primarily the result of human errors during these processes. A representative profile of a BWR outage is shown in Figure 3.
Operational issues observed during the conduct of the refueling outagesSignificant modifications and maintenance activities
As mentioned in the introduction, the primary purpose of the outage review effort was to collect information related to outage risk from both a configuration risk perspective as well as from the standpoint of major maintenance and modifications on important plant equipment for use in the inspection planning process. For each of the outages, a compilation of the most important modifications and major maintenance activities was obtained. A summary of these items is presented in Table 2.

As shown in the table, the majority of the significant maintenance activities did not involve actual modifications to the plants. Rather, most of the important work activities involved equipment replacements, primarily on a "like-for-like" basis. Some exceptions to this were noted, particularly in the case of battery replacements which involved replacing the existing batteries with equipment of a newer design. In general, however, the equipment replacements were implemented to address aging considerations associated with the existing components. As seen in Table 2, many of these activities involved the replacement of relatively risk significant components.

The prevalence of equipment replacement activities (to address aging considerations) versus plant improvements via the modification process is likely a result of the maturity of the nuclear industry as a whole. It was noted that the average (operational) age of the plants which were assessed was just over 15 years. The most common plant change which was observed were emergency core cooling system injection line modifications implemented as a result of NRC Information Notice 97-76, "Degraded Throttle Valves in Emergency Core Cooling Systems from Cavitation Induced Erosion Following a Loss of Coolant Accident", dated October 30, 1997.
Operational Issues
The NRC inspection reports for each of the outages were reviewed. Additionally, interviews and debriefings were conducted with the resident inspectors for selected outage inspections in order to understand the most important operational issues and challenges which occurred during the outages. A compilation of these observations is shown in Table 3.

As can be seen in the Table, two loss of shutdown cooling events and one inadvertent entry into reduced inventory occurred in the 19 outages which were assessed. Additionally, three switchyard control issues were noted, two of which occurred during midloop operations. Other operational problems included issues related to spent fuel pool cooling alignments, fuel handling errors, improper valve and equipment lineups, and other work control errors. Each of these issues is documented in the NRC inspection report for the associated facility.

While the risk significance of several of the issues was assessed from a quantitative perspective, the majority of the issues were evaluated qualitatively. None of the issues which are documented in the table were characterized as risk significant by the NRC in the inspection, assessment, and enforcement process. (The highest estimate of the conditional core damage probability of the issues which were assessed quantitatively was in the low 1.0E-07 range.) With respect to the loss of shutdown cooling and inadvertent entry into reduced inventory events, a high level of redundancy and diversity was observed in the available core cooling and inventory control systems at the time of the events. This served to mitigate the overall risk significance of these events. However, because less mitigation equipment is required by NRC regulations to be operable during shutdown conditions, these events would have been of significantly higher "potential" risk significance if it were postulated that only the minimum set of required equipment had been available at the time of the event. This observation underscores the importance of the industry's voluntary efforts to minimize shutdown risk by exceeding the existing regulatory requirements.

Further, human error along with weak or deficient procedures were the causes (or at least contributing factors) for almost all the operational issues that were observed. Additionally, the majority of these problems occurred relatively late in the outage. This was seen to be a factor in mitigating the risk significance of several of these issues, particularly those involving a loss of shutdown cooling and the inadvertent entry into reduced inventory in that decay heat levels had dissipated considerably.

With respect to the early midloop configurations, there were no significant negative observations from an NRC inspection perspective for the outages which were assessed. Thus, even though the midloop configurations represented a relatively higher level of operational risk than other outage configurations, the increased attention and awareness afforded to this evolution most likely decreased the potential for human errors. In addition, the NRC placed special emphasis on these higher risk configurations. For several of the midloop configurations, particularly those that involved emergency diesel generator outages or switchyard work, the NRC conducted management level teleconferences with the licensees to emphasize the Agency's concern with the elevated risk. Further, the NRC generally conducted around-the-clock inspection coverage of the midloop and other elevated risk configurations.
Summary and conclusions
The results of this initiative indicate that the use of formal risk assessment in outage planning and outage management is widespread throughout the nuclear industry. For each of the outages which were assessed in this effort, some type of structured risk assessment or safety review was performed. Further, the results of these assessments were generally reviewed and approved by site management and used by the planning, scheduling and operations organizations at the sites to plan and execute the refueling outages. Of the sites which were reviewed, about 23% of the sites employed a plant-specific shutdown model in their assessment approach while about 62% used a proprietary industry product for their modeling. The remaining 15% of the sites used a purely qualitative approach to outage risk assessment and outage management. Further, all the sites incorporated the NUMARC 91-06 guidelines in their planning activities.

With respect to the quantitative results, a wide range of values were observed in the estimates of both the cumulative outage risk and the peak risk. While it is true that no two outages which were assessed were identical, many commonalities were observed in terms of both outage duration and actual plant configurations. Thus, these disparities in the quantitative results are not likely the result of true differences in the actual risk of the outage but rather represent differences in modeling and other related data issues. There was a relatively close agreement (within plants) with respect to the predicted versus the actual cumulative risk. This would suggest that within a given analysis, the quantitative results are somewhat stationary and repeatable. Also, the general shape of the risk profile was consistent across plants (for a given reactor type). This suggests that the quantitative approaches were effective at identifying the relative risk of different outage configurations. Thus, it appears that while the actual value of the risk estimates for a given plant may not be reliable in an absolute sense, the relative risk of the given plant configurations may be more consistently identified.

Because of a paucity of data and the anomalous nature of one of the data points, no valid conclusions of a quantitative nature regarding the BWR outages were possible. However, for the PWR population, the average (actual) outage duration was about 37 days with a standard deviation of about 7 days. The average (scheduled) duration was about 36 days. This suggests that, overall, most licensees had effectively planned and implemented their outage schedules. Additionally, there was a high level of refueling outage experience among the licensees which were reviewed. (i.e., This was at least the 7th refueling for each of the sites, whereas some of the multi-unit sites had performed more than 20 refuels.) Thus, one possible conclusion is that the maturity of the industry has contributed to effective scheduling and outage management.

With respect to the PWR outages, 94% of those assessed employed an early hot midloop or reduced inventory configuration. Further, 53% of the PWR sites entered the midloop/reduced inventory configuration with concurrent emergency diesel generator or switchyard maintenance. The average time after shutdown prior to entering midloop was a little over 3 1/2 days, with the most aggressive schedule being about 2 1/2 days after shutdown. The time to boil during midloop ranged from about 9 to 24 minutes with an average of about 15 minutes. Analysis of the data showed no real advantage in terms of outage duration savings by earlier entry into the midloop configuration. (i.e., Those plants with the most aggressive schedule for entering midloop did not, on the average, experience shorter outages than those with longer delays in entering midloop.) However, this relationship may not be statistically significant, and further review in this area may be warranted. Further, even though the quantitative estimates of risk varied greatly among the plants, the best estimate of the conditional core damage probability of a typical midloop configuration was about 1.3E-06 based on the data collected. The annual (at-power) core damage frequency for the plants which were assessed was in the low to mid 1.0E-05/yr range. Thus, given that the typical midloop configuration lasted about 22 hours, it is interesting to note that these plants accumulated the equivalent of about 10% of their annual at-power risk in essentially one day of midloop operation. (These results are presented for illustration purposes and are not intended to imply a direct comparison between the shutdown and at-power modeling approaches.)

For the vast majority of the PWR outages, either the steam generator inspections or the actual refueling activities themselves constituted the critical path for the outage. Further, the majority of the significant maintenance activities performed during the refueling outages did not involve actual modifications to the plants, but rather involved equipment replacements, primarily on a like-for-like basis. Many of these replacement activities were associated with relatively risk significant components. The prevalence of replacement activities versus modifications may be attributable to the age of the American nuclear power industry in that it was observed that the average operational age of the plants which were assessed was just over 15 years.

From an operational perspective, two loss of shutdown cooling events and one inadvertent entry into reduced inventory occurred in the 19 outages which were assessed. Additionally, three switchyard control issues were noted, two of which occurred during midloop operations. There were other operational considerations related to issues involving improper spent fuel pool cooling alignments, fuel handling errors, improper valve and equipment lineups, and other work control errors. From a safety perspective, none of the issues were characterized as risk significant by the NRC in the inspection, assessment, and enforcement process. However, evidence suggests that these issues may have been of much greater risk significance if only the minimum required set of equipment had been available at the time of the events. Finally, most of the events which were observed involved human errors or deficient procedural guidance.
References
NRC Information Notice 97-76, "Degraded Throttle Valves in Emergency Core Cooling Systems from Cavitation Induced Erosion Following a Loss of Coolant Accident", 10/30/97

NRC Inspection Report Nos:

50-313,368/98-10, 99-01,99-03, 99-1450-483/99-0950-445,446/99-07, 99-15, 99-1850-275,323/99-03, 99-14, 99-1750-285/99-1350-528,529,530/99-06, 99-19, 99-2050-458/99-03, 99-0550-416/99-17, 99-1850-361,362/99-01, 99-03, 99-04, 99-0650-498,499/99-06, 99-11, 99-1850-382/99-02, 99-0550-482/99-03, 99-0650-397/99-10, 99-13

NUMARC 91-06,"Guidelines for Industry Actions to Assess Shutdown Management", December 1991,
Table 1 - Selected Outage DataPWR OUTAGESPLANT NAMEOutage DurationTotal Risk EstimateTime to BoilTime after S/D before MLPeak Risk/hrScheduledActualScheduledActual(ML/RI)ScheduledActualmin.hr.PWR 128302.1e-061.5e-0617721102.0e-08PWR 1A48437.7e-065.7e-0621104963.2e-08PWR 225351.7e-052.0e-0512801023.7e-07PWR 336352.4e-043.7e-0410761084.9e-06PWR 3A32336.7e-046.6e-0415791021.6e-06PWR 424314.0e-041.5e-0415961205.0e-06PWR 4A31321.5e-041.4e-04131321505.0e-06PWR 53240Note 1Note 124120148Note 1PWR 64638Note 1Note 1186869Note 1PWR 6A3736Note 1Note 1157272Note 1PWR 760542.9e-062.5e-061678762.3e-08PWR 7A55432.9e-062.4e-061678602.1e-08PWR 828324.1e-054.1e-05968718.0e-07PWR 8A28274.0e-054.1e-051072748.0e-07PWR 93842Note 1Note 1129681Note 1PWR 1034362.2e-052.2e-05n/an/an/a2.2e-07n1616121216161612Mean36.436.71.3e-041.2e-0415.283.893.41.6e-06Standard Deviation10.76.62.1e-042.0e-044.220.928.92.1e-06High60546.7e-046.6e-04241321505.0e-06Low24272.1e-061.5e-06950552.0e-08BWR OUTAGESPLANT NAMEOutage DurationTotal Risk EstimatePeak Risk/hrScheduledActualScheduledActualBWR 132494.5e-082.0e-086.0e-09BWR 229924.5e-08Note 23.3e-10BWR 338371.7e-061.7e-063.1e-08n33323Mean33.059.36.0e-078.6e-071.2e-08Standard Deviation4.628.99.6e-071.2e-061.6e-08High38921.7e-061.7e-063.1e-08Low29374.5e-082.0e-083.3e-10Note 1 - Qualitative approach usedNote 2 - Data not availableTable 2Major Modifications and Maintenance ActivitiesSITEMajor Modifications and Maintenance ActivitiesPWR 1Main steam isolation valve actuator replacement, emergency feedwater       pump replacement, magne-blast breaker replacementsPWR 1AService water pump replacement, refueling level indication       modification, vital AC upgrade, reactor coolant pump seal replacementPWR 2Battery replacements, steam generator electrosleeving, emergency       service water pump motor replacement, main feedwater check valve       replacementsPWR 3Emergency core cooling system injection line modifications, emergency       diesel generator start circuit modifications, midloop level indication       modifications, battery replacementsPWR 3ATurbine-driven auxiliary feedwater pump impeller replacement,       emergency core cooling system injection line modifications, emergency       diesel generator start circuit modifications, midloop level indication       modificationsPWR 4Emergency core cooling system injection line modifications, auxiliary       salt water pump motor replacement, containment fan cooler motor       replacements, RCCA guide tube split pin replacementsPWR 4AContainment fan cooler motor replacements, main transformer bank       replacement, centrifugal charging pump replacementPWR 5Diesel driven auxiliary feedwater pump vacuum drag modification on       condensate storage tank, letdown isolation valve modifications, 161/345 kV       transformer autotap modificationsPWR 6High pressure safety injection line modifications, low pressure safety       injection and containment spray injection valve replacementsPWR 6A1E battery replacement, high pressure safety injection line       modifications, low pressure safety injection and containment spray       injection valve replacementsPWR 7Emergency diesel generator tank liner replacement, component cooling       water heat exchanger retubing, TH reduction activitiesPWR 7AEmergency diesel generator tank liner replacement, component cooling       water heat exchanger retubing, TH reduction activitiesPWR 8Emergency diesel generator governor replacement, emergency auxiliary       building fan motor replacementPWR 8AEmergency diesel generator governor replacementPWR 9Startup transformer replacement, static uninterruptible power supply       replacementPWR 10Emergency service water containment isolation valve       modification, reactor coolant pump seal package maintenance, non-safety       swing battery charger additionBWR 1Standby service water basin draining, recirculation pump seal       replacementBWR 2Reactor core isolation cooling injection point modification, emergency       diesel generator air compressor replacements, safety relief valve actuator       logic modificationBWR 3High pressure core spray electrical panel   modificationsTable 3Operational Issues
SITE
Operational IssuesPWR 1Failure of reactor coolant pump anti-rotation device necessitated       natural circulation cooldownPWR 1AInadvertent entry into reduced inventory, switchyard access control       weakness during midloopPWR 2Work control errors - pulling the wrong fuse for accumulator fill line       valve, valve misalignment caused 2000 gallon refueling water storage tank       spillPWR 3Dropped reactor coolant pump motorPWR 3APWR 4Loss of level indication during midloop, inadvertent spent fuel pool       pump trip and unmonitored rise in spent fuel pool temperature, partial       loss of offsite power due to maintenance errorPWR 4AWeak protection of single source of offsite power, poor control of       switchyard work, refueling cavity drained without venting pressurizerPWR 5Loss of shutdown cooling, improper alignment of spent fuel pool     coolingPWR 6 PWR 6AInadvertent discharge of nuclear cooling water (via relief valve) to       containment sumpPWR 7Loss of shutdown coolingPWR 7AInadequate shutdown cooling vent path resulted in personnel spraydown,       poor communications during draindown, failure to adequately monitor       shutdown cooling flow due to instrument uncertainty issuesPWR 8Feedwater pump caused steam generator level transient during shutdown,       fuel bundle placed in incorrect storage location in spent fuel pool, local       leak rate test caused an erroneous indication of lowering level during       flood up to midloopPWR 8ACore alteration performed without containment integrityPWR 9      Switchyard work control issue during midloopPWR 10Mode change without performing all required source range       nuclear instrumentation checks, improper fuel handling issues, core       alterations without containment integrityBWR 1Inadvertent isolation of service water to auxiliary buildingBWR 23 inadvertent engineered safeguard feature actuations, fuel handling       errorBWR 3Failure to maintain reactor level below reactor core       isolation cooling trip setpoint, inadvertent de-energization of core spray       minimum flow valve , incorrectly assembled fuel bundles
Figure 1 - Outage Duration vs. Time Before Entering Midloop