<<

IAEA-TECDOC-504

EVALUATION OF RELIABILITY SOURCES

REPOR TECHNICAA F TO L COMMITTEE MEETING ORGANIZED BY THE INTERNATIONAL ATOMIC ENERGY AGENCY AND HELD IN VIENNA, 1-5 FEBRUARY 1988

A TECHNICAL ISSUED BY THE INTERNATIONAL ATOMIC ENERGY AGENCY, VIENNA, 1989 IAEe Th A doe t normallsno y maintain stock f reportso thin si s series. However, microfiche copie f thesso e reportobtainee b n sca d from

INIS Clearinghouse International Atomic Energy Agency Wagramerstrasse5 P.O. Box 100 A-1400 Vienna, Austria

Orders should be accompanied by prepayment of Austrian Schillings 100, in the form of a cheque or in the form of IAEA microfiche service coupons orderee b whic y hdma separately fro INIe mth S Clearinghouse. OF RELIABILITY DATA SOURCES IAEA, VIENNA, 1989 IAEA-TECDOC-504 ISSN 1011-4289

Printed by the IAEA in Austria April 1989 PLEAS AWARE EB E THAT MISSINE TH AL F LO G PAGE THIN SI S DOCUMENT WERE ORIGINALLY BLANK CONTENTS

Executive Summary ...... 9

1. INTRODUCTION ...... 11

. 2 ROL RELIABILITF EO Y DATA ...... 3 1 .

2.1. Probabilistic safety assessment ...... 3 1 . 2.2. Use f reliabilito s desigP y datNP nn i a ...... 4 1 . f reliabilito e 2.3Us . operatioP y datNP n ai n ...... 6 1 . 2.3.1. Operational management ...... 6 1 . 2.3.1.1. Maintenance schedules ...... 6 1 . 2.3.1.2. Optimisation of test intervals ...... 17 2.3.1.3. Outage times ...... 8 1 . 2.3.1.4. Spare parts ...... 8 1 . 2.3.1.5. Availability of plant ...... 19 2.3.2. Safety management ...... 9 1 . 2.3.2.1. Backfitting and/or improvements ...... 9 1 . 2.3.2.2. Accident management ...... 19 2.4. Reliability data requirements ...... 0 2 . 2.4.1. Initiating events ...... 20 2.4.2. Failure data ...... 21 2.4.3. Testing ...... 21 2.4.4. Repair and recovery data ...... 23 2.4.4.1. Repair times ...... 3 2 . 2.5. Issue datn o s a collection, evaluatio utilizatiod nan n ...... 4 2 . 2.5.1. ...... 4 2 . 2.5.1.1. Availability/incompletenes f dato s a ...... 4 2 . 2.5.1.2. Inconsistency of data ...... 25 2.5.1.3. uncertaintied an s s ...... 5 2 . 2.5.1.4. Random/dependent failures ...... 26 2.5.1.5. judgement ...... 26 2.5.2. Data evaluation ...... 7 2 . 2.5.2.1. Sources of reliability data ...... 27 2.5.2.2. Factors affecting failure data ...... 29 2.5.2.3. Categorization of initiating events ...... 29 2.5.3. Use of data ...... 30 2.5.3.1. Generic vs. specific ...... 30 2.5.3.2. Limitatio f dato n a ...... 1 3 . 2.5.3.3. Validation ...... 1 3 . 2.5.3.4. Historica r improveo l d data ...... 2 3 .

3. DATA BASE FORMULATION ...... 33

3.1. Statu characteristicd an s f reliabilito s y data base Memben si r States ...... 3 3 . 3.2. Component failure description ...... 6 5 . 3.3. Modes of data collection ...... 60 3.4. Structure and organization for data collection ...... 69 3.5. Quality assurance (QA) in data collection, validation and screening ...... 79 3.6. Characteristic f computeo s r system r datfo sa transmissio storagd nan e ...... 1 8 . 3.7. Potential application date th a f baseo s s ...... 2 9 . Componene 3.8Th . t Event Data Bank (CEDE Europeae th f o ) n Reliability Data System (ERDS) ...... 4 9 . 3.9. Current problem areas ...... 5 9 .

. 4 DATA MANAGEMEN ANALYSID TAN S ...... 7 9 .

4.1. Computerized data base management systems ...... 7 9 . 4.2. Data base security ...... 98 4.3. Statistical treatment to generate usable parameters ...... 99 4.3.1. Statistical treatmen f dato t a ...... 9 9 . 4.3.2. Assessment of running times and number of demands ...... 99 4.3.3. Bayesian data uptading ...... 100 4.3.4. Combining data from various sources ...... 1 10 . 4.4. Expert opinion ...... 3 10 . 4.4.1. Artificial intelligence applie dato dt a bases enquir treatmend yan f o t reliability parameters derived from expert judgement by making use of fuzzy setpossibilitd an s y theory ...... 3 10 . 4.4.2. Aggregatio f experno t opinion ...... 4 10 . 4.5. Reliability parameter data bases ...... 105 4.5.1. Informatio reliabilitn o n y data bases ...... 5 10 . 4.5.2. CEDE - Reliability Data Book (RDB) ...... 112 4.5.3. IAEA generic component reliability data base ...... 113 4.6. Special studie evaluato st e dat r initiatinafo g events (IE) ...... 4 11 . 4.7. Special studie evaluato t s e reliability datreliabilitd aan y indicators ...... 5 11 . 4.7.1. Generatio f safetno y system reliability indicators ...... 5 11 . 4.8. Data base network for reliability improvement ...... 117 4.9. Current problem areas ...... 121 4.9.1. barrier — The need for a communications network system ...... 121 4.9.2. Problem areas connecte f dgenerio wite hus c data bases ...... 2 12 . 4.9.3. Problem areas connected with combinatio f datno a sources ...... 3 12 .

5. FUTURE TRENDS ...... 125

REFERENCES ...... 7 12 .

APPENDIX: PAPERS PRESENTE MEETINE TH T DA G

Reliability data and safety evaluation of nuclear power plants — Status and trends in the German Democratic Republic ...... 131 /. Rumpf, J. Sydow Present status of the nuclear power reliability data bank in Japan ...... 139 OhtaK. Development of FREEDOM/CREDO for LMFBR PSA ...... 155 Nakai,R. Setoguchi,K. Yasuda,H. H.E. Knee Reliability data source Pake th sn i sNuclea r Power Plant ...... 5 16 . Hollô,E. TôthJ. FOREWORD

Reliability dctta play n importana s t rol Nuclean i e r Power Plant safety d avaan i lability.

n planI t design reliability data art- use o evaluatt d e safetth e y implications of various redundancy strategies. En ploint operation reliability dottd arc needed for the evaludtion of maintenance schedules, allowable outage o optimi/t time d an s e test intervals.

Other use f realiabilito s y data include: root caus d failuran e e trend «•analysis, common cause failure analysis, plant performance indicators ctnd optimisatio f sparo n e parts inventory f particulaO . f o r e importancus e th s i e reliability data in probabilistic safety assessments.

cleas Ii t r tha e establishmenth t maintenance th d an ta reliabilit f o e y data bank base n specifio d P operationa P N c l experience requires considerable commitment froorganisatioe th m n managin worke th g . Experience shows, however, that benefits clearly compensate for the costs involved, particularly e considerion f e multiplth s e collectee th use f o s dP safet datWP d n i an ay availability analysis.

A studiesPS n i Clearly e suitable b , us o thei t r f dat i e ,fo er aar collection should be orgctni^ed in a way which meets the needs of the PSA analyst. This implies that a close liaison between the people who are responsible for the collection of data and the PSA analysts should be established. "I he combined experience of the Agency's member countries in the various aspect datf o s a collection, analysi d retrievaan s l represent sa muc h richer sourc f dateo a than that which coul e provide b dy singl an y b de country.

Tn orde o ensurt r e that this wealt a f experienc o h, of e mad b e eus n ca e Technical Committee Meetin s convene e wa g1AC th Viennan Ay i b d 5 Februar1- , y generae Th 1988.l objectiv meetine o compildisseminato t th t s f d o ewa g an e e ongoing word experiencan k e with reliability data sources including aspectf o s data collection, analysi d retrievalan s . This Technical Document, prepare e participantth y b d o meetingth n i s , highlights the issues discussed during the meeting. The document reviews, e informatiobaseth n o d n availabl e grouth f participantsn po i e e th , experience in Member States and identifies areas where further work is needed,

EDITORIAL NOTE

In preparing this material for the press, staff of the International Atomic Energy Agency have mounted and paginated the original manuscripts as submitted by the authors and given some attention to the presentation. The views expressed papers,the statementsin the general the made and style adoptedthe are responsibility namedthe of authors. Tfie necessarilyviewsnot do reflect governmentsthosethe of Memberofthe States organizationsor under whose auspices manuscriptsthe were produced. The use in this book of particular designations of countries or territories does not imply any judgement publisher,the legalby the IAEA,to the status as of such countries territories,or of their authorities and institutions or of the delimitation of their boundaries. The mention specificof companies theirof or products brandor names does implynot any endorsement or recommendation on the part of the IAEA. Authors are themselves responsible for obtaining the necessary permission to reproduce copyright material from other sources. Reliability data acquisition in CEGB nuclear power stations (abstract only) ...... 181 C. Wells Some problems with collection f reliabilito , analysie us d y an sdat a ...... 3 18 . J. Kuble PACS Programm Projece— r analysifo t f componento s systemd an s f nucleao s r plants ...... 9 18 . Curcuruto,S. GrimaldiG. IAEA's experienc compilinn ei ga 'generi c component reliability data base' ...... 3 19 . B. Tomic, L. Lederman Development of reliability and the particular requirements of probabilistic risk analyses...... 207 T. Meslin Characteristics and use of the Component Event Data Bank ...... 215 A. Besi Evaluation of reliability data sources in China ...... 241 X.Y. Chen DATBASE: A code for the handling of reliability data sources in PS A studies ...... 247 F.J. Souto, R.A. Cano Methods for combining plant specific operating experience data with data from other nuclear power plant PRA/PSn i s A studies ...... 5 25 . Lehtinen,E. Pulkkinen,U. KuhakosklK. Data specialization for reliability studies — An application to diesel units ...... 269 FeliziaE. A review of initiating events selection and frequencies for PSA studies ...... 283 D. Ilberg

Lis f Participanto t s ...... 3 30 . EXECUTIVE SUMMARY

1 o compile and to disseminate on-going work and experience with reliability data sources, including aspects of data collection analysis and retrieval a Technica, l Committee Meetin s convene e wa gIAE n Viennath i A y b d , 5 Februar1- y 1988.

This technical document, prepare e grouth f participanty po b d e th n i s meeting, reviews ,e informatio baseth n o d n availabl e groupth e o t th e, experience in Member States and identifies areas where further work is needed.

Chapter 2 reviews the role of reliability data in plant safety and availability. It also identifies major issues in data collection, evaluation and utilisation. Among these issues the incompleteness and inconsistency of data e factorth , s affecting failure data, datf o ae validatious e th d an n generi d planan c t specific dat e addressedaar .

n ChapteI e experiencth r3 f somo e e countrie establishinn i s d an g operating data bases is compiled in the form of tables. Both event data bases d reliabilitan y parameters data base e addressedar s .

The following aspects were compiled:

- status and general characteristics of data bases main information items provided - modes of data collection manpower and computer resources in data collection - of data manipulation potential application of the data banks

A full section of this chapter is devoted to the Component Event Data Bank (CEDB) of the JRC Tspra managed European Reliability Data System.

In addition, the chapter contains a detailed description of information collectee tb o n adequata r fo d e failure characterizatio safetn i e yus d nan analysis. Quality assurance aspect datn i s a collection, validatiod an n screenin e alsar g o addressed. l\lew date* collectors can benefit from the experience gotinod during data collection and data base formation in other countries, 1 hört Fore, common Is on 1 the experience availabl d potentiaan e l pitfall e givenar s .

Chapter 4 addresses and analysis Once the data base is established special attention should be given to the computeri/ed data base management system in order to choose the most appropriate one for each particular application. Information found in data bases must be procosvd using appropriate statistical techniques selected in accordance with the characteristic date d requirementth aan f o s analysise th f o s .

A number of data bases containing component, re] iabi 1 à t_y parameters are availabl e opeth n n i literaturee . They usually differ with regar o sixet d , of detail and the ultimate source of data. The comparison of main characteristics of representative data sources is also found in Chapter 4. Special attentio devotes e Reliabiliti nth o t d y Date a th Boo o f CM)t o k d Ban IAEA compilatio f generio n c component reliability data.

The data for rare events (some initiating events are usually of that kind) usually cannot be collected From plant operational experience. Special studies use o assest d s that kin f dat o e dpresented aar .

Tnfonnation «about events can be used to generate system reliability indicators. Reliability indicators which condense a large amount of information about the system operation into a few quantitative parameters is discussed.

Finally, the participants in the 1CM identified aspects which deserve special attention by those involved in collecting and using of reliability data. Among other e somar s e remarks about historical qualit f datao y , operating times needed to derive parameters, root causes of failures, importance and cost oF data collection efforts, manpower requirements and need r internationafo s l cooperatio d standardisationan n .

10 1. INTRODUCTION

Reliability data plays an important, role in Nuclear Power Plant safety and availability.

Tri plant design reliability dat e use ar ao evaluat t d e safetth e y implication f variouo s s redundancy strategies plann E . t operation reliability e evaluatio date needeth ar ar fo d f maintenanco n e schedules, allowable outage o optimist time d an s e test intervals.

Other uses of reachability data include, root cause and failure trend analysis, common cause failure analysis, plant performance indicators and optimisation of spare parts inventory. Of particular importance is the use of reliability data in probabilistic safety oissessrnents.

s cleai t rI thae establishmenth t maintenance th d an a treliabilit f o e y data bank base n specifio d c I\SPP operational experience requires considerable commitment from the organisation managing the work. Experience shows, however, that benefits clearly compensate for the costs involved, particularly e considerion f e multiplth s e ecollecte th use f o s d dat I\IPIn i a safetd an y J availability analysis.

Data can be derived from generic or plant specific information. for use in Probabilistic Safety Assessment (PSA), data is needed for the frequencie f initiatino s g events differene e rateth th ,f o s t component failure modes, common cause failure rates, repair times, unavailabilities due to tests arid for preventive maintenance and human error probabilities.

Specific field data collection campaigns, generic published information, laboratory testing, expert opinion d abnormaan , l event data from operational experience are the most common sources of data.

Available data is, however, often of limited use in PSA studies because whicn i e dat y th ha wa have th e f beeo n collected. Frequently evente ar s recorded without providing any information concerning the time over which the data have been collected or the number of demands which have been made during this time. Other shortcomings in available data sources are the Jack of sufficient detail concerning the event or operating conditions and the lack of consisten d welan t l specified definitions, including component boundaries,

11 operating environment, design specificatio d availablan n e information o n failure or root cause.

A studiePS n i Clearly se suitabl e b thei us o t r datf ri e ,fo e aar collection should be organized in a way which meets the needs of the PSA analyst. This implies that a close liaison between the people who are responsible for the collection of data and the PSA analysts should be established, "Iho combined experience of the* Agency's member countries in the various aspecb f dato s a collection, analysi d retrievaan s l represent a mucs h richer sourc f dato e a than that which coul e provide b dy singl an y b de country.

n ordeI o ensurrt e that this wealta f experienc, o h of made e b us en ca e Technical Committee Meetin s convene e wa gIAL Viennan th i Ay b dFebruarS l- , y 1988e generaTh , l objectiv meetine o compildisseminato t th t s f d o ewa g an e e ongoing word experiencan k e with reliability data sources including aspectf o s data collection, analysis and retrieval.

This Technical Document, prepared by the participants in the meeting, highlights the issues discussed during the meeting. The document reviews, based on the information available in the group of participants, the experience in Member States and identifies areas where further work is needed.

12 2. ROLE OF RELIABILITY DATA

Reliability data plays an important role in Nuclear Power Plant (I\IPP)> availabilit d safetyan y establishmene Th . e maintenancth d an ta f o e reliability data bank base n specifio d c |\IPP operational experience requires considerable commitment from the organ i /a t ion managing the work. Experience shows, however, that benefits clearly compensat e costth sr fo einvolved , particularly if one considers the multiple uses of the data associated with WPP design and operation.

Assessment

Safety assessmen n generai t d probaban l stii iJ c safety assessment (PBA) in particular provide important insights to be considered in connection with e desigth d operatioan n f nucleao n r piants,

Three different level f PSfe defineo se literature ar tth n i d . ThusA PS , may be focused on plant analysis and in calculating the frequency of core y damagealsma ot T addres. e physicath s l phenomena leadin o uncontrollet g d radioactive release and its associated probability or the risk of harm or e generainjurth o t yl public,

This document is restricted to the first of these objectives (leveJ } PS A) ,

n normaI l operatio e planth e abovtf o nth non ef o econdition s woule b d reached. Then onl e ca experienceyb y e planth f ti d operates beyon desigs it d n limits. The plant can be placed beyond design if it is subject to accidents r operationao l transients t controlle,no thavarioue e th ar t y b ds controd an l safety systems.

In order to calculate or assess the probability of the above conditions the analyst must determin e frequencth e f occurrenco y f accideno e t initiating events, together with the unavailability of the appropriate safety systems. This can only be done if the appropriate data on initiating events and component failures are known.

"I he application for which PSA has been used most widely in the past is identification of design or operational weaknesses having an impact on the core damage frequency. Evaluation of the dominant accident sequences, and

13 system faiJures oind human error n identifca s y relatively weak poinls thatf i , improved, would most effectively reduc e expecteth e d core damage frequency.

In order to niako most, use out of the probabilistic safety assessment, it has to be continuously updated. Therefore, operational experience must be monitored to ensure that the various assumptions used in the- analysis are not vioi rilled.

f specifio e Thus e c operational f utmosdato s i a t importance, because l.he examinatio f suco n h dat n highlighca a t those areas where safety needs further consideration fts a result of the safety review, the resources for safety improvements can then be allocated more effectively.

Probabilistic Safety Assessment methodology provide a sver y important systematic means of predicting new accident scenarios. These scenarios can be extracted either fron a tPSA f ,availablei y constructinb r o , g dedicated event and fault trees for specific accident sequences. This information can be used in operator trainine variouth o o aJert t gsm accidenhi t t scenarios. Additionally e use b o identif t dy ma t i ,y weak e knowledgpointth e n th i s f o e plant personne]

tor this subject e concep th applicabls ,a Jivini f A o t PS g d an e useful. Ihis form of training necessitates an updating process for in-plant data collection and analysis to periodically revise the plant specific accident scenarios user traininfo d g base n in-plano d t event experienco t d an e provide information require o modift d y both emergenc d normaan y l proceduref o s operation.

2.? Uses of reliability data in WPP Design

Several options might be available to achieve a specified function at the desig ne plant stagdesignee th Ih f ,o e r must conside e structurth r f o e the systems, the choice of materials, the reliability of the available options, quality assurance programme, etc. Reliability dat e useo aar t d evaluat e reliabilitth e e variou r th eac fo f yo hs design options. This information enables the to judge which of the option should be adopted, taking into accoun a tcost-berie t fi analysi d thereforan s e enabling him to realise a more rational and economic design.

14 t valuat ion of design option imply in the spef i f i cat ion of d i ff front. lewels of redundancy and diversity.

ft genera] procédure to specify redundancy and diversity levels includes'

i) specify the possible different system structures; ii) perform reliability analysis for each defined system structure usin e samth ge dat t inputse a ; iii) evaluate the dependencies and common mode aspects for the different redundancy and diversity levels (including consideration f diversito s d separation)an y ; iv) compare and evaluate the results for the various system structures.

The identification of specific aspects of the level of redundancy considers that:

) a redundanc e establisheb n ca y n differeno d t level achievo t s a e given safety goal; b) the logic of redundancy is not unique (e.g. parallel, voting logic); therefore various option se studied b hav o t e , e effectivenesth ) e redundancc th f o s dependens i y e th n o t operational (i.e. whether passiv r activo e e trains <*re used) mode e reliabilitth n e individuao s wela th s a lf o y l trains.

e identificatio1h e diversitth f no y level involves analysie th f o s effect: of s

a) functionally diverse systems/components, e.g. for reactor protectio d shut--downan n , decay heat removal; b) technically diverse systems/components, e.g. for different power (steam or electrical) supply units; c) manufacturing diversity, i.e the components manufactured by different companies.

Tn conclusion for the identification of the appropriate redundancy and diversity levels reliability dat e needear a d beyon e simplth d e component failure rates, i.e. common mode failure, data d huma,an n e alsar s o required. It should be noted that the groat variety of possible design option n increasca s e substantiall amoune th y f efforo t t neede o complett d e this task.

15 reliabilit" of e Us yP Operatio 3 datNP 2, n i a n

f reliabilito e us e Th yP operatio NP dat e characterizen b i a n ca n n i d three general areas namely: Operational Management, Safety Management and Operator Training.

2,1.1 Operati onal Management

In the framework of reliability analysis for operational management generall o typetw yf informatioo s e neededar n :

(i) a description of operational procedures, and a description of the different operational modes tha te considere b nee o e analysist d th n i d , and (ii) reliability data as input for the analysis,

e Schedulec n 2,3.1.ifna V o Ü ]t s 1

Specifically o evaluatt , e plant maintenance schedulea n o s probabilistic basis the following analytical steps should be performed: a) define the calendar period to be considered. Basically it can be categorized as refuelling period, i e. several weeks per year, operational period, i.e. about one year, e campaignon , i.e e continuou.on s operational period plus subsequent refuelling period (normally one year for PWRs), several campaigns, i.e. several year r refuelino s g period,

) b determin differene th e t maintenance schedulese b whic n ca h considered as possible options. Typically long term schedules (for several campaigns e desirable)ar maintenancA , e schedule should include all plant systems, subsystems arid complex maintenance activities.

c) Obtain the input reliability data required. For maintenance scheduling three type f dat o se needed aar : failure data; repair and recovery data; and test induced failure data (i.e. errors occuring before or during test which render the system unavailable after the test).

16 d) calcule the equipment/system reliability or unavai labi 1 ity for different maintenance policieimpacs it n pland o t an s t safety.

) e compar resultse th e d deriv an ,e economi th e ce wortth f ho different policies considered in the analysis.

It should be noted that in the course of the analysis, special attention must be paid to maintenance activities, failures caused by the maintenance actionse specifith o t s wel a ,cs a lprocedure s user botfo d h technica d economian l c evaluation f Testo n _ io lnterv_alt sa i im 2.3,1.t sOp 2

r optimisatioFo f teso n t interval e followinth s g procedur e useb dn ca e (together with the information listed): a) definition of time period considered. Basically it can be: one test cycle (i.e. one stand-by period plus test period) one operational campaign of the plant (i.e. several test cycles).

b) collection of input information for reliability analysis. The information involves: test procedure description (i.e. frequency of testing of each traia redundan f o n t system, shift period within train tests); reliability data for stand-by period,

c) calculation of unavailability of components/systems considering different test frequencies;

d) consideration of their impact on the probability of occurence of dominan t set cu n PSAti s ,

(e) evaluation and interpretation of results.

The unavailability of a component/system is subject to two opposite effecte testh tf i sfrequenc changeds i y .

1. In case of more frequent testing the contribution from stand-by latent failures decreases, 2 the contribution to system unavailabilities due to testing and from test caused failures increases.

17 A time depend ont rel iabi li ty analysis based on the minimum cut set of the system is normally performed to determine the minimum time averaged system unavailability. This is important when the system has c*n important impact on plant safet d availabilityan y .

It, mus e emphasi/eb t d thae optimisatioth t n described above involves only technical aspects. Tn practice for the selection of the actual test frequency other aspects, suc s availabla h e manpowe d economiran c also need to be considered.

2.3. ] .3 Outage T i mes

When a failure or an abnormality of a safety system is detected by the activities, the system goes into a repair. Technical specifications (Operating Rule U.K.n i s ) restrict outage time f theso s e systems to prevent unacceptable increase in the risk. If longer outage times e requiredar e planth , t mus e shutdownb t . PSft produce e dominanth s t minimal cutsets which lea o cort d e damage. These cutsets indicat e importancth e f o e the safety systems and of the various components. If contribution of outage a syste f o s smali m r negligibleo l allowable th , e outag e eincreaseb timn ca e d if required argues i t I de outage , o repair th t that affec f no e i t sdu o d st significantl e availabilitth y e variouth f o ys safety systems, repaire b n ca s carried out during plant operation. Repair times are more controllable than the failure data. Therefore, operating experienc f e useo b e dn on ca onle s a y the ingredients in estimating or planning repair times for a certain determinatioe th e user b equipment fo dn e permissibl ca th A f o nPS . e outage time of the system or components. Reliability data used normally in PSfl are neede r thifo ds application. Appropriate safety criteria mus e useb to t d specify acceptable risk levels, against which outage times can be judged

2.3.1.4 SpareJPar t s

e repaiTh r a functiotime e spare th ar s ef o npar t inventor t sitea y . Storage spacprovisioe d budgeth an e r fo tf spar o n e parts are, however, conditions to be considered. Actual component reliability data, allowable outage times, data on accessibility of components, costs and available, repair time d estimatean s d time neede o obtait d n replacement e partsb n ca , use optimizo t d e inventoreth f sparo y e parts.

18 2.3.1.4 A vai Labil ity of Piant

Availability of the plant has an impact, on both its economics and its safety.

Reliability data of various plant systems can be used as performance indicator f plano s t safety n thiT .s framework A resultPS , s particularle th y importanc f safeto e y systeme toteth dn i s core damage f mosfrequenco e tb n ca y use,

2.3.? Safety Management

2,3.2.:! Backfitting and/or Design .Improvements

The U.S.WRC has conducted a program riouned " Integrated Plant. Safety Assessment, Systemati valuatioF c f nthio Program"m s ai progra o e t Th s . wa m review some older plants with respect to the more recent regulations imposed w plants a ne result s e A .th ,n o backfilling issue d desigan s n improvements were identified. However, before imposing corrective actions to be taken by the utilities, a PSA was performed to evaluate the relative risk impact of the proposed changes or improvements. The program included the development of the fault-tree e relevanth r fo st system pending improvemen r backfittingo t . Actual failure data was used for the quantification of fault trees.

2.3.2.? Accident Management

Reliability data are also used in the area of accident management. Reliability analysi e use b o providd PSAt dn an s ca s e guidelinee th o t s operators. The accident sequences must be reviewed to specify appropriate operator actions, as well as to identify safety features which can be used in acciden o stot t s pmanagementi accidenm ai e Th t . propagatio o mitigatt d an n e consequences of accidents.

tmergency preparedness should take into consideration the human ability to cope with procedures under situation stressof s . Therefore, human reliability analysis, as well as ergonomie aspects should be considered.

The reliability data needed for this task are those normally used in e humath PSAnd an reliabilit, y dat conditionn i a f stresso s .

19 2 .4 Reliabi^lity_ Data Requirements

2.4,1 In i t_i_a± ina_ Events

e selectioth r Fo d frequencan n y evaluatio f initiatino n g event 's)I (I s, two type f dato s a source e generallar s y required: ) a Event dat actuaa- l occurrence WPPn i s s suc s thosa h e reporten i d lERs

b) Failure data - generic or plant-specific failure data for evaluation of low frequency initiating events.

The main source needed is the event data from the operating experience of NPPs. Ideally, any occurrences in a nuclear plant should be analyzed with respect to a periodically updated master list of initiating events, in order to determine whether it is an event that can be classified as an "old" type already identified in the master list, or whether a "new" type of event has occurred, which should then open a new category in this master list.

An example of a list of IE1 s that developed over several years and is frequently used in the last years is the FPR3-NP 2?30 list of 41 PWR Ibs and 37 BWR TEs. All LERs in the IMRC file up to the end of 1983 have been put into the above categories. This list covers anticipated transients only. In a number of recent PSAs this list was augmented to include other sources of initiating events based on additional LER and other considerations. Thus, it can be seen that at this time the PSA analyst does t havno wela e l agreed maste s wherr LERlE l lise include al ef ar s o t a n o d periodical basise . th prioe Suc r th a hrfo liss a desirabls i te us r fo e selectio d determinatioan n e relativelth f o n y frequent Its.

In ordee usefu b masteE a prior I o s rt e a l th ,r list should includn a e estimat e frequencth f o e f eaco . yThi IE h s estimate coule e baseth b d n o d data accumulate nationan i d r internationao l l event data n bankso d an , published PSAs,

The low frequency (rare) events do not occur frequently enough to be established from the experience with LERs, In these cases engineering judgemen uses r theii t fo d r selection a specia d an , l analysis (fault-trer eo other methods) is performed to determine their frequency. An example is the interfacing LOCA, In this case the location of the break and its size are

20 A analysisPS importan e th r . tIRfo I t sHowever w availablfe e th , e jusar en a t indicatio f theo n - possibilit f suco yn intiatina h g e frequenceventth d an ,f o y this even r differenfo t t break si^e d locatioan s n e needseparatelb o t s y assessed.

A common master list for selectjon of low frequency Its for PSA does t existno . Rather, different PSAs generate thei n ]istow r s base n previouo d s studies and plant specific Lb'Rs, There is a need for a master list also for the low frequency (rare) initiating events for future PSAs. nomination from this master lis f thoso t e event t relevan no a particula s e r b whic fo ty ma h r plant should the a e doncasb n y n casb eo e basis d thoroughlan , y documented

It is recommended that master list for [Es and their expected (generic) frequenc e categori/atioy th shoul n i e preparee b d us r f operatinfo o dn g e startinth experience e b go t poinA studyd PS n choosinan , i t r .fo K T g

Z.4.li e Datur Fa 2a

n ordeI o undertakrt e variouth e s reliability calculation e analysth s t requires the following information: (i) mechanism of failures, (ii) failure modes and (iii) failure rates.

Firs e analysth t t must e decidmechanisth n o e f failureo m e b o t s considered, such as whether they are demand-dependent or t i me-dependent, whether they are random or dependent on each other. Second, he needs the failure data separated int a osufficientl y fine selectio f failuro n e modes. Additionally, numerical failure data must be characterised either by their or values and uncertainty, or by their distributions. The failure data at the component level is required for most applications, system or subsystem data may be useful in some of the applications discussed in section 2.2.

2.4,3 Testing

Numerical calculatio f reliabilito n y parameters e depenth n o d operational mode of the components/systems; i.e. different data are needed if continuously operating component r stand-bo s y component e analysedar s .

21 hrom Ihr» point of view of the analysis, the stand-by components can be classi f ied as •

repairable corit J nuousl y monitored, repairable periodically tested, r noi'o i repairable,

lo calculate reliability parameters, i.e. averaged or time- dependent unavailability of periodically tested components, the following input data are required :

failure data (, unavaiJabiJity per demand) repair data (repair Lime) information on testing policy and efficiency (including test induced failure data).

Information on testing policy and efficiency involves the following parameters :

a) frequency of testing, b) duration of test period, including further repairs (if any) c) failure detection efficiency during tests; i.e. the probability that the failure mode in question will be identified during the test, ) d test caused failure probability, i.e. probabilit f failureo y s e testine causeb whicth n y b ca dhg procedure, (incl. non restoration after test) ) e test override probability; i.e. probabilit f takino y e th g component under test back to operation in case an actual demand occu. rs

The data (a) and (b) can be extracted from actual operational procedures, while data (c) to (e) can be deduced from operational statistics (from the ). This kind of data is in general not readily available. e opposinth o t ge Du effectabove th ef o sfactors a ,tes t frequency optimisation can be performed as mentioned in Section 2.3.1.2,

rn practic e safet th mos f yo t system r safety-relateso d systeme ar s periodically tested according to a predetermined time schedule. All trains of

22 redundant systems have to be tested, and both the test period and the lest stagger have to bo considered and taken into account in the analysis of the« redundant system.

2.4.4 Rcpai r and Recovery Delta

2.4.4.1 Repair limes

Repair time is the time needed to repair a system or component, which has failed during the operation of the plant. Ft should be noted thai the repair time is not necessarily equal to the time during whir h the system is unavailable due to a failure since repairs do not always start at the time of e detectioth e failureth f o n . Furthermore repairs mus e followeb t y testinb d g to ensure thae systeth t s functionini m g again withi technicas it n l speci fixations requi renient s .

Since the repair time can contribute appreciably to the total time

during whic e systeth h s unavailablei m e repth ,(! t jr tim e mus e determineb t d an d controlled, There is a general need to calculate the maximum allowable repair timea mor n eo s sophisticated basis. Probabilistic safety criterie b n ca a use o specift d e maximuth y m timr maintenancfo e r repairo e f componento s d an s systems during plant operation.

o calculatT e allowable repair times e followinth , g informatios i n necessary :

a) meantime to failure ) b meantim deteco t e t failure — c) meantime to repair d) meantime of test.

Plant operating experience including manpower available for maintenance and availability of spare parts is needed and should be used to complement above information.

Recovery Data

The more recent PSfts (such as Oconeo PRfl) do not conclude with a list f plano t dominant accident sequence e resultin applt th bu sn o y g dominant sequences a set of recovery probabilities. This can significantly change the

23 resultJny hierarch f donunario y t sequences These recovery probabilities manifest tho probability of operator corrective actions to mitigate the accident sequence the plant may experience. The recovery probabilities are derive demergence baseth n o d y procedure e plan th d correlat an tf o s o theit e r effectiveness and operator training in their use.

The determination of recovery data is riot yet well established. There i a neesr dat fo d a that will helanalyse th p chooso t t e recovery probabilities based on the factors presented above as weJl as other additional factors. Further discussio f thio n s data woul e covereb d n studiei d f humao s n reliability data,

b , ? Issuej _ n Dato s a Collection,, tyaluation .and Utilisation

Some issue n dato s a collectio ne detaileevaluatioe ar th e n us i dd an n following sections

2. 5. 1 Data Collect!on 2,5.1.] Avai la_bi li._ty_/Incompletenes .Datf o s a

For Reliability Analysis and PSA required data are compiled from generic sources, plant specific statistics, and engineering judgement.

Generic data have been published in various report in different f suco e hcountrie us generi e h 1 cs data involve a numbes f problemro s which include : the limited types of components involved and unknown assumptions; the inconsistencies between various published generic data banks; (Section 2.5.1.2) the difficulty in application of generic data to some specific components (Section 2.5.3,1)

Plant specific statistic e availablar s r plantfo e s which have been i n operatio r lonfo n g periods. Eve n thii n s case difficulties still exist, namely : o extract w e informatioho th t n neede r reliabilitfo d y analysis frow datra m a sources, which very often doet e includno sth l al e parameters of the required data in existing data collection systems o avoiT . d this proble t recommendei m d tha a treliabilit y

24 analyst shoul o involve b de developmen th n i w datd ra af o t collection system for a new plant from the earliest stages, d plant ol e curren r th s fo t form d methodsan s shoul e reviseb d d an d extended by reliability analysts.

Data based on engineering judgement very often imply data suggested by one person. Collective opinion and suggestion of an experienced team composed f boto h operational staf d roaliabilitfan y analyst e preferrear s d (see Section 2.5,1.5 and 4.3).

2 . 1 " . j. Inconsistenc 2 f Dato y a

Since the raw data are usually collected from many different plants on several sites, the data collected can include inconsistencies. Frequently encountered problems are listed below: Inconsistent definitio f componento n r systemso s , especialln i y the definition of the system boundary and interface points; - Inconsistency of the component boundary, e.g. interface to the control system, the power supply, and the lubrication system. Therefore boundare th , f eaco y h component e clearlneedb o t s y defined in order to avoid overlaps or omissions. Inconsistent definition of failure. For example, a component success/failure criterion depends on the failure mode and failure severity in the system analysis. Failure due to an inapplicable failure mode or incipient failure should not be considered. Inconsistent definition of operational data, including the number f demando s estimate e operatinth d an d g times. These shoule b d assigned for each failure mode separately. For example, the failure rate of "failure to run" should be calculated on the basis operationae th f o l time t tha f bu ,"externao t l leakage" shoule b d calculated either on the basis of the time the component or system is under fluid t pressuravailable f no thi i s e basii s, th or e n so , calendathe of r time.

2.5.1,3 Statistics and Uncertaint i es

The following statistical problems are also frequently encountered: Assumptions used in the calculation of statistical parameters must e welb l documente d kep an mindn i t d when drawing conclusionse Th .

25 assumptions mus e includeb t n Reliabiliti d y AnalysiA PS r o s reports. Uncertainties are sometimes mi sinterpretfH . Ihey arc» sometimes mistakenly believed to express objective stochastic variations of given parameter s However, because of the lack of sufficient statistical informatio nt necessaril no thi s i s . Iherso a y s i e large amoun f subjectivito t e specificatioth n i y f uncertaintieo n s People with operational as well as statistical experience should be invoived in the collection, évaluation and use of reliability data. Computer n statisticai s l analysi e usefular s t mus bu e ,useb t d cautiously n understandinA . e statistic th e variou f th o g d san s assumption f moso s ti s importanc n manipulatioi e f datao n .

4 . 1 . Randqm/Depende3 ' . 2 nt Failure s

In the design of complex, highly reliable systems the designer and the safety analyst must work together to decide how many trains will be necessary to achieve the required reliability.

As it is generally recogni?ed that complex, multipie -train systems can e affecteb y hiddeb d n dependencies, ways mus e devisedesignee b t th y b d d an r e analysth r dealinfo t g with them. Generally, they loor guidancfo k y b e examining operational experience with systems of similar complexity. However, operationa t alwaylno dat e sar a collectey whicwa a h n makei d s sucn a h examination fruitful. Therefore, it is recornmendable that, whenever possible, reliability data clearly indicate which ones are truly random and which failure e relatedar s .

2 . "b . 1 . 5 I n£LLne§r_iQ£L ^ydgement

Engineering judgemen s sometimei t s require o obtait d n reliability parameter r thosfo s e component r whict exist fo w sdatno ra ho ad . Engineering judgemen s necessari t l levelal n f handlino yso g reliability dat n boti a h Reliability Analysi d PSAan s ,

t coul I e judgemendangeroue th b d e us f eitheo o tt s r anonymous experts or well known experts with expertise which is irrelevant to the problem in question. It must be always ensured that it is known who the experts are,

26 who»e theiar t r creden e base th r theid wha tfo se Jaan ar tls r opiniod an n judgement. Tt must be remembered that because experts frequently have their influenced b_v their background and interactions with each other, thei t completelno r e advicb y yma e independent. fngineering judgement should be tested, as with any other source of reliability data, and not accepted uncri tically.

Engineering judgement should be provided by skilled engineers who have a considerable experienc designingn i e , constructin d operatinan g g n IMPPsi r o , related topics as well as in Reliability Analysis and PSA work.

Tt is also more advantageous to use engineering judgement to modify available data for similar application rather than to use it to produce new data for which no related is available.

i>.r.>,2 Data t valuation ? . '3 . ?.. 1 Sources of Re 1 iabi 1 i ty Data

There are many sources of reliability data that the analyst should consider. However, the various sources must not be used uncritically. The analyst must be aware of the advantages and of the limitations of the various sources.

Ihe available sources can bo broadly classified on by how the data were w specifiho obtaine a particulan o r cd fo an thede ar yr application. Classificatio e date datth th a a f y o havnaccordinwa e th bee o t ng obtaines i d shown in 2.5.2.1.-1. Classification of the data according to how specific they are is shown in Table 2 , fj . ? . 1 .--? . Which source of data should e useb d depend n specifio s c condition d requirementsan s .

27 Table 2.5,?,] -1 : Classification of data according to the way they have been obtained

t DATSOURCIH AF O t ADVAMIAGtS LIMIIAIIOWS

Operational data most appropriate full spectru f dato m a rarely available

Field tests influenc f variouo e s important operational parameters parameters can bo can be mi ssed ascertained

Laboratory testing failure mechanisms possible unrealistic and over- can be more easily simplified operating conditions identified; testing e accelerateb n ca d

Gener ic pub! i shed data conveniently primary source is not always information available; sometimes given and thus not open to endorsed by reputable e misleadingb scrutiny y ma e us ;; organisations applicability problems

Expert opinion sometimee s th thi s i s o misleadingb n ca ; credentials (engineering only source availabl e experteth f o s mus e knownb t ; judgement) must not be accepted uncritically

1ABLF 2.5.2,1-2: Classification in accordance to how specific the data are

SOURC F THFEO . DATA ADVAWrAGLS LIMJL1 A1IONS

n planow t specific data most appropriate not always available-

plant reference data providee th y b d t appropriatno e ar f i e vendor of the plant; vendors' assumptiond an s often checked an d experienc t reflecteno e ar e d validated in the operation of the plant

generic data most readily not always appropriate, must available be used cautiously and critically

28 2.t>.2.? Factors Affecting Failure Data

Reliablity data arc chardcteri/ed not only by stochastic features such as frequencies of random events. There are other factors arising from both environment d operationaan ^ l condition e systemse componentth th f f o o s .d an s

r appropriatFo f operationao e us e l experience dat n Reliabiliti a y necessars i t i AnalysiA o collect yPS d d evaluatan tan s a wide e rangf o e operational information e followinTh . g lis f typeo t f informatioo s gives i n n as a minimum of what should be t<*ken into consideration:

- e evendat d th timd transien an ef an t o e t sequence th s wela e s a l time froe beginninth me norma th f lo g operatio e componenth f o n t - operational state of the plant at the occurrence of the event operational state f systemo s s involve e transienth n i d t a wholuniinfluenc statthe as teven the e the of e on t of e evaluation of the influence of the event on nuclear safety causes of the event as well as their evaluation special technological system characterisation characteristic features of history of inspections, testing and repai f systemo r d componentan s s relatee eventh to t d other information on technology, operation and maintenance, such as e componenth f o e thtag e

2.5,2.3 Categorization of_initiating Events

To help in performing plant-speci fie PSAs, F.PKI (M) and WRC (l'a) supported studie o prepart s e generic list f initiatino s g events n thesT , e studies a list of 37 It categories for BWRs and 41 Ih categories for PWRs was recommended. The latter study reevaluated the IE categories and determined:

R listRW sd showan R a comparisosPW thae ) th (a t t f no o then o d y have similar detail in part of the categorization and mainly with respect to loss of condenser initiated events.

(b) categories PWR 38 and BWR 34 "cause unknown" are too broad in nature and should be detailed when the list of initiators would be revised.

29 Another of lack of sufficient, information for categori/at ion of initiating event can be found in a report (J6) which was basea <~ircuJotte n o d d questionnair l utilitieal o t e s operating WPPse h 1 . was not, defined weJJ enough to screen the correct initiating events. [he result was that 109 events were categori/ed as LOSP, while later studies (J7,J8) revealed that only hal f theo f m coul e correctlb d y categori/«'d s LOSa P events.

recommendes i t I d that categorizatiof o wouis e H us e mad b df y o b ne event descriptions that wilj well define eac K tha F hs categorize i t d an d selected for data collection and frequency evaluation. This would help to avoid misinterpretatio e eventsth f o n.

2 '). ^ Use of Data ?.'3,3.1 Generic vs. Specific

It is obvious that for plant studies plant specific data are desirable. The appropriate amount and quality of data for such studies will be only avaiJabJe if the plant has been operated for a long period arid systematic data collectio s beeha n n performed. Unfortunatel n mani y y caset i s is not so; therefore it will then be necessary to extract reliability informât ion from generic sources.

There are three main problems using generic data for plant specific studi^s: ) Generalita dataf o ymann I .y case generie th s c dat e derivear a d from plant specific experience d froan s m engineering judgement (see WASH-1400), so they are sometimes more specific than really generic. b) Combination of generic and plant specific data. This combination e donb n componenthao eo t s , sub-system r systeo , m level. Bayes theore n approaca s i m o thit h s problem. ) Interpretatioc f resultso n , from calculations basea combinatio n o d n of generic arid specific data. Results which have a relative nature, e.g. importance factors or ratios (risk reduction worth, risk achievement worth e les)ar s dependen n dato t a used an d e useb dn ca with greater confidence than absolute valueso l" , illustrat e dependencth e f resulto y n inpuo s t data, extensive sensitivity analysi e requiredar s .

30 2 r).l.? limitation of Data

s discusseA J variou , n Sectioi ? d , b . s ^ nsource iabl y t re i iJ f o s e availablar e analystth e analyso t eTh . t must recognise thae reliabilitth t y data cannot bo used universally and in aJ J c i rcumstancos. All data art- subject to certain limitations and these must be «Appreciated, rocognixod and understood,

o analys1h t must ensur s possiblea r e fa thao useh s e -data tth s a onJy withi e limitth n f theio s r validity. Sinc e rangeth e f validitieo s t no e ar s always given, the analyst must use his judgement whether the available data e appropriatar s applicatiohi r adjustmentf fo ei r o n e neededar s .

fis a minimum, the analyst should recognise that as the operating conditions become more extreme, the uncertainty associated with the generic data increasos.

3 Validatio. 3 . '3 . ? n

Most studies, especially those relate o lest d s common typef o s reactor e d firsplantth an s n ti syear f theio s r operation muse generius t c data to establish component parameters. In these cases the dotta have to be extracted from generic information, and f possible,i , froe referencth m e plant, to yield more realistic results.

Onc a estud s beeha yn completed e use b o validatw datt dy ne ,ma a r o e o updatt e study th en orde I .o carr t rt suc ou yh validation w datne s a confirme y operationab d l experienc r simulatoo e e wilus r l contribut o thit e s proces f validationo s .

e majoth e processinp f rIu th o n e objectivedat t e th se on a f o o gt s i s agreed method r datfo sa authenticatio d validationan n ; this provides increased confidenc e resultA studiesth PS n i f eo s . Data mus e validateb t n ordei do t r show how methods can be applied to problems of common interest and transferred into standardi/ed procedures.

31 2.1>.3.4 Historical or Improved Data

One of the common prob Jems with the use of the reliability data from the analysts poin decido t f vie o ts i we what reliability dat e shoulh a e us d when analysing future system s happen(a s analysin i se desig th t a sn stage).

Two approaches are possible, namely the use of data from historical database f dato r ao s reflecting technological progress. Ther e gooar ed argument r botfo s h approaches.

\ or example, the use of historical databases will indicate how well proven technology has been used, Such an approach will enable a direct comparison to be made with other based on the same or similar technological developments.

e otheth rn O hand technolog s advancedesignere ha yth d an do leard s n from past mistakes. Thus improvement n availabiliti s d reliablitan y f o y various component e expectedb d systemo t an s e .ar s These improvemene b n ca t taken into account and targets for improved reliability data can be used, provided that: ther evidencs i e e that ove e year th re reliabilit th s d an y availabilit f componento y d systeman s s have been improving, the observe d documentean d d improvements, rather than postulated (or hoped for) improvements, are cautiously taken into account when settin e targetth g r improvefo s d reliability data, targets from improved performance, reliabilit d availabilitan y e ar y challenging t realisticbu , .

These considerations provide an appropriate and legitimate framework for incorporating technological progress. However, it cannot be over-emphasise w importanho d above th t e conditions aret appl no f the I .yo d y e targetth anf r varioui dsfo s improvements become divorced from realitye th , credibilit e wholth ef o yapproac s losti h .

32 3. DATA BASE FORMULATION

3 . 1 Status arid Characteristics of Reliab_i_ii_tj/ Data _Base_s_ in__Mernber States

A general review of some of the data bases in Member States has been undertaken wito objectivestw h , namely:

to give general information on the nature, the structure and the contendifferene th f o t t data bases.

to help in defining the specifications of new data bases.

Wot a]1 existing data bases are described here, because some countries wer t representedno e e participantTh . s tried, howevero t , reflect all the information known to them.

The main data bases described here are:

France: SRDF, SRDF--A, Evene J i F t Federal Republic of Germany: FUV - Worddeutschland E.V. German Democratic Republic: Reporting System Great Britain: PR/A, WUPLR Hungary: Generic data bank, Component reliability data bank Italy: SDE, SEME, PACS Japan: NSIS, FREEDOM - CRFDO Republic of Korea: PUMAS/W Spain: DACIUE, BD10, DACNFC D B , Sweden: A TV CEC-JRC ISPRA: ERDS/CEDB, ERDS/AORS

Fhe status of the different data bases is described in Tables 3-1.

33 T ABI t 3.1. Gen f rôti information

Country: Fh DURAI. REPUBLIC OF GLRMANY (I-RG)

Warne of the DCU R A Da ta Base

Operator/ N - V U l Manager

Type of Component failure information in OB

Main purpose f operationao rew vto l plant experience reliability parameter comparison actual with reference data

Date of start 1986

n principali l safetal , y component f I\IPo s P f o . No monitored cornp. s/uni t

n operatioi n Status

No. of records ~ '3000 (-end 198/)

l typeal s (seed Components/ event

R BW 2 . No Type d an s of units 3 PWR concerned

Conditionf o s confidential information release

34 TABLE 3.1, Gene roi] information (Continued)

Country: I- RAWCE

e h L Nam f o e SRDF ÏRDA F Event Ki le Data Base

Operator/ EdF/SPT EdF/SPF EdF/SPF Manager Opera Doptt. . Opérât.DGpL Opérât.Dept,

Typ f o e Component faiiure Component failure Fvents information in DB

Main purpose PSA maintenance PSA maintenance Operating Experience Analysis

Dat f Staro e t 1978 1984 1980

No, of monitored 600 > SOU cornp. s/unit

Status in operation in operation in operation

No. of records 1'iOO 2 '500 20,000 (end 1987)

Components/ Fleetro - Electronics Siqnifi cant Events mechanJ ica E vents

R PW x 130W M 0 1 R PW W M 0 90 x 4 3 . No Type d an s 4 x GCR f unito s R concernePW x 130W M 0 1 d 34 x 900 MW PWR 10 x 1300 MW PWR 2 x LMFBR

Conditions of e discusseb o t d to be discusse scussei d e b d o t information accordF fd o t , accordF Ed o t , accord, to KdF reJease rules rules ru ] e s

35 TABLF 3.1. GeneraJ informâtjon (Continued)

Country: German Democratic Republic (GDR)

Name of the ters ReporSy n g n ti Data Base

Manager/ National Boar n Atomio d c Safet d Radiatioan y n PruU-i lion Operator

Typ f o e Abnormal event f safeto s y related systems information in OB

Main purpose Safety evaluation of NPP

Date of s U r t- 19/6

in opcr ,-il ion

No. of 10000 components Monitored comp.s/un i l

Status In operation

No. of records Data accumulated in 60 reactor years (end 1987)

Components/ Events from off-normal reports Event e (WERMW 5 unit0 - 44 )- - sR PW . No Typ d an e f unito s concerned

Condition definet No df o s information release

36 "l ABI K 3.1. General i rif or mat i on (CoriUnued)

Country: GREAT BRLTAIN

e th Nam Planf o e t Reliability/Availabilit e NucleaTh y r Plant Puent Data Base D.B, - Safety Systems Recording System (NUPI: R) (PR/A)

Manager/ CH58 CRJB Operator Production Planning Department Mue3ear Coordination Group

Type of Component h vont reports information in DB

Main purpose To gather quantitative To collect and transmit informatio n availabilito n y informatio n safeto n y and reliability related events

Date of start January 1988 for safety March 198*5 system reliability

Wo. of Of the of 500 dpend ing on Not relevant e complexitmonitoreth f plando y t comp,s/unit)

Status At pilot scheme stage Fully operational, but evolving

No, of records ^ero '300 event reports, (end 1987) (growing by 5 per year)

Components/ Safety related components in Fvents of safety significance Events systems

GEGl Al B Magno . Wo Type xd witan s h s cooleconcretga l dAl ereactor K U n i s of units pressure vessels, and all CEGB (40 reactors), with significant concerned AGRs 4 unit1 : n totai s l events from other countries

decidet ye Condition t dNo f o s Confidential availablet bu , * otheo t r utilities wita h information release need to know

^controlled dissemination

37 IftBU 3.J. n (Continuedtu Genera.Jo m r fo n i l )

Country : HUNtirtRY

Warne of 11 3 Ceneric D,B. Load Réduction Incident <*nd Component Datei Hase Report System Safety Related Reliabilty D.B. Event Report

Operator/ Frist, For P PAKNP S >P PftKS I\1PP PAKS Manager F 1er, trical Power (VI1KI)

Type of [ni tiatinq plant urioivai 1. events Failure data formatjoin n event di <>tr i but J on of periodicalJ y in DB frequency tested comp. Component rellabiy t li data

purpose P°>A (Rft) Analysif o s - e ReporReliabilitth o t t y plant authority data for PSfl availabili ty - Feedback to the operation

Date of Start 3987 1983 J98J 1988

Wo. of (100) 400 WO monitored component comp,s/unj t categor Jes (30)" initiating events

Status From 1989 f o d en e th o T e extendeb o t d this year planned by generic to extend to common mode other components and human err or data

Components/ l typeal s Periodically events f componento s tested components only

Type d an s rt/a 4x400 VVfcR 4x40R 0WE 4 x 400 f unito . sNo WER (PWR) concerned

38 lABLF 3.J Generotl in forme* t ion (Continued)

Country: L1ALY e th Nam f o e SDE SI MK PACS Data Bejse

Operator/ FNKI H\IHA/IHSP Manager

Type of Abnormal event Abnormal event Rp] it-ibility data ni f orrna L oDi n ni B opo r reporr L s t s on safet l atoc r yd f.ornpontirits and s_vs torns

Main purpose* BaickfitLJng Dackf jttinq and op«>r Uoickf i t Li ng. and operatioal ational s< design improvement, safety improve improvement, reliability parameter ment, design improvemenA t PS r fo design improvement

Date of Start J9/8 19/8 CAÜRSO 1989 J98'> 1RINO

Status operationaJ operational development

Nof recoro . d ?00<) Diesel generators (end 1907) reliabil y datit a from 197 o 1988t 7

components/ safety safety safety related events related events related events component d systeman s s

Types and No. BWR CAORSO BWR GAORSO BWR CAORSO of units PWR 1RJWO PWR 1RIWO concerned

Conditionf o s to be agreed to be agreed with information with ENFL FWhA/DISP (major release released to events reported to IspraC CfcJR C )d lAf- S an l\l1R AA r

39 TABU 3 1, Genercd information (Continued)

Country: JftPAN

Name of the rRhEDOM/CRHX) Data Base FBK Reliability Evaluation Data for Operation and Maintenance Centralized Reliability Data Organization

Manotger/ Power Reactor and Nuclear Fuel Development Corporation Operator Oak Ridge National Laboratory (U.S. DOP)

Typ f o e Component information in DB

Main purpose Collection, storage, maintenance d evaluatioan , f IMBRo n s components

Date of slart hRLEDOM (1985) at PNC CREDO (19/8) in the US

Nof o . 21.000 components Monitored comp,s/unit

Status in operation

No, of records 21.000 components 1. '300 events (end 1987)

Components/ liquid metal reactor specifi r relateo c d components Event

LMFBR3 d severa. an s No Type d l an s test facilities of units concerned

Condition f o s limited (availabl d U.S E an users DO .C ePN )onlr fo y information Release

40 TABLE 3.1. General information (Continued)

Country: JAPAN

Warne of Lhe The Nuclear Power Safety Information Data Base

Manager/ Nuclear Power Safety Information Research Center Operator

. Incident1 d failurean s Typ f o e s file informatio . Operatio2 n n fiJe in DB 3. Power station data . Annua4 l Data 5. Monthly Data 6. Data on individual energy loss 7. Shutdown data 8. Damage data 9. Overseas information

Main purpose 1. Maintenance of nuclear power safety control information. 2. Analysis and evaluation of information on off-normal events 3. Reliability evaluation of plant systems and facilities, 4. Evaluation of the plant characteristics. "3. Compilatio e pertinenth f o n t informatioe b o nt distributed to local municipalities.

Dat f staro e t Oct. 1984 accumulatet bu , pase d 0 th years2 tdat r fo a.

No. of n/a Monitored comp.s/unit

Status in operation

Nof recordo . s 1000 events (end 1987)

Components/ at present events or off-normal report only Event

Type and Wo, 1 gas reactor, 33 LWRs (PWRs, BWRs) f unito s concerned

Conditions of not yet defined information release

41 "IABL. Gêner«* J , 3 L ] inform n o (Continued i »t )

Country: REPUBI 1C OF KORFA

Warne of the PUMAS/N Da tot Base

Manager/ 2 Plan1, Kort. no i Operator Nuclear Generation Dept.

Type of ]. Incidents and fai Jures file information ?.. Operation file, . Mate3 r if* J Dat aB O n i 4 . Ou tage Da ta 5. Equipment History Data 6. Event Data 7. efficiency Data 8. Radiation Protection Data

Main purpose Management,

Dat f staro e t Jun6 8 e

No. of 10000 components Monitored comp. sAinit

Status En operation

No. of records r>000 (end 1987) Components/ all important equipment and events Event

(PWR2 0 MWe )60 . ,No e (CANDU1 Typd MW an e0 )60 e 6 (PWRoMW f 0 unit90 ) s concerned

Conditions of not yet decided information release

42 1 ABI F 3.1, Genen*] information (Continued)

Country:

Warne of the DACI\IE-Bf)[0 DACWE-BDC-ChDB Data Base

Operator/Manager UI\irSA/lECI\IA10M UNESA/lhCWATOM/JRC Tspra

Type of information Event; Component in DB

Main purpose PS A Reliability parameter fo r Reporting to CSW I'SA Data interchange

Dat f staro e t March 1989 March 1989

Wo, of monitored 500 cornp, s/uni t

No. of Record; (end 1987)

Status Development Development

Components/Events Events Me chemical and t]ectromechanical

Types & no. of units G<.;R - GCR concerned

6 PWR West inghouse 6 PWR Westinghouse 1 PWR KWU U KW R PW 1 F G R BW 2 E G R HW ?

Conditions of e us Utilitie W CS d an s ODB-rules information release only

43 TABLE-, 3.1, General information (Continued)

Country: SWH)t~W

Name of the ATV Data Base

Operator/ Vattenfall Manager

Typ f o e Component failure information in D8

Main purpose Reliability parameter A PS r fo Plant availability

Date of start J976

No. of 7600 monitored comp.s/unit n operatioI n Status

94263 Wo, of records records

Components/ Components event

Types and No. 12 LWR(PWR-fBWR) of units ? Finnish BWR concerned

Conditions of e discusseTb o d information with utility release

44 TABLF 3.1. General infornidLion (Continued)

Country: VARIOUS

e th Warn f o e F RDS - ( If DB LRÜS - AORS Data Base

Operator/ CFIC JRC-T

Typ f o e Component failure safety significant event information in DB

Main purpose Reliability parameters PSA for PSA Backfi tting Plant availability Design improvement Operational safety Operational safety Maintenance evaluation

Date of start 1984 1984

lovane r t tNo 0 60 Nof o , monitored comp.s/unit

n operatioT n operatioT n Statun s

5200 comp.s, 30.000 94263 Nof recordo . s 4200 fail. events (end 1987) records (incl. USA I LR)

Components/ mechanical and Plant abnormal events event electro-mechanical comp,s

Types and Wo. 10 LWR(PWR+I3WR) LWR(PWR

Conditions e discusseb o T d discussee b o T d f informao - d an witC JR h with JRC and tion release data suppliers data suppliers

45 fts far a<> t ho component reliability datot bases are concerned, a table with tho main information given by tho data banks has been prepared.

Tt includes: tho typo of component <> monitored; e maith n ongi noering arid operating characteristics recorded; tho operating tables (number of demands, operating time's,. ).

The results are presented in Tables 1.7,

The complot ones s of information regarding the engineering characteristics of each component monitore s indicatei d e datth an i based , including-

opérât ing conditions; ; e / i s materials; manufacturer; preventive mcdntt'nance (maintenance practice); pr«'Cciutions and limits of use.

The operating data include e tableth n i sd (i.e exposure time, operating r numbe/o tim d f domands)o ran e e essentiaar , obtaininr Fo l g correct reliability parameters Ihis informaitio e obtaineb n ca n d from evaluatior o n from observation.

In the first case, it is possible to estimate the operational data on the basis of the plant operation or from tho number of expected periodical tests. This can load to an underestimation of the exposure times or of the number of demands.

The second cas preferreds i e . Severa l e use b meano observe t dn ca s directl operatine th y e numbeg th time f demandsd ro an s e besth ; t being counters installed on actuators, A very efficient solution is to use the plant programmed to record practically hour by hour the operating times and the number of demands on the components monitored.

46 labié 3 ? Main in form«* t. ion Herns provided

Country DERAK : L RFPUBLC (iLRMANK CO Y (f-RU)

NAME OF HIE DA1A BASH DCURA

Types of Components

Pump .V Val M fi y Breakers V Transformers V Heat Exchangers _v Bus Boirs y Tanks y Motors (filectric) y Turbe in y AJ ternators y Enqino (Diesels) v Batter i PS y

Electrons sc

Enq , Charac . futur«( n ' pJans)

n Natur f Huio e d n Pressure and Température n Other

Manufacturer

Periodical Tests Description

n Wof Demando . s

n Operation Time Unavaiiabil ity Tirnp Due to Preventive assessed Mai ritenance Number of Test or Preventive Maintenance outside DE) Acts

47 labJ ? Mai3. en informatio terni n s provided (Continued)

Country: FRANCF

NAME OF THF. DATA BASF MROF SRDF A

Types of Components

Pump .V Valve V Breakers y Transformers y Heat f xchangors y Bus Bars y Tanks y Motors (electric) y Turbine y Alternators y t'ngine (Diesels) y Battors ie y

Flectronics

Eng. Char cic y Natur f Fluio e d y Pressur d Températuran e e y Other

Manufacturer

Periodical Tests Description

No. of Demands observed no Operation Time observed operates permanently Unavailability Time Due to Preventive not direct yes Maintenance Numbe f Tesro r Preventivo t e Maintenanc t direcno te t direcno t Acts

48 Tabl 2 mai3. e n information items provided (Continued)

Country: GRHAT URil'AIW

Plant Reliability/Availability NAME OK THE DATA BASE Data Bank

Type f Componento s s Pump y Valve y Breakers y frans For mars y Heat Exchangers y Tanks y Motors (electric) y Turbine y Alternators ri lingino (Diesels) y Batteries y Bus Bars y

Electronics

Eng , Charac . y Matur f Fluio e d y Pressur d Temperaturan e e y

Manufacturer

Periodical Tests Description

Wof Demando . s (only for some component Operation Time y Unavailabilit o yPreventivt Timo Du e e y Maintenance Number of Test or Preventive Maintenance Acts

49 Tabl 2 Mai3. e n information items provided (Continued)

Country: LTflLY

IMME OF fi IE DATA BA^3E SUE GKME

Types of ComporionLs Pump y y Valve Breakers y y Transformers Her»! Exchangers y y F «as nk y y Motors (electric) y y Turbine y* y* Me n Generato*i r yX y* Engine (Diesels) y y s e i Bar e 1t y y Bus Bars y y ronit EC lP cs y y

Eng . Chc*rc»c .

Si/e nXK r,xx IMaLuro oF Fluid ,,xx n XX Pressure cjnd Température r,xx r,XX

Manufacturer r,xx rixx

Per'iodicc»! Tests Description r,xx r,xx

f Demando . I\lo s rixx nxx Operation Time „XX nx-x- Uridvöiiläbi 1 ity Time Due to Preventive n n Maintenance Numbe f Toso r r Preventivo t e Maintenance nMK nxx Acts

if safety related part e affectear s s consequentiaa d l event ailabi n othei é r plant documentation

50 Table 2 Mai3. ? n information items provided (Continued)

Country: JAPAN

NAME OF fHE DATA BASE M l-R 1DO WSIS

Types of ComponcnLs d (safetta i le e r y components only)

Pump y Valve V Breakers y "I ransformers y Hua t F_x changar s y Tanks y Motors (electric) .y Turbine y Al ternators y Eriqiric (Diesels) y Batteries y Bus Bars y tranicc Ela s y

lïrig. Charcic. Si/e y Matur f Fluio e d y Pros surd Temperaturan e e y

Manufacturer

Periodical Tests Description

No. of Demands y n Oparation FLine; V n Unavailability Time Due to Preventive y n Maintenance Number of Test or Preventive Maintenance Acts

51 Table 3.2 Main information items provided (Continued)

Country: REPUBLI F KOREO C A

NAME OF HIE DATA BASE PUMAS/W

Type f Componento s s Pump y Valve y Breakers y Tran merr sfo s y Heat Exchangers y Tanks y Motors (electric) y Turbine y Alternators y Engine (Diesels) y Batteries y Bus Bars y Electronics y

Eng. Charac.

Size y Weit u re of Fluid V Pressure and TcMTiperaturo y

Manufacturer

Periodical Tests Description

Wof Demando . s n Operation Time n Uriavailabi lity Time Due to Preventive n Maintenance Numbe f leso r r Preventii/o t o Maintenance Acts

52 Table 3.2 Main information items provided (Continued)

Country: SPA CM

NAME OF THE DATA BASH L)ACI\IE--6PC -CKOB

Type f Componento s s

Pump V Val vß y Breakers y Transformers y Heat Exchangers y Tanks y Motors (electric) y Turbine y Alternators n Engine (Diesels) y Batteries y Bus Bars n

Electronics

Eng. Charac. Sire y Nature of Fluid y Pressure and Température y

Manufacturer

Periodical Tests Description

Wo, of Demands observed* Operation Time observed, Unavailability Time Due to Preventive n Maintenance Numbe f Tesro r Preventivo t e Maintenance Acts

*as much as possible

53 Table 3,2 Main J n for ruction Herns provided (Continued)

CounLrv: JMDKAI

NAMtf OF IMF DATA BASE ATV

Types of Components

Pump y y Value Breakers y Transformers y Heat Exchauyers y Tanks y Motors (ele.ctri<) y y Turbine y nator Alte rs Fngine (Diesels) y y _ Batteries y s BarBu s

LlectroniL s y

. Cha q rEn 01 r.,

Si?o y Wotturo of M nid y y Pressur emporoitur1 d an e e

Manufotcturer

Periodit.a] Tests Description

y Nof Demano , ds Opération Time y Uridva o JPreventivt laby lim y e it i1 Du e e Maintenance! Numbe f leso r r Preventivo t e Maintenancy e Acts

54 3.2 Main information items provided (ConLinued)

Country: VARIOUS

E DATH I NAMA F BASO E F a OB

Typos of Components

Pump V Valve y Breakers y Transformers y Heat Exchangers y Bus Bars y Tanks v Motors (electric) y Turbine v Alternators y Engine (Diesels) y Batteries y

Electron]es

Chara. g En c. y Mature of Fluid V Pressure and Température y

Manufacturer t avano i JabJe

Periodical lests Description Planned for future

Nof Demando , s V Operation Time y Unavailabilit o Preventivyt Tim e Du e e Maintenance Not observed Number of Test or Preventive Maintenance no prow, maint Acts recorded(X)

Average values, estimated by operators, will ble given (Future improvements)

55 7 3. Componen Juri fa te description

n thiI s sertio e c informâbe i th n*s tn Jnecessaro n adequata r fo y e failure descriptio listes i n d commente n an additiondI . e speciaon d th , l requirements for PBA use are specified.

Table- 3,3 correlates the information collected for failure description and its use, primarily from the point of view of the safety analyst.

Table 3 3, Description of informal ion to be collected d relatio an e safetth o yt n analysie us s

FA H URE ION

date of failure detection for studying time to failure

date of start of the repair for assessing average Lime before repair starts date of restart to operation for assessing actual repair (enf tagging-ouo d e th f o t time component)

duration of the failed (or duration of the degraded unavailable) state performance or loss of (from the failure occurrence performance detection until the restart) r assessinfo g total downtime (unavailability f componen)o t

duratio f repaio n r give usefua s l indication of technical aspects of repair (usefur fo l maintenance purpose) manpower for repair, mainly for the optimization f maintenanco radiation e exposurteam activite y

plant statu t failura s e evaluatio e impacth f tno detection (e.g. in operation, of the function loss or during maintenance or degradation on the plant shut-dow r refuellingfo n ) safety. Failures during shutdowe ar n t usuallno y taken into account for PSA purpose

56 Tabl 3 (Continued3, e )

FAUUFn Dt SCRIPT LOW cont'd INItRE.Sl

plant status durine th g impac n p]ano t t safety unavailability time system status at failure provide data for calculating detection (e.g e trai.on : n conditional probabilitier o s operatioo traitw na n i n for state transition system, components sharing probabilities in Markov models load)

effec y whicb t e failurth h s i e observed (failure mode in the CFDB classification)

) FailureI s occurrs while component is operating

a) degree of suddenness r characterisinfo g whethee th r of the component failure component failure initiatio s prompi n t [The componens i t or gradua] (in the latter case suddenly unavailable credit can be given sometimes or the unavailability for emergency intervention) deferred.e b n ca ]

* immediate (e.g. catastrophic failure)

* progressive (e.g. incipient failure)

b) degree of seriousness it is correlated to the degradatioe th f (o f no previous (a) and at the same the component function) leve f importanco l e e.g.: -complete loss -partial loss -no consequence on the function (minor imperfect- ion or the repair can be made while maintaining the component available)

57 Table 3,3, (Continued)

FftJUJRL INSCRIPTION r.ont'd IN1KRFS1

13) Failures occurrs on d ernand ( i n c l ud i ng testing)

* complete failure to start * it starts, but with in some cast'a t s no thi s i s a certain delar o y catastrophic failur d shoulan e d e requireth d not be considered as such in performance is nob emergencies. reached

descriptio e failurth f o ne important according to the mechanism (failure modn i e degre e f detaio eth f o l SRDF classification which modelline g th use n i d a failur s ha e mode matrin i x IJSA: it also helps in identi- accordance with each component fyin e possibilitth g f o y type) recovery actions e desTh .- criptor e failurth f o se mechanism are useful inform- ation item o understant s d whas reallha t y occurred wite componenth h t

causes of fai]ure (immediate from the "cause" and root causes) analyst understands i t i f i s spontaneous (random) failure Tt reveals (identifies) (component hardware fault) the root cause r causeo y misoperatiob d n e failurth f o e (design, or by external influence. manufacturing, installation, operator error or maintenance error, abnormal service/ environment conditions; faiJure induce y externab d l influence).

parts failed: f primaro s ii t y importance maintenance th r fo e aspects it characterize e partth s s of the component involved in the failure and in repair

effect of the comp. failure it is of interest mainly for e e plantsysteth th n n o ;mo operational safety evaluations, it belongr o o t s it can provide some useful n otheo r system/components informatio casn i nf o e _E?£e_ndencies_ .between _faj._l_ures common cause failure it allow r assessinfo s g probabilities of identification (related common cause failures failures)

58 . (Continued3 3 )

rftllURt OF.SCRIP1JLON (cont'd) TWltRtSl

corrective actions taken it describes the repair action r planneo d (incl. human and it indicates the need factors) for modifications

administrative actions taken it specifie e repaith s r schedule; consequences on plant operation schedulen o , failure reportin o safett g y authority, Important to the plant management.

numbe f demande ro tim th e t a s to calculate reliability e failurth f o e parameters for pcirtJcular components. it is also used to verify the adequacy of constant unavailability on demand model, to study variation f failuro e probability n demano d component ageing, etc.

number of opérât ing hours at o calculatt e reliability the time of the failure parameters for particular components. it is used to verify the adequacy of a constant failure rate model, to study failure roite time dependency, component ageing, etc.

Free (uncoded) description* it helps the data collector to proposed minimum information: better describe what occurred, plan d systean t m status e safet usefus th ii t r yfo l description of what happened, analys o examinewh t d an s direct causes, consequences possibly discards some failuret sse froe th m before making the statistics.

reference to similar events in the same plant or similar plants

a list of keywords is convenient for easy retrievals

59 3.3 Modes of Data Col lection

Several modes of data collection can be used according to the objective e resourceth d an s s availabl date th a o b base e manager.

Table 4 indicat3. s e modeth ef dato s a collectio varioun i n s Member States. Some options have been include e lis s th possibla t n i d e modes despite their present limited use.

Table 3,A Modes of data collection in several Data Bases

Country: FFDE'RAL RKPUBI 1C OF GERMANY (hRG)

DATA BASE DCURA

MODES OF DATA COU HM ION

Technician(s n sit) o charg n i e f dato e a colJection

Maintenance tech. in addition to their current activities

Operation tech addition i . o theit n r current activities

Automatic Data Collection (plant computers, maint. comp.)

Specialists (PSA analysts) send on site for limited mission

Investigations by

Others (to be specified) TUV specialist in charg f L.Ao e.

60 Table 3.4 Modes of data collection in several Data Bases (Continued)

Country: FRANCE

DATA BASF SRDF JîRUF A Fvont File

MODUS OF DATA COI IX M TON

Technician(s n sit) o chargn i e f dato e a col lection

Maintenance tech. in addition to current activities

Operation tech. in addition to thoir current activities

Automatic Data Collection (plant computers n studo , y l\14 type maint, cornp.) plants

Specialists (PSA analysts) send on site for for PÜA limited mission project

Investigation y questionnaireb s s

Others (to be specified)

61 labi 4 Mod 3, f édctt o os a collectio n sever«*i n ! Dotta ü&ses (Corit inued)

Country: BKIÏAIN

DATA P loin t Re-liability/ WUPER Avai iabi Jity D.Ei. Safety System nonrs o^ DATA

1>chnician(s) on sit« in charqe of col]oction

Maintenance tech n «additioi . o th^it n r current activities

Operation tech. in addition to their current ac ti \i i ties

Automatic Data Collection (plant computers, (in the future) m«t i nt. comp. )

Specialists (PRA

Fnvestigations by questionnaires e specifiedOtherb o (t s ) x x (ÜpeciaJist information engineer)

62 Tabl 4 Mode3. e f dato sl lor co .a Lio n severai n l Doit* tëa:>e<> (Couti nuod)

Country: HUNGARY

DATA BASH

W TO MODEd Lt F DATSO I CO A

Fechnician(s) on site in charge of doita col lection

Maintenance tech n additioi . o theit n r current activities

Operation tech, in addition to their current activities

Automatic Data Collection (plant computers, mai nt. comp.)

Specialists (PRA analysts) sen n sito r d fo e limited mission

Investigations by questionnaires

specifiede Otherfo o (t s )

63 Table 3 4 Modes of data collection in several Data Erases (Continued)

Country: ITALY

DATA BASK SUE SkME

MODKS OF DATA COLLUJl TON

- fechnician(s n sit )o chargn i e f dato e a col lection

Maintenance tech. in addition to their x - current activities

Operation tech. in addition to their x - current activities

Automatic Data Collection (plant computers, mai nt comp.)

Specialists (PRA analysts) send on site for - x limited mission

Investigation y questionnaireb s s e specifiedOtherb o (t s ) reported e bth y utility d revisean d

64

Iah U i 4 Mod«'» of d<'wor

;

1 1 c

Coi.inl.rv: JAPAN

DAÏA BA'.f DOM i in i

W IO I C ('ÖA l I l l HA f MODO S I

i t .s n Pü'wr-q i l ff.li n ">{ o )n an f" r o l J«'< t i 011

M. i i n t frii-trK, P l.pfh. in . iHHi f. ion l,o l^if_> i r ci.ir r PI 11 c-if t i w i t i f">

oi n Ml.ofhf; n additioi . ^ t o t n ne r ci it df l i v i l i <"•

.om.-il ic Ddla O»J Iff.I ion (pJotnt fornpulrrs, t f,oni) p

s (PRi - > Sp<'t l i Ä« C i .111.4]r Vfo T t°>e I ) i s son n o d J i in i t <'d rn i ss i on

rriv<_''>M

o '>pob ( o ififd(t ) By hoad office or sdft'ty dppoir'l.mont of ut,i l i t. i <-s

65 Tabl 4 Mode1, e f dato s a collectio n sever«*i n ] Data Hase0» (Continued)

Country: RLPUBK KORFO C IE A

DATA BAST PUMAS/W

MODFS OF DATA CO I I FU ION

Technician(s n sit)o charqn i eX (2/uni.t f dato e a ) collection

Maintenance tech. in addition to their current activities

Operation tech. in addition to their 4 computer specialists/unit current activities

Automatic Data Collection tormina!, automatic collection (plant computers maint, comp.) (plant network)

Specialists (PRA analysts) send 10 n sito r limitefo e d mission

Investigations by questionnaires

Others (to be specified)

66 Table 'Ü.A Modus of data collection in several Data Bases (Continued)

Country: SWfDFN

DATA BAStl A1V

MODI'S OK DATA CO I l H M TOW

Vochnician(s n sib)o chargn i e F dabo e a colloction

Maintenance tech n additioi . o theit n r current oictivities

Operation tech. in addition to their current activities

Automatic Data Collection (plant computers, mai nt. comp.)

Specialists (PRA analysts) send on site for periodically limited mission

Investigation y questionnaireb s s periodically e specifiedOtherb o (t s )

67

ôiblo 3 A Modes of date* <,<>\ Je* (.ion in soufre*] l)e>iti Heisos (Continued) t

Country: VARIOUS

iwsr cim -

MOWS Oh DATA COU H,'! ION

rechnician(s) on si he in ch^ryc of H a U* f, oJc(,I n tio

J ntoncince Loch, in addition to t.h^ir current wf. ti v i Li«is

Opération toch, in addition to Lh^ir o<-J t ,i v J t u « cur t n eo

Automatic Data r,oJ]or.tion (pJoint comput.o, s r t ri comi nu ) p.

ali-sts (PRÄ oiriciiyst'î) send on sit« for some JRC specialists preferred limited mission seuorcil d

y qnostionrioib s < r i

Others (to bo specified) as si steinte qiven for trotiniri«) in d

68 3 4 Str uc tur e arid Oryani/ation for Data Ko J lection

Data cojJerMon require1; cons iderable effort ah d i f forent levels. While e overalr th l.h,fo ey espont r i l datl i b a s i base typicall s witHo y a h

specified qroup of people ,:i t the headquar tor :> of the utility, the ultimate quality of the job is stronqly dépendent on the personnel actually collecting data

Th er onhaiicin fo prim m s ee i qualit rnon th q ha f f data o daily s i a y follof plano p u wt activities. compiisher Ihia n onl e fa s b ya perso y b d n well inteyrate e operaMnth n i d q tead ablan m e bot o e dotofailuret h th ft f o s cuinponents of interest and to record Lite information required.

Whil e deteftioth e f failureo ne donb n e ca ssolel y from maintenance work orders, reliability reports will require some additional information for whirh specific trainin f persoui'ieo q neededs i l . Dedicate a perso f r o d fo n this task is thus recommended.

rtn extremely important point to be aware of is the fart that any loss f informatioo nt detectewhicno s i hn sito d e will after-ward e verb s y difficult, if not impossible, to recover. That makes it almost essential to include a first level review by some plant staff member to ensure completeness of the records and to detect son«1 of the quality problems. 1 hi s can be accomplishe y Q.flb d . peopl n siteo e .

People at the headquarters should also provide some spot checkinq of the information wite maith hn purpos f rnaintainino e q consistency between different plants and to ensure that the objectives of the data base are beinq satisfie e actuath y lb d data supplied. Ihese people will normally reln o y computer verification of the information, and might also be able to cross check between even d componenan t t data banks.

Tables 3.b describes the manpower and computer resources allocated in some data bases.

69 ') '> Moiripowor and tomputor rosourcos u s öd in doit. «A coJJpr, t i on

I RKPUBF RA O (Countr C U 1 IHI y:

DA ABftsîl" E DCURA

MKAWS ASSOCiniFD WITH DATA co i unioi w

Mcxnpowor

On Silo

Compulors

Manpower 1 engineers t r,orpf>rmtA p l ouol CompuU-rs 3 «M PC

70 Tabl 5 Manpowe3. e d computean r r resources usen i d data collection (Continued)

Country : FRANCE

DATA BASF S R D F SRDF A venF i f t

MF.ANS ASSOCTAÏFD W LUI DATA COI I FCUOIU

Manpowe 2 tech./r b tech./4 0 unit2s units eng./b . 0 -I 4 units On Site

Computers Per son&J Computer Person^] r.omp. omp PC/AT lypc IBM PC type

Manpower 7 ong irifyr 0.'g > icn 5 s At corporate lovol Computers w cu r Mnf a i

71 labte 'i '> Manpower and r.omput or rosonrro', n<>od in dat(Con l Joo i nttodri co ant, I )

Country: CKJ-A1 BRllfHN

DATA Plant Rr«) inbi ] i by/rtw-nj ].-ibi l i t v DU Soif M y S y'5 torn

MF AIMS ASSOCIAIf I) W11H DA l A N IO 1 COMJ I I

1 (part ? nniltirno r fo s) ) 1 mo (pai t r t e t i OS n but with oissi sLan( <•

Cornpubfr Wo V()(J r r>l,nor diront Vf>U jnpnt planned o riTiiott o 'S yoars) ru.-i i n fr . une

Manpower At. corporate low*.] Crjmput er purpose rua j nf r tune

72 Tabl 1. > 3 e Manpowe d computean r r resources usen i d data collection (Continued)

Country: HUNHAKY

Dft 1 "A BANK Component Reliability D.B,

MCANS ASSOCIATKD WL1H DA1A COI I.OI LCC W

Manpower 1 pa r t -t i me t rig i n p o r o pp r dt o r s f * 13 i ng f o rrn On Site

Computers IBC networP M k

Manpower l part-time engineer At corporate level Computers

73 lab! o '). cj Manpower and comput.fr resources u s öd in n (Codato 11eri nuo o i nt c at , d)

Country: II AI Y

DATA BASE. r, m S FMK.

MEANS ASSOCIAU.D WITH DATA EiU O;U NCO

Manpower about 10 1 (integration of data) ed from utJ J i ty) On Site

Computers Moii

Manpower 1 (data revision) ] (data revision) At corporabe_ It'Vt'l Computers Motinf ramo Mc»J nf r'dtiuj EBM- PC

74 Table 3.5 Manpower and computer resources used in data collection (Continued)

Country: JAPAN

DATA BASF F KM DOM WPS L

a ASSOCEA1KD WITH DATA EC1IOI I CO W

Manpower More than 300 man months ) US C (unknowo PN th t r a fo n On Si be

Compute-r:> FACOM M380 at PI\IC

Manpower abou0 3 t At corporate_

Computers FACOMC M38PN t 0a

75 Tabl b Manpowe3. e d computeran r resources usen i d data coJJcction (Continued)

Country: RfPUBLIC OK KORtA

DATA BASE PUMAS/IU

MEANS ASSUCLAÏED Wilfl DATA COI I EC HOW

Manpower 10

On Site

Computers Westinqhouse H-8000 on site

Manpower At corporate level Computers

76 Table 3.5 Manpower and computer resources used in data collection (Continued)

Country. SWLDLN

DATA BASH AIV

MEANS ASSOCIAFFD WI1H DATA W LO I tC I I CO

Manpower i contact person/unit

On Site

CornpuLurs r rnte i e un \ r f rn.-n i t (UNISYS) IHM, VAX

Mai i power At corporate^ level i n puter o C s UWISYS

77 lôibJe 3 . cj Manpower and computer resource u 's öd in data collection (Continued)

Country VARIOUS

DA1A BfVU CH)B AORS

S ASSOCIAN K M WI1D A r- Al l HA D W F.CLO l 1 I CO

Manpower o t i S n O Compute> r•

l eng i not;r t 5 onginoer1, s 3 tof.hrn <, Jans H? tf'chi'i J ci 1,5 cowpuUir 5 compute0. r eriqint->tirs onyineer At corporate

Computer r> AMOAHl 470/V8

for day to-day ni

78 3 . 'j Quality Assurance (QA) in Datei Co J loc t ion, VaJ id«*tioii «und Screeniny

Qft is of utmost importance iri any data col Joe t ion system,

Ihe first stop Jn data collection is obviously to define clearly arid unambiguousl o collecteb y o t wha s i t d Detailed procedure' d rjootrlan s y s> t fl out forms should prevent incomplolness or misinterpretation of data, furthermore, people coJ Joe tiny data should continu«*! l v bo made aware of the importanc f theio e r word poriodicaJ.lan k v retrained,

Responsibi J ity and interfaces should aJso bo c!o<-ir!v dofincd and periodically confirmod. Verification of all colJoctod d,-,\la at plant lo\/ol should bo r ocomniondod when tho possibility still exists to revise data instead of rolyinq on memory. flt this stciqe data should bf> verified for cornpletoness d contonan t accordin o uioJt g J defined validation procedures lechniciann (a s assure qood data collection, but engineers should be involved in verification d vialidatioan n activities. Validation should mostl e basea b cleay n o dr view e activit e scopth th f o ef o ye fina concerneth lf o utilisatio d an d e th f o n data.

Knowledge of tho characteris tics of components and of their functions e plan ith d nin-fiel an t d experience help o avoit s d misinterpretatio f dato n a n validationi d an .

At corporate level an i ndepondont verification is r ecornritended, but only on a sample basis. At this level a background relioibility analysis and are nocoss

Validation would benefit an effective graphical representation and "trend and pattern" analysis, aimed at djscovorinq wrong, incoherent or incomplete reportin n somi g e

Data shoul e screeneb d t onlr consistencno dfo y d contentan y t alsbu , o r possiblfo e negative tendencie o allot s w prompt backfilling actions when necessary. Computers should be used in connection with automatic techniques in the processes of data verification and validation.

79 Data verification in t ho collection phase should bo employed mostly to chock that the coJJortod data are consistent, with t ho objectives of the data collection program cind analysis.

There ar e two main mechanisms for the verification of the data:

- Q.A. programme (so p foe.forohandtu ) cross-chock verification (carried out afterwards)

For the first mechanism, a written procedure should be specified in order to define the target and acceptance criteria. The reporting should be mandatory for everything that is required, with no optional items. This is neede o prevent d t minimum reporting becomin e normth g . Likewise, definitions o broas e shouldb t thae datno dth t a supplie s troublha r e decidin whicn i g h category to report Checklists 01 re- one means to enhance the quality of this phase. Periodic meetings between everyone involve n dati d a collectiod an n analysis are recommended in order to give everyone a clear idea of the overall work. Tt is very important that data suppliers interact on a regular basis wi t.h the data ba'>e managers or evert with the users, and make use of the data base themselves. Otherwise, thera tendenc s i e o lost y ee purpos sighth f o te of the work and ultimately there is iikeJy to be a reduction in the quality of the data supplied. Frequent retrainin l partieai f alss o gi s o necessary.

Mnally e planth , t personnel responsibl r collectin fo ew dat ra ae th g should ensure that they are free from ambiguities which could cause mi sunder stand ings.

for the second mechanism, if many failures are observed on one type of component performance th , f similaeo r component differenn i s t systems coule b d compared e performancth f I . similars i e e reportinth , confirmeds i g e th f I . performance of this component is different, it might be because of different condition f operatioo s e otheth rf o n system r alternativelyo ; e reportinth , g migh e incorrectb t r differeno , t procedures might have been used. Similarly verification could be made through comparison with generic data bases on the same component from other plants.

80 3.6 Characteristics of Computer Systems for Data Transmiss ion and Storage

According to the si?e of the utility and the objectives of the data base, severa le use b meano coJJecb t dn ca s o transmi t ,o stor t e d th ean t data. Two distinguished set-ups are:

Centralized organisation with computer networkd an , local organisâtJon

The more classical solution (and probably the more efficient) is the use of a mainframe computer at corporate level connected in a network with local microcomputer r filfo s e interrogatio e usersth y b n.

Tables 3.6 surnrnari/e means of data acquisition, transmission and storag s wel ea s mean a l f releaso s usere th f datn severao e i s o at l established data bases.

Tabl 6 Mean3. e f dato s a manipulation

Country: fhDfRAL REPUBF Q.RMAWO C I1 Y (I-KC)

DATA BASF DCURA

Data acquisition n PC-screeo n

Data transmission

Data storage IHM-PC Diskettes Tape

Data release to users Reports

Software used for data DCURA treatment and retrieval (dBase (II)

81 labi 6 Mean 3 é f dato s a riioinipuJoin io t

Country: 1-RftWCE

A BftSE SRDf «KDK ft Event

Data acquisition direc n o t direc n o t direcn o t Terminal

Delta transmission network network network

Data storaqe I~8M 3080 LBM 3080 LBM 3080 Mainframe Mai rif rarn7 S e DP J J Hu Mainframe

üatr a to users network network networ k and and and di skct tes di sket tos d j <>ke t tes

Software package for data F sofFd tf sofFdfEd - t soft treatmen d retrievaan t l d Obas d an Dbas d an Dbas 2 pL an ' e ? e

82 Table- 3,6 Means of data manipulation (Corit i nuod)

Country: UKKAT BKHAEW

DATA BA

Datan acquio t i is Forms Direct on screen

Data transmission post to computinq pr i «dit! J i no <. en t re, thon onto ir, tapo

Da l

Data release to users Network Network

Software packag r datfo ea treatment and retrieval

83 Tabl 6 Mean3. e f dato s a manipu n (Contio t la i nued)

Country: HUNGRY

DA1A BrtSE load Reduction Report Systems Component Re ] i abi l i ty D.H.

Data acquisition Load reduction report directly on computer; failure dat<* manuaJ Jy on written forms (computerisation in progress

Data transmission IHC networP M written i k n form

Data storage IHM PC streamer in written form

Data release to users in plant by IHM PC network; outside in written form

Software packag r datfo e a treatmen d retrievaan t l

84 labjo '}. 6 Moans of data ntotnj pu lai Jon (Conti nuod)

CountryY I A 1 1 :

DATA BASK SDK F M I S

Da Lot acqu J si t ion wr J 11 on f'orrn

Data transmission tapo.

Data stor PUJ i if r ariio Ma i nframo (OLivot.ti, Hitachi) Personal coruput.or IBM

Data r elf öiso to users Maynot, \<. tapo IMofwor k Iocal network \ NFft/DIGP ( j n si do oi/

Software packag r datfo e a c soflwarrtho d o IBM S1AJRS treatmen d retriouaan t J for so.qi.ion] a Li toxt soarc loi f s troat.tiirrit (l)ataniot )

85 Tabl 6 Moari3. e f dato s a manipulation (Continued)

Country: JftPAN

WPS [

Data acqui si t ion from u tjH t i os to MJII by writ ton reporte t d an s

Data transmission lorrninal c connectear s y b d toJcphoric linos

if disk, tapo, optical, disk

Data rc']«'cir)t' to on lino is officiai use only 1C and ML! E

used for d

86 Tabl 6 Mean3. e datf o s a manipulation (Continued)

Country: JAPAN

DATA BASK ^ KIÏ DOM

Data acquisition Written forms

Data t.r arisnin io s is Po'>truje (partiaJJy )

Datn storage fACOM M'M) W S (Japan U ( iM 1 O) IH )

Data releas o user t ey networ(b s k JisUnq r networo s k diskettes, listings)

Software user datfo da treatment and retrieval

87 loiblf> Mf'nin'< > f '' o 'dat i a manipulation (Cont inuod)

Countr K KOR O PUB W KC A 1 Iv

DAlfl BAfU

Dei'1 <* «icqui si t Wr J tt«^n forms

Data transmission At prest-nt, eace hon unis ha t computor

a storuye Westinghous 8000N e ? ,

Data roloaso to users Written reports and CRT

SoFtwaro us«'r datfo d a KKPCO soft trcoitnionl, oind rot r icv/ai

88 f duo t t.ci riiuin Jtitiou p j n (Oou Lnuedi )

Country: SPÄH

DA1A BASt DAOWK DACrvIK. WHO B DC

cif.qui si I ion wr~ i t ton f'orni'ï and wrillon forms ,-,md scr fous se r cens

di ')kot U"> rfi d j sl«'t modern modern

<> per*>oruac l oind .)Ri; computer

Datei release t.o user^ d i sket t,e<; oti id ne twor k ] i s t i i ig s

Software use r d--iFo d* r l personal computer personal cornputor

it rind ret r J e\/,;i l software softwar d ADABAan e S

89 Tabl 6 Moan3. e f o dats a manipulation (ConUnited)

Country: SWH)FN

DATA BASF fllV

Data acqui s it. ion Direct on torminnJ CR1

Dot t. a transmission Network, tapc<>

Data UNISYS lJ90

Data releas o useret s Network, printouts, spor.iaJ topic report

Software packag datr fo ea S 110DM 0 treatment and retrival

90 Table 3.b Moans of doit,«* manipulation (Continued)

Countrv: VARIOUS

DATA BAS* < If IJB

Data acquisition o datTh a coJlecto e filleus n n i dca r forms or an informe»tic support (magnetic tape, diskette) to send data to JRC-Ispra

Data transmission 3RC computer network, tele- communication network, post, diskettes

Datei storciqe AMDAHI 4/0/V8 (IBM compatible) JRC-Cspra mainframe, running under OS/MVS, DBMS ADABAS (Software A.Ü.)

Data release to users b_v network, diskettes, printouts, etc ,

Software package for data treatment S with an enhanced version of arid retrieval ADASCRI PI (user-or j erited software from Software A.G.) - Other software developed by J.R.C.

91 j / Potential Applications of the Data Bases

1 ho importance of" data on reliability analysis has already been discusse n Chapte i t dthiA s. 2 rpoint shoul. il ,e emphab f do d e 1/e . shoon i it r e mosth t obi/ion d dironan s t t appjon ca f o bot.l'i l> i I, I' if component t^nd pvcnl. l)(,if.<-i

Banks i <> to prowidf t ho wr.f^sary mfin;> for informaMon <'xch tlie btiwis for a sound analysis oF Lhf observed maJ fünf, t ions and an (jfTccl. i u<_' of i informât j on .

'{ , / furU'KT oittJirioa some additional applications of data bases

Sorno app f.aJi t iono mainJar s f intereso y o utilitiest t , «;Lhers mainlo l y requJators, yenefaJ i ndi.ir> try or research orqani /a t ions Waste of time .sind r«'sourr,ps <,ouJd be avoided by cons idori nq various needs wh^n c-> tab] i shi nq da!a bas n additionE e . f.has tele , r, qenera i r:th ar 'i > t , J methodo Joqy use o r.oljer.t d t d assesan se nuclea th dat n i a r field coul e effectivelb d y use activitiesn i d - other thoin nuclear. In this respect, mutual exchanqe of data sources between e conventionath d an r oa lJ c fiejnu e d th could bring mutual benefits. Different design, manufactur i nq and operation aspects should be, however, properly considered e ()I-I)Bh 1 ., develope y JR

92 o >E -

0 0 a o LU Lu uj K fill £ *•* 1 1 H 1 1 1 1 o > x o + o-

< X X X

CD V) oo X X x + X oLJOuC

1/1 o X X X X a. M Z 2 à. E o 1 tS X X + 1— a Z ot ut c a 3 h- Z LU LU ZO + Z X X 0 o. Q o o __ 1 U. X X X 1 X X 0 ce LO

U. XXX Cfl Q X X 0 X X X x x cr VI

CD CD XXX Q X X 0 X X X + X LjJ O D CC LL Ul Q_ O o- +• X -z. Z O LJ X X X X x X X < UJ X O V) _l Q. Q. LJ X X X X ! X 1 1 1 X 1 1 x 10 co O LU c m x X W |2 X X 1 QQ

^ a O Q j— m s X X X z £ CJ

Z 0 0_ >_

X X X X X X X U. Q Lu

X X X X O x X +

a c « c ° u £ z M i e i CD a •a 1 i f 1 5 1 = 0

93 3 8 1 he Component. I went Date* EJank (CHW) of the I-uropean Reliabi J ity Data System (ERÜS)

One of the rno;>t widely known data bases containing component events is the Component Kvent Dat aC e Tspra s si/JR th Ran C Ft n kei .fF managee th y b d sense of the number of records and of the number of countries participating requires that one chapter of this document be devoted to Q DB only.

"Ihr Q DB is a centra Ii/ed bank, managed by the CH> JRC Ispra, coliecting operational data (failure reports, annual operating times/demands) f componento f IMIM'o s s opérâtin n varioui q s turopean countries e bank'h 1 . s main objectives are to supply data suitable for reliability/avaiiability evaluation e promotioth d an sf operationa o n l safety.

o ban1h k receives data either from national data basese , th suc s a h e VAIHMAHH/SRD thein th i d r, an foriginaAW M l format (and languager )o directly from some IMPPs (in the. CrDF) format).

Where necessary information is expressed and homogenized in a common structure (i.e CH)e .th B structure) throug a computeh r aided transcoding process and translated to a single language (Fnglish), 1 he main peculiar features of the bank are its classification scheme, data retrieval capabilitie n lino d e an sstöel tis i Coil processing programmese b e banh n 1 ca k. interrogate dinterna JRC bot by h l users, T.PthrougJRC . networkthe h by and , external users through national telecommunication networks.

f DecembeAo s r 1987 CKDe ,th B contains data from about '5200 components (well identifie y theib d r engineerin d operationaan g l characteristics), pertaining to 21 component types (mechanical and electromechanical equipment pieces) and *jj engineering systems, monitored for an average time of 5 years in 10 LWR units and in the steanv-water cycles of units of other reactor types and of conventional power units. These units are located in seven European countries (the number of components monitored in each unit is about 600). The faiJure events reporte aboue ar d t 4?00.

94 9 3. Current Problem Areas

Countries which have developed thej n datow r a bases have often addresse e probleth d n différeni m differenh t. i tP w H way I d t an s w ideaho f o s w datNo informatiosod u an benefi . o ca rolleb s o r t t rto s i fromne th experience already gained d avoi e an initia, th f somdo f repon o e lio t ti difficulties. IAEA assistance is desirable in co ordinating this activity. The problem r ever fo w sdat ne y a collector wii e différenb l o somt t e degree. Frt countrie n whici s h o therplann s n operatioi ei t t onlbu na plany t under construction, there is more time to gain informat)on and experience concerning data collection methods, computerisatio f dato n a collectio d storagean n , etc. After a systematic examination of international experience, the means (manpower, computer techniques, etc ) and structure of the future data b.-ml< e determinedb n ca r countrieFo . s with plant operation i s t witbu o nn h reliability data banks established there is not much time to plan concepts, to develo e computeth p r code d the an so star t n t collecting datae dath 1 a. collection might well be started before the data bank structure is fully defined, in which case it will be necessary to record manually every detail

that is available in order to leave open cil 1 options, 1 he information would the e include b ne dat th a n i band k retrospectively, whestructurs it n d beeha e n finalise n sucI hd cases data collectio developmene th e band th an nk f o t itself may qo in parallel.

e relativth r Afo se convenienc f continuino e n ongoina g t limitebu g d reliability data collection syste r startino m w morne ea g comprehensive one, the following remarks can be made:

s necessarii t o ensurt y e continuous monitorin e performancth f o g e of the equipment of a plant in order to control ageing problems and to monitor maintenance effectiveness arid the correct application of operating procedures;

for new plants the use of more sophisticated equipment technicalJy requires a more sophisticated reliability data acquisition system.

95 remarkable H i ff er ci \< os are often identified in t h«1 reliability r f mano o apparentlf o er pe y uory simila priioni n oq . t r Ihis requires thoronqb ana J y s i '> of .H! J I he factors thaï miqht influence such performance, thèse analyses drc qro

oriiponen< ^ c- r lo t Hoit- o ni.-ii tw bd'icn i difficultie e th , s <.ir t ensure th e fohere.rif.e .,in de hornoqenHal.th weeI f e ao o differenh th n<.<>y t n ei \\<<< Io . I t planls; and the conip J et eness of the dul.a c.olJeftion

o first1h , problee solveb n y qivJnmb ca d q t.he dal.a n collersito s er .Lo siitipJe and prer i sc < riter Ja to define fai Jures Jncreacïinq t.he u:>e of existing pi.int. foruput.ers used for in.-ii ntenance records, IcK^qinq out, <-uid process conlroJ are other ways to q i we the collector additif>nal means to catch failures. Hicour\:i< q «onl.acn i j t betwee nanalyst A s.-ifetPS r d Hal.o yan s * collectors on site, and or qani / i nq joint ruée t i rigs for the data collectors from each of the plants in order to exchange information and to discuss diffitulties and practices, .-ire additional means of ensuring coherence and homoqeri n i dat y t a e i collection

1 he se< oud problem can he handled by t.he same approach, but. in addition

96 4. DATA MANAGEMENT AND ANALYSIS

4 , J Computeri/ed Data Rase Management Systems

Reliability databases have a tendency to become very large after <* few years of reporting by several power stations at the < ornponent level, 1 hie si« of such databases demands t he* t state of the art software for information handlin e usedb g herI e example,ar e f databaseo s s whic w yeare onlfe ar h a sy old but which suffer from the considerable inefficiency of overnight batch processing for even the simplest enquiry, Ihis should be avoided in any new system, b_y giving thought at the design stage to system upgrades Interactive user friendly access is most desirabie

Another consideration is to build in flexibility and spare capacity at the design stage of the data base. The requirements usually change with time d evean n essential e over-lookeb item n e beginningca sth t a d systet f . m that cannot accommodate such contingencies wil le abandonedb hav o t e ; possibly with the loss of much useful and expensively obtained data, When computer network is being user inpu fo d dretrieva an t f datao l , message facilities between users at. different locations are very desirable,

Cn most cases, only part of the information contained in the event data base is needed in the calculation of the reliability parameters. The interface problem could be solved by assigning the same identification codes e correspondinth r fo g informatio o eventh n ti n date ath basn i s welS a e

e specifiFth n e utilisatioc th cas f e dato e th a f o basn e retrievad an l manipulation system in a Pfirt study, the minimum information required by it froe collecteth m d event data bas ee componen systeth e ar m t type e failurth , e e associateth mode d an , d informatio n componeno n t reliability a nex s A t . step, «mother computerised system can be used to generate the appropriate input for the specific PSA application which can be, for instance, the generatio f numericao n l value e user quantifyinb fo o dt s g basic e eventth n i s fault trees.

97 The database, be- it reliability or event type, needs to bo searched according to the requirernents of the users. User's requirement are difficult o includt n somi e e existing data han q systemsd n a Jprobles i los i f o st f bu ,i m modern user-friendly information software or the expert system interface is used. There are databases in existence which take a long time for the novice to learn how to use, and are cumbersome even for experts, and thus should be avoided,

2 4. Data Base Security

The first stage in ensuring the security of the data base is a clear definition of who can have access to the data, both within the organi/ation d outsidean , fven then e norr sucth ,fo m h access shoul e "reab d d onJy". Where there is a requirement for derived or altered data then this should be a dat f ao base us achievee e whicth separates y i b hd d froe primarth m y one, d unde an e controusere th rth .f o l

The methods needed to maintain the security of the data wiJJ cliffer depending on the data base support. An administrator of the data is an obvious requirement orden i , r tha a centralizet d responsibilit s clearli y y defined. The administrator should be responsible for:

avoiding unauthori/ed manipulation or inadvertent destruction of the data base; ensuring that data cannot physicall e losb yy suc b t h means a s fire, computer crash r otheo , r "hardware r huma"o n activityr To . this purpose at least one backup copy of the data file should be made and stored in a controlled area, as is normal computer practice; ensuring release of confidential data only to authorised people and organizations; bein e onle thath galloweon s yi t acceso t d e filr writingth s fo e .

r computerizeFo d data bases, password acceso t s date th n sa

98 Finally, because higth hf o ecost f settino ,d maintain an p u g a dat g !n a base it is advisable to avoid any unnecessary limitation of the "road only" e dat th y oxternab a o t s s JP , organisationau orden i s o maximist r e benefith e t to everyone, but taking into account, obviously, any sensitive commercial aspects d ensurinan , g proper utilisatio f releaseo n d data.

4 , 3 Statistical Treatment to Hcnerate Usable Parameters

4.3.1 Statistical Treatment of Data

Data Bases can provide users with a wide body of information on the resulte operatioth f o s f systemso n , component d piecan s e parts (parf o t components). This information mus e processeb t a suitabl n i d e manner before it can be used for different purposes such as PSA, special reliability studies, planning of maintenance activities, optimisation of plant features suc s avaa h r reliabilityo i Jaby t i i1 .

The treatment of data must be performed through the application of appropriate statistical! techniques However, these statistical techniques must be carefully selected and applied according to the characteristic of the dat e requirementa th acquire o t e ongoin d th an df o sg analysis.

Point and , test of hypothesis and techniques like discriminant function analysis and correlation analysis are mentione e fiel th f classica o dn i d l statistical approach. Bayesian approach (parametri d nonan c - parametric alss )i o applied despite some criticisms that have periodically arisen, concerning the practical applications of this statistical approach in deriving failure and reliability parameters,

4.3.2 Assessmen f Runnino t g Timeg d Numbe_an f Demandro s

In addition to the component failure events which are recorded in event data bases, other operational information like numbe f demando r d an s operational time is essentiell to derive usable reliability parameters.

In the absence of fully computerized mai ntenance records and/or process control computers, the running times of rotating components, or the number of starts experience y themb d e vergoins b i , yo t g labour intensiv r eveo e n sometimes impossible to acquire. Tn some instances it will be possible to

99 a significan n i fiN e tneede th par f o td informatiof o n y appb n io o »t t li algorithm o datth a o t bases , providing certain rule e obeyedar s .

f\ requirement t.o input, exposure1 time r runnino s J safetg d ö tJmo r y fo s system components would increase the task of l.h« data gatherers at the station n ordea f magnitudey o b rs . Thus wha needes i a tclea s i dr statement date e defaultth oath gathererf o tj optionsaJ f o sr instance Fo . a ,runnin g reactor implies tha a tlarg e proportio e componentth e f safeto nth n i sy systems otre in a clearly defined state, unless it is reported otherwise. These list f assumeo s d plant confiquratious should cove l likelal r y opor.itiny states, and the data collector at the station will need to be familiar with them.

The number of demands experienced by certain components are much more difficult to obtain, if not impossible, unless of course they are put in explicitly. Any number derived is likely to be an underestimate This problem is solved by having dedicated counters on selected components, or by recording demand n planto s , computer.

4.3.3 Bayosian Data Updating

1 he Bayesian approach can be used for deriving reliability parameter for systems, components or parts of components, Much reliability parameters coul e failurb d e rates, failur n demano e d probabilities, maintenancd an e , etcs e t .a r r i a p e r

Bayes1 theorem is used to derive an a posteriori of these parameters from an a priori probability distribution and related data which can be used as evidence (Ref, ?). The Bayesian approach can be applied in the so-called one stop methodology as well as in tho two step methodology (Réf. 3)(Ref, 4). The information from data bases can be use o assesa t priord e th si probability functio e likelihoo th s wel a ns a l d function. For example, parameters defining the reliability of systems or components pertaining to PSA of specific plant can be considered as a priori information. Plant specific data bases are also tho main source of data on failure behaviou f systemo r d componentan s . Information from different data e basesinformatioth r o , n derive y aggregatiob d f dato n a from different plants (or other sources) can also be used to assess the a priori probability distributio e reliabilit r th som fo f n o e y parameters.

100 s beeha nn obtaineio t ma r Fo dn i fro Whee mth n expert opinionse th , methodology of pooliny this in for motion have to be analv/ed with care. Principally it must bß assured that the dependencies, or bias among these exports, have been identified arid removed

Data froe datth m a e provideb base n ca sdifferenn i d t forms, namely f paio f valuest o r se r eacfo , h component) a e numbeth f demandf o ro , d an s corresponding numbe f failureo r s that orcurred. f paio f valuest o r se r eacfo , omponent < h) e b totath lf o , timn i e operatio n testi d correspondinr )an (o n q numbe f failureo r s that occurred,

c) sot of values for components or system maintenance duration and/or repair times.

a prior Once th ei probability distributio e likelihooth d an n d function has boon obtained, the» a posteriori probability function is calculated,

Accordinq to the type of a priori functions, the a posteriori probabilit e assesseb n ca y d through analytica r numericao l la methodse th f L . priori probability function is the conjuqate distribution to the , then the calculation of the a posteriori distribution can be performed analytically, because the a posteriori distribution will be of the same type as that of the a priori function. When this is not the case, numerical approximations can be used for practical purposes One of the methodologies currentl e discreti/ay th use s i d n methotio d (Ref) 3 ( .

4.3,4 Combining Data from Various Sources

The lack of sufficient arid/or relevant data on component failure rates r failuro e probabilitie a proble s i s m often encountere n I>Si dA studies.

Nowadays ther e w quitreliabilitar efe a e y data sources availablee h 1 . power plant utilities, suppliers, and national as well as international organisations collect operating experiences from both nuclea d conventionaan r l plant r otheo s r industria r militaro l y facilities n ordeI .o broadert e th n population base and the number of failures recorded, data bases are sometimes

101 combined Some methods to combine data sources, which consider uncertainties e parameterith n s have boon published. Som f theo e m «ire also discussee th n i d PRA Procedures s referencesGuidit d e an (Réfe method h ) 1 6 ,. s have been (Applied in some of the PSA's as well as in reliability data books (Ref. /). Ihe method c mainlar s y base n empiricao d l Bavesian methods. Subjective method r combininfo s g data from various source e presentear s d Refn i dan 8 . Ref. 9. (Ihe phrase "subjective method" is used to emphasise that the estimates or the distributions obtained by using such a method are not completely base n statisticao d l .)

f dato e aTh us efro m various sourcee appropriatb n ca s s i eA whePS a n beinq performe n installatioa r fo d e designth n n whici ,s i hconstructio r o n initial operational phases, and consequently where plant specific data are not yet availabl e unreliablar r o e e becaus f theio e r sparseness.

Reference 6 presents some of the pooling methods. This methods require thar eacfo th source bot n intervaa a poinh d an t l estimate failurth r efo e rat provideds i e . Furthermore s assumei t i , d thae datth ta sourcee ar s statistically independent and of equal importance A "consensus" estimate for the failure rate is then obtained by means of simple geometric averaging techniques.

e dat Jf equath fo a t sourcel no importancee ar s weightea , d can be used with weights chosen to reflect the importance of each source resultanIh e t maximum likelihood consensus point estimat thes i e a n weighted geometri e individuac th mea f o n l estimates weighte Th . s assigneo t d each source could be simple functions of the uncertainty bounds of particular data source (Ref. b).

Another metho dProcedureA presentePR e th n i sd o Guids e eth (Refs i ) 6 . called "mixture method" t involveT . s fittin a suitablg e prior distributioo t n each generic sourc d thean e n combinin e individuath g l prior distributiony b s forming a mixture. Several methods are suggested for determining the weights for the prior distributions in Réf. 6. If the mixture is used as a prior distribution, the corresponding posterior distribution will also be a mixture of the individual posterior distributions with the new (updated) weights.

e subjectivEth n e Bayesian metho date dth a (Ref ) fro4 , m3 . various sources are used as the evidence data in the likelihood function of the Bayesian equation, and the usability (or relevance) of the data from each

102 sourc s evaluate i oassumes i t e datI th d da f thao e frousab y th it m i i] each source, to be used as evidence for the specific case being analysed, can be interpreted in a probabi 1 i sti c way "this feature enable combination of distinct data from various sources,

The subjective probabilities of the weights < an be, in principle, miner lo o dd rather arbitraril o describt y e analyst'th e s confidence th n i e usability of the data from each source.

e datLth fa sources come from different nuclear power plantse th , weiqhts can be interpreted aïs indices to describe the similarity between these plants and the specific plant being analysed (Ref. 9). One way to obtain such indices is to apply the analytic hierachy process (AHP), which is a systematic procedur r representinfo e g element y problernan f o sparticularn i ; e th , decision problem hierarchically (Ref ]()).

4 . 4 Export Opinion

4.4.1 Artificial Intelligence Applie o Datt d a Bases Inquiry arid Treatmenf o t Reliability Parameters d !)<-frove ri m Fxpert Judgemen y f Makinb to e Us g Sets and Possibility Theory

Literature sources very often give rompone.nl reliability parameters which were derived from expert judgemen r instanceto t ,e th som f o e reliability data given by 11 HE Std SOO were produced through the aggregation of estimates of experts collected following the Delphi method f or

The recommended and limit values given for each failure rate by rtt-t- e interpreteb n ca s identifyina d a fu//gf failur o t yse e rate value a fu?v( s y set with the associated membership function). Fu/,*y sets, possibility theory d fuzvan y logic (Ref. ll)are effective mathematic tools whic e particularlar h y suitabl deao t e l f thinkingwito e huma th y h wa n , expressing judgementd an s taking decisions,

103 - CM;UK - JR<; Ispra n collaboratioi , n wHI e Pauth i l Sabatier University

(Toulouse, France) ,;l re possibilite studth q yin F developino y a Reliabilitg y Parameter Data Bank (RPDB y exploitin)b g fu?vy loqif., Accordin o thit g s approach, the future KPDB should consist of an intelligent interface capable of interrogating on line data bases representing the J r M and other similar reliability source m hidingi s e ()H)B th shoul,1 1 . d also combin e answerth e s obtained from the various sources to generate a unique answer, I he request ran also be expressed by making use of fu//y attributes for the identification e componenth f o mods tf it failure o e typ d «m e .

e Pauth l Ad Sabatiea sfirs an C tJK stere th Universitp e developinar y g an intelligent interface capable of understanding a request containing some fu//y expressions, and of translating this request into a sintax developed for K U source ie liteth oga r g .n ti More precisely t wouli , e usefub d r fo l retrieving and processing the reJevomt data contained in a data base representing the If K tables and giving as an answer a failure rate expressed as a fu//y set,

In this first application onle componenon y t type e electrith , c motor famjly, are considered. Some new and complex problems (such as dealing with reliability parameters expressed by fu/vy sets on one hand and reliability parameters expressed by probability Histributions on the other) are still to e investigateb e theoretic«*th t a d ! level before thee considerear y s viabla d e for developin a KPDBg ,

4.4.^ Aggregatio f txpero n t Opinion

e statisticaAth s l dat n operatino a g experienc t alwayno e sar e av

Ihe <-xpert. opinion is usually collected from individuals familiar with operating and failure history or even with design and manufacturing of particular rornponent or generic types of component. To avoid substantial error' n estimatioi s a reliabilit f o n y paramete a singl y b r e expert r smalo , l grou f expertso p , several methods were develope o collect d d evaluatan t e expert opinion n addition[ , , dealing wit a hlarge r grou f experto p s requires the establishmen a feedbac f o t ke writte systeth r nfo m exchang f dato ed aan information among the group. A widely known method for this purpose is the

104 OH phi method, successful ]y used in H ht Standard bOO and in a number of other

Cases .

Regardin e crodibiJitth g a dat f o ay source compiled from export opinion s obviouii b s Li-tat compilatio f moro n e expertise (larger numbef o r knowJodgooiblo, independent expert«) guarantees better results.

If the data sources arc ranked in accordance with the methodology used o aggregato gathet t r o r e expert opinion e followinth s g options exist:

1. Consensus (larger grou f knowledgeablo p e expert requireds i s ) 2. Nominal group technique (simila o Delphit r ) 1, Delphi procedure (used in )i-F>_ '300) . 4 Aggregate individuals (statistical aggregation) 'a. Individual judgement 6. Absolute probability judgement

A . r> Re 1iabi1ity_ Parameter Data Hases rif forman Reliabilito 1 n . tS io , 4 y Data Bases

A numbe f dato r a base- r comportenfo ; t reliability parametere ar s availabl e literatureth n i e f mosO . t n PSA'importanci e dat e ar s us a r fo e bases which were compiled from nuclear experienc r froo e m experts with knowledg e nucleath n i er area.

Reliability parameters found in PSA studies are either plant specific (derived directly from plant specific operating experience); generic scenarios, updated with plant specific experience or data corning from outside the plan t assesssebu t s beina d g applicabl o particulat e r components.

Ther e examplear e f singlo s e plan A datPS t a bases which were derived from operating experience directly or generic data updated with plant specific operating experience. Those include Oconee PSA, 7ion PSA, Ringhals PSA.

Ther e alsar e o several data bases compile r singlfo d e plan A studiePS t s in which the reliability parameters mostly rely on general nuclear, industrial and military experience, or on experts opinion. This approach is usual when the PSA is being performed on a pro operational phase, or early in plant

105 lifetime when the operational experience is limited. hxamples of this category ire. lüde s Shoreham PSA, Si/ewell B PSA and the German Ki sk Study.

A programmWhePS a n e with several studie beins i s g performed, usualla y single data bas uses r i severae fo d l plants (aJthough some plant specific data is also used). Ihese types of data bases usually draw parameters either from a grou f nucleapo r plants, from expert opinio r froo n m non-nuclear sources like industria r militaro l y experience. Data base f thio s s kine founar dn i d the U.S.A. in 1RH> data base (WURHJ 27Ï9), I\IRH> data base (WURtG ?8J'j), and ASEP data base (NIJRR3-4'ibO, Vol.1).

Lt is important to mention the f rei'tcl'i approach where data used in a PSA study currently being performed comes from a collection of operating experience from many identical plants. Having such wide operating experience for various components, PSA studies can be carried out using operational data only.

The most widely used sourc f dato e a front expert opiniof IH s i n Standard 'iOO, (19/ d 198/an 4 editions) which contai e reliabilitth n y parameters for a large number of (UPP components. The reliability parameter s compiled from only nuclear experience are found in several WURKG reports (120S for pumps, 1162 for valves, 1163 for DGs) and are based completely on analysis of raw data from l.t-R reports.

Several other WURhG reports or industry publications are also available presenting parameters derived from the operating experience of a limited group of plants and which consider IfR's, plant internal documentation or information provide e planth ty b dpersonnel .

Outside the US, the Swedish Reliability Data Book is a widely known source, compiling data from operational experienc Swedis/ f o e h PWRs.

a numbeTher e f ar eindustriao r d militaran l y sources available, most f whico h cove a rver y specific are f applicationao .bettee th Som f reo known are: Military handbook 2J7 t , a widely used source for electronic component; UKAF.A SRD operates a large data base consisting mainly of industrial data. As the reliability is extremely important in off-shore operations, a great deal f dato n off-shoro a e component s collectewa s d reliabilitan d y parameters were published in the OREÜA Handbook.

106 Ihr- aerospace ind y ti ,deaJv J tr problemu s i numbet e b Ia i witr f i o fo rs ro h years, and it has produced very comprehensive data sources, althouqh rarely applicable to nur, J oar components

Military sources prowido reliability parameters on many components some t use nuclean no f whici do e ar h r plants t dat bu n ,commoo a n components like motors, dieseJs, pumps, otc , , are usualJv applicable. As tho military data bases usually incorporat n relativelo e y l«ar«je amount f operatino s g experience, sometime wiss i o consult t e i s t this sourc s well a en examplA .a militar f o e y data source is the Won electric Parts Reliability Data (NPRD--3), 1985, Reliability Analysis Center (RAC) Rome Air Development Center.

A comparison of several reliability parameter data bases are qiv/en in the f o 1 1 ow i rig tab les 4 . ] ,

107 labi 1 4. Comparisoé f o s e f i hart-tonid o c nt s in i r te data sources

A y Stud P y A StudPS y DATA generic data updated operating experience with plant operation only experience (o.g. /ion NPP) Char««, tori s tics f componeno . no t types

level of detail in component description ]imited moderat o higt e h (no. of sub-divisions of genera] component, type)

component boundary n/a n/a défi ni t, ion

component operating n/a (directly assessed a (directln/ y assessed mode (o m) from sy s tent o. m. ) from syste) m o m

component opérâti rig n/a (sometimes assessed usually n/a (sometimes envi ronmont from iocat ion) assessed from location)

f failuro no e modes J- 3 ]- defined per component

reliabili ty mean value; ; mean value distribution parameters confidenc ntervali e s

repair time sometimes available availab!e

ultimate source generic prior, operating experience f dctto a updated with plant only specific operating experience

other relevant information

108 lab Jo 4,1 (Continued)

of t xpo r onci Nurr oa ] , e Stud i PS l I.Rs

I\IURK; l Hook

f i'iocomponeno . t typos JO

level of ck'tai l in e moat r de c oinpo ne n t, description 1 imiled moderate to (no. of sub division:» of high qoneral component typo)

component boundary n/a yes défini tion

coinponon t oporat i nq y«* s l i nies mode (o.m.) defined

component opérât i nq defined for not directly t direct.Jno v enu ironment w comportfe a , def i ned défi nod only

no. of failure modes 2 4 J 3 defined per component

reliabily it m c meani d mo , rne.-m, parameters error facton rio t t,s bu ri i d upper" bound

repair time n/a n/a

ultimate source assessed from event reports event epor ,; s rt. f dato a several from US plants data collection different system; plant sources inc1. sources n io n expei op rt

other relevant information

109 1 otble 4 . J (Cont i

compilation from different sources

1-H F WASH l/tOO

rio. of component types

i eve l of deUii l in component desrr jption J i mi ted relatively high (no. of sub -di v i s ions of with component types) general component typ'1)

cornporif-nt boundary no no dt> f ] n i t i on

component ope reit i n

component opordti defined for few multipliers cu/oti lable envi components for most component;>

no. of failure niodo<> J 3 dc>fined per component

rel it-ibi l i t y median; distribution; recommended value, > ; r e l me ; maximu d minimuan m m error factor of assessed sources

repair time no sometimes available imcttt l u o soue rc assessed from variety assessed from nuclear of data of sources industrial and military sourced an s agqregation of expert opinion

other relevant infor matn io

110 Tabl J (Continued4. e )

Mi J i tcirv data RomDevelopmenr Ai e t Centre v iab AnalysiJ ( i e il (R n O stor )

HOBK/>I/I NPKfW

no. (jf component typo«? 100

of dotai J in cornponorit. doacri pt.ion hiqh irni tt-d nof subdivisiono . s component boiindotry n/a n/a de finn Uo i

component i ng M/ a n/a modo cornponon fc opér i n< a; t j s VJ ' y os onvi ronrnont

no. of failuro rnodos l -3 do fined por component.

rf 1iabi]i tv mean va lue rilsan, paramo t, o r s

ropair Lime n/a n/a ultimate soi if ce fjfJd Hala field of data other r i nformation

111 4.'> ? ai)B Rf-J Jâbi Ji tjy Data Book (RDB)

Reliability data derived by a statistical processing of the- primary data stored in 111 if CH)B are being collr-cted in the CF DB RDB. This book is a col lee ti on of tab Ins of r.omponent re-liability data; these tables are considere n ortjana e b jo /-<-t d d e basoutputh ef o t Updatind "a n a mads i gy b e c programmei t ma r 1i 1fo hoc."

The RDB has been r.onr.eived as an easy to use too] for the analyst in safet d reJiabi1ity/availabi1itan y y studies y merelB . y consul tine bookth g , without accessin n quickl basee ca th ge h , y obtain reliabilite yth datr fo a t s interestethra i ite jd e h sarnfm«m , ? in dtim e associated informatio n theo n . sampJ e froi/ s me whjch these data were derivee seerib n .ra d This assoc i<*d te information enable e analysth s o evaluatt t e credibilitth e e reliabilitth f o y y data qiven in the relevant tables for any particular' item.

The book structure is described next:

Ihe component is identified on the basis of ^ code specifying five component features :

country, fro w datm ra whica e originateth h s plant typew dat ra o whic t a,e referth h s plant engineerinq system, to which the component pe.rt.ains component family (i.e type) such as "pump" Jst component engineerinq characteristic a pume (fo t coulrth i p e b d combination type/medjurn handled, e.g. centrifuyal/water) d componen2n t engineering characteristic; (e.g. operating pressure ) 'ird component engineering characteristic (e.g. operating flow range)

Some background data for the statistics (i.e. data characterising the sample observed) are given. For each failure mode, number of items observed, cumulative operating time and/or number of demands, number of components which had failures, number of failures occurred, cumulative observation calendar time, etc. i s qivon.

Information on the component application/function performed, operating mode, external environment, test/maintenance«; boundary specification (by a definitio a sketch) d an n ,

112 lor each typ f failuro e e durin Moae gth nopen , "limon *U e Between Failure (M1BF") and L he related (BID) are given; in I. he cast- of fed Jure t im«1, the d i «str i but ion can be assumed to be exponential ( L ho tes f exponential}tyo t , provide e standarth y b d d CHDB data treatment procedure, will haue been satisfied) e failurth ; e rate best estimate) SU s it , % symmetrica90 e th d an l confidence interva e givear l additionn i n e samTh e. applie r failurefo s n demano s d

Repair dat e alsar a o given: background e statisticth datr fo a s (number of repaired items, number of repair, etc.) Mean Time To Repair (MlTR) its S1D, d minimuan d maximuman m repair time experienced.

Comment: the choice of the three engineering features characterising the item e base th e mad b f previou n o so o e it s s analysi e influencth f o s f eaco e h attribut e componenth n o e t behaviour.

4.r>.3 IAF-"A Generic Component Reliability Data Base

A compilatio e publisheth f o n d component reliability parameters wa s undertake 1AFe a computeth o facilitatf At t o a n e us r e codth e e packagr fo e fault tree and event tree analysis (currently under development at the 1AKA named PSAPACK and to facilitate a compèir i son of the various data bases availabl e literatureth n i e .

Currentl e IAFth yA generic reliability data base consist f abouo s t 1000 records, providing reliability parameter r A'ifo sO different components, grouped in about 100 component types. bach record provides as much information regarding respective components as possible (limited by the source of information), including operating mode arid environment, repair time, source d ultimatan e source, component boundary definitio l appropriatal d an n e comment se originafounth n i d l source.

For the generic data base a common record form was developed, and also the uniqu 5 alphanumerie c characters coding system, characteri/ing component types, failure mode d sourcean s f informationo s date Th a. bass developewa e d M compatiblTB n a n C computeo P e e us r rfo usin dBASFe softwarel th g Lf I .

The IAFA generic data base includes reliability parameters from ?\ sources including data froA studiesPS m , industry reportse majoth rd datan , a sources available fro me USA furopth ,d an e

113 6 4, Special Studio vMluatf o t sJiltini eTu Dat r gTo a Event's (EE)

Initiating event frequencie e needear s n PSA'si d n manI ,y casee th s operating experience (IKR's) cannot be used directly without some sorting, grouping or modification. Therefore, determination of IK frequency requires special studies on the raw data, which may be either generic (Ref. 12) or plant specific (Ref. 13).

Generic studie f initiatino s g events haue been performe o determint d e frequenc f anticipateo y d transients (Refs. 14-15) n thi[ .s caso listtw ef o s anticipated transients for BWR and PWR were used, and each LFR in the basic event data base was allocated to one of these ft categories. Thus lk frequeueJes for each separate category were obtained. hor this évaluation to e effectivb e very well defined event description e needef o ar sr eace fo don h F categoriesI e th .

Another example is the development of the methodology to quantify the Los f Offsito s e Power (LOSP) frequency e earlieTh . r studies (Refs -I/6 1 . ) s almosuseR' F L d t directl e onlTh y y treatmen e groupintth e mad th s f wa eo g l ER's into geographical regions. However, a more recent study (Ref. 18) has further examine e entirth d e data bas f LOSo e P from [fcR's. Then yi wer t pu e categories base n geographo d y related feature s wel a ss plan a l t specific features, suc s numbea h f incomino r g power supplies froe gridth m ; numbef o r switchyards; numbe f transformerso r ; numbe f switchgeao r e r th buse d an s availability of "black start" capability. Ihis approach provided factors base n operatino d g experience which coul e useb d d witabove th h e plant-specific features to obtain a more closely tailored frequency of I OSP for any type of plant and according to its specific design.

D analysiPS r f Fo LOSPo s e recoverth , y time after LOS alss i Pf o great importance e samh 1 e. special studies discussed above derived recovery times on the basis of the LFR's for each of the above features. It is obvious that geographical features (severe weather conditions d longe)ha r recovery times than plant specific features such as failure in the switchyard,

A third exampl f speciao e l studie r derivinfo s E frequencgF dat r fo a y determinatio e stud th f LOCo s yt i frequency nI A . Suc a hrecen t stud gives i y n i nn thiI Ref . s .19 stud y (ER'Decembeo t p su r 1984 incorporatin 0 reacto80 g r years were analysed. This study considered specifically three pipe si?eso tw ,

14 leak rates, and different systems (I OCA sensitive and non -I OCA sensitive), [t provided failure ratee abov r th pipe fo sr e fo scategorie s R F l se baseth n o d survey A simila. r special stud f pipo y e break ITRs s performewa , r fo d Seabrood facilitatean A PR k e evaluatioth d e frequencth f o n f interfacino y g LOr,A (Ref. 20).

In the Oconee PRA a special analysis was made and cutsets that lead to loss of instrument air were identified in the plant fault trees and then quantified to obtain the frequency of this ]ow frequency IK This is also commonly used to evaluate other frequencies of [Es which are case.s of support syste lurei fa m .

In summary, raw data of L\ R type or generic failure data of components e needear o estimatt d frequencieE F e s A require studiesS P r fo d.

7 4. Special Studie o Evaluatt s iaby l Indicator t iab l Re i iey l DatRe i t i _1 d aan s l

4.7,1 Ci'iitir tttion of Safety System Reliability Indicators

Reliability dat e ofteaar nn expedit a use s a d e appro<-*c o keet h p track of the reliability of safety systems and components,

One of the ways component event data can be used is in conjunction with safety system reliability indicators t involveE . e condensatioth s f o n the large amount of information on fault and maintenance duration of safety system components, into a few quantitative parameters These can then be compared with the various design and license conditions in order to see if any remedial actio s requiredi n t mightI . e thab , t e replacedequipmenb o t s ha ,t r thae o practicth t d frequencan e f maintenanceo y , e alteredneedb o t s . This activity is in no way a replacement for a comprehensive PSA study; it is rather somethin e accomplishegb than ca t d quickl d frequentlan y s para yf o t the surveillance activity.

The data that is needed consists essentially of the availabilities of the components of the various safety systems. Unavailability will be due to faults, maintenance, and testing. The simplest indicator will thus be the time fractio r nmoro thae on tcomponent e safetth f yo s systemf o wer t ou e action, for whatever reason. This safety system partial unavailability indicator suffers from a total lack of precision on the degree of impairment;

115 there is no d J stinctiori between a fault that completely disables the safety e systemtha on s inconsequentiali td an , .

An assessment can bo meide, however, at the time of the fault, or unavailability, on the degree of impairment of the relovoint -safety system, taking into account the redundancy inherent in such systems, Ihis is subjective oind raise competens i e questio th o s wh o makf t to n e sucn a h assessment in an impartial] mcinner. However, it has the advantage of being very simpl n thai e t onle extron y a number e needrecordeb o t s d inte dotth o to i base for each event. The indicator to be produced is just the t im« fraction 1 weighted by the assessed impairment for each unavailability period. The resul a roug s i t h quantificatio e degreth f f impairmento eo n e th t bu , treatmen F redundanco t weaks i y .

e nex1h t leve f refinemeno l o takt s ei t into accoun e facth tt that there are many occasions when a safety system does not need to be entirely functional, such as when the reactor is shut down. Indeed, maintenance and testing activities will deliberatel e scheduleb y r sucfo d h periods, Ihis i s quite easy provide e poweth d re reactor leveth e time th f o lr s o , s whei t i n critical, is known to the data base. This gives the actual safety system unavaiJabiJity however, is t T ., more meaningfu e cas th f failureso e n i l , other than from maintenanc d testinan e g activities derivo t , e indicatoth e r taking no account of any fortuitious non requirement for failed components, on the grounds that failures will occur randomly.

e mos1h t refined safety system avaiJabiJity indicators wiJ e thosb J e that take accoune configuratioth f o t e componentsth f o n .e onlth Thiy s i s rigorou f aJlowino y r redundancwa sfo g d multiplan y e overJapping failurer o s unavailabilities. This requires some kind of system model; not in the same leve f detaio l s thosa l e uset leasa n PSflsi dt tbu , arcurate th dow o t n component level. The algorithm being used to generate the indicator will nr-ed o searct date e availabilitth ha th basr fo e y componentl recoral f o d eacn i s h system; the default being that the component was available. Obviously, the subjective assessmen e degreth f f impairmeno eo t e safetth f yo t w systeno s i m redundant, but there is great advantage in replacing it with an estimate of the degree of impairment of the component when the data is put in. This is a much less demanding task than previously as no account of redundancy is needed. The indicator produced will now be a genuine measure of the degree of impairment of the safety system,

116 The final requirement might, be to distinguish the various causes of unavailability by producing an indicator similar to that described above, but for each possible cause, namely: component failure, testing, maintenance, human error (if this is logged) etc. This refinement would obviously be uf great value to the station management.

Another concept for the treatment of reliability dat

4,8 Data Base Network for Reliability Improvement

Improvements in availability, rnai ntai nabi li tv <^nd r e 1 idbil i ty are of utmost importanc n nucleai e r power plant safety. PSft studies indicate that importanc f improvino e e reliabilitth g f safeto y y syste d theian m r support system s wel a ss othe a n lsafet no r y equipment whic f failei h d coin cause turbine trips, reactor scram d othean s r plant disturbances.

The most important information that are needed for1 reliability improvemen e operatinth e ar t g experience, accident report d materiaan s l analyst's. However, one of the most difficult problems encountered in data analysi a consistene lac f th o k s i s t procedur o correlatt e e symptoms, trends d actuaan l failure probabilities,

labie 4,2 compares some of the feature«, of several event data bases.

117 en ce LkJ en

-'en •*-» •n c: ._• na -.«-' OJ

01 U) in 03 «x «

(0 en O ça ££.

C (V

K> C: K LO -O u —-• Cl k- t> - —-U CLO -*-> c t- --«.—I to =1 O -Cl £Z OJ c XI o

n -o c oL- OJ c

c o in S S £J l_« CL »T> CO Q.

«X t.. ^~> o l L- 3 ** J U U 3C iX. «X

03 H en ce. CL. CJ ~ *-. •+- -*-• m

^—. ui en o OJ -*-' 1 .—« na

«-»- Ü -*-C J» to » 1 U= l o r > O -t~t -4^ =* cr =3 m f-m =^C3LJ iC-' Cr- ill II II

118 The combined experienc f variouo e s nuclear power plants provid a muce h richer source of information for avai labi J i ty and rnai ntai nabi ] i ty improvement than that of any single plant. ft computer network connecting l\]|>Ps around the world greatly facilitate this exchange of experience

1 he primary objective of that network wouJd be to identify generic problems in component quality, recurring failures, and to some extent, the qualit f nucleao y r plant management e flowchars showth a , n i n n figuri t. 1 4 e

CENTRAL MAIN NATIONAL D/B 1.TRIP REDUCTION DATA BANK ANALYTICAL SYSTEM ZEQWPMENT REUABUTY IMPROVEMENT ^MAINTENANCE PLANNING INTERNATIONAL SEARCHIN G. STATISTI C 4.INSPECT10N / TEST fREQUENOES AND NATIONAL PROBABILIT Y. ANNUA L TREND 5.TECH SPEC EVALUATION DATA BANKS AVAILABILITY. RELIABILITY 8.SPARE PART INVENTORY

LOCAL D/B MANAGMENT INFO SHORTAONG TERM MANAGEMENT NPPN (I )

MAINTENANCE . MATERIAL MAINTENANC E. PURCHASIN G HISTORICAL RECORDS SPARE PART . OPERATION OP€RATIONAL EVENTS SYS. UPGRADIN G. TRAMIN C INCIDENT REPORTS RADIATION PROTECT. CONSTRAINS

FIG. 4.1. Suggeste flowcharB dD/ r reliabilitfo t y improvement.

In this frcimework a more detailed exchange of experience including mechanical, electrica d instrumentationan l , design aspects, faiJuros, spare parts, tools, engineering, operation history, training, procedures, outage reports, analysis programming, radiation protection and plant management. I or effective exchang f informatioo e n between plants e Internationath , ] Data Bank should consider:

Common Data Bank l-ormat International Data Bank Network including PRIS, 1RS, IRDS, USrR*> and others banks. Ort line communication system betwee e Dat th e nnuclea ath Band an kr power plants

119 The opérât ionaJ prediction s q e exporopebasein th t ra n o di ence from NPPs

countre on s n i i limitedy , excep r thosfo t e countries, which have nuclear

plant n i servics a Jon r q fo etim e Operational datci r.oJJof. tt'd inLorvioitioritrtv ] ]

with i'ijqh ]f'i/pJ of ctyqr cqctNon (not, raw doiLoi), «nf«? in priru-ipjo r-asjjy

ohLainahJf.' Lhj-oij

monibcrî t host f o «» orqcUi \ ionurthfrnioro\ /^ i s. , thost o ye librario t no c ar s intorr onnf r. t(jd and event reports have, to be '>ent or i nterroyated separatetely on each of these Jibrar_y 5_y;>terus

Koqarding the present situation, possibilities for a systematic

exchanqe of information arnonq countries are limited in the near future due to a commoe Jôu. f th o k n lanquaqe e differenceth , n evaîuatini s q envi conditions, the variety of reactor types, etc.

Various international data bases which collect operational events in

n operationi NPPe ar s . ftrnonq them are:

PKIS, JAE A

USI- RS : Ul\ILIJt-l)F: IKS: m A (on;i>) LRDS : n:

VIAHONS USED JW UIIS SMJ1 ION

PRIS : Power Reactor fnTormation Systems

: Internationa A M I l Atomic Energy Agency : Inciden1RS t Reporting System MF A : Nuclear Energy Agency (OLDD) : I RDFuropeaS n Reliability Data System FD : European Community USKRS : UWLPE.Uk" Significant Fvent Reporting System UWll'E.DE : Union International des Producteurs et Distributeurs d'tnergie Fle i quetr e : J|\IPOInstitut: f eWurJeao r Power Operation

120 4.9 Current Problem Areas

a) The special requi rerttents which are placed on information systems for Hotla handling and storage are:

capability of handling large amounts of data e us eas o t y feasibility for further development; e are th f dato an F a verificatio ) b n special attention shoul e giveb d: to n

standardised component identification coding system;

sUtndarised method for checking the credibility of raw data;

) c Every data base collectin w datra g a shoul e reviseb d d continuouslo t y reflect the actual nuciear power plant operating experience.

e TtexTh t o>ubse< e lionseveras i m r s l additional problem area n mori s e detai1,

1 Informatio9. 4 n a CommunicationBarrie neee r Th fo d r s Network System

En recent years, there h<*s bee a nmarke d increas n thei e . interesn i t improving the reliability of nuclear power plants. PSA and other simi Jctr analysis techniques have been developed and data from NPP operating experience d engineerinan g analysis were extensively used. Thee usuallar y y useo t d predict the frequency of certain events like core damage accidents including those caused by equipment malfunctions or operator errors.

To generate or predict a maintenance management program from the available operational experience is difficult due to the lack of hardware reliability informatio d inherenan n t uncertainties. Some international orga iont a sn i/ (IAIA , UWIPLOE1C , ) have Data EJanks, tailore o specifit d c purposes. The access to raw data collected here is, however, rather limited.

The need exists to establish a good communication network between plants, utilities, nationa s wela ls internationaa l l data basey s an fre f o e barriers (language, interpretation)- International Organisations like IAEA could contribut e establishmenth o t e gooa f do t data base networr fo k effective sharing of experience between countries.

121 4.9.2 Problem areas connected with use of generic data hasp

When using generic data base there are several areas whore misinterpretation of I he data supplied by generic sources can occur. This results sometimes i n unacceptable variation in component reliability parameters. four general problem areas have been identifie e followinth n i d g order of importance'

component boundary definition failure mode definition operating mode definition operating environment definition

Component boundary definition is the main source of misinterpretation. o firn Ther e m ar erule r eveo s n similaritie y variouwa e th s n i sources s deal with this problem. Most sources do not even provide detailed definitions of component boundaries; sometimes components are only defined as "off the shelf" items. Inclusion or exclusion of, for example, the driver on the pump boundary, can sometimes change reliability parameters in orders of magmtude

There are three major interfaces to be specified for an unambiguous component boundary definition, namely:

mechanical interface; power supply interface; control system interface.

Failure mod anothes i e r problem area whery eb difficultie d so u a r e ar s a commolac f o k n nomenclature o solv t e proble y defino th et wa s i e me On . generic failure modes, as it was done in the lAtft Generic Data ESaso compilation.

Operating mode is of importance for active components like pumps. There are three distinct categories:

standby alternating running (continuously operating)

122 Fach of the above r,an influence the reliability parameter substantially componentr f-o , s suc s valvesa h , normally onlo opérâtw y tq Jn modes, open or closed, needs to be considered.

Component environment can also change reliability parameters substantially (2-5 times). 1 he main environmental factors which can influence : e e Iiabir ar y t li

humidity temperature pressure radiation

I he operating environment is not usually mentioned in sources. This can lead to errors when calculating the system reliability in the environment of an accident.

4.9.'-i Problem areas connected with combinatio f dato n a sources

When several data sources are to be combined to obtain reliability parameters one has to be aware of the possibility of them not being independent a limites ther A e . ar e d numbe f ultimato r e data sources (either experience r expertso 1 almoss i t )i t alway e casth s e tha t leasa t e t th par f o t data base e samrelieth e n populatioo s f componentso n , even whedate th na sources are PSA studies performed separately in different countries. ft solutio r limitinfo n e probleassignmene th gth s i m f propeo t r weighting factors to the different sources, after the ultimate source has been investigated and fully identified.

123 5. FUTURE TRENDS

In reviewing problem areas in data col le< t ion, analysis and retrieval the group of partir, i point s in the ir,M hay P id on t. if i ed the following aspects as deserving special attentio d usinan y thoseb ng gin t -r involve1e l co n i d reliability data .e issueth Som f o es highl ighted require further inves d coordinatiotan iga n tio n internationaa f rese-a o nn i h rc l framework (o.g. EAKA's Ooord inated Research Programm n Dato e a Collectio ) d AnalysiA S an nP r fo s

Da toi collected in recent years have been done in a more systerna t J c way e therefor ar reliabilitn i e d preferre b e an o us t e r fo dy studies. Historic«! record;» contain important

estimate o compensatt d e J0 iclth f actua o

125 Manpower r equi renient s Tor data <.<>\ l ff. t ion art' j n general very difficult to assess and can be misleading. Tor e x «imp i p, in some cases the actual number of poop]o stated to be involved ivi running the system can be low bfMause the involvement of the plant personnel needed is not reflected. Different data bone y hauma s e different structures dependin n theio g r specific objectives, Tt is, however, important that common requirement e establishear s alioo t dr comrm.micatio fo w n between data bases. It is fur tlierrnore recommended that IM A wi J J use its i nternat ional role to lea n effora d r constructinfo t n internationaa g l networ f nationao k l and international data boises Standardisation of information in data bases is highly desirable for sharin nternai f o g t jovial experi evic e, Aspects which will require standard]/ation include r examplefo , e failurth , e description. Countries embarking on re J iabi 1 i t_y data collection should take advantage of the available international experience and should attempt to establish standard structure and content in the planning phase of the idatr a bases. T hit- aerospac d miJitar

126 REFERENCES

1. R ,S . Sayles, C.J. "Ihe Use of !)i sr r JrnJ liant Function Techniques Jn Reliability Assessment and Data Class i ficati on" , R P liability Engineering 6 (1983) 103- 124.

2. G. Apostolakis, S. Koiplan, B.J. Carrick and R.J. Duphily . "Dm t ci Spécialisatio r Planfo n t Specific Risk Studios". Nuclea ngineeF r g n ri and Design '36 (1980) 321-429.

3> P.M. trôner. "Analytical Bayesian So Jut ion of 1 1 it- Two Stage POJSSOII Type Proble n Probabilistii m c Risk Analysis". Risk Analysis, b . J Vo . , 198b.3 7 22b. ?J no . o stay«Tw a * Jann p Bayt-siai"O Ka , . S i Procedur . 4 r DeLcrrnfo e g n i in Rates from Experimental Da toi" . INK 1 r<*ns . Power App. S_yst. ]9'j 20?.

'>. M.J. Greenacre "Theor d Appan y ] icmtio f l-'orrespondenr.o n e Aii«AJysi:>", Academic Press, London, J 984 .

A ProceduresPR . 6 S Guide e PerformancA Guid,th o t e f Probabilistio e c Risk Assessment for l\lur.le«ir Power Plants, WURLG/CR -?. H)0, Vol. L. Washington, DC. January J983.

/. Reliability Dat<* Book for Components in Swedish Nuclear Power Plants, RKS 8'i -25.

8. PuJkkinen, U. Huovinen, 1, Kuhakoski, K.; r^onibi nation of Several Data Sources, Probabilistic Safety Assessment and Risk Monaqement PSA '8/, Volum , Verlal e V RheinlanU l g d GmbH, Köln, J98/

9. Lehtinen, FI., Pulkkinen, U. Kuhakoski, K. Methods for Combining Plant Specific Operating Experience Data with Data from Other Nuclear Power Plants in PRA/PSA Studies, Technical Committee Meeting on Evaluation of Reliability Data Sources, Inter na t iona I Atomic fneryy Agency, Vienna, February 19H8

10. Saaty, l.C. The Analytic Hierarchy Process, MrGraw Hill, New York, J980

11. 0. Dubois, H, Prade "Theorie des possibilités; application a la representatio s connaissancedo n n informatiquee s e edition2 " , Masson S.A., J98/ (English translation distribute y Plenub d m Publishing USA)

12. R. Bari et al, "PSA Procedure Guide", NURHÎ -?81'i Rev. 1 (198 )

13. A Probabilistic Risk Assessment of Oconne Unit 3, NSAC/60, June 1984.

14. A.S. McClyrnond and B.W. Poehlman, "ATWS: A Reappraisal, Part 3 Frequenc f Anticipateo y d Transients" P ?230N ! ,PR F ,Januar y 1982.

!••>. D.P. Mackowia d C.Dan k . Gentillon, "Developmen f Transieno t t Initiating Event Frequencies for Use in Probabilistic Risk Assessments", NURhG/CR- 3862, May 198S

127 10. K f . Kr, hol J, "l os <> of Off site Power Survey Status Report", Revision 3, Report to the Systf-mdtic (-"valuation Program Branch, Division of I irensiny, USIMR 9801 O .

17 A.S, McCJ yniorid und B W. Poehlman, "loss of Offsite Power at Nur. J f^r Powor Plants: D<*ta , An«*t.PKs" i v^ fl WP-y.10i, March J98Z.

18. P.W. BarcU'iowsky , "f va 3 Lint ion of StoitJon Blcickoi.it fir ci dent s at Plants", WUHFG -J03?., 19«'3.

19, R . F . Wriqlit of. aJ., "Pipo Hroatk J rt-qufncy f r> t J nwt o for Wucloar Powoi- / s" IWFL, WURUVCR -440/, H(JG 4407 y 1987Ma , .

. FJominqIM . K DororiioK . R , d J.H. an n?0 . Moody, "Realistic ftssossnu-nf o t [ntf-Tf.Ar. inq °>ystfm I OCft Scenario in PWR Plants", Procofding Tnt . TopJcaJ Mcftirty on PSA and Risk Mariagornt-nt , 7i.iri

-bOD yi O -1984K IN , /»I"Reliabilit. y (Dat r l\lur,]<-cifo a g in t r ra Powf- « On r Stations" , Dor.cmbt- m i , r 1983

')") . Roactor Safety Study - "An Assessment of Accident Risks in U.S. Commercial Wuclear Power Plants", WASH 1400, MUR 7VOJ4G I MucleaS U , r Regulatory Hornmi ssion, October 19/5.

?1. NI'RI) 3, "Woneler tronif Parts Reliability Data", Reliability Analysis Center, RADC, Kali 1985.

128 Appendix

PAPERS PRESENTED AT THE MEETING RELIABILITY DATA AND SAFETY EVALUATION OF NUCLEAR POWER PLANTS - STATUS AND TRENDS GERMAE TH N I N DEMOCRATIC REPUBLIC

. RUMPFJ . SYDOJ , W Staatliches Amt für Atomsicherheit und Strahlenschutz, Berlin, German Democratic Republic

Abstract

Muclear safety depands strongl knowledge th n o y e about faulty conditions of components and systems. Therefore a systematic approac necessars i h t comprehensivge o t y e safety-relevant . System analysi computatioe th d san processef o n s governing design basic accident d seversan e accident maie th n e tasksar f sucso h n approacha e solutio.Th f problemo n s covere thesy b d e taske sar strongly connected. System analysis covers structure investigation methodd san f so reliability analysis maie , th whicn e pointar h s withi framewore nth k of probabilistic safety analysis. Collection, analysis and retrieval of reliability data had been found to be a field of increasing importance to safety analysis. Therefore both constructor and operational organizations in the GDR are legally bound to collect and analyse reliability data as well as to make changes of the technology of a NPP if data indicate a necessity. n independenA t syste datf o m a collectio bees nha n establishey b d the National Board on Atomic Safety and Radiation Protection. Current data bases of the GDR involve generic data as well as plant specific reliability informations. e papeTh r present generae sth l o introapproact R -GD e h th use n i d duce reliability data into licensing decisions. Statu pland s an dat f so a manipulatio discussee nar wels a ds la the structure of data bases. n additioI n experiences gathere usinn i d g reliability date aar presented .followinge Somth thef e o ar m : presene th t A t ) statui reliabilitf o s y analysi probabilistid san c safety analysis respectively generic data play an important role. ii) Plant specific data bases are to be improved to get more sophisticated probabilistic safety informations. Special attention has to be paid on human errors and common mode failures, iii) Engineering judgement is the most important point in mani- pulating reliability data and using them in probabilistic safety analysis.

131 1. Introduction Since the very beginning of commercial use of NPP in the GDR reliability data have been considere havo t d a greae t influ- enc n safeto e y evaluation. Therefor evaluatioe th e f reliano - bility datbecoms ha a n integratea e d par f evero t y safety evaluation of a NPP. Reliability of a component or a system ia defined as the proba- bility of performing a specified function under given conditions givea r nfo time interval. Defining reliabilit n thay i y wa t gathering and analysing of quality data become a very difficult work. Reliability data must as well as possibly specify the statistic populatio e takeb n o whict n s intprobabilistie i h th o c conside- ration. Therefore reliability data bases must cover a wide range of properties of components and systems as well as environ.1-en- l conditionta s whic y influencma h e failures. Data aspect e carriear s y speciab d l regulation Regulae th f o s- tory Body of the GDR. Laws and national standards contain general requirement safetn o s y evaluations. /1/,/2/,/3/« Guide d speciasan l decision Nationae th f o s l Boar Atomin o d c Safety and Radiation Protection give exact informations on how to perfora safety evaluations in a prescribed manner. ïhe main part of safety evaluation is established by accident analysis. Their results are the base for performing all mea- sures of nuclear safety. possiblt ge o T e initial event d sequencesan f accidento s s ope- rating experience P mus KP gatheree tb f o s d analysedan d . Accordin / institution/2 o gt s incolve implementinn i d n i P gNP the GDR are legally bound to collect and analyse operating experiences as well as to make changes of existing tech- nolog datf yi a indicat necessetya e . In the 20 years of using commercial ÏÏPP in the GDR a data base has been established containing experiences of roughly 60 years of reactor operation.

. Reliabilit2 y Data

Two main tasks of safety evaluation must be distinguished by their way f solvinso g problems: i) accident analysis which is to be done under given initial and boundary conditions and

132 ) systeii m analysis defino whict s i he possible initiad lan boundary conditions. An accident analysis contains .calculations of accident sequences taking into consideration general physical laws. It covers both deterministic and probabilistic results. Generally computer-aided calculation maie th n e n parta ar s f o s accident analysis. There is a general approach used in probabilistic system analysis which neglects uncertaintie accidene th f o s t analysis compared with possible change initiaf o s d boundaran l y conditions sucs a h failure safetf so y relevant systems. That means a functioning component (or system) will fulfill its given function under given conditions. Therefor performance th e reliablf o e e accident analysie on s i s of the main conditions to be successfull in probabilistic safety analysis resula B .A t special requirements mus fulfillee b t n a y b d accident analysis. r requirementFo n computeso r codes use licensinn di e e GfDse th R n gi e.g. /4/. System analysi determino t s sha behavioundeP e NP eth ra f possiblro e conditions usin describinga g approach. generao n Ther e ear l physical law determino st e system failures from former conditions. Failures of every system under con- sideration mus e oalculateb t d from operational experiences gathered ove lona r g time period. Supposing that conditions won*t chang timy e operationab e th e l experience e assumeb y sma d to be valid also in future. That is a general assumption of PSA. Besides there isn't a large number of elements with identical propertie welt ge l o definest d statistical results. That means there won't be samples of a poor which can be used in the system analysis. Therefore a system analysis must contain a wide range of informations including plant spe- cific as well as generic data and engineering judgement. For that reasons a probabilistic safety analysis is a more subjective approach. A system analysis covers two main tasks: ) structuri e analysid san ii) reliability analysis. In both fields methodical investigations and developments have been done for some years in the GDR, e.g. /5/,/6/.

133 Pigur show1 e e structurth s f safeto e y system analysit i s a s was established by the Regulatory Body of the GDR.

—Determination of initial Ond boundary conditions —Reliability of safely s ystems — Probabilistic safely analysis

FIG.1. Structure of the safety system analysis of the Regulatory Body of the GDR.

Data bases have been established by both operating organizations Regulatore anth d y Body. Pigur show2 e s some characteristic features of reliability data base of the Regulatory Body of the GDR. Generic data are considered to be a good measure to evaluate results of reliability analysis.

Opera fina Incident Reporting Experiences Systems ( IAEA, *CMEA ) International PSA published Data Transfer HUE G-Typé Conventional Fbucr -Requlatory Plants table*.. J _ Operational Other industries organisations \7 Other Oata from Opinions Literature 1—— Lxpert Opinions

Engineering Juaqcment

Evaluated Reliability Evaluated ' Dota BQSÇ of Reliability Operational Organisation DataBase

Safety Analysis

FIG.2. Structur reliabilite th f eo y data Regulator e basth f eo y GDRe Bodth f yo .

134 Operational experiences gathered up to now throughout the world giv n averaga e e frequenc f coro y e damage accident n thermai s l reactors of IxlO^y""1. This number is for the ability to use thermal reactor safa n esi manner, resulting fron 4,500 year reactof so r operation .publisheA PS Lookinlase 2 th 2 t n t yeari ga d d usinsan g a lognormal dietrubutio mediaa wil u t nyo l ge n valu corf o e e damage frequency of about 7 x 10"5y~1. That is ahown by figure 3- (Results fron m/l

core melt frequenc] y [ y

FIG.3. Distribution of core melt frequencies.

A 9056 confidence interval is got by 10~x 6 6y~1^ xe* 10"9x 4y"1. usiny b beed t ha gngo Thoug A differen PS result e e hth th f tso method d assumptionsan consideree sb the y thef yna - i in ys a d dicat possibilite th e f coro y e damage accidents expectei t i s dsa for modern ITPP. If PSA or reliability analysis are done their results must be carefully compared with generic data mentioned above taking into consideratio characteristie nth c feature constructiof so d nan operatio analysee th f no d NPP. Simular measures may be established for single components and systems from literature.

135 Operational experiences e.g. indicate a mean value of failures per deman roughlf o d y 10"- r proofefo 3 d automatically working redundand safety relevant système containing active irechanical components such as pumps and motor valves. Without redundancy a probabilit failuref o y r demanspe receiveds f roughli o d 0 1 y . _p Collecting and evaluation of generic data are considered to be an important part within the framework of system safety analysis s beeha nt i estabilishe s a e GDRth .n i d Nevertheless main interes s focusee improvemeni t th n o d f o t plant specific data. Thee collectear y t onlno dy from operatio- t als l experiencebu o na e R froth GD f ne o othe th ÏÏP f P o sn i NP Pr same type as they are used in other countries. Recently a special incident reporting system was established Regulatore th y b y Bodie f socialiso s t countries characteristic features of which are focused on PSA data needs. One of the most important reliability data sources used by the Regulatora specia s i R l GD abnorma e y th Bod f o yl event repor- ting system. It covers a wide range of informations. Accordin / ther /8 three o ar et g e classé abnormaf o e l events. They differ in the frequencies of the events and their influen- cenuclean o s r safety. Special requirement whan o s t information is to be reported were estabilished for every class of events. Class 1 is to cover core damage accidents as well as conditions which can lead to core damages with high probability. This class involves e.g. transient- s with failure reactivitf so y control, - critical states cause y transportb d , storag fuef o e l elements, - failures of removing heat from the core. Class two contains other transients where core damage is expec- ted to be impossible but given conditions of safe operation aren't met, such as lack of safety functions being not necessary and deficiencies of safety relevant systems as they are defined in the licence. Class 3 contains all other events influencing failure conditions of safety relevant systems. Such events are e.g. decrease- d availabilit safetf o y y systems - deficiencies found during inspections and testing - increased time of in-service inspection and jepair of safety relevant systems.

136 Report n abnormao s l évente hav o carrt e y information aboue th t following items: - name of KPP and unit - designatio abnormae th f o n l event investigatioe numbe- th f o r n aport - date and time of the event and transient sequence as well as the time when the normal state was established again - operational state of the plant when the event was starting - operational states of systems involved in the transient - influence on the state of the unit at all - transient sequence - influence on nuclear safety - causes of the event as v/ell as their evaluation - special technological system characterisation (failure modes, causes, precursors, failure effects) - datd mod an elatesf o e t inspection, testin repaid gan f o r relevant systems and components - other information about technology, operatio maintenanced nan . Special inspection Regulatore th e carriey b sar t you d Bodo t y retrieve data.

3* Concluding Remarks

Data managemen describes ta thin i d s pape undes i r r continuous development. Especially the improvement of data bases is a main task at present. Therefore data exchange with countries whice har operating WWER-type reactors too was enforced recently to im- prove specific data bases. Special attentio e evaluatio th pais ni o t d datf o n a including generic data as well as a carefull engineering judgement at all levels of safety evaluation. Regularities obtained from data bases are used to avoid mistakes. The further improvement of reliability data depends strongly sophisticatea n o d evaluatio humaf o n n error d commosan n cause failures .A specia l programm s initiate ewa Regulatore th y b d y Bod o investigatt y e influencth e f operatoro e abnorman so l events, The main topic f evaluatioo s reliabilitf o n y dat thes a y were found in performing safety analysis are: i) The evaluation of reliability data is an integrated part of safety analysis including accident analysis as well as system analysis.

137 ) Generiii cn importan a date ar a t par reliabilitf o t y analysis. They represen measura t o compart e e result wels sa s a l methods and data of reliability analysis with the inter- national standard. iii) Nevertheless there is a general need of improving plant spécifie data taking into consideration that system analysis idescribinsa g approach. iv) Engineering judgement is a very important topic of safety analysis. v) Special attention must be paid to some important aspects of safety analysis such as evaluation of human errors and common mode failures.

REFERENCES /!/ Gesetz über die Anwendung der Atomenergie und den Schutz vor ihren Gefahre Atomenergiegeaetn- z- 325. S , , 8.12.19334 . Hr GB1I .3 /2/ Verordnung über die Gewährleistung von Atomsicherheit und Strahlenschutz GB1. I Hr. 30 S. 341, 11.10.1934 / Atomsicherhei/3 Strahlensohutzd un t ; Kernkraftwerkssicherheit; Allgemeine Forderungen TGL 44003, Feb. 1986 /4/ Verification of Safety Analysis Computer Codes Used in Licensing Rumpfd Höhnan ; IAEA-TC/W. ,J ,J. IAEe th An So Programm e on Computer-Aided Safety Analysis, Warsav/, May 25 - 29, 1967 / Probabilisti/5 c Method r Safetsfo y Decisions Höhn, J. et al.; IAKA Workshop on Advances in Reliability Analysis and Probabilistic Safety Assessment (PSA), Seregelyes, Hungary, 7-11« September, 1987 /6/ Reliability of Complex Technical Systems in the Context of Parameter Uncertainties Tiirschmann, M.; IAE Workshop on Advances in Reliability Analysi Probabilistid san c Safety Assessment (PSA), Seregêlyes, Hungary, 7-11. September, 1987 / Probabilisti/7 c Safety Assessment: Growing Interest ledermann IAE; ,L. A 1 Bull5 . (1985)7 S . 2 , 3 . ,H / Richtlini/8 Verhaltem ezu außergewöhnlichei nbe n Ereignissen Anwendunr bede i Atomenergir gde e - AE-Riohtlinie - Mitteilunge Staatliches nde n Amte Atomsicherheir sfU d un t Strahlenschut 5 (19882 1 z . )Hr

138 PRESENT STATUNUCLEAE TH F SO R POWER RELIABILITY DATA BAN JAPAN KI N

K. OHTA Nuclear Power Safety Information Research Center (NUPEC), Tokyo, Japan

Abstract

Since its establishment in October,1984, under instruction by the Ministry of International Trade and Industry, Nuclear Power Safety Information Research Center has built up the nuclear information data base on the construction, operation and maintenance of the nuclear powe e effectivth r n stationi d eai fulfillmen( NPSo st ) s f nationao t l safety administration.

The outline datth af o ebas e wil e introduceb l d herein. Basen o d the incident and failure information in Japan stored in the data bank o datet e Centeth ,s starteha r e evaluatioth d n progra f unavailabilitmo y e engineereoth f d safety system s systea s m level failur) e R ratF ( e and of FRs of the major valves, pumps and heat exchangers as component level FR since JFY 1987. The outline of the results of the program wil alse b l o described.

. I Nuclear Power Information Data Bas n Japai e n 1. Role of the Nuclear Power Safety Information Research Center Sinc s establishmenit e n Octoberi t , 1984 e Nuclea,th r Power Safety Information Research Center has been

maintainin e computeth g r syste d keeman p buildinp u g the Japanese nuclear safety information data base with the aim of enhancing the safety and reliability

of the nuclear power plants and the effective fulfillment of the national safety administration by analizin evaluatind an g e safet th greliabilitd an y y of the nuclear plants, based on the information of their construction, operatio maintenanced an n .

139 Main activities of the Center are as follows: ) Maintenanc(1 f nucleao e r power safety control information ) Analysi(2 d evaluatioan s f informatioo n n o n off-normal events ) Reliabilit(3 y evaluatio f plano n t systemd an s facilities ) Evaluatio(4 e planth f to n characteristics ) Compilatio(5 e pertinenth f o n t informatioe b o t n distribute o locat d l municipalities Information on Nuclear Power Safety management (1) Incidents and Failures file This data file was prepared primarily for the purposes of pattern retrieval and statistical analysi f incidento s d failuresan s . Approximately 1,000 reports are filed, which

include incidents and failures required to be reported by law and minor failures by regulatory notification. The main items of filing are: serial number; statio d unian n t name; titl f incideno e d an t failure; dat f occurrenco e r detectiono e ; operating status; descriptio f incideno n r o t failure; affected systems, equipment, and components; trip signal; cause; countermeasures; influence on safety and plant output; method of detection; duration of shutdown (hours), etc. In addition, narrative accounts of the incidents and failures and their causes are input to magnetic storage devices, enabling data

140 retrieva y designateb l y words ke e dcontent Th . s e reportoth f e alsar so store n opticao d l disks s imaga e data availabl r detailefo e d study. In addition, OECD/NEA-IRS and USNRC LER information are also compiled as the separate data base for reference. ) Operatio(2 n file This filen a e basiserve th r fo s a s understanding and analyses of the state of nuclear power plant operation n accuratA . e recognition of operating status is necessary for analysis and evaluation of incidents and failures, evaluation of reliability, analysis of availability, etc e content.Th e f inputh o s o t t file have been selected to support the various analysis accompanyin e ongointh g g studied an s evaluation, especially those concerning the electrical energy loss and its specific causes. The main input items are as follows. ) Powe(a r station data: Date of initial criticality, initial connection to grid, and inauguration of commercial operation for individual unit. (b) Annual data: Total electricity generation (gross, net), generating hours, and capacity factors, etc. for individual fiscal year. (c) Monthly data: Electricity generation (gross), generating hour r eacfo s h month.

141 (d) Dat n individuao a l energy loss: Dat f occurrenceo e , typ f causeo e , quantitative energy loss, reduced power level, and other items for each case of power reductio r shutdowno n ; cause e classifiear s d into 23 categories, including periodical inspection, incident d failuresan s , minor incidents or failures, surveillance testing, control rod pattern adjustment, and external causes, etc. (e) Shutdown data: Datd tim an f ebeginnino e f poweo g r reduction, disconnection from grid, connectio o gridt n , anf resumptioo d t fula n l power s wela ,s a l energy loss during power reduction, shutdown, and power increase e operatio,th etcr fo . n cycle. (f) Image data: Annual operation graphic curve d monthlan s y reports for each fiscal year. n additionI ) (g , overseas information including IAEA PRIS data, France CEA ELECNUC are also compiled as the separate data base for reference.

) Radiatio(3 n exposur d radioactivan e e waste (4) Inspection (experienced periodical inspection data, analyzed data on critical path schedule of periodical inspection, ISI data, welding data)

142 (5) Plant basic information (design values, operational limits, acceptance criteria) (6) Equipment ) Internationa(7 l power plant data (plant basic data) ) Document(8 d othean s r materials including drawings ) Newspape(9 r topics

II. Provisional Calculations of Unavailability at System Level In case when any of maintenance and other works will be performed on the plant important safeguard system, etc. whose availability is controlled by the safety regulations, such work should, regardless of its nature be reported to MITI. By analizing such reports about the maintenance or events e hav,w e starte e provisionath d l calculatiof o n unavailabilit t systea y m level. . 1 Statu f Occurrenco s f troubleo e s (standby release) of Safeguard systems ) Annua(1 le occurrenc trenth f o d f unscheduleo e d standby release Unscheduled standby releases frequency of LWRs was 88 (63 for BWR, 25 for PWR) cases during the period betwee Y 198F n 0 through 1985.

Fig 1 show . annuae th s loccurrencee trenth f o d ; r BWR e r d lowegrapfo th ba an ,s i re h th sid f o e the upper side is for PWR; the axis of ordinate represents relative values (by percent) to the Y 198F 2n i e maximu whicth R valus BW i hmf o e among others.

143 R.liUvt vilu. (%) D BWR D PWR 200

.n. FÏ1980 FY1981 FY1982 FY1983 FY19SÏ FY1985

Unschedule1 g Fi d Standby Release -LWR

(2) Distributio f unscheduleo n d standby releasa n o e unit basis Fig 2 show. e distributioth s e frequencth f o n y of unscheduled standby releases wher e totath e l numbers (63 for BWR, 25 for PWR) of unscheduled standby releases for BWR and PWR during the above duration are respectively taken as 100%.

Fig 2 Unschedule. d Standby Releas eUni• t Base (fro 0 througm'8 h '85)

2. Calculation result f systeso m unavailability n JapanI e unavailabilitth , e engineereth f o y d safeguard system s beesha n zero t calculatio,bu n value consideratio f withouo n t repairing failed system could be obtained using the average testing interva d in-servican l e time .4 sho d Figswan 3 . average value n logarithmi(i s c scalee th f )o unavailabilit f engineereo y d safeguard system.

144 iiiüwf Seillo «m n

10 10- 10- 10- 10- 10- 10- 10- 10-

LJELlÄLL-.—iKai l tant . C H A H C R R C H P P D P • -GG-CC IHCCSCSC TSS OSSP S I

Fig3 ECC. S Equipment Unavailability

Seil logarith«n I m

0 (PWR fiDlili.s)

FigECC4 . S Equipment Unavailability

III. Failure Rate Data Construction Progra t Componena m t Level Y 198F 7. 1 Program A long-term reliability evaluatioe n th dat t a a component level in Japanese nuclear plants is being constructed utilizing information formally reported to MITI suc s incidenta h d othean s r operational events. In the FY 1987, the following items of pumps, heat exchanger d valvean s e surveyedar s , reviewed an d calculated on a trial basis; e numbeA surveth ) f incidentf o ro y(1 d eventan s s based on the formal reports on LWRs

145 (2) A survey of the number of specific components by type of LWR (3) Review of calculation method of the service interval hours (frequency of demands) of specific components (4) Review and provisional calculation of the failure rate calculation model of specific components . 2 Basic Concep r establishinfo t Scopine th g f o g components corresponding to Failure Data o keeT p appropriate accurac f calculationo y e th , scoping of in service components is limited to the e extenformath f o lt reports. Since formal incident d failuran e reports cover those components failures of which affect plant availability and safety, the scop f componento e s counte n thii d s progras i m limited to the followings: (1) Components constituting main piping systems or directly connecting to them (2) Components directly affecting the functions of the engineered safeguard systems Sinc e numbeth e f plano r t components depende th n o s plant capacity, component surveyee ar s n plano d t output basis (500 MWe class, 800 MWe class and 1100 MWe class) 3. Review of Calculation Methods of operating hours (frequenc f demandso y f Specifi)o c Components (1) Operating hours (frequency of demands) of pumps Operating mode f pumpo s e groupear s d into three: a. Normally operating pumps . b Alternately operating pumps

146 . c Normal standby pumps (2) Operating hours (frequency of demands) of heat exchanger Because operationath f o e l characteristie th f o c heat exchanger e static ar s believei t i , d that o cleathern s ri e difference between operation and standby conditions. Therefore, it is judged thae annuath t l plant operation e b hour y ma s appropriately evaluate y combininb d g operation and standby hours.

) Operatin(3 g hours (frequenc f demandso y f valvo ) e Excep r somfo t e control valves, n valvei e ar s steady (constant) conditions during most of the operation hours. . 4 Failure Rate (FR) calculation n examplea s A e derivatio,th macroscopia f o n R F c calculation equation for pumps is as follows. The macroscopic FR of pumps of the FY 1986 is obtained by quotient of the cumulative number of event f pumpo s s fro Y 196F m 9 through 1986 dividey b d the cumulative operating hours of pumps, thus expresse e followinth y b d g equation: Macroscopic FR ( ) _ Cumulative number of pump failures from 1969 to 1986 (F) ,,. Cumulative operating hours of pumps from 1969 to 1986 (T) The cumulative operating hours in the denominator is e cumulativth f o m thsu ee operating hour f normallo s y operating pumps, alternately operating pumps and normal standby pumps.

147 IV. Summary We have constructed and been maintaining data of the operating experienc f Japaneso e e nuclear power plants, includin e accumulateth g e pas d0 th years 2 t dat r fo a. e intendinar e W e o utilizinformatiot gth l al e n statistically treate r compilatedo d . Thoug e havw h e just starte e provisionath d l calculation r failurfo s e raty b e utilizing Japanese data, we believe it is important to conside e followinth rr continuin ou n i g g e efforth n i t calculation: . 1 Since failure e applierateA b wil PS o t lso t dreflec t the quality and reliability of manufacture and maintenance, such rate shoul e inherentlb d y specific to each country. 2. In calculating failure rates based on LWR operation data a simpl, d realistian e c model commensurato t e the level of accumulated failure information should be used. 3. Failure rate data must be continuously revised based n dato r operatinfo a g experience being added. Calculational method d preconditionsan s , etc. should e continuouslb y reviewe r furthefo d r refinement.

148 A.WNKK

The general outline of a treatment technique for reliability data is introduced. It is a very preliminary concept which will reflect the actual nuclear plant performance of each country.

It should be appreciated that there is a need for designated specialists to present constructive comments on this concept in order to develop this method.

General Outline macroscopie th t Ge c ) a failure rat eacf eo h countr strictla n i y y specifie d standardizean d d way.

b) Classify the operational records level according to the priority of the failure rate (Refe Tablo t r. e1)

c) Using a compensation factor, modify the appropriate data sets according to the special PSA. purpose. The macroscopic failure rate shoul e continuouslb d y revised dats operatinr ,a fo a g experiencs i e accumulated.

Figures

Figur showe1 rate capacitsf th eo y loss classifie causey b d r fo s BWR Japann i s .

Figure 2 lists incidents and failures.

Figur depicte3 basie th s c data flow concerning nuclear power generatio Japann i n .

Figur eindicate4 generae sth l configuratio computee th f no r system.

149 Table 1

plant Numbe f failuro r e case_ s Fn Macroscopic Failure Rate "1 plant Operating hours Tn (or Frequency of demands)

Classification Fn Tn

Total 1. System level By detail operational records y detaiB l operational records o Numbe f failuro r e cases o Operating hours o Failure mode o Maintenance hours o Failure cause o Operation demands o Testing hours

Total i Component level By operational records By Operational records with preconditions (includes every o Number of failure cases o Preconditions depen n plano d t capacity supporting sub- o Failure cause factor components o Scop f comporneno e r fo t o Standardized operating hours and parts) Fn and Tn o Standardized frequenc f demando y s Compensate 3. Parts level By engineering judgement Utilize Fn, Tn derived from experimental (Component with- of non-nuclea o applie X o t d r data, factory data, specific nuclear out accessories field plant data or non-nuclear operational r partso ) o alph f specifio a c nuclear experience plant operational data (e.g. Wash-1400) s desirabli Note t I : o calculatt e e *system level failure rat y detaib e l operational records. e failurTh e rate f -'syste(FRo ) m level, -'"compornent leve d partan l s level shoul e revieweb d d for consistenc r som o y usinb yeA FT otheg r engineering tool o verift s y that reasonable engineering judgement was applied in the correction factors. total B w R

(5) 0.3X (6) 0.4X 0.27. X I . 0 K11HJG >->(7) 0.4X

1 A- Fig(Notes. ) Rat(1 f )Capacito e y Factor Loss Classifie y Causeb d s (2) F.Y. 1984 ) Capacit(3 , y Factor (4) Periodical Inspection (Annual Inspection & Refueling) (5) Short Planned Outage (6) Incidents & Failures (7) C/R Pattern Exchange & Ajustaient

(1) : K - * r f » t t 4Jc Nü. --•» h 9fc4Ë*ÉflB ) (3 ) (2

l 116 XXXX S53 01 26

2 12! XXXX 2 2 6 0 3 S5

3 122 XXXX S53 08 18 ( l C-

-t 128 XXXX S53 U 09 -tf£J

5 133 XXXX 6 2 S51 0 4

Fig. A-2 (Notes) (1) List of Incidents & Failures (2) Name of Unit, (3) Date of Occurrence (4) Outline of Incident & Failure

151 N)

Japan Atomic Energy Ministry of International Research Institute Trad Industrd ean y (JAERI) Power Reactor and Nuclear Fuel Development Corporation ___ (PNC)

Nuclear Power Engineering Test Center The Central Research Japan Power Engineerind gan Nuclear Power General Institute of Inspection Corporation Safety Center Electric Power Industry ____(JAPEIC) Nuclear Power Safety Information Research Center

Electric utilities Manufacturers, etc.

Fig3 .A- Basi c Data concerning Nuclear Power Generatio Japan ni n Central processing unit (CPU)

Magnetic tape control unit

t

X"~ /Magr -{ tat V un r

e« Terminal unil ( Terminal unit

UJ Fig. A4 General Configuration of the Computer System DEVELOPMEN FREEDOM/CREDF TO O DATABASE FOR LMFBR PSA

R. NAKAI . SETOGUCHIK , . YASUDH , A Power Reacto Nuclead an r r Fuel Development Corporation, Tokyo, Japan H.E. KNEE Oak Ridge National Laboratory, Oak Ridge, Tennessee, United States of America

Abstract A probabilistic safety assessment (PSA) is being performed for the liquid-metal cooled fast breeder reactor (LMFBR), MONJU, whic s currentl i he constructio th n i y n phase. FBR Reliability Evaluation Database for Operation and Maintenance (FREEDOM s beeha ) n develope e Poweth rt a d Reacto d Nucleaan r r Fuel Development Corporation (PNCr fo ) the collection, storage, maintenance, and evaluation of the data to support the MONJU PSA. The FREEDOM system includes the data contents and structure of the Centralized Reliability Data Organization (CREDO) CREDe Th .O systes mwa initially developed in the United States at Oak Ridge National Laboratory (ORNL), and is jointly sponsored by the U.S. Departmen Energf to f Japano y C (DOEPN . d Datan )s aha been collected from the experimental fast reactor, JOYO, the Fast Flux Test Facility e Experimenta(FFTF)th d ,an l Breeder Reactor-II (EBR-II). In addition, data has also been collected at several important test facilities in the U.S. and Japan. The utilization of the CREDO database has recently been initiatee MONJth Ur fo PSAd . This paper describee th s structure e databasapproacth th d f f o o an eCREDeh O applicatio LMFBe th Ro t n PSA better reliabilitf o Fo .e rus y data e effectth , f componeno s t boundary, component failure mode d failuran s e severity were investigated A failur. e trend analysi performes swa o examindt e applicabiliteth f yo thes e MONJeth dato Ut a PSA e accumulatioTh . f o n operational experience in LMFBRs and a detailed investigation of the existing reliability, availability, and maintainability (RAM) data would contribute to the reduction of the uncertainty of PSA.

INTRODUCTION A PSA is being performed for the Japanese prototype LMFBR, MONJU, which is currently in the construction stage. A PSA requires an extensive database in component RAM data as well as initiating event frequency data. Available LMFBR-specific component reliability databases were

155 relatively limited compare e light-wateo th thost d f o e r reactor (LWR) industry n e supporI MONJth . f Uo t PSA, e collectionth FREEDO r s fo develope wa MC ,PN storaget a d , maintenanc d evaluatioan e e datae FREEDOth Th .f o n M system was originally develope e purpose improvementh th r f o fo ed t in operatio d maintenancan n e experimentath f o e l fast reactor, JOYO. Furthermore n i orde ,o t perforr m more realistic reliability analysis, which includes the minimization of the parameter uncertainty and the exclusion of conservativeness, expansio operationaf no l experienc LMFBRn i e s necessaryswa . PNC therefore participated with DOE in the further development of CREDO. The purpose of the CREDO system is e collectionth , evaluation d analysian , f dato s a associated with the operational experience of advanced reactor components. The CREDO system produces not only RAM measures of performance ,e failur th suc s a he mean-timee th ratd an e - to-repair, but can also produce enhanced statistical analysis outputs and customized analyses.

DATABASE DEVELOPMENT e primarTh y database, FREEDOM s beeha , n under developmen C sincPN et a t 1985o majoTw .r purposef o s o providFREEDOt e ar Me o inpucompilt o CRED t td an Oe informatio n operatioo n d maintenancan n e improvemenr fo t existin C facilitiesPN g e FREEDOTh . e M th syste s ha m following functions: ) Dat(1 a storage ) Verificatio(2 f inpuno t data (3) Compilation of CREDO input ) Formatte(4 d outpu storef to d datreportinr fo a g (5) Primitive retrieval Data has been collected from JOYO, 50 MW Steam Generator Test Facility, Sodium Exposure Test Loop, Control Rod Drive Mechanism Loop d Sodiuan , m Flow Test Loop (now decommissioned) at 0-arai Engineering Center (OEC) of PNC. A lis f componento t s collecte s showi d n Tabli n . 1 eThre e type datf scollectede o ar a ) even(a : t data ) engineerin(b , g data [component descriptions], and (c) operating data [hours of reactor or test loop operation per reactor mode] . All relevant events related to the reliability evaluation were extracted from operators e mosth tf o g timbooks e lo 'e On . consuming aspects of developing a comprehensive data system such as FREEDOM/CREDO is the process of getting actual field data into the computerized database management system. The data collection wormorr fo ke tha 0 1 componentn d pasan st operating experience took more tha0 man-month30 n t PNCa s . Statistical analysis of the failure data is currently being performed.

156 Table 1 Component List

CREDO FREEDOM 1 Annunciator Modules 2 Batteries 3 Circuit Breakers and Interrupters 4 Cold Traps and Vapor Traps 1 Cold Traps 2 Vapor Traps 5 Contactor Starterd san s 6 Control Rod Drive Mechanisms 3 Control Rod Drive Mechanisms 7 Démineraiizer« 8 Electrical Buses 9 Electrical Conductors 10 Electric and Electronic Connectors 11 Electric Heaters 4 Heaters 12 Electromagnetic Pumps 5 Electromagnetic Pumps 13 Filters/Strainers 6 Filters 14 Fuses 15 Gas dryers 16 Gas movers 7 Blowers 8 Vacuum Pumps 17 Generators 18 Heat Exchangers 9 Intermediate Heat Exchangers 10 Dump Heat Exchangers 19 Indicators 20 Instrument Controllers 21 Internal Combustion Engines 22 Liquid Rheostat 23 Logic Gates 11 Logic Circuits 24 Mechanical Control Devices 12 Drive Uni Vaner tfo s 25 Mechanical Pumps 13 Mechanical Pumps 26 Motors 14 Motors 27 Nonnuclear Sensors 15 Process Instrumentations 16 Leak Detector Sodiur sfo m 17 Load CelCotror fo l l Rods 28 Nuclear Detectors 18 Nuclear Detectors 29 Penetrations 30 Pipe and Fittings 19 Pipe 1 3 Plugging Meters 20 Plugging Meters 32 Power Supplies 33 Pressure Vessel Tankd san s 21 Tanks 34 Reactor Control Rods 35 Recombiners 36 Recorders 37 Relays 38 Rupture Devices 39 Signal Modifiers 40 Signal Transmitters 22 Preamplifiers and Nuclear Inst. 23 Monitors for Nuclear Inst. 41 Support and Shock Devices 24 Pipe Supporters 42 Switches 43 Transformers 44 Turbines 45 Valves 25 Valves

157 e structur Th e FREEDOM/CREDth f o e O syste s showi m n i n e CREDTh FigurO . syste1 ea mutua s i m l data-sharind an g cost-sharing database between the U.S. DOE and PNC of Japan.

JOYO.SGTF SFTL.CRDL SETL

ReliabilitR FB y ' 'Centralized Evaluation DB Reliability for Operation & Data Maintenance Organization

RP Retrieval Processor CONV Terminolog d Unian yt Conversion Processor CREST CREDO Statistical Plotting Package UCONV Unit Conversion Processor

Figur 1 eLMFB R COMPONENT RELIABILITY DATABASE AND DATABASE MANAGEMENT SYSTEM

The CREDO system is currently operational at both PNC/OEC and ORNLe CREDTh .O syste component-basea s i m d systed an m collects data on components that are liquid-metal-specific, associated directly with a liquid-metal environment, contained in systems which interface with liquid-metal environments e importanar d an ,t critical safety-related components. Data sources in the U.S. are the FFTF and EBR- II, and several important test facilities. The data sources are showCREDe TablTh n ni O . 2 esyste m contains information on a population of more than 21,000 components and approximately 1,500 event records e totaTh .l component operating time is approaching 2.2 billion hours. e objectiveTh CREDe th Of s o syste categorizee ar m d into thre ecollectioe partsth ) (a : engineeringf o n , operational, and failure event data from liquid-metal, nuclear-related facilities organizatioe th ) (b , structurind an n date th a f go int n efficiena o t database managemene th t ) system(c d an , disseminatio e datd informatioth an aM f no e RA for th f o mn i n analyses to various DOE and PNC users. CREDO'S database management system (DBMS) was designed to catalog and store data in three types of files engineering, event, operating e engineerinTh . g data file contains a unique description of each component as reported by each site. The event data file contains detailed data concerning any CREDO-reportable event that occurs to components being trackeCREDe th Oy d b system e operatinTh . g data file consists of a set of chronological reports that give the accumulated operating history of a reporting unit. e evenTh t data includ a descriptioe e eventth e f th ,o n metho f detectiono d e failurth , e mode e failurth , e cause, corrective action, etc n engineerin.A g data supplemens i t

158 Tabl 2 eCRED O Data Sources

Liquid Metal Reactors Fast Flux Test Facility (FFTF) Experimental Breeder Reactor-II (EBR-II) Experimental Fast Reactor JOYO

Test LOOP Sites Energy Technology Engineering Center (ETEC) Westinghouse Advanced Energy Systems Division (WAESD) General Electric Advanced Reactor Systems Department (GE/ARSD) Hanford Engineering Development Laboratory (HEDL) 0-arai Engineering Center (OEC/Japan) 50-MW Steam Generator Test Facility Sodium Exposure Test Loop Contro Drivd Ro l e Mechanism Loop Sodium Flow Test Loop •

Other Data Sites FERMI-I Hallam Nuclear Facility Sodium Reactor (SRE)

use n i conjunctiod n wite engineerinth h g data filo t e collect such a descriptioinformatio ) e (1 th : f as o nn component in terras of its engineering parameters, (2) materials datr criticafo a le componentpartth ) f (3 o s d an , design and operating parameters for the component. This information enabl a detailee d analysis concernin e desigth g n specification. CREDO'S standard statistical output is composed of two separate analyses primare Th . y metric generate s i failurd e rate. It is calculated by taking the ratio of the total number of failures for a specified population, to the total numbe f operatino r e gsam th hour er fo populations . This definition inherently assumes thae failurth t e populatios i n exponentially distributed. Another ite f interesmo a s i t listing of the separate failure modes. This listing provide e numbeth s r that failed e percentagth , f failureo e s confidenc% 95 d an e% 5 interva a r mode pe d an l, aroune th d failure rate mean. In addition to failure data, repair data is also provided in the form of mean-time-to-repair based on a log-normal distribution.

159 One of the most important aspects of the reliability database is quality assurance of the data entered. The data gathered must provide a consistent picture of the operation of components and systems being addressed. In order for CREDO to provide multi-site data, it is obvious that an underlying consistency and uniformity in both nomenclature and component definitio s essentiali n e CHECKETh . R program systematie isth user fo d c checking suc verificatios a h r fo n spellin keywordf o ge rang th numerica f o ed san l value. This program flags any missing or incorrect data. A data screener re-check addition si computerizee th o nt d checking. This is necessary because much of the supportive information concerning the description of a component and its history of operatio e reflecte ar ne narrative th n i d s includel al n i d three types of data collected. Such logical checking requires the attention of a specialist employing good engineering judgement.

DATABASE APPLICATION e systemTh e sMONJ th mode Uf o l plan s beeha tn constructed based on a large fault tree-small event tree method e systeTh . m fault trees which involve more tha4 10 n fault events, were reviewed to obtain a list of components and failure modes e resultinTh . g liss categorizewa t d an d use o request d t reliability datae reliabilitTh . y datr fo a LMFBR-specific components are extracted from the FREEDOM/CREDO system. In addition, extensive data gathering and processing of generic components such as electrical component d water/steaan s m components have been performed from other existing databases e collecteTh . d dats i a compiled to quantify the failure events included in the systems modelr multiplFo . e data sources e geometrith , c averaging technique has been applied. In the FREEDOM/CREDO database application to the MONJU e followinth PSA, g treatmen s utilizedi t e faulth : t tree mode s developei le detaith f o thao t ld e t th usen i d database. Consistency of the component boundary is essential to avoid overlap or omission. Therefore, in some cases e faulth , t tres adjustewa e e o confort dth o t m developed database. This kin f feedbaco d s necessari k r fo y reliabilitbettef o e rus y data CREDe Th .O staf ensures fha d consistenc reportine th n i y5 dat4 f go f defininy ao b t se ga generic components since the definition of the term "component vary "ma y from sit siteo et . Also, the definition of failure is an important aspect. A failur s sometimei e s caused e outsidcomponenth f o e t boundary and defined as secondary failure. A secondary failure is often caused by a loss of driver power, flow control valve abnormality due to variation in the media pressure, etc .primary/secondarA y failure fla attaches i g d e databaseith n . This informatio s usefui n r searchinfo l g cascade types of dependent failures.

160 e componenTh t failure/success criterio a faul n i nt tree analysis depende failurth n o se modd failuran e e severity. The failure modes are defined by 35 types of keywords in the CREDO system. Since there might exist some inconsistency betwee e failurth n e event modele a faul n e i dt th tred an e e keyworsystemth n i d, careful examinatio f bote o nar h required. Effective matching and categorization are performed base n o keyword d definition d sometimean s s involves readin e narrativeth g f eveno s t datae failurTh . e severity information are classified into three conditions: complete, partial d incipientan , . Suc a hcategorizatio n allowe th o use t e sapplr th mos yt appropriate failure/success criteria. Failure trend analysi s beeha s n performe n ordei d o t r examine the applicability of the database to the MONJU plant. The environmental effects and engineering parameter effects are of primary interest. The effects of environment on the failure rate have been examined for three types of valves: manual, motor-operated, and pneumatic valve. The medium processe s chosea primarwa d s a n y e concerth f o n environmental effect because utilizatio f o sodiun s i m specifi o LMFBRst ce comparisoTh . f failuro n e rates i s r representba show e n FigurTh i n% value 5 s. 2 e , meand an , % value9595 % valud san e% 5 e right fro e th lefe th mTh o .t are obtaine e chi-squarth y b d e estimation r lengtba e hTh . represents uncertainty range whic s controllei h e th y b d failure population s observei t I . d thae failurth t e rates are different between sodiu m s valvess valvei ga t d I an s. considered that this evidence is due to the difference of the design specification and operational environments. Another observatio e differencth s e failuri nth f o e e ratf o e valves with different actuator types. This difference in failur actuatoe th eo t ratre typedu mors i e e distincte Th . pneumatic valve is less reliable than the manual valve by an order of magnitude. The motor-operated valve is less reliable than manual valve by a factor of two or three. It is recognize e failurdth thao e differenct th e te du s i e causes in the actuator parts. It is judged that these two

Medium Actuator 5% Mea% n95

Sodium Pneumatic

Gas Pneumatic

Sodium Motor

Gas Motor

Sodium Manual

Gas Manual

10 1CT6 10-5 Failure Rate (1/hr)

Figure 2 COMPARISON OF FAILURE RATES FOR THE VARIOUS TYPES OF VALVES

161 effects are independent. Therefore the appropriate component failure rates are used in the reliability evaluation. The effect of design temperature on the failure rate of the motor-operated sodium valve has been examined. The result e show ar s n Figur e failuri n th . 3 f eAlmoso e l al t rates reside within a small range. A slight trend is indicated that higher temperature valves accompan highea y r failure rate. This is particularly for the valves whose design temperatur s abovi e e 650*C. They ten o havt d a e failure rate n ordea whic f magnituds o ri h e higher than those designed for lower temperature operations. Since the maximum design temperature of sodium valves for the MONJU plan less i t s than 650*C, thes excludede b datn aca .

Design Temperature (°C) 5% Mea% 95 n

650—700

590~650

540—590

480—540

-480

10~7 10~6 10'5 10"4 10 -3 Failure Rate (1/hr)

Figure 3 COMPARISON OF MOTOR OPERATED SODIUM VALVE FAILUR VARIOUE RATETH R SFO DESIGN TEMPERATURE

e effecTh f valvo t e failur th siz n o ee rats alsha e o been examined. It is observed that only a small failure rate trend exists for valve size. Therefore all the data can be applied to the MONJU valves. With respec o datt t a sources o apparenn , t trens wa d found. Becaus a date a populatio na specifi sizf o e c componen distributios it d tan n vary from sit s o siteei t t i , difficul o separatt t e suc n effecta h t thiA .s stagee th , whole data sources are included to obtain the reliability data. In the course of the MONJU PSA, some importance measures are evaluated to interpret the results. The uncertainty and sensitivity analyses show that the human error factors and dependent events have a significant effect on the results and have a relatively large uncertainty because of a relatively small population of data. The key components contributin e totath lo t gcor e damage frequency e alsar o identified. Hence, these components shoule b d given higher priorit n dati y a collection work. Collection

162 of human error event data is initiated in the FREEDOM database based on the human error check sheet. Though explicit common cause failures wert identifieno e e th n i d database, the efforts on the search will be performed for the potential common mode failures. Because of a relatively sparse data population, the use of generi e cinclusio th data d an f ,expero n t judgement, there exists a relatively large conservatism and uncertainty e analyseith n s performed e utilizatioTh . e specifith f o n c component failure rate o enablereduct e e erroth on es r factor of the results. The FREEDOM/CREDO database allows a detaile r fo d descriptio f componento n d associatean s d failure definition s judgei t I d sthae parameteth t r uncertainty has been reduced by the application of the FREEDOM/CREDO database e failurTh . ea spars ratf o ee componen s controllei t s operationait y b d l experiencee Th . accumulation of the operational experience is expected to refine the component failure rates in the FREEDOM/CREDO system.

CONCLUSIONS The FREEDOM database has been developed for the purpose of LMFBR PSA and improvement of operation and maintenance in existing facilities e internationalizatioTh . e th f o n database has been achieved by participation in the CREDO program operated by ORNL and now jointly sponsored by the U.S. DOE and Japan's PNC. Throughout the application of the CREDO system to the MONJU plants essentiai t i , o assurt l e qualite th eth f o y database, to keep consistency of data definition, and to investigate the failure trends. The detailed information includee FREEDOM/CREDth n i d O system allow e useth o st r analyze such multiple effects on reliability data. The accumulatio f operationao n l experienc r a LMFBRfo ed an s detailed investigation of the reliability database aids in reducin uncertainte gth PSAsn i y .

ACKNOWLEDGEMENTS The authors are thankful for the encouragement of R. J, Neuhold (DOE), H. Alter (DOE), and A. Watanabe (PNC).

REFERENCES (1) J. J. Manning, et al., "A Guide for Completing Input Data Form r CREDA Centralizefo s- O d Reliability, Availability d Maintainabilitan , y Analysis Center fo r Liquid Metal Cooled Reactor and Test Facility Components," ORNL/TM-9892 (November, 1986).

163 . HaireJ . n ExaminatioM "A , ) (2 Maintenancf o n e Activities in Liquid Metal Reactor Facilities: An Analysis by the Centralized Reliability Data Organization (CREDO)," Reliability '87 Conference. Birmingham, United Kingdom (April 14-16, 1987}. (3) B. L. Humphrys, "An Examination of Reliability Critical Items in Liquid Metal Reactors: An Analysis by the Centralized Reliability Data Organization (CREDO)," Proceeding e Internationath f o s l Conferenc n Faso e t Breeder Systems, Kennewick, Washington (Septembe- 13 r 17, 1987).

164 RELIABILITY DATA SOURCEE TH N SI PAKS NUCLEAR POWER PLANT

E. HOLLO Institut r Electricaefo l Power Research, Budapest J. TÖTH Paks Nuclear Power Plant, Paks Hungary

Abstract

In the Paks Nuclear Power Plant with four unit in operati- on there is a 10 reactor years operational experience. This fact make e sresulte operationa th th possibl e f o us s o t e l experience for probabilistic safety evaluations.

For safety evaluations up to nov; we used datas given by the supplie limitea wha- rs wa t d d datasourcan s, - eobtaine d from different existing dat ae world bankth n i .s e neath rn I futur r safetfo e y performance e woulw s d liko t e use plant specific datas, gained from the Paks Nuclear Power Plant.

This paper describe e existinth s g data sourcee Pakth sn i s Nuclear Power Plant, which contains information and statis- tical datas, necessary for safety evaluations. These sources are Incident investigation report Safety related event report Report of events with reduction of plant power Component failure data system (for a limited nunber of components).

Our futur eo o defin extract t tas s w i e necessarkho e th t y informatio d dataan n s froe differenth m - tex reporto t d an s tene componenth d t failue e maidatth n a l equsysteal r -fo m e ipmenplantth f o t.

165 duco r n t tio In 1.

In Hungary activities in probabilistic safety assessment of nuclear power plant started approx 4 year. s agos .A part of the level I PSA of Paks NPP several case studies have been performed. Parallely with performing level I PSA different particular system reliability problems have been analysed during the last two years, such as optimal test interval of the safety systems, possibility of maintenan- ce of the condenser cooling pumps during operation of the plant. There are some other problems which have to be sol- ved in the near future by means of reliability analysis. The r plantsafet ou s aproache f wa o sy a deterministi n i d c r operationaou n wayI . l manuals ther e severaar e l techni- cal specifications and limiting conditions of operation which are, we consider, very pessimistic. Some of these tech specs and LCOs might be overviewed using PSA tech- nics . For the above mentioned reliability and safety evaluations up to now we have mainly used reliability data taken from publications. e firsth f Sincte e o P Pak th starth uni NP p esf u o tt 9821 . (280 reactoc 1 ) de . r years operational experience have been gained .(Now there are four units in operation.)This could have been sufficient to feed back the operational experience and as a form of feed back, to use plant speci- fic data for PSA. Unfortunately not a total reliability data collection was initiated immediately after the start up of the plant.

Especially many problems we had concerning the reliability e componentsth dat f o a . n thiI s pape briefle w r y describe those data sources which contain information necessary for PSA calculations and our futur ee fieltask th f dat o dn i sa collectio evaluatid an n - f oreliabilito n y data sources.

166 2. Existing Data Sources

e presenth At e Pakt th tim s n i eNuclea r Power Plant there are several incident and malfunction recording systems. These report systems were establishe o t providd e informatio e operationath r fo n l organizations e timth et A . of the formation of the requirements for the form and contentn generai n i t e f no theso ss us l wa e A reportPS e th s Hungary. Therefore such points of view which could guarante e usabilitth e r PSAfo y , coul t havno d e been taken into consideration. Nevertheless these reports contain a lot of useful information for safety evaluations. Just e prope th shouly wa o re extract found b dw d evaluatho an , t e the information from the incident reports. e componenth s a r t fa Asfailur e reporting systes i m concerned, the situation is worse. The component (or equipment) failure recording system, establishee th t a d Paks Nuclear Power Plant after the start up of the first units was, one could say "too simple" and inhomogenous. All the different maintenance organizations (mechanical, !<&C, electrical) recorded failure information in different way concerning both the form and the content. The basic informatio e calculatioth r fo n f reliabilito n y parameters of the components were not recorded or were recorded in an insufficient way r thi.Fo s reaso a fairlnsyste w ne ym must be established t fulge l o t failur, e statistice th f o s components. The concepts of such a reliability data system were describe e authorth y b f dthio s s paper abou yearo tw t s ago/Y/ Unfortunately durin e yearo las e th gdeveloptw tth s - e th abovmen f o e tmentione y wa dt a gonsyste no n i es mha and at a rate as we had planned it. This fact has first of l reasonal s concerning organizatio interestd an n .

The different kind of information originates within diffe- rent (most of the information at maintenance) organizati- s i ver t onsyI difficul. o forcteact d t an eh maintenance peopl o t collece d recoran t d information whic o theit h r opinio s i mostln y unnecessary more Th e.

167 organizations are envolved in the data recording, the less e accurac th e recordeth f o y d dat. is a

For these reason in January of 1988 we started a limited scope data recording system for a limited number of compo- nento calles ( s d stan y b safetd y systems), e b whic y ma h operated entirely by only one organization which is inte- e resteaccurac th e collecte n th i d f o y d data.

Now we would like to describe very briefly those types of reports which in some way could be used as reliability data sources, includinlimitew ne e d th gscop e component failure recording system.

2.1. Incident investigation report Safety related event report

Incident investigation must take plac n casei e , when a n occurence is classified by the electrical network dis- n patchea "incident s a r ( "losf power-productioo s n event ).

The requirements to the content of the report is descri- n bei Appendi d"incidente Th . A x " classificatiot no s i n e definefactth y ,b dwhethe e nucleath r r e safetth f o y plant is concerned or not.

s i e consequencedefineth t I y b d s froe operationath m l point of view of the electrical network.

Therefore for those cases when the occurence is not classified as an incident by the network dispatcher, but the nuclear safety is concerned, a so called safety related event investigation must take place and a report mus e writtenb t .

The content requirements of the report is described in Appendix B.

168 As we can see both kinds of reports contain practically the same information. In both reports there may be found the descriptio e initiath f o l n state a detaile, d description of the event sequences, evaluations of the event, descriptio e operatoth f o n r actions, human respon- sibility and the necessary measures to be undertaken.

2.2. Load reduction report

The load reduction report system actuall e firsth s ti y e th equipmen forf o m t failure reporting systemn u t Bu . fortunatelly this syste s i expandem d onl r thosfo y e equipments whose failure causes load reduction. Therefore good statistics may be obtained only for those component, any failure of which causes load reduction. As far as this recording system - like the incident reporting sys- - tehavm e existe e dfirs th sinc f e tstaro th uniep u t t e plantth of , e thesuitablar y r evaluatiofo e e th f o n probabilit f somo y e initiating events.

But for calculation of component reliability parameters the data collected in this system are still not adequate.

2.3- Failure report mentiones wa t i As d earlier n Jani , .failur 1988w ne a e. report syste s starte a mlimitewa r fo d d numbe f systemo r s and components, with limited possibilities. For basis of this systems serve e periodicath s e safetl th tes f o yt systems and, some automations and protections. The safety systems and the main automations and protections are tested once during six weeks according to a schedule for a whole year. After each cest performed a test report has to be written (see Appendix D), wich practically serves as an official document. Report must be writte n thosi n e case s wella s a t , wheno e tes th s ni t periodica a specia t bu l l one r exampl,fo e afte e repath r - ir of a main component of the safety system.

169 Special test must be perfomed for two operable safety systems in the case, when one of the three systems is inoperable during a period of time not exceeding 24 ho- , toos ur .

n I case, when durin e tesequipmeny th gan t t failsa , failure repore filleb n o (sei t dt s efor Appendiha m x y B meanE)f o thi. s s data recording systee th m reliabilit f o thosy e component e evaluateb y ma s d which are characterised by failure per demand. Systematic documentation of the performed tests and detected failures will assure the accurate number of failures and l demandcomponentsal r fo s . f Generio e d PlanUs an c . t3 Specific Data

As was indicated in preceeding chapters for safety evaluations up to now data obtained from different existing data banks and generic data files have been used. Plant specific data e suppliegivetb y b n r extracteo r d from plant operational statistics wer specifiw efe usen i cd cases.

For compilatio d automatisean n d retrieva f generio l c data a computerized dat . Presentl aZ bas p s u i beinee t th y se g data base involves INITIATING EVENT AND COMPONENT FAILURE DATA files. INITIATING EVENT cathegories are: LOCA and TRANSIENT ones. COMPONENT FAILURES are grouped on - types, as TECHNOLOGICAL, ELECTRICAL, and C/I failures, - modes, as STAND-BY and OPERATIONAL ones. For combination of data from different sources simple avarage rule using weighting factor s usedi s . Files listed presently contain information published in following reports :

WASH-1400 Reactor Safety Study , 1975 GRS German Risk Study , 1979 NUREG-2815 PSA Procedures Guide , 1935 NUREG-2728 IREP Procedures Guid , 193e 3

170 NUREG-3862 Transien E FrequenceI t , s198 5 EPRI-801 ATWS Frequencies , 1978 ANO-1 ARKANSAS IREP Study , 1982 RKS 85-25 Reliability Data Boo, 1985k NKA SAK-1 PRA Uses and Techniques , 1985 (A Nordic Perspective) EUR 10696 CEC Benchmark Exercise , 1986

For of compiled generic file structures a sample case sub-file is given in Appendix F.

Plant specific operational and failure data have limitedly been e followinth use n i d g areas:

o t defin - e mean time between failure averagd an s e repair times r condensefo , e.g. r cooling pumps within their maintenance policy study, - to formulate auxiliary assumption in numerical data form for given calculation, e.g. for FRANTIC code to define q. unavailability of test override capability within safety system test period optimization study, - to screen causes of plant outages and load reductions, to estimate distribution of failures within different failure mode d systemsan s , - to verify a - priori assumed event sequences through operational tests or real cases , e.g. to make clear mission times within reduction of feedwater event sequence study, to establish realistic success criteria for redundant safety system trains, e.g. within smal d largan l e LOCA event sequence studies.

It is emphasized that plant specific data from Paks NPP were use n i abovd e listed cases a ratheonl n i y r limited scoppe for PSA purposes, and in the future a more systema- tic data acquisition, processing and retrieval system is necessary.

171 n . Gonio 4 s elu

Data containe n differeni d t plant reports describen i d Chapter 4. involve a lot of information which are necessary and/or A purposesPS usefu r fo l . These type f dato s a potentially availabl e summarizeb n ca e s followsa d .

Typ f Reporo e t Involved Data Available for PSA 1. Incident Investigation Report, a/ Initiating Event Safety Related Event Report - identification - frequency Limitation: Only for / Evenb t Sequence - network operation or - identification - safety related sequences - time scaling c/ Human Errord an s Recovery Action

2. Load Reduction Report a/ Initating Event Limitation: Onl r componenfo y t (see 1.a.) failures wbich result load b/ Component Failure reducn tio Paramerters - failure rate, outage time - failure mode (Limited) c/ Personnel Action

. Tes3 t Report, Failure Report / Componena t Failure Parameters Limitation: Onl r testefo y d - failure per demand safety systemd an s probability components - failure modd an e cause failur- e identification mode b/ Component Repair Rate

172 Considering data listed abovo maitw en conclusione b n ca s drawn :

1. Operational experience recorde n differni d t plant reports durin e pas th reacto0 g 1 t r years involve more informati- opurposenA usefuPS r sfo l then o whanowt s use p wa u td . The main reason for limited application is the huge man- power require o t manualld y retrieve information from existing data sheet .

2. There is a need for computerized storage, processing, and retrieval of data contained in the reports described in present r paperfo extensio s a wels ,a l f scopo n f o e p compiled data useable for reliability and probabilistic safety assessments. For this purpose a computerized reliability data base softwar s i undee r development within VEIKI and PAKS NPP cooperation. This work is partly supported by the IAEA through a research contract, (see Ref.X.)

REFERENCES

- E.HollôY , J.Tôth: Current Activité Futurd an s e Trendn i s n i Hungary A PS d , Ran AIAE MeetingC T A , Vienna, Austria 25-29 Nov. 1935.

- DevelopmenX f o Method t d Procedurean s r Collectiofo s n and Analysi f o r DatProbabilistifo s a c Safety Assessment, IAEA-VEIKI Research Contrac . 4855/RBNo t , 1987

- A.VânkaiZ , E.Hollô: GRD - BGeneri c Reliability Data Bank, IAEA Worhshop, Seregélyes, Hungary, 7-11 Sept. 1987

173 Appendix A

Incident investigation report form

. Identi1 f cation number: . Uni2 t numbe) (s r

3. Title of the incident - reactor protection I. II. III. IV. - turbine protection - electrical protection - other:

. Beginnin4 e incidentth f o g : End of the incident: Duration of localization : Duration of restoring :

. Los5 f electro s . production: ...... MWh Loss of heat production : ...... GJ Power deviation from the plan average : ...... MW max. :...... MW

. Classificatio6 e incidenth f o n t

. Discriptio7 e incidenth f o n t 7.1. Initial state (deviation from the normal state) f detectioo y 7.2Wa . n 7.3. Discription of the event (detailed)

8. Evaluation of the incident 8.1. e incidenCausth f o e t 8.2. Actuation of the controllers, automations, protections, alarms 8.3. Evaluation of the operator actions

174 . Equipmen9 t failure

10. Method of the equipment repair 11. Personnel responsibility 12. Measures to be taken . Necessar13 y special expert investigatio e takeb o nt n . Othe14 r comments 15. Investigation is finished (date) . Investigatio16 n commission (names, signatures) . Appendice17 s

Appendix B

Safety related event report

Ident. number

1. Unit : 2. Title:

3 . Beginning of the event End of the event

4. Initial state (thermal power, electrical power, core average temperature increase, boron concentration, control rod position ...)

. Descriptio5 e eventh f to n (detailed)

6. Evaluation of the event Cause of the event Actuatio f alarmso n , controllers, automations, protections

7. Operator action 8. Measures to be taken 9. Investigation commission: (names, signatures) 10. Apendices

175 AppendixC

NPP PAKS load reduction Unit report Event title:

Protection: Signal:

Beginning of the event : month day hr. rain, evene th tf o d En month day hr. min, Duration hr. min.

Reduction max: MW aver.: MW Los f productioso n MWh 1. Incident . Primar1 y side Malfunction . Secondar2 y aide •P 2. C3 3. Operative maintenance I C . 3 ü 4. Planned preventive maint, Electrica. 4 l 5. Other 5. Auxiliary •cHa 6. Network demand 6. Chemistry m aj 7. 7. iH 8. 8. o 9. Othe. 9 r 0, No classified fielo H , d0 concerned

1. Design r(Da 1. MGP 3 2. Manufacturing mounting G S . 2 «j Pailur. 3 equipmenf eo t o 3. Turbine, ovcrheater 4. Quality of documentâtion Q 4. MIV 5. Human error p, i. 5. HP preheater Tes. 6 t •H-CJ 3 0) Diese. 6 l generator 7. Repair failure equipmenV Dk 1 «6 . 7 t Othe. 8 r 0 h 8. Generator, exiter 9. Unknown Transforme. 9 r Networ, 0 k demand 0, No equipment concerned

Equipment actuation: Personnel activity:

Restoration of the initial state:

Comments, proposals:

Pilled in by; Checked by:

176 Appendix D

Unit : Interlock. Protect ion: TEST REPORT

PERIODICAL - SPECIAL: Cause:...., Interlock. Protection: Idem; : . ....

1. Dat f tes o : e ...... t ...... monthyr ...... day

. Failur2 e found during

Maintenance before test Measure undertaken

3- Failure found during test Measure undertaken

4. Qualificatio f teso n t results:

5. Necessary further measures:

6. Initial state restored:

Techn. Dep :. . , C I: Electr Signatures

177 Appendix E

FAILURE REPORT

Component : Ident. code:

Dat f failuro e e month day nr. min. Beginning of repair yr. month day hr. min . End of repair yr. month day hr. min. Start of operation month day hr. min.

Failure mode: Cause of failure:

Act ive: * Fails to start * C I * Fails to stop * Electrical * Spurious start * Mechanical * Spurious stop * Des ing * Fail o opet s n * Manufacturing * Fail o clost s e * Mounting * Spurious openning * Operation * Spurious closing * Repair * Test Passive: * Leakage * Metallurgical * Rupture * Unknown * Deformation * Other * Plugging

Failure detection: Consequence :

* Test Los f systeo s m f Preventive maintenance function * Sound/light alarm Loss of subsystem Abnormal state function indication Failure of other * Routine checking component Load reduction MW Loss of production MWh Measures undertaken Generator switcf of h Reactor shut down o consequenceN * s * Change of part * Other * Repai f paro r t * Total change * Desing modification * Temporary repair * Other

Date: Signature :

178 Appendix F COMPONENT STAND-OY FAILURE DATA

Component Type: TECHNOLOGICAL COMPONENTS

No. Component Name Failure Mode Type Mean EF HTTR Source

1. Pumps 1.1. Motor-driven 1.1.1. Failure to start 3 3.0OE>03 10 3 3.00E-03 10 NUREG-2728 2 1.00E-0S NUREG-2815 2 4.00E-05 A SAK-NK l 3 3.B0E-03 5 EUR 10696 3 1.20E-03 3 HASH-1400

1.2. Turbine-driven 1.2.1. Failur o start e t 3 3.00E-02 10 3 3.00E-02 10 NUREG-2728 2 1.00E-04 NURZG-281S 3 1.20E-02 3 EUR 10696 1.3. Diesel-driven 1.3.1. Failure to start 3 1.00E-03 3 3 1.00E-03 3 NUREG-272B 2 1.00E-06 NUREG-2815

1.4. Centrifugal , hor/vert, 75-250kg/s.0,3-0.9MPa 1.4.1. Failure to start 3 3.90E-03 3 3.90E-03 RKS 85-25

1.5. Centrifugal. hor/vert. 30kg/s. 2. 2-6.7HPa 1.5.1. Failur o start e t 3 1.40E-03 3 1.40E-03 RKS 8S-25

1.6. Centrifugal, hor/vert. 1 20- 240kg/ s .1.2-1. BMP» 1.6.1. Failure to start 3 5.10E-03 3 S.10E-03 S 85-2RK 5

INITIATING EVENT ANNUAL FREQUENCY

IE Type: LOCA INITIATORS

No. IE Definition F E MeaSourcn e

1. FLOS RC LOSW F SO 1.1. Loss of RCS Flow In 1 Loop 1 4.40E-01 4 4.40E-01 4 NUREG-2815 3.9ÖE-01 EPRI-801 1.2. l Loop S Al Flo RC Losn s I uf o s 14 2.80E-02 4 2.80E-02 NUREG-2814 S 2.00E-02 EPRI-801 2. LEAKAGE IN PRIMARY SYSTEM 2.1. Leakage fron Control Rods 4 2.30E-02 4 2.30E-02 4 NUREG-2815 3.00E-02 EPRI-801 2.2. Leakag Primarn I e y Circuiting size) 5 1.10E-01 4 1. ICE-01 4 NURF.G-2315 9.00E-02 SPRI-801 2.3. Large Lea n Primnri k y Circuit 1.00E-04 2.70E-04 CKG 2 - inc 5 hC. 1 .0CE-04 W ASHO 0 -U 10 - 13.5 inch 1.23E-0S ANO-l greater than 13 5 inch 7..WE-«lf. ANii-1 2.4. Medium Lea n Primari k y Circuit. n.floE-« 4 -0 E 8.«W ORS 2-6 inch n.OaE-04 WASH-;4rio 4-10 inch 1 .COE-04 AHO- J 2.5. Snail Ltfc n Primari k y Circuit 1 . (WE- 03 Z.VPK-03 GRS 05 - 2 inch : .isiE-an WASH- 14 11*» tf.38 - ] 2 inch 2 WE -02 ANC- 1 O IncC 1 h - 2 1 3 lOE-fU AN''i-l 1.64 - 6 inch 3 M'r-iK i-' lAN

179 RELIABILITY DATA ACQUISITION I CEGB NUCLEAR POWER STATIONS

. WELLC S Central Electricity Generating Board, London, United Kingdom

Abstract

The Central Electricity Generating Board (CEGB) has two computerized databases currently in use for obtaining reliability data; the scope of one of thes abousubstantialle s b ei o t y increased Plane Th .t Reliability/Availability (PR/A) system logs predominantly availability data, i nvera y comprehensive conventionamannerl al r ,fo nuclead lan r power stations (approx. 50) within CEGB. Some reliability data is logged, but it is of little relevance to Probabilistic Safety Assessments (PSA) . The other database is the Nuclear Plant Event Reporting System (NUPER) which records safety related events onlt ,bu significance y e importanth thos th f o t ea d ten e spectrum e formeTh . entirel s i r y quantitative, whils e latteth t mainls i r y text.

Starting in January 1988, detailed reliability data on all nuclear safety related plants will be logged by the first of these systems. To begin with this will be on only one power station, but it is intended that it will extendee b concretl al o t d e pressure vessel station 2 nuclea(1 s r unitse th y )b end of the year.

A unique safety system list is needed for each station, as these are all substantially different from each desig o othet e rndu evolution. Each lis orderes i t d accordin o importancet g , wit e intentiohth beginninf no e th g data collection only for the top items but gradually extending downwards. Each list contains approximately fifty items, eacn a whicf ho f mado s i hp eu indeterminate but large number of components, It is intended that the reliability informatio e collectenb e "itemth t a "d level, albeit wite hth component intitating each fault identified. Thi dons i scontaio et e th n magnitud e tha practicablee on tass i tth o kt f eo .

All faults occurring during operation or discovered by surveillance activities are to be logged. Additionally, all unavailability due to maintenance and testing will be recorded. These activities depend strongly on the enthusiasm of the station personnel; namely the operations and the maintenance engineers speciallA . y designed reporting for beins i m g produced for these two groups, to be filled in by the respective supervisors at the end of every shift. This will be obligatory, but even so it is anticipated that e informatioth som f eo n wil e incompletelb n ordeI .encourago rt bettee th e r reportin f failuresgo obtaio t missiny d nan ,an g data retrospectivelyw ne ,a appointment will be made at each station. This "Information and Feedback Engineer" will have no responsibilities other than the handling of safety related information.

It is intended that the fault and availability information will be used e productiointh safetf no y system indicators e firsth tn i , instancet ,bu ultimatel stationsPSA'e n i yeacth r sfo f ho .

181 SOME PROBLEMS WITH COLLECTION, ANALYSIS AND USE OF RELIABILITY DATA

. KUBIJ E Central Electricity Generating Board, London, United Kingdom

Abstract

Typical problems witcollectione th h reliabilitf ,o analysie us d an sy dat discussede aar .

argues i t I d thae collectioth t reliabilitf no e b o yt dat s aha selective, and that insufficient attention to this selectiveness is responsible for the majority of problems with the collection of data. The collection of reliability data must be carefully planned and undertaken by dedicated, well-trained and we11-motivated staff.

The reliability data must be analyzed, tested and used as carefully and cautiously unded ,an same rth e discipline othes ,a r engineering parameters.

1. INTRODUCTION

In this pape wilI r l highligh commoe t th som f neo problems associated witcollectione th h f reliabilit,o analysie us d san y data. This is not a comprehensive survey; rather this is a selection of the various problems I have encountered during my work in safety assessment.

Reliability dat e generallaar y require r threfo d e differentt ,bu related purposes:

(i) to learn from the past, i.e. to ensure that past problems are not repeated, (iipresente chooso t th ) t ea , i.e ensuro .t e that adequately reliable components and systems are used, and (iii o forecast ) futuree th t , i.e develoo .t p modelf o s component and system failures and to assess their reliabilit rise th k d thean y y impose.

I believe that becausdifferene th f eo t requirements there cannoe b t a universal method for data collection, analysis and use, but only an appropriate method, and this should be devised to deal with our particular application or problem. Thus, for example, quantitative reliabilit ye appropriat b dat y ama reliabilitn ei d risyan k assessment, but they are not particularly useful for design development and product improvement. On the other hand, qualitative datsuitable ar a r desigefo n developmen producd an t t improvement, but useless in reliability and risk assessment.

183 I will discuss the various problems under three different headings: - problems due to collection of data, - problem analysio t e evaluatiosdu d san f datano , - problem f datao retrievao t e e .us du s d lan

2. COLLECTIO DATF NO A

It mus appreciatee tb d tha cannoe w t e tth date collecl th al a l al t time. Suc approacn ha h practicable e b woul t no d woult i ; d placn ea unbearable strain on the collection system. It is inevitable that e wil w e insufficienl th e selective b havs i o t et i d t,an attention to this selectiveness whic responsibls i h majorite th r efo f y o problems with the collection of data. Since it is impracticable to hav all-embracingn ea , universal collection scheme e hav,w o et selec have w decido - t e whicn eo h aspect concentrateo st : which plant to collect the data from, which components and systems to include, how to define failures, which non-failures to report, etc. This selectiveness must not be ad-hoc or considered only as an afterthought. It must be regarded of fundamental importance in devising and designing adequate collection systems.

t believno Thus o d eI , thaobjective th t f dateo a collectioo t s i n collect the maximum amount of information, but rather the objective must be to collect the relevant information. Hence, we have to e collectin beginnine decidar th whar e w t fo a etdate y d th gwh gan a purpose. Obviously, computerisation enables mor mord ean e dato at be handled, but it should be appreciated that data collection is much less ameanabl computerisatioo et n than r example,fo , data analysis and retrieval.

Insufficient consideration of what to collect and why can lead to the following problems witcollectioe th h f datano : ) insufficien(i t information collected, (ii) inconsistent information collected, and (111) unreliable information collected.

2.1. Insufficient information collected

This follows practically always fro badlma y executed preliminary analysis of the need for the data. Typical omissions, which may make a particular data collection less than useful, are as follows:

underlyine th - g e failurecausee failurth th f d so san e mechanisms, - the consequences of the failures, - the operating and environmental conditions, perioe th - d over whic e datth ha have been collectee th d an d behaviour and history of the component or system in question.

The last aspect is of a special importance if, for example, quantitative reliability datt sufficiene requiredno a ar s i t I o .t know how many times a particular component has failed, we also have to knot failemanw no who y s dtime ha whe t i sn called upoo t n operate, etc. Thi obviouss i s unfortunatelt ,bu alwayt no y s appreciated or collected.

184 2.2. Inconsistent information collected

This, once again, usually follows from a less than thorough preliminary analysis. Comprehensive, but inconsistent collections may appear superficially adequate, but a more detailed analysis of the data (whic s invariabli h y undertaken much later) then reveals many hidden shortcomings. Unfortunately o lat to y o thet e ma e nb t ,i amen collectioe th d n system.

Typical problem s followsa e ar s :

- inconsistent definitio f componentno d systemsan s (especially definitioe ith n boundary)e th f no , - inconsistent definition of component failures. For example, what constitutes a failure - a pump not starting on the start-signa t startinno r lo g withi second0 3 n f initiationso .

Problems can also arise if a particular collection system is based on a physically incorrect model. The collection requirements may be o strongls y demande driveth y nb f this o s particular model, thaf i t the model is then shown inadequate the collected data may not be appropriate for any other purpose. This is particularly true when data are collected on rare events, such as dependent failures, etc.

2.3. Unreliable information collected

We have to know how reliable and error free is our particular collection system mose th t. e difficulb Thin ca s t proble f datmo a collection. It can be partially dealt with by having an adequate in-built QA scheme, but this in itself may not be sufficient. What is of primary importance is to ensure that the data are collected by dedicated, well trained and well motivated staff.

3. ANALYSI EVALUATIOD SAN F DATNO A

The problem thin si sconvenientle b are n aca y discussed undee th r following headings:

(i) insufficient understanding of the failure mechanisms, (ii) insufficient distinction between the various sources of data, (iii) statistical shortcomings, and (iv) bias in evaluation.

3.1. Insufficient understanding of the failure mechanisms

Many problems have been observe thin i d s area r exampleFo e . th n ,i case of dependent failures the analysis may be particularly strongly model-driven e scarcit Th e dat .they th a ma n f yo mak e eth phenomenology of the failures appear more important than their mechanism. Thin thesca n lea problemo dt s whemodee nth s i l extrapolated to different situations.

Another exampldifference th s i e e between time-dependend tan demand-dependent failures. If this difference is not appreciated d understoodan incorrece ,th t assumptio time-dependencf no y yma lea unrealistio dt c expectation f increaseso d availabilitf yo stand-by systems postulated by their more frequent testing.

185 3.2. Insufficient distinction between various sources of data

There are many sources of reliability data and they all should be considered. However, the limitations and the benefits of the various data sources mus takee b t n into account typicae Th . l source reliabilitf so y: date aar - operational data, - field trials, - laboratory testing, - generic published information, - expert opinion.

All these sources can provide useful information, but only if used correctly generalls i t I . y accepted that operational dat e mosaar t appropriate. The advantage of field trials and laboratory testing is that various parameters can be varied, but the limitation is that important operational factors may be missed. This again shows that field trials and laboratory testing must be carefully designed and controlled.

advantage Th generie th f eo c published informatio s thadati e n th ta are usually conveniently available, and some of them may have been endorsed by virtue of being used by reputable organisations. However, the main disadvantage is that the primary sources of the data are not always given and thus not open to scrutiny. Hence the generie statuth f o sc published informatio uncertaine b y nma d ,an informatioe th f o e thpurposer eus nfo s different than those initially envisaged may be inappropriate and possibly misleading.

The use of expert opinion can be contentious. First, some people finwhole th d e philosoph Bayesiae th f yo n approach flawed. However, I do not think that this is the major problem. I believe that the second aspect of this approach causes much greater difficulties - the credibility and the expertise of the experts.

It can be dangerous to use either anonymous experts or well known experts with expertise which is irrelevant to our problem. We must always ensure that we know who the experts are, what are their credentials and what are the bases for their opinion. We must not forget that experts frequently over-estimate their knowledgd ean that, becaus f theieo r backgroun contactsd dan e b t ,no the y yma giving independent advice. Expert opinion should be tested as any other source of reliability data, and not accepted uncritically.

3.3. Statistical shortcomings mose th t f commoo e On n examplee th f o f thi so e sus problee th s i m media distributioa f no n insteameane th .f do Sinc r certaiefo n distribution numericae sth l difference b n ca e o betweetw e th n considerable confusioe ,th lean difficultieso nca t d .

3.4. Bia evaluation si n

The whole process of data collection and analysis is rather time-consuming. In order to save on time and effort we may be more prepare accepo t d t without further analysis those results which appear reasonable, and only analyze further those results which do not conform witr experiencehou . quite Thusar e ,w read o accepyt t

186 withou mano to ty questions wha considee tw r normal, without perhaps appreciating thar assumptioou t e justified b normalitf no t no y .yma

4. RETRIEVAL AND USE OF DATA

After collection and analysis the reliability data become available r retrievafo used lan . Sinc e date commonlth ear a y use groupy b d s different from those responsible for collection and analysis, the design of the appropriate retrieval system also deserves careful considerations. It is not sufficient to give just the reliability data e rang;th validityf eo operatine ,th g conditione th d san limitatio date th a f musno givee tb n too.

s suggesteIwa t Section i d tha2 nobjective th tdate th a f eo collection is to collect the relevant information (as opposed to the maximum amoun f information)to . However e desige th ,th f no retrieval system must follo differenwa t philosophye th l :al information collected mus available tb r retrievalfo e . Hence, computerization of the retrieval system is required.

If the collection system is designed to give detailed descriptions mechanisme causee th o th fd san f componenso d systetan m failures, the data can be used purely qualitatively. Such data can be used most effectively in design development. Thus, for example, we can use the data to re-design a particular component or system to ensure that particular failure eliminatee sar t leasa r tdo made acceptable. It must be stressed that to be suitable for this purpose the database must be carefully designed. For example, it is not sufficient to give numerical values of reliability; good qualitative descriptio failuree th f no s mus alse tb o given.

As suggeste Section e reliabilitdi th , 1 n y dat e mainlaar y used quantitatively - either in the design stage or the evaluation stage. There are some important differences between the two applications, but they are in many respects similar and inter-related.

mose Th t important common proble decido t s i me which reliability data should be used. Do we use the data from historical databases, or do we take into account technological progress. There are good arguments for both approaches. For example, the use of the historical databases will indicate how wel have lw e used proven technology. This will direca giv s eu t comparison with other design ssame baser th similaeo n do r technological developments. othee th rn O hand technolog o leard s advance yha e n w frod r an dmou past mistakes. Thus some improvement in availability and reliability of various components and systems is to be expected. thes Ii t n argued that shoul made db e awar f thiseo o ,s that the e reminde yar betteo d o t dpastre th tha n .i n

I believe that the latter approach is appropriate and legitimate and should be used, provided that:

- there is evidence that over the years the reliability and availabilit componentf yo systemd an s s have been improving.

187 - this observed and documented improvement, rather than a postulate hopea r d(o d for) improvement cautiousls ,i y taken into account, - the targets for improved performance, reliability and availability are challenging, but realistic.

It canno over-emphasizee tb w importandho above tth e conditions are. targete th t Ifollowe fno f variour i thefo se d ar yan d s improvements become divorced from the reality, the credibility of the whole approach is lost.

This implies that, once again, only appropriate reliability data should be used. As in the collection and the evaluation of data, the use of the reliability data must also be planned. Using the dat ad-hon isolation i a n i c d mannenan r wastee s th muc f ho considerable efforthein i t r tpu collectio d evaluationan n ca d an n lead to distorted and uneconomic designs.

5. CONCLUSIONS

The collection of reliability data must be carefully planned and undertake y dedicatednb , well-traine well-motivated an d d staff.

e reliabilitTh y data mus analyzede tb , teste used carefulls an da d y d cautiouslyan unded ,same an th re disciline othes ,a r engineering parameters.

Acknowledgement

This work is published by permission of the Central Electricity Board. However viewe ,th s expresse authoe those th ar df reo alone.

188 PACS PROGRAMM PROJECE— ANALYSIR TFO F SO COMPONENT SYSTEMD SAN NUCLEAF SO R PLANTS

S. CURCURUTO, G. GRIMALDI Italian Directorate for Nuclear Safety and Health Protection (ENEA/DISP), Rome, Italy

Abstract

Objectiv e PACth S f o eProqramm o evaluatt s i o e clal f abnormao n l events on desig d riaan lg n La In improvement nI I NPI' i i operationr f j k st ba r sfo , purposes,

low threshold events will ho analysed wJ Ih stal isljcal melhodo loqy, a moi u evaluatt d e re.liabi lily parameter omponanl< f o s d systeman s s

Results of analysis will be stored in a computeri/ed data baso, und updated Lime by tjino, as now oporaL L n rial dala will be available

Some resullh of PGn s Lud i es, already pi1 r formed, will be revh.ed uLili/inq p^-inL spécifie data, drawn oui by PrtCtt pnx^i-Miiiiiie

1. Objectiv d Scopan e e

Objerlive of the PACS proqranime is lo cvaluale, in f\ syslemal i( w<:iy, lha (jpor'atiriq cjxpari arice (o.e.) of Italian planlj in opérai i on, for bark f J Ltinq purposes sind desiqn improvemenl s of new pLanls.

I irst of all, dc\la of Colors o I3WR ploint will bo analy/ed, taken into drcounl the following:

mose th thit s rerenli s " Jtalian plan n operationi t ; most of its o.e. is expec led wi II be applicable lo Monlallo HWR plant, now in cons trurl i on; a qi.ialily assurance (Q.A.) proqr-amm s implementewa o n Caorso d o plant froe beqinninqmth thao l s operationa,al t l data were

col lee led in a systematic way.

In ci second staqe data of the other plants in operation will be analysed.

189 Mol hudoloqy cine! software package are expected could bo applied to plants other (.ban m.u, I ear ones.

Furthermore- technical results CDU) d give some indication of behaviour of components used in conventjonal plants as well, at least for some selected failure mode-'*. Obviously different desig d opérâan n t Jonal criteria shoulo b d taken into account

Methodology of analysis will bo of both qualitative1 and quantitative typo o lhas , t firs y predominanb t t faHijro d failuran s e modes wilo b l searched, in a second s ! atjo data will be analy^od with sLrttisiical techniques, aime d fini t drolJabiJjL ou d y paramoLcr e arialy/eth f o s d parts.

He programmea resuls th f o t a ,softwar e packag r reliabilitfo e y analysis will be available and a data bank containing reliability parametars f toiiiponenl'o ) an

e softwarh I e package wil e developeb l n personao d l computer. Guided mannes wiI e providedb I , wit a hprovisio o updateL n , tim y timeb e , data entry o<; new dale» will become available. Jn such a way "living" reliability data wil e available;b l d indicatioan , f degradeo n d failure rate wil o drawb l n out, e basiifth f tren any,o sn o d analysis.

Some connections wil e establisheb l d with other l.l\IIIA/l)rSP activities, such as probabilistic safety studies (PGn), already performed for Caorso and flontalto plants, fiome results of PSA studies will be revised, utilising plant specific dala draw t froou n m PfiCC! programme1,

Mainl b wiljo y le I .h includ e followinh I e g steps:

definitio f componento n d system an o analysedsb e o basit sth n so , of the master part list of Caorso plant and the classifications alread n studiesyPS user fo d ; definition oF failure modes to be analysed, on the basis of design and real plant characteristics (i.e. only drift towards technical specificiation limit violations, instead of all events of drift, will be considered); definitio f modelo n s (i.e. component n operationi s n stani ,, by d etc; .)

190 developmen o softwarLh f o t e package, data entr d oulpuan y l formal, omponori< technica d o d ( an system, > t'u • I lo «s analysis o arih I d f o s lisu s ;o r f o o g ra o st plant bac k f J. l ti nq and desiqn modifications impj emonl al j on, if ciny

t Stud lo d Ongoini an P y 2g. Programme*

ft pilot study was performed manually on diesel generators of all [Lallan plants j ri operation, with the aim to orientate the entire proqrcxiniiic1, o improuL o plant e ariaJy/osafetth n o y d system <\n o dofjnt d o softwarLh e e resoiircas needed.

We anaJy/ed this system, as an exampJo of two different cond i l 10111. , a system in stand-by arid in operation. In ;>u<. h »A way we had a complete f possiblo q n i :e l ; l d ee mo d fai e mo r lu

f urthcrmore DOs arc one of the most import<\nl, safely related s

n fact[ , m^nA studiePS y s underlin e importancth e s performanceDG f o e ; in contributing to core damage frequency.

Data were arialy/o o evaluatt m de ai followin witth e e th h g parameters1

imauailabi 1 i ty on demand, reliability in operation.

e firsloth r t parameter e considerew , d all. °Aartup e dieselth f d o san s the failures to startup were

o seconLh r d Fo one e tim f th rea,o e l operatio f theso n e e engineth d an s pertinent failures to operate were evaluated.

Reliabj lity parameter d f singltotao san G lI) e ones were found out. Also homogeneity analysi f resulto s s for1 eac hn genera i plan d an Ll were performed o thas ,e influencth t f differeno e g charactei s , de tc i l s ri manufacturing and operation could he evaluated.

191 ns results u f (.ho analysis Iho frill owing aspects wore; focal i/od.

surveillance programme of Caorso plant is adequate; a better performanc e dieselth f o es coul o reacheb d d wita Lh h implement al i on of n prehoater system of Ihr lubrication oil; d i shomogene ily was found among tha 4 diosols of Cojorso plunL, ma inly for UG? ; crJtJral sub^ysLoms wor r eeac fo foun hr i ear diosofo ou d n d an l p l ani.

Furlhor studios are now in progress on.

dril'L of i ns IrumtjnUil ton of amorgoncy safely sysLoms of Caorso p l(\nt ; iiroii' i f f I l o uunJuc-:- i a m f o safel. y rolalod system f o Caorss d an o Irino p l an L

Average reliability paraiuoLoi-' l pressural f trumentalios o i in e s beeha n n ovaluaU'd und compared wil.h Lh(^ target ui IIIII'iOO. Mow spacific evaluation i « in progrès;', for each system, instrument type and manufacturing.

Analysi f valveo s s malfunction s recentlwa s y t thestarteA . . momenup d t r lassifica1 ion of valves is in progress, aimed to group valves according to system, type, si^o, manufacturing and environment condition.

192 IAEA'S EXPERIENC COMPILINN EI G'GENERIA C COMPONENT RELIABILITY DATA BASE'

B. TOMIC, L. LEDERMAN Division of Nuclear Safety, International Atomic Energy Agency, Vienna

Abstract

Reliability data are an essential part of a probabilistic safety assessment. The quality of data can determine the quality of the study as a whole .e datAmonth al al whicg e needear h r performinfo d studyA PS ,a g component failure data are the ones most frequently mentioned. It is obvious that component failure data originated from the plant being analyzed woul e mosb d t appropriate. Howevercasew fe sn i ,complet e reliance on plant experience is possible, mainly because of the rather limited operating experienc d usuallan e y limited numbe f failureo r r fo s meaningful statistics. Nuclear plants, althoug f differeno h t design, often e ratheus r similar components e experienc o th soms ,f o e e coul e combineb d d and transferred from one plant to another. In addition information about component failure s i availabls e also from experts with knowledgn o e component design, manufacturin d operationan g . That bring us to the importance of assessing generic data. (Generic is meant to be everything that is not plant specific regarding, the plant being analyzed ). The generic data available in the open literature, can be divide n threi d e broad categories e firse includeTh on .t s data base used in previous analysis. These can be plant specific or updated from generic with plant specific information (latter case deserve special attention). The second one is based on compilation of plants' operating experience usually based on some kind of event reporting system. The third category includes data sources based on expert opinions (single or aggregate) or combination of expert opinions and other nuclear and non-nuclea e generius o t cr s experiencei dat e a on source f I . s either directly or as a prior for updating, much information is required about the different aspects of generic data sources.

This paper reflects insights gained compiling data from generic data source d highlightan s s advantage d pitfallan s f usino s g generic component reliability data in PSAs. Considering current IAEA efforts to prepare a computer code package for event tree and fault tree analysis in personal computers (PSAPACK) and e associateth da reliabilit r neefo d y data base a compilatio, f o n published component reliability dats undertakewa a e IAEAth t a n. Somf o e e featuree th datth af o sbase , like codinth e g system, are, therefore directly governe e packageth y b d . f Ao toda se generith y c data base contains about 1000 different records, including practicall e componentth l al y s whic e accountear h r fo d studieA PS f Nuclean o si r Power Plants. Having in mind the goal of compiling data from many data sources, 20 sources have been included so far. The amount of information contained in the various sources is, however, substantially different. Some of the source differen0 s 18 provid o t p t u e records, whil source on s citee wa n ei d only two of the records. With many different sources providing different types of information, s necessarwa t i o t definy a unique e record form which would enable inclusion of information in a systematic and consistent manner and also user friendly for information overview and retrieval.

193 e recorTh d fors definewa m s havina d 1 lines2 g , characterizin0 1 g categorie informationf so . The IAEA Generic Data Base was created using the IBM-PC software dBASE III, so it can be stored in data base or in the plain text format. limitet no s o PASPACKTherefori t d e us s .eit During the development of the IAEA Generic Data Base insights were gained in how different data bases address different problem areas, namely: component boundary definition, failure mode definitio'n, operating mode definition, operating environment definition. These insights and possible way f avoidino s r solvino g g such problem e addressear se th n i d paper. e IAETh A effor o compilt t a generie c component reliability data base aimed at identifying strenghts and limitations of generic data usage and at highlighting pitfalls which deserve special consideration. It was also intended to complement the PSAPACK package and to facilitate its use. Moreover,it should be noted, that the IAEA has recently initiated a Coordinated Research Progra n Reliabiliti m y Data Collection, Retrievad an l Analysis. In this framework it is expected that the issues identified as most affectin e qualitth g f existino y g data bases woul e addresseb d d an d alternative solutions proposed.

1. INTRODUCTION

Reliability data are an essential part of a probabilistic safety assessment. The quality of data can determine the quality of the study as a whole. Among all the data which are needed for performing a PSA study, component failur onee eth sdate mosar a t frequently mentioned. It is obvious that component failure data originated from the plant being analyzed woul mose b dt appropriate. However w casefe sn ,i complete reliance on plant experience is possible, mainly because of the rather limited operating experienc d usuallan e y limited numbe f failureo r r fo s meaningful statistics. Nuclear plants, although of different design, often use rather similar components, so some of the experience could be combined and transfered e froplanon m o anothert addition .I n information about component failure s availabli s e also from experts with knowledgn eo component design, manufacturing and operation. That bring us to the importance of assessing generic data. (Generic is meant to be everything that is not plant specific regarding, the plant being analyzed ) . The generic data available in the open literature, can e b divide n threi d e broad categories e firs .e Th include ton s data base usen previoui d s analysis. plane b Thes n t ca especifi updater o c d from generic with plant specific information (latter case deserve special attention) bases i e seconcompilation Th do .e on d plantsf o n ' operating experience usually based on some kind of event reporting system. The third category includes data sources based on expert opinions (single or aggregate r combinatioo ) f o expern t opinion d othean s r nuclead an r non-nuclear experience. If one is to use generic data- sources either a prio directlupdatingr s a fo r r o y , much informatio s requirei n d about the different aspects of generic data sources. This paper reflects insights gained compiling data from generic data source d highlightan s s advantage pitfalld san usinf so g generic component reliability data in PSAs. Considering current IAEA effort preparo t s computea e r code package for event tree and fault tree analysis in personal computers (PSAPACK) e anassociateth d a dreliabilit r neefo d y data base compilatioa , f no

194 published component reliability datundertakes awa e IAEAth t .a n Somf eo the features of the data base, like the coding system, are, therefore directly governed by the package.

2.IAEA's GENERIC DATA BASE As mentioned earlier a primary reason for developing the data base was o t have readily available reliabilit conjunction i e y us datr fo a n wite hth PSAPACK. As the package is planned to be used for analysis of different plants, one important aspect was to draw data from a wide variety of sources.

Usually, different sources present information in a different manner, therefore a common input form had to be defined. To enable data retrieval and direct use with the PSAPACK, a unique coding system had to be developed. Having chosen the data sources, the selection of the data for inclusion had to be made. At last, the data input and quality control to creat e generith e c dat avera bas s y ewa tim e consuming task.e th Eac f o h above points define steps in a generic data base compilation, and are elaborated in more detail next. As of today the generic data base contains about 1000 different records, including practicall e componentth l al y s whic e accountear h r fo d A studieiPS n Nucleaf so r Power Plants.

2.1. Data sources Havin n goae mini gf th compilin o ld g data from many data sources0 ,2 sources have been include o fars d e amoun.Th f informatioto n containen i d the various source , howeveris s , substantially different.e Somth f eo sources provide up to 180 different records, while one source was cited in only two of the records. o T highligh e tbasith somf co e characteristic e sourceth f o s included, the best way is to divide them in the three basic categories (mentioned earlier) each of which show some unique characteristics. Some of the sources belong to more than one category. A typical e exampl"Germath s i ne Risk Study" where som P operationaeNP date ar a l experience, combinationsome ar e s includin experienceP NP g , while ress i t a combination of several different data sources, not including NPP experience. Therefore the ultimate data source is not always unique.

2.1.1. Plant specific data o basiTw c subgroups exist inside this category e firs.Th plans i t t specific data drawn directly from sources available planth t a e (logbooks, maintenance records, work orders etc.), and the second one is when generic data are updated with plant specific information. The first subgroup is normally considered the best source of data for the analyzed plant, but that is not necessarily the case when one uses these dat anothet a r plant. Generally, sourca thi s i s e rarely founde .Th only e IAEth sourc An i eDat a Base full than i y t categor NUREs i y G 4550 (Vol.S.Surry NPP) and it provides only 10 records. It should be noted that some other sources also provide the single plant operating experience data date th as mosa f provideo tt bu d there belong otheo st r catetgory, they quotee ar d later.

195 e seconTh d subgroup considers generic data updated with single plant operating experience. This procedure is usually applied when either limited plant specific data are available, or available data could tend to over-or-underestimate component reliability. In fact in most of the recently completed PSA studies (which are not using generic data base) component reliability e datderivear a n thii d s manner. IAEA Data Base include several sources of that kind(e.g. Oconee NPP PRA, Zion NPP PRA and a source identifie s "Ola d d W PWR" . In e additioproblemth o t ns encountere n definini d g component boundaries and failure modes which are going to be addressed later, the mean f o acquirins e plan th w dat ra t ga hav greatese th e t e impacth n o t quality of reliability data derived. There are basically two sources to derive raw data at the plant. These e logbookar maintenancd san e work orders. Bot thef o h m have advantaged san drawbacks. Usually deriving raw data from the maintenance work orders is easier and less time consuming (especially when work order computerized)e sar . Because every work order adresses, in principle, an abnormal occurrence, events relate eaco t d h single component coul easile db y compiled together. e qualitTh f informatioo y nwore founth k n orderi d generalls i s vert no yy good, because work order e personneform e th fillear sy b d l actually performing work. Examples like work orders open for months or years and wor e kcomponen on donn o e t identifie s dona danothen o e commone ar r . Logbooks, especially ones filled by control room personnel are more accurate t derivin,bu w datra ga from ther extremels i e y time consuming. w date ra drawar ae nth e logbookEvefrof th i mn maintenancr so e records, one is still not sure that all the failures of a certain component have been reported. if both sources are searched, the probability of failures not reported is lower. However it still exist, and can result in an overestimate of component reliability. s i understandabl t I e thaqualite th t componenf o y t failure dats i a directly proportional to the quality of plant's records. If the plant has a dedicated reliability data collection system in place, that would be obviously the best possible source of raw data. e probleTh eves i m n wors demanr fo e d related failures, whe actuae th n l number of demands is not readily available and have to be assessed on the basis of average time on power or calendar time. If a component is started for testing purposes usualli t t knowi no ,y n weathe t i starter d immediately or after a number of trials. Operating experience for the standby systems involving failure to run given start is usually limited to running time of about 1 hour. However it is usually used (in analysis) as the long term failure rate, without any evidence that the long term failure rate is equal or comparable to the short term one.

2.1.2. Data extracted from reporting systems A widely know evenP nNP t reporting Licensee systeth s i m e Event Report System used in the USA. Safety significant events occurring at the NPP-s have to be reported, so it is possible to identify component failures related to those events. Identification of component failures is not always straightforward, and other means of discovering components involved have to be utilized. The IAEA Data Base includes 4 sources of that kind, namely LER based rate valvesr fo s controd ,an pumpsC l& I rods, . R baseLE de y similafailure th wa rateth o e e t rson Iar e n rates published in the Swedish "Reliability Data Book", which provides the reliability parameters derived from Swedish LER-s, ATV system (The Swedish

196 Thermal Power Reliability Data system d informatioan ) n providee th y b d plant staff. Advantages of reliability parameters derived in that manner is that the actual component population covered is very large, what guarantee more reliable statistics. On the other hand, LER systems are event oriented and t no component oriented o s actua, l component failure coult ge d misinterpreted or overlooked. In addition, some of the component failures are never reported in the system because their failures either did not caus y safetan e y significant even ther to y wer t requireeno o reportt d . Furthermore, a small percentage of events is not reported because of plant personnel general attitude towards reporting system thil .Al s factory sma lead to possible overestimates in component reliability. Another proble e operatinmth ares i ag tim d numbeean f demando r f so e componentth . Operating timusualls i e y estimate n reactoo d r operating time d numbean ,f demando r s i estimates averagn a s a de also basen o d operating time. Thin driv ca e spredicte th e d reliability parameten i r either direction. Compilatio f thao n t kind teno diminist d h difference n componeni s t design and operational practice and environment, which is sometimes a very important information and can greatly influence the component reliability. o T conclude, reliability parameters foun n thii d s typ f sourco e e should be used with care in PSA studies.

2.1.3. Data based on expert opinion, nuclear and non-nuclear experience Categorie n thii s s group include single expert opinion, aggregate expert opinion, aggregation of several non-nuclear sources, aggregation of expert opinion and other sources and aggregation of operating experience of several NPP-s. Usually, eve singlna e data source includes severaf o l these categories. It is obvious that any aggregation of data (if properly performed) provides more reliable data than single expert opinion or single source.

e mosTh t widely known representativ f thio e s categor e IEETh Es i y Standard 500 s .197It 7 version mostly includes expert opinion, while th e 1984 version also includes nuclea d non-nucleaan r r experience. Other examples of data sources which are included in the IAEA Data Base are: NUREG 2728-IREP (Interim Reliability Evaluation Program, which adopted data base from EGG-EA-5887), NUREG 2815, PSA procedures guide (data from expert opinion combined with IREP data base), Sizewel assessmenB l t (operating experience including nuclear and other industrial sources). The WASH-1400 (combination of expert opinion, non-nuclear, nuclear sources) also belongs to this category and it is important to mention that it stilwidela s i l y used source .sourcee th Som f eo s include e IAEth A n i d Data Base like NUREG d 288NUREan 6 G 3831 draw r datparametefo a r estimation from a limited group of plants. Other example is the Shoreham NPP PRA- GE data, which draw data only from GE operating plants. The quality and reliability of data in this category can vary substan- tially, dependine finath n lo g source importans i t .I t mentioning that expert opinio s severawa n l time versn i prove ye b goo o nt d agreement with actual operating experience data.

2.2. Record form

With many different sources providing different types of information, it was necessary to define a unique record form which would enable inclusion of information in a systematic and consistent manner and also user friendl r informatiofo y n overvie retrievald wan .

197 The record form was defined as havin lines1 2 g , characterizin0 1 g categories of information (table 1).

Tabl Recor; 1 e d categories

1. code 1 line 2. component type line4 s 3. operating mode 1 line 4. operating environment 1 line 5. failure mode 2 lines 6. failure rate 5 lines . repai7 r time 1 line 8. source 2 lines componen. 9 t boundary 1 line 10.comments 3 lines

. 1 Every a codrecor s e ha da whic s i h unique combination of 5 alphanumeric characters. A detail description of the coding system is presented later.

2. Component type is described in 4 lines, namely: type, subtype, detail . 2 Typ d ean typ characterize1 e s basic component type (e.g. "pump", "valve" ). Subtype characterizes more specifically the component category (e.g. motor driven pump, solenoid operated valve, pressure sensor, AC motor e component th )t . hav Somno f o e e o informatiod s thit a n s level (battery charger). Detail typ contain1 e s information abou e systetth m where the component is located or other characteristics as voltage, or pipe diameter etc. Valve types (e.g. gate, butterfly, etc. alse ar )o include n thii d s line. "General" means that further characterizatios i n t possibleno . Detaie lasth e t lcomponen s th i entrtyp f 2 o ey t description. Usuall a detailey d divisio componenf o n t categories which should belong to this entry is not available. For most of the valves, pump somd an es transformers information abou te syste th siz r meo whice th h component belong founs i s thin i d s line. . 3 Operatin e g nexth tmods i ecategory . Operating a mods i e particularly important characteristi pumpr fo cs (standby, alternatinr o g running). For other components this information is of less importance. Precise, information of that type is seldomly included in data bases. When e componenth t operating mod s i obviouse , lik safetea y injection pump a standbwhic s i h y pump, this informatio includeds i n n otheI . r cases "all" operating modes was the default value chosen. . 4 Operating environmen e nexth t s i tentr y which, similae th o t r previous one, is seldom found in data sources. It is obvious that harass environment should influence the component failure rate, but very few sources address thatr examplFo . e 0 IEEprovide50 E multiplicatiosa n facto mosr componentf fo to r s liste environmentr fo d s like high radiation, temperature, humidity or vibrations. WASH 1400 provides different failure rater pump fo motorsd an s extremen i s , post accident environment. Failure rates are, particularly in the cases where the operating experience is the basis for determining the failure rate, usually based on normal operating environment. A default value "normal" was chosen for all cases where no other environmental condition was indicated. Some of the sources addressing components operating environment define "normal NPP environment" as the usual one. 5. The failure mode category is presented in two entries, one describing "generic" failur othee eth mod rd presentinean g failure mods a e originae th foun n i dl source. Details abou e failurtth e mode goine sar o t g be described later. Briefly, a generic failure mode was assigned because the coding system was not able to cope with the number and differences in failure modes found in the sources. The original failure mode was, however left in the record for users' clarification.

198 e failurTh . 6 e rat presentes i e entries5 n i d firse .Th t entrs i y failure rate description, giving information about the failure rate (mean or median), upper and lower bounds ( of the distribution, low an dd min.values)an hig r maxo h. d definin,an failure th g er ratpe s ea r demandpe hou e failurr o .Th r e rate entry provide actuae sth l numerical value for the mean, median, or best estimate value. Upper and lower bound entries provide e actuath s l numerical values, respectively e erroth rf .I factor is available it is given in the fifth entry. Upper and lower bounds and error t alwayfactorno e sar savailable , therefor a (meaninen/ t no g available) is used instead. . 7 Repai rnexe th ttims i categorye indicatet .I e averagsth e repair time associated with a component failure. It is also very seldomly found in generic sources. Some sources provide duration based on recorded repair times, in others repair times are a mean value of several maintenance durations on a particular component. For the real case generic information of this kind is not of much use.

8. Source is presented in two entries, one indicating the exact source (name of publication, page #., table #.) if available. The second entry gives information abou e ultimatth t e sourc datf eo a (e.g. expert opinion, operating experience). 9. Component boundary is one of the problem areas to be addressed later. Very few sources provide adequate information about component boundary e besTh . t informatio e Swedis s founth i nn i dh Reliability Data Book, where a sketch is made for each component. Whenever this information wat available,"detaisno availablet no l writtens "wa . . Commen10 t e lasentrieth te categorar s recorda f o y . Usualll al y the information found in the sources and considered relevant is written here. That includes the prior source and/or mean, if the data source is an updated generic e operatinth , g experience (total population covered, numbe f demando r r operationao s l time, numbe f failures)o r , additional failure rates relevant to the component (with or without command failures) etc. Practically all information which could by any means clarify failure rate, failure mode or component description are written here. The comment categorn a integra s i y l par f o eact h recor verd an yd important when choosin recory gan further fo d r calculatio comparisonr no . Tabl present. e2 complete sth e record form.

Tabl : Complet2 e e record form

CODE 10 spaces " 5 6 TYPE " 5 6 SUBTYPE DETAILTY 65 " DETILTY1 65 "

OPMODE 30 "

OPENVIRO 65 "

GENFAILMOD 50 " FAILMODE 50 " FRATEDESCP 30 " " 0 1 FAILRATE UPBOUND 10 " LOWBOUND 10 " ERRORFCTOR 10 "

REPAIRTM 10 "

SOURCE 30 " ULTSOURCE 65 " COMMENTS 65 " COMMENTS1 65 " COMMENTS2 65 "

199 2.3. Coding system

Coding aree systeth a s i wherm e PSAPACth e K code mostly influencee th d IAEA Data Base structure. In accordance to the PSAPACK requirements, each record code could have 4 alphanumeric characters. The fifth character is the character describing the source but the PSAPACK does not use this information (table 3).

Tabl Codin: 3 e g system example

COMPONENT CODE DESCRIPTION

W I A KT fuse, general, fail to open, WASH 1400

T R D pumpM P , motor driven, centrifugal horisontal, flow rate 130-200 kg/s, fail to run, Swedish Reliability data book R R A c E relay, protective, all types, fail to close,IEEE 500

V C B O F valve, self operated, check, less than 2 inches diameter, fai o opent l , CANDU assesment.

Because each record musn uniquow t s have it e cod d there an e ar e component categories which should have the same code, longer (more characters) code would have been preferable. However, some of the fault tree analysis codes included in the PSAPACK limit identification of basic event to eight alphanumeric characters. Moreover, it was felt that at least 4 characters are needed for further identification of components (includin s physicait g l positio r eventuanfo l common caus dependencr o e y analysis). Therefore only 4 characters were used for basic component identification and failure mode description. Originally, there were mor differen0 e10 thae th n t failure modes. That number required 2 characters for coding, leaving only two characters for e componenth te generith type s A .c failure modes were designede on , character was sufficient to describe the component failure mode. Three alphanumeric characters were then used for the component caracterisation e componentth r Fo . s types with many subdivisions (for example valves) firse th , t characte componene uniqus th i r r fo e t typee th , secon s i uniqu dr subtypfo e e (fo rs valvi exampl d 'vm ' an e 'v s 'i e motor operated valve) lase .Th t position characterize detaie th s l type1 s and 2. No firm rule exist for the last position. Usually when the detail typ s i 'generale o furthen r o ' r division existse th , n charactei s i ' 'a r third position. For the components with few subdivisions, the first two positions characterize the type (e.g. 'It' is transmitter) , while the last one characterizes the subtype or detail type, if any.

e th r Fo components which are 'one of a kind' all three positions characterize single component type (e.g. 'xmc' stands for manual control device). e IAEth InA Data Base ther e abou ar edifferen0 t45 t components listed y b component identification code. Thedividee types6 yar 7 n s theri dA . e is no space in the coding system for operating mode or environment, sometime e samth se componen s codei t d differently becaus operatinf o e g conditions (e.g. motor driven pump without further subdivision is coded 'pmb' whe n alternatini n g operating moded 'pmran , ' whe runninn i n g mode).

200 2.4. Data selection

After choosing the data sources and defined the record format and coding system e actuath , l data inpu performeds twa e .source th Som f o es (like 'WASH 1400' or 'IREP') were included completely, while in others (like 'IEEE 500' or 'Old W PWR') data for inclusion were carefully chosen. From some of the data bases, data for components which are plant specific and are not comparable with any other (e.g. emergency AC source-hydro unit) were excluded. Also date ,th a directly adopted froy an m other generic data base (which is also in the IAEA Data Base) were not included. e IEETh E Standar 0 provid50 d e single source value d aggregatsan e e valuesIAEth A n I Dat. a Base, dependin eacn o g h particular case, single or composite values or even both (when particularly illustrative) were included f I 'pe. r demand d 'pean ' r hour' failure rate e providedsar , both were included, along with the source where the data are coming from. Sources like NUREGs providing failure rater pumpfo svalved an s s usually present two values, namely: with command failures and without command failures. Values given in the failure rate entry are usually without command failures (clearly stated in the comment entry). The "with command failure" rate is also cited in the comment entry. These sources often divide dat categorien i a accordancn i s NSSo et S e IAEvendorth A Datn I .a Base usuall e overalyth l valu s giveni e , whas i t than describe commenn i d t entry.

2.5. froe Datth ma base

e IAETh A Generic Data Bas s createewa d usin e IBM-Pgth C software dBASE e b store n n i date plaica dth a n nt i i bastexr o o ets III format, . t limiteno s o PASPACKi Therefort d e us s .it e The PSAPACK package provides its users with the options for browsing throug d retrievaan h f dato la froe IAEth mA Data Base. Retrieva datf o l a e b accomplishe n ca knowiny b d e exacth g te recor th cod f f interesto edo . Then the complete record or the entries of interest can be retrieved The f dato secon ay wa retrievad vieo t Date wth s i a l base recor y recordb d , and than retrieve information entering the particular record number. The PSAPACK code also includes a base editor which allows the user not only to retrieve data but also to change, modify, add or delete any information y B retrievin. g d combinindatan a g them with data which were added or modified (if any) the PSAPACK form its own small data base which is then usesolvinr fo d particulaa g r problem.

Using the dBase III code it is even easier to 'search' for or to 'locate' a certain code, type, subtype or any other relevant information. Browsing throug e choseth h n fields, after locatin particulaa g f o t se r component f o interests easiln ca e valuee y,on th comparf o s y includeean d e IAEith n A Data Base.

3. PROBIJM AREAS CONNECTED WITH GENERIC DATA BASES

When usin a generig aware b c possiblf o eo t dat s aha ebase on e problem areas. Considering the areas where misinterpretation can occur, e followinth 4 areag s have been identifie e folowinth n i gd ordef o r importance : -component boundary definition -failure mode definition -operating mode definition -operating environment definition

201 Even when deriving failure rates frow datmra a froplane th m t being analyzed, thes issuee ear s whic lean substantiao hca t d l errors. During the development of the IAEA Generic Data Base insights were differenw gaineho n i d t data bases addres thessf o eace e hon issues. These insight d possiblan s e way f o avoidins r solvino g g such probleme ar s addressed next .

3.1. Component boundary

It is obvious that a main source of misinterpretation is the component boundary definition. Some of the experts agree that variations in component boundaries are the primary reason for failure rate fluctuation between sources. Although that statement seems to be too rigid, component boundaries could, depending on the particular component, change failure rates substantially. It is therefore interesting to see how different sources address this issue. Probably the best defined component boundaries are in the Swedish Reliability Data Book, because practically each component categora s yha sketch exactly indicating the component boundary and points of interface with other systems or components. Usually, in the component boundary, local control and protection (if any) are included. Some of the 'NUREG' documents also have adequately defined component boundaries, with precise definitio f interfacno e points.

Other sources are defining a component as being an "off-the-shelf" item. This is an interesting and remarkable definition, but it assumes that "off-the-shelf" items hav e sameth e meaning everywhere,t whano s i t necessaril e componentsth l al case r yth fo e . Data bases whice par PSAsf ar ho t , usuallt providno o yd e detailed definitio e componenth f o n t boundary. Thiunderstandables i s , because these sources were compile r specififo d c use. When performing data updating, component boundary gain importance e neer becausth fo d f o e matchin prioe th g r witplane hth t specific operating experience. The sources which base their failure rate upon the combination of nuclear and non-nuclear experience (or even expert opinion) do not provide detailed boundary description e leve Th f .similarito l f o differeny t e expecteb source n ca sd t i t thacombineknownno t s bu certai,i d n differences would exist. e sourceth r sFo mostly base n expero d t opinion questioe th , f no strictly defined boundary becomes a more academic one. However, cases like lubl beinoi e g par f dieseo t r o breakel puma rn pi includet no r o d boundary must be addressed to avoid significant (orders of magnitude) variations in the failure rates. avoidinf o y wa g e seriouOn s problems with component boundary definiti- ons is to define 'generic' component boundaries. That, of course, does not help in already existing data sources, but could save considerable trouble e futureith n . However, this mainli s y applicabl dato et a collection efforts undertaken durin performance th g PSAa f than eo I . t case component boundaries should reflect two, sometimes opposite, requirements: the leve f o detail l neede wantedr systee (o th d y )mb e leve th mode f o d l an l detail of plant records where raw data are retrieved from. There are generally three major interfaces to be defined in connection with the component boundary definition, namely: -mechanical interface (incl.cooling system,lubricating system, etc. where appropriate) -power supply interface -control system interface

202 3.2. Failure mode

Component failure mode is another problem area, although of a different character boundare thath n y definition. Failure modes founn i d various sources show significant difference even when describing basically the same failure. For example, in the sources which were included in the IAEA Generic Data Base over 100 different failure modes were found. Difference between somf thio e s failure mode basicalls i s wordinn i y g (e.g. fail to run vs. failure to run) and it is therefore easy to understand that they describ e samth e e failure othen I . r cases i t si sometimes difficul o understant t exace th dt failure mod d comparan e t i e among sources To compare failure modes and also to enhance the IAEA Generic Data Base coding system, considerable effort was undertaken to define generic failure modes. n I additio componene th o t n t desig d functio nan e system th n i n , there are three basic component operating modes which affect the failure mode. These are: -standby -alternating -continously operating.

There are also two distinct failure rate definitions. One is time related (further divided in standby and operating hourly rate) and the other is demand related. These were also taken into account while determining r eacfo ,h single componen grour (o tcomponentsf o p ) possible ways (modes f failure)o thal Al .t basee serve defininth r fo s a d g generic failure modes. Finally the original failure mode was included under one of the generic categories. e disadvantagTh e approacth f o e h describe thas y i dopent wa i t e sth for inconsistencies in the grouping. For example generic definitions "failur o functiont e 'failurd 'an operateo et ' describe basicall e samth ye failure mode, but while first is defined as per hour, the second is per demand. Because some sources define 'failure to operate' as per hour value, while others define it as a per demand value, the same (in words) failure mode is listed in different generic categories. Another possible complication comes from sources like NUREG 2815, Baseline Data, where all failure rate definee sar hourr pe d , while som thef e actuallo ar m y demand related. Therefor generia e c failure mode, suc s 'faia h o startt l ' (which is defined per demand) include per hour failure rate comming from that source.

The failure mode 'all modes' deserves special attention because it is usuall a composity e failure mode, actually containing several 'single' failure modes. The problem here is that each component usually have different failure modes. Whenever possible failure modes containe n 'ali d l modes e commene th listear ' n i t de IAE th entrA f Generio y c Data Base record form. Generic failure modes as proposed in the IAEA Generic Data Base are e possiblth f o e e way on defininf so ghowever, themis t uniqut I . ,no d ean it woul e b indeed d possibl o t define e then severai m l other ways. Altogether 28 failure modes were defined. The 19 of them considered most important e show ar n ,Tabli n. 4 Nine e others cover minor numbef ro peculiar failures like 'overheated hear o 't exchanger 'tube r 'shell'o ' leak.

203 Table 4: Generic failure modes

FAILURE MODE FAILURE MODE CODE

A L MODEAL S DEGRADED B C FAI CHANGO LT E POSITION FAIL TO REMAIN IN POSITION D E FAI O CLOSLT E F FAI FUNCTIOO LT N SHORT TO GROUND G H SHORT CIRCUT OPEN CIRCUT I PLUG/RUPTURE J SPURIOUS FUNCTION K L FAI OPERATO LT E O FAI OPEO LT N PLUG Q R N RU FAI O LT FAIL TO START S RUPTURE T OTHER CRITICAL FAULS X LEAKAGE/EXTERNAL LEAK Y

3.3. Operating mode

Component operating mode is of importance for active components, while generally have much less meanin passivr fo g e components. Ever activfo n e components there are cases where the operating mode has more or less importance, dependine d th mechanis an w ho y gf wa o m primaril e th n o y failure occurs. Obviously operatin ggreaf o mods ti eimportanc pumpr othefo d e an s r components which perform their function by continuously moving. These components have operating modes defined in three cathegories: standby, alternating and running (operating). r componentFo s which perform their function changing between discrete states, (e.g. valves), operating mod defines a e d abov actualls i e y status of the system they belong to. Operating mode pertinent to the component itself should be normally open or normaly closed position. The majority of the sources do not define the component operating mode e onlTh . y sources which define operatin ge NURE mod th some f eGar o e LER sources. PSA studies used as the data sources usually define the system where' e componenth s locatedi e tsystem th possibls r i mos Fo f .o t i ts o t e determine the operating mode, what could be used for defining active components operating mode. Althoug t directlno h y connected wite operatinth h g mode vere ,on y important characteristic which sometimes is overlooked is the duration of e operationth r standbFo . y components e failurth f i , e rat determines i e d based on operating experience, it is based on recorded operation during test performance, wha usualls severar i to e yon l hourse reath ln .I case , particular components are required to operate for times which substanti- ally diffee failurth e basr th rwhice efo s on rat frohwa e eth m determi- nation .sourcee addrest Mosth no f o to sd s that problem.

204 When modeling standby components, failures during standby muse tb accounted for. Failures occurring during t revealestandbno e ar yd untia l test or an actual component demand, therefore are usually included in the model as a demand related failure. In this cases the demand related failure should comprise those failures whose mechanis purels i m y related e demanth to d (e.g. high curren motoo t r windings during start alsd )an o failures e timrelateth e o t whicde componenth h t spenstandba n i t y condition. However,if data base provides only demand related failure rate without indication how long is the componet in standby between two demands, this overlooks the fact that component failure during standby is time related and could vary substantially with variation in time between tests or actual demands. Some of the sources recognized this fact and provide hourly failure r ratstandbfo e y condition othee th n r.O hand that approac possibla s i h e sourc f o errore , becaus normalls i t i e y impossibl o distinguiset h between time and demand related failures.

3.4. Operating environment

As mentioned earlier, the component operating environment is rather poorly defined in most of the sources. Most of the sources do not address t alla it , while som f thedefinine o ar m g environmen e normath s lta power plant environment. This definition could basically hold for normal operatio r o accidentn st chang no whic o d eh environmentally affected parameters. However, when performing a PSA one is interested to predict the outcome of accident in environments, that could in certain cases change component failure rates substantially. WASH 1400 is a source which provides separate failure rate for post accident situation for pumps and motors. The IEEE Standard 500 lists the environment multiplier e component th r mos fo f o st s includedr fo , environmental effects like high radiation, humidity, temperaturd an e pressure. Environmental effects could obviously affect component failure rate in different manners, therefore careful consideration shoul givee b d thio t n s issue. Data from plant operating experience assume a normal environment, because operating experience data are normally either from normal operation or from test data, both of which are quite different from accident conditions. e otheth On r hand numbee th ,typed an r f componentso s affecte y posb d t accident conditions are usually rather limited. The extent of that is greatly dependent on plant design and type of accident. Other type of extreme environment condition which can occur in NPP-s are high temperature condition occurring afte e failurrth roof eo m cooling systems r mos Fo f .electronio t c component r systemo s relativels i t si y d easaccuratan y o predict e e effectth t f o extrems e environmend an t experimental dat s availablei a r mechanicaFo . l components like pumps, high temperature condition and consequently accelerated failure rates are relatively more complicate predicto t d .

4. CONCLUSION

Generic component reliability s dati indispensabla y an n i e probabilistic safety analysis. It is not realistic to imagine that all possible component failures and failure modes modeled in a PSA would be available from the operating experience of a specific plant in a statistically meaningful way.

205 The degree that generic data is used in PSAs varies from case to case. Some studie e totallar s y base generin o d c data while other generie sus c dats prioa a r informatio specializee b o nt plany b d t specific data. Most studies, however, end up in a combination where data for certain components come from purely generi otherr cfo datd s an afro m Bayesian updating. e IAETh A effor compilo t t generia e c component reliability data base aime t a identifyind g strenght d limitationsan f generiso c data usagd an e at highlighting pitfalls which deserve special consideration. It was also intende o complement d PSAPACe tth K packag o facilitatt d an e uses it e . Moreover,it shoul e notedb d , tha e IAEs recentltth ha A y initiatea d Coordinated Research Progra Reliabilitn i m y Data Collection, Retrievad an l Analysis n I thi. s framewor expectes i t i k d tha e issuetth s identifies a d most affectin e qualitth g existinf o y g data bases woul addressee b d d an d alternative solutions proposed n particulaI . e followinth r g areae sar being adressed: -Component Failure Data Collection System(PR China) -Development of Data Collection System of Reliability SystemsP KP Datf o a, Component Eventd san s Important to Plant Safety(FR Germany) -Bayesian Analysis Under Population Variability (Greece) -Develpmen f Methodo t Procedured san Collectior sfo n and Analysi f o r DatsProbabilistifo a c Safety Assesment(Hungary) -Inteligent Interface for Database Interrogation by Making use of Fuzzy Sets and Possibility Theory( EC JRC-Ispra) -Reliability Improvement d an Experimentas l Reliability Determinatio f o Nuclean r Reactor Instrumentation(Roma) a ni Reliability Data Collectio Analysis(GBd nan ) Contribution n i Fielsf Dato da Collectiod an n Analysis for Probabilistic Safety Analysis Application(USA)

Finally, it should be mentioned that the work described in this paper is being complemented by an extensive quality assurance, where all the record e beinar s g reviewed .comprehensivA e IAEA Data Base user's guids i e also under preparation. e PSAPACRelateth o Kt dpackage smale ,th l data base for benchmark calculations or test problems is going to be extracted e completth from e IAEA Data Base. This small data base shoul contaio t d n abou 0 records6 t , includin e componentth e failurl th al g d san e modes which are tipically considered in the PSA studies.

206 DEVELOPMEN RELIABILITF TO Y DATABASES AND THE PARTICULAR REQUIREMENTS OF PROBABILISTIC RISK ANALYSES

. MESLIT N Servic productioa l e ed n thermique, Electricit Francee éd , Paris, France

Abstract

Nuclear utilities have an increasing need to develop reliability databases for their operating experience e purposeTh . f theso s e databasee ar s often multiple, including both equipment maintenance aspectd an s probabilistic risk analyses. EOs thereforFha e been developing experience feedback databases, includin Reliabilite gth y Data Recording System Evene (SRDFth d t an ) historFilee welth s a ,s f numeroua lyo s operating documents.

Furthermore s bee f ha 1985o n F d preparin, EO en sinc, e th e a g probabilistic safety analysis unitapplie e 1,30e r whicfo ,on MW 0 o dha t large amoun f dato t f Frencao h origi necessarys ni . This data concerns both component reliability parameters and initiating event frequencies stude thus Th .yha s bee opportunitn na tryinr yfo t gou the performance databases for a specific application, as well as in-depth audits of a number of nuclear sites to make it possible to validate numerous results. Computer aided data collection is also on trial in a number of plants.

After describing the EOF operating experience feedback files, we discuss e particulath r requirement f probabilistio s c risk analysese th d an , resources implemented by EDF to satisfy them.

. 1 INTRODUCTION

Since the end of 1985, EDF has been working on a probabilistic safety analysis of one of the 1,300 MWe units of its PWR facilities (réf. 1 ).

To complete this project, a large amount of data is necessary, to obtain systematicalls i whic F hED y drawing upo operatins nit g experience.

Particular use has been made of the vast databases represented by the Even Reliabilite th t Fild ean y Data Recording System (SRDF).

Probabilistic risk analyses are nevertheless very demanding in terms of quality (nature and content of raw data) and in terms of quantity (size of sampl availabilitd ean f generayo specifid an l c data concernin site gth e studied). This being the case, the raw data must be as complete as possibl recordins it d ean g mus supplementee b t numerouy db s in-plant audits.

207 2. OBJECTIVES

Concerning reliabilit probabilistin i e y us dat r afo c studies, there arer fo , EOF principao tw , l objectives.

e firsTh t objectiv s thaei f obtainingo t , from operating experience with EOF PWR units, a range of validated reliability parameters relating to the different item f equipmenso t studiese useth n di . This involves:

• Establishin equipmene th glisa f o t treliabilit e alloweth n i r dyfo studies, • Monitoring of this equipment in the units, • Validatio date th af n o obtained .

r monitorinFo f equipmentgo mads i e eus , essentiall f SRDFyo t alsf bu ,o o the EDF-SPT Event File and of various operating experience feedback documents suc incidens ha defecd an t t reports.

Validatio carries ni analyziny b t dou g sample f failurein-plany so b d san t audits.

secone Th d objectiv thas ei f guaranteein o t durabilite gth datae th f .yo The requirement is for monitoring and periodically revising the information, involvin complega x setup.

3. MEANS

1 Natur3. f dato e a

The information is of the following two types: - Raw data

An item of raw data is essentially a description of a phenomenon: failure, damage, repair, circumstance etc. This description is often made in a structured manner using a set of questions and answers, in which the answers may be pre-established. A free description frequently accompanies this coded description. - Processing results

datw ra s subjectei a e Th o mathematicat d l processin o obtait g n reliability parameters: • failure rates (in operation, on demand etc.), duratione th • f repairso , failure, unavailability etc.

Depending on the nature of the objectives of the studies and the way in which systems are modeled, the interpretation of raw data for subsequent processinf primaro e b y importancegma .

208 3.2 Sources of raw data

principae Th l sourcequipmenw ra f eo t reliability dat SRDFas i .

SRDw ra Fe datTh captures ai d directl nucleae th t ya r plantfore th m n si of: - descriptive report failuresf so , - equipment operating tables.

The principles of the collection system are: - maximum decentralization, - data capture based on criteria as simple and reliable as possible.

A list of the equipment monitored is drawn up, and clear definitions are given.

The records cover the greater part of the electrical and electromechanical equipment starA s mad. wa te Fessenhei197n ei th n 8o d Bugeman y sites 198n i , standardize2 4 scopCP e d eMW an include0 1 d90 CP e dth n 198i unitd t 6i include an s e 1,30e th unitsd 0MW . Som0 60 e components are monitored, a large number of which are parts of safety- related equipment.

date Th a f approximatelfloo wfailurs 0 i 15 eo t record0 10 y r unir spe pe t year, involving the work of two or three technicians at each site. f 1986o d en , SRDe Ath t F contained som 0 reactor-year11 e f o s observatio 11,30d nan 0 record f whichso :

- 2,600 concern pumps and motors, - 5,000 concern valves. In addition, there is a system designated SRDF-A for the collection of electronic equipment failures ("SPIN and Controbloc", I and C systems, Plant computers etc.) from 1,30 unitse 0MW .

This system was put into service at the same time as the first EOF unitse 1,30MW 0, i.e. 1984 failuree Th .enteree sar y maintenancdb e technicians at the sites. Each record is a subject of analysis with the manufacturers and checking at power plant level.

At the end of 1987, the observation period ran to approximately 20 reactor-years, the file containing about 2,500 records of failures in electronic equipment of all types.

Finally EDF-SPe th , T Event File make t possiblsi fino et dlarga e number of failures which have affected safety-related equipment or caused unit unavailability.

In short Evene ,th t File f represented1987o reactor-yeard 5 ,en 18 e th t a , s for the 900 MWe units and 19,500 records, including 1,200 scrams, 1,000 scheduled shutdowns and 500 turbine trips.

209 3.3.On-site audits The collection and processing of data from national archives must be supplemented by in-plant audits in the following cases:

- equipment not monitored, - initial sample insufficient, - results not offering a sufficient guarantee.

The audits involve the analysis of the operating and maintenance department archives.

4 Scannin3. f magnetigo c tape f unio s t computers To supplement and validate the conventional approach for data collection, softwar r scanninefo g unit computer magnetic tape undee sar r development. The objectives of these programs are:

- carrying out automatic calculations of the number of actuations and the operating componenttimee th f so s covere SRDFdn i ,

- obtaining all the standard reactor states, hour-by-hour,

- finding protection system actuations, - analyzin monitorind gan automatie gth c sequences (for example eth safety injection sequence).

Systematic processin computee th f go r tape bees sha n carrie t sincdou e June 1987 at the Saint-Laurent B site.

In the 1,300 MWe units, this processing shall be linked to scanning the records of the tagging assistance computers. This makes it possible to determine, with a high degree of accuracy, outages of all items of equipment, particularly those which are safety-related.

4. REQUIREMENTS OF PROBABILISTIC STUDIES AND PROCESSING METHODS

To carry out the 1,300 MWe unit probabilistic safety study, it is necessary to procur greaea t amoun f reliabilito t y data (failure rates, unavailability etc.) operatinfroF mEO g experience feedback.

In this field, the use of raw SRDF data is systematic. Nevertheless, the direct use of reliability parameters given by this system is not possible as, hande failuron e th e ,o nth e definition sprobabilistie useth r dfo c safety stud more yar e restrictiv othee th and n r o ,hand samplee th , s muse b t carefully checked (size and representativeness). In practice, the processing of qualified data therefore involves re-examination of all raw data.

210 e collectioTh n syste s mi necessaril y decentralized, which entails complications. Even with precise definition unambiguoud san s criteria descriptioe th , f no a failure frequently involves interpretation, which can result in errors in terms of the objectives of the studies and lack of homogeneity in the records. Ther e beear e n case f definitiono s s resulting from maintenancr o e operating practice being substituted for theoretical definitions. Thus, when equipmen whico t t h technical operating specifications appls i y tagged out for repair, the plants generally assume that the equipment has completely failed (such equipmen t madno s ei t unavailable withoua t good reason), wherea certain si n case t coulsi d perfor functions mit .

In consequence, in a reliability study, it is necessary to check the coherenc homogeneitd descriptive an th basil e datal th e f n sth o a o f eyo material concernin failuree gth .

In addition, a certain number of items of equipment may have insufficient numbers of operating hours or numbers of actuations, and it is necessary establiso t h groupbasie th samplef stude sn o s th o f yo s concerned.

analysie Th f failurso e records befor calculatioe eth f parameterno thin si s manner makes it possible to obtain homogeneous and realistic data, due to low interpretation dispersion resulting from the judgment of the engineers, and to rigorous selection of complete and pertinent failures, as concerns probabilistic safety studies.

e analyseTh s necessitat w record e studra th e d extensivf o yan s e examination of plant operating archives. Nevertheless, at the present f computeo e us time e r th recorde ,unit th f so s (maintenance, management of works and tagging out) makes it possible to rapidly obtai nlarga e amoun f informationo t t woulI . d appea futurere thath n i tt i , will thus be possible to make considerable progress in the field of equipment reliability data.

5. RESULTS

Aunie s1,30e tpar th MW probabilisti 0f o t c safety analysis bee s lisa , ha t n drawn up of about 140 electromechanical components specific to EOF PWR power plant r whicsfo h reliability parameter f Frencso h origie nar sough operatinF EO t e usinth g l experiencgal e feedback resources.

This wors provideha k d nearl item0 47 yf reliabilit so y data concerning failure rate parameters (in operation and on actuation) corresponding to different modes and repair durations. The common-cause failures have been quantifie generi0 3 r dfo c components. Finally unavailabilite th , y rates for preventive or curative maintenance have been established for abou component0 3 t safetr so y functions.

followine Th g examples illustrate different type f resultso s obtainee th n di unie 1,30t MW probabilisti0 c safety analysis.

211 In the field of reliability parameters (failure rates in service, on demand or repair time) comparisoa , s madni e wite resulthth s obtaine othen di r studies. In the case of the auxiliary feedwater pumps and the standby diesel generators followine th , g tabl obtaineds ei .

EOF PRA PRA WASH Connecticut 900 MW Oconee Yankee 1400

Feedwater pumps A. (per hour) 2.4x1 0-4 2x10-5 2x10-5 2.4x4 10' •y (per demand) 2.5x10-3 5x1 0"4 4x10-3 10-3 hoursn T(i ) 20 h — 40 h —

Standby diesel generators

X (per hour) 3x10-3 IQ'3 1.3x10-3 8x10-3 y (per demand) 1.5x10-3 4.6x10-3 5x10-3 3x10-2 T (in hours) 9h — — —

In this table, a comparison is made between the results obtained by EOF from the Event File and by INPO using LER and SER, in the field of analogue systems.

Wh EOF (réf. 3) INPO (réf. 4)

Nuclear flux 6x10'6/h 8x10'6/h

Pressure measurements 2.8x1 0-6/h 3x10-5/h

The results match extremely well.

same Inth e way similaa , r compariso made b f unavailabilitn eo nca y rate f safety-relateso d equipment:

EOF 900 MWe Audin o t US data unit experience 1 ,300 MWe (source INPO feedback unit site réf. 5)

Motor-driven auxiliary feedwater pumps 5x10-3 5x10-3 7x10-3 Standby diesel generators 3.3x10-3 7.8x10-3 2x10-2

212 Finally, an example of an audit of equipment maintenance is given for the duration of maintenance of standby diesels on a 1,300 MWe unit site.

These examples demonstrate that the different sources of data show considerable coherence t carbu , e must nevertheles o taket e b st no n underestimate the difficulties in obtaining and validating data.

of interventions

H I— I I I I I I—HH—I—I—f I I I • l> t]I lI I I I - l l" 1 3 57 9 11 13 15 17 19 21 23 25 27 29 31 33 35 37 39 41 43 "Duration of interventions

Number of interuentions outside unit shutdomn on diesel engines afunctiosQ f theino r duration (auerage duration 8.4 hours)

6. CONCLUSION

uniR cleas Ii t t PW operatin r F thaEO t g experienc extensives ei s i d an , sufficient for the successful collection and processing of reliability data to be envisaged.

EDF has provided itself with large-scale resources for attaining this objectiv e implementatioth y b e f operatino n g experience feedback management tools (SRDF, Event File, unit computer magnetic tapes etc.).

Nevertheless e requirementth , f probabilistio s c risk analysee ar s considerable, specifically:

- Guarantee of comprehensiveness:

It mus e madb t e sure tha l failureal t s pertinen e studth o yt t have effectively been recorded at the sites.

- Validity of the operating tables:

The calculation of quality reliability parameters involves obtaining certain number f hourso f operatioso f activationo d nan f validateso d equipment.

213 - Interpretation of raw data:

A certain number of failures involve difficulties in evaluating potential consequences with regar safete th do yt function equipmente th f so .

In such cases, expert opinion is primordial, and can affect the results.

- Adequacy for system modelling:

The nature and the modes of failure must be compatible with the choices made in the system studies.

It would appear that in the future, it will be possible to make considerable progress by using the site computer systems. This can take place from the level of detection of failures and unavailabilities for maintenance, and contributn ca qualit e parametere th th eo f t y o accuraty sb e countine th f go operatin actuationsge timeth d san .

thi s Ii currentlts i wils F F thal EO onl EO t n yyo workinfrod w an m no , gon use its own operating experience feedback data in its probabilistic studies.

REFERENCES

[1] A. Villemeur, ü.M. Moroni, J.B. Berger and T. Meslin

Frenc NucleaR PW h r Power Plant: Probabilistic Studie f Accideno s t Sequences and Related Findings — Probabilistic Safety Assessment Risd an k Managemen PSA'8— t Zuric7— Augush— t 30-Septembe, 4 r 1987.

[2] T. Meslin

Common Cause Failure Analysis on the Basis of Operating Experience Probabilisti— c Safety Assessmen Risd an tk Managemen PSA'8— t 7— Zurich — August 30-September 4, 1987.

[3] T. Meslin

Analys t quantificatioee défauts nde cause sd e commun Chaînee— e sd mesures analogique Nots— Aprie— , EDF-EP19873 6 l 00 .C SDC

O P N I ] [4

The Operational Performance of Reactor Protection Systems in U.S. PWR - 1981-198 Repor5— t INPO 87-02 Novembe2— r 1987.

[5] INPO

Safety System Unavailability Monitoring — Report INPO 86-021 — August 1986.

214 CHARACTERISTICS AND USE OF THE COMPONENT EVENT DATA BANK

A. BESI Joint Research Centre, Commission of the European Communities, Ispra Establishment, Ispra

Abstract

The Component Event Data Bank (CEDB) is a centralized bank collecting, Europeae ath t n level, data describin operationae th g l behaviou compof ro - nent Nucleaf so r Power Plants (NPP's) operatin varioun i g s European countries. It is one of the three event-data banks of the European Reliabi- lity Data Systems (ERDS), develope managed e JRC-Isprdan th y e db (th a other two banks being the Abnormal Occurrence Reporting System and the Operating Unit Status Report) . The CEDB stores information on the opera- tional history (operational times and/or numbe f demandro f interventioso n in a year, failure-events reports) of components of NPP's well identified by their engineering and operation characteristics. As of December 1987, the CEDB contains data from about 5200 mechanical and electromechanical components, pertaining to 21 component-families and 51 engineering systems, monitored for an averaged time of 5 years in 10 LWR Units (and in the steam-water cycle of other reactor type Units or con- ventional Units) locate Europea7 n i d n countries e failure-eventth ; - re s corde aboue ar d t 4200. CEDe Th B receives data either from national banks- EDF e , th suc s a h SRDF and the VATTENFALL-ATV, or directly from the NPP's. Ths mai a ERDSe e whole nth s CED th wels )objectivha f eo s (a B a l e th e promotion of safety. In particular it has been conceived as a support to e th e analys s safetr th o hi P n ti yNP assessmenw ne desige a th f r o nfo t backfitting of an old one. By putting together the operational experience of Europea e intentionth NPP'ss wa creato t nt ,i databasa e dataw ra ,f eo e convenientltb o y processed orden i ,: to r - improve the credibility of existing estimated reliability parameters by exploitin necessare th g y feed-back from plant operation; - provide a solution to one of the major problems of the reliability ana- lyst; namely the wide spread in reliability parameters existing in the current literature, especially for mechanical and electromechanical com- ponents ; - allow comparison betwee performance th n componentf o e plantf so f o s different countries. This paper shortly describes: - the main features of the bank classification scheme, its data retrieval capabilities and on-line statistical processing programmes; - some improvements under study to better meet PSA needs. Some examples of on-line data treatment are given and commented. The structure of an organized output (a CEDB-Reliability Data Book), whic beins i h g implemented shortls i , y illustrated. The results of a study on linked multiple failure-events and some analyses based on the application of multivariate analysis techniques are summarize e interesth d continuo an dt investigato t e e along these lines is shown.

215 l. DatProbabilistir fo a c Safety Assessment; aim d structursan e th f eo European Reliability Data System

starteThC eJR n 197 i d"Europeae 8th n Reliability Data System" (ERDS) project, aimed at organizing in a series of data bases the operational experienc Nucleaf eo r Power Plants (NPP's) /!/ ERDSe .Th , mos whicf to h has been operational since 1984, collects, organize disseminated san s Europeae atth n level, informatio operation no NPP'sf no mais ,it n objec- tive bein promotioe th g f safetyno particulan I . e anae supplth th r -o t y lyst of data on component failures and on safety-significant abnormal events derived from operating experienc d necessar s safetan e it r yfo y assessment. ERDe bees Th Sha n structured into four data banks, thre whicf eo h stor w evenra e t data e fourt th ,beine on h g dedicate e organizatioth o t d n reliabilitf o y parameters e thre evenw Th . ra e t data banks are:

a) the Component Event Data Bank (CEDE), which stores information on the operational histor f safety-significanyo importanr (o t planr fo t t availability) component somf so e NPP's (component operating time and/or number of demands of intervention in the year, failure-event reports)

/2,3/f Abnormae th ) b l Occurrences Reporting System (AORS), which stores infor- matio n safety-relateo n d events; Operatine th ) c g Unit Status Report (OUSR), which stores information no Unit productivit d availabilitan y eventn o d an sy which losa lea o st d of generating capacity (hystogram of Unit power during the year, plant event description in free text and coded format). This bank is now based mainly on the PRIS-IAEA system.

e fourtTh h bankdifferena f ,o t nature e structur,th whicf eo stils i h l in a study phase, is:

Reliabilite th ) d y Parameter Data Bank (RPDB) purpose ,th whicf eo s i h the storag f reliabiliteo y parameter homogeneouf so s classeP NP f so components, derived from operational experience (CEDE) and literature sources (e.g. IEEE St 500).

216 2. CEDB structur datd ean a processing

2.1 Introduction

The CEDB is a centralized bank collecting, at the European level, operational data characterizing the behaviour of components of Nuclear Power Plants (NPP's) operating in various European countries. Working group expertf so s have operated sinc refep u e t 197-se o 8t rence classifications and a bank structure well-suited to the general requirement ERDe th S f projecso capabld tan ensurinf eo g compatibility, when transcoding, with the following national data banks:

- SRDF/EdF (France) - GRS/KWE (Germany) - ENEL Data Collection System (Italy) - SRS/UKAEA (Great Britain)

Referenc alss eha o been mad: to e

NPRDS/INP- O (USA) - ATV (Sweden) - LER/NRC (USA) - GADS/MERC (USA) - UNID/TVA (USA).

The CEDB, as well as the whole ERDS, has been developed using the DBMS ADABA Softwarf So e A.GAMDAHn a n .o L 470/V8, running under OS/MVS, connecte e externa internae th th P networo T t o C t dd l JR l an k telecommu - nication network. As of December 1987, the CEDB contains data from about 5200 mecha- nical and electromechanical components, pertaining to 21 component-fami- engineerin1 5 lied an s g systems, monitore n averaga r fo de tim f abouo e t 5 years in 10 LWR Units (and partly in the conventional part of other reactor type Units or in the steam-water cycle of fossil-fueled power plants) locate Europea7 n i d n countries failure-evente ;th s recordee ar d about 4200. e CEDTh B stores data coming frofollowine th m g three national data banks :

Frence th - h EDF/SRDF; - the Swedish VATTENFALL/ATV; Germae th - n GRS.

217 Original information coining from these reporting systemse b nee o t d transferred intCEDe th oE structure, i.e. homogenize same th e n di reporting scheme and language (English). A semi-automatic transcoding programm beins i e g implemente e transfeth r fo dr from SRD CEDEo Ft ;a computer-aided transcoding programme already exists for the transfer from ATV to CEDB. e followinTh g Organizations supply e CEDdat CEDth o t E an Ei struc - ture: ENEL (I), KEMA (NL), EBES (B) , CEGB (UK), NCSR/UKAEA (UK). All Spanish Utilities have decided to adopt the CEDE scheme, to collect data in all their operating NPP's and to supply them to CEDE. JRexchangins Ci g information witNationae th h l Nuclear Safety Authority of the People's Republic of China, which has chosen to imple- ment a national reliability data system similar to the ERDS (CEDE and AORS) for data collection in their future NPP's. By putting togethe operationae th r l experienc Europeaf eo n NPP's, intendes ii t o creatt d databasa e convenientlw e datab ra o t f ,o e y pro- cessed, in order to:

- improv e credibilitth e existinf o y g estimated reliability parameters by exploitin necessare th g y feed-back from plant operation; - provide a solution to one of the major problems of the reliability analyst: namely the wide spread in reliability parameters existing in the current literature, especially for mechanical and electromechani- l componentca s; - allow comparisons betwee performance th n componentf o e plantf so f o s different countries.

DATA SUPPLIERS

VATTENFALL-S

EDF-f

L ENEL-I JRC inl»rn*l n*iwort [ GRSiHWE 0 M«nu«l or •ultxniiic (CEDB1 [ KEUA/GKN NL J^±L-- MArcn Da n »no » • o* oirtc. * B D 1 KEMAVPZEM.NL proccumg TttapiaciU USERS [ 110' tQ« CEGB UK

HCSR-UK CEDB r »poo lormi

Source: S. BALESTRERI, "The European Component Data Bank and its Uses", Reliability Data Bases, A. Amendola and A.Z. Keller (Eds.), Reidel Publisher, Dordrecht, 1987. PER 1388/87

Fig. 1 - Flow of information from the data suppliers, through the CEDB, to the users.

218 2.2 CEDB data collection schem repord ean t forms

2.2.1 Classification_scheme

A comprehensive classification schem r failure-evenfo e t reporting /2,3/ results from the combination of the two following schemes:

Plana - t Classification characterizatioe Schemeth r ,fo contexe th f no t in which the event occurs (plant type, Reference Engineering System Classification, Component-family Classification); - a Failure Classification Scheme, for the general characterization of the failure event followine th , g repai s consequenceit r f actioo d nan s at plant and system levels.

2.2.2 Plant_Classification Scheme_and Component_Report Forms

The Plant Classification Schem e establishmen bases th i e n o d f to the following hierarchical level r structurinfo s plante gth : component, system, system grouping.

a) component: it is a structure, or equipment, considered as an aggre- gat mechanicaf o e l and/or electrical parts, constitutin wela g l identified element inside the plant. It has defined performance cha- racteristic removee b n d replaceca an d d san d withi plante th n e .Th CEDB classification covers about 40 component families (TABLE I). A piece-part reference list for each component family has been set up to enable the failure reporter to single out the part(s) of the com- ponent involve failura betteo t n i dd ran e characteriz ensuine th e g repair action (TABLE II) e identificatioTh . componena f no e th n ti bank is performed by specifying the following data: functional posi- tion in the plant, system to which it pertains, engineering (e.g. design) characteristics, operating characteristics (operating values of the "numerical" engineering characteristics), environmental con- ditions, mode of operation, maintenance type and schedule. Data col- lection form adoptee CEDe sar th B y db (Figs . 2,3,4,5) e firs:th t two forms Componene ,th t Repor Operatioe tth Ford man n Report Form, are fille oncen i d characterizo t , componene th e whicr fo t h failure data will be collected.

Text continued 226.p. on

219 TABLE I Component family reference classification list of the CEDB

ACTE Electromechanical Actuator ACTH Hydraulic Actuator ACTP Pneumatic Actuator AMPL Amplifier ANCT Annunciator Modul/Alarm BATC Battery Charger BATT Battery BLOW Blower/Fan/Ventilator BOIL Boiler CXBR Circuit Breaker CLTW Cooling Tower GLUT Clutch COMP Compressor CPCT Capacitor DLGE Diesel-Generator set DRYE Aar, Gas Dryer/Dehumidif1er ELBE Electrical Heater ELMO Electric Motor ENG I Internal Combustion Engine EXCH Heat Exchanger FILT Filter FUSE Fuse GENE Electrical Generator INCO Instrumentation-Controllers INST Inst rumentation-Field INSU Insulator MOPU Motor-Pump Unit PIPE Piping/Fitting PUMP Pump RECT Rectifier RSTR Resistor SAVA Safety/Relief Valve STGE Steam Generator SUPP Pipe-Support SWIT Switchgear SHTC Switch TANX Accumulâtor/Tank TRAN Transformer TRSD Transducer TUGE Turbine-Generator Set TURB Turbine VALV Valve (except safety valve) HIRE Electrical Conductor, Wire, Cable

Source: CEDB Handbook

220 TABLE II : Component family reference classification - component family VALV: boundary definition and piece part list

Component family = VALV

Boundary definition: Component boundar identifies i y s interfacit y db e with plant equipment, that is: - body ends, connecting the component to the installation of which the valve is part.

Within the component boundary are included: - auxiliary devices, as far as they are dedicated to the'unit; protectio- d trinan p devices; - instrumentatio monitorine th componente e statur th th fo n f f so go .

Outside the component boundary are : actuator- ; - support/control devices.

Piece-part list I Body I I Diaphragme 13 Trunnion bearings (ball valves)/shaft bearings (butterfly) 130 Regulating/setting devices 14 Positioner 15 Spring 16 In strumentation/monitors/recorders 17 Damper/shock absorber (check valve) 2 Bonnet 8 2 Body-bonnet connection 29 Body seat 3 Stuffinx gbo 30 Disc/ball/plug/wedge 32 Pipe connection 33 Supports 4 Body trunnion (ball valves)/hing n (checepi k valves)/shaft (butter- fly valves) 8 Stem 8 7 Limit switch 8IX Cooling system components (general) X Protectio82 n devices (general) 82A Protection devices: sensing elements 90X Sealing (general) A Sealing90 : packing gland/stem B Sealing90 : body-bonnet 90C Sealing: pipe connection flange D Sealing90 : bellows/stem 999 Other

Source: CEDE Bandbook

221 fUfiOffAH HtLIAHL ITY DA TA SYSTCH - t/»OS COMPOMf HT [ VfWn DATA «AM* - CfDê

COMPONENT REPORT FORM

»r*^"°*1 | [ |"''Ti'>i'>l'"l i M i l l ! l MI i n

]iï£f£frlLu ^r^„^.^„r IrlT^iTrri'iTriTTNÏïiTTrr I I I 1 ^îTrrrrrrrtiiii'ïïiTTiTriT'iTTntrrrrriTi'ii'» t! ___c****crr» r I____cwutrgj»y_ 1 CM*^crrv«j I oi**fcr*r» M | f i^TriïiTrit'nTiïiTi'ilTiTrrrri'lT'riiTfiTiTi*

Ijtlctjj ». uiUIj

i» | o«>».ctr» • | TfTTiïïT ÏÏIl'iTÎTïïîiTr fMfrwrrawt n»«*vr*OT* XM*Mrr*»wi I CM»«Aftr* • I cM«**rrF« n I e>**»âcriTi M I • i Iri T u 1 n1 l il i l i t i i u 1 1 1 1 1 1 ^i^f1 iï1 3*'1 i *1 T 4Jl*J^uitMU'MWij>>''>'{*jliJ »« »ifun* j»J5t JMj* >M« J«** i«»*«|«r}«»*o '*»'r- j*A-j »* >j ^jrr n trt >*•]

f «•«$

Sourc e: CEDB Handbook

Fig. 2 Component Report Form

222 COHtQNCN T fVtMTS OA TA tAMK - CfDi

OPERATION REPORT FORM

I !.. c"***crf* ** wmïïiT uiijjjk>lij tuUiHiUrw«Lii>»lf irrrrrrnnr pu i < tuxli'Iu vl Mk f ÏÏT

CKtiuerr* » e»A»Acrr* >i Nk i»' l»»uj:»«l»»wu'.»ni»|««l»I4J|«M« I t It [71 r/ln I» tn tn m I IN I i 1

ttuftrrn p CHAfAcrcm u \ ÏÏTII—• to^j U.M»U«^Ttj adepti m&ti!;u T j:-M i 11U'•*[>1.»»1 M» »"'•''*u»jinu JIM urirtkt ITB ?j1»(7j|>< rj |*

I« ti ____ ejmMCTr» p I C»J»ICTT» i« I I FFii>r'H»l»UcUi 1' ig*i'>n\i*Ltw\te\tnie'»<1 rn i rr f fi T |»jnj'jj J»iit»i««|i7iMl»i JKijri rj'rrni m>\

rWMf CO* f * *S

Source : CEDE Hsmdbook

Fig. 3 Operation Report Form

223 CUKOHM HfLIAtlLITY CM TA SYSTfV - tHOS COM*OWf NT (VfNTS DATA «4*«T - CfO » FAILURE REPORT FORM \\

«Lf4 COM

•Hero» J COOtH T 'M>c|»'UJJ"|>(**f>*|r^

0jrf 0/* ft ft I» Tint «aut/»f I (j»jfm.»afr H ttOUffMI jirSi »i» U fffffffff fffl *T 00 or wo ftnufr ffiiuin rtutourn HlLUHlftiiatt onati'rofi ctuiu

^^«=p3:^p=^=p=k^: »So *»|»» »In|j»

Ttltffr

COMHC 71 fr IM , , I , , I . I . riiTriUlp»|«Bpl 4tlil44U U i U Iu SL m

feiiUMi imiliiir r«». J

rrfn Jr«JT>i>tj>T M5 1 « »

Ulil• » X» »Il i « wlw f I I

a*rc HI t ft mo

MM« «to» *

Source: CEDE Handbook

: FigFailur 4 . e Report Form

224 lUHOftAN Hf LIABILITY DATA SYSTfU - tftDS 1 COMPONENT [VIMTS DA TA «AM* - CCDt •r*e»' M

ANNUAL OPERATING REPORT FORM

18 t • —nit net — — | | r e Ii •VMM crci»x t n reu » »e touffu r * «H»J urt"• î « r ttor u 5 rut» Mtm

» fr o rl |u n M IT N r» MU' a u M a H n it m « u U M »t* IT, m H «c 44 4J uur • i F* t h ^ It ' 1 i l 1 ' » 1 I ' l > l i 1 j t i i ^ T 1 l j ! t j ' l > I j f 1 1 1 i • 1 1 1 ; 1 T * , 1 i 1 1 » j 1 1 i i e i i • -- 1 » 1 ' .

' , 1 1 i ' | l i . »

' i 1» 1 t [ i 4 ' I 1

1 1 1 1 I Hi ' i ' I 1 [ -1t T 1 ' , j » ' \ 1 1 . »' T i i ' ! ' 1 j i , , i t ! ! ' ' 1 ' ' ' ! i» 1 i

t , • , ill i ' 1 i j 1 »

t » ! i j i 1 1 i 1 » ! i i ' 1 ; *i ^ < i 1 i t . • ! 1 i _ ! i * , i 1 1 ' ' ' I ' " 9 • ; i 1 . j t 1 4 | i , ,' ' i j » , 1 ! ' i ! , , • i \ 1 i I i ! , • i i -rr- I 1 ' ;

! ' i \ i» ' ; i i 1 ~1 « ! » ; 1 ' '

amu«

CM« « * • «5 Sourc eCED: E Handbook

Fig. 5 Annual Operating Report Form

225 Comment: Experience shows that difference defininn i s boundare th g y of the component (i.e. of the material which can contribute to its failure) are a major cause of variation in reliability parameters e variougiveth y b ns sources. The CEDE makes in general a distinction between motive equipment (valve-actuator, turbine, electric motor, etc.) and driven equipment (valve-body, pumps, electrical generator, etc.), i.e. it classifies each of the above mentioned equipment items as components. In addition it classifies a few composite items (motor-pump unit, turbine-generator set, diesel-generator set). Other banks monitor the aggregate (e.g. the GRS bank considers aggregates such as "valve + reduction gear + electric motor" and "booster pum electri+ p c moto over-gea+ r mai+ m n pump").

b) system and system-grouping: a system is a set of mechanical, electric, electronic components univocally identifie whethery b d : . it accomplishes a clearly defined function inside the plant, . it accomplishes more than one function, but in different plant operating modes (i.e. cold-shutdown, emergency, normal operation, etc.) . A syste f systemmo t groupinse sa whics i ge characterize har y b d common properties, suc: as h . they can be framed in a more general logic function (e.g. the en- gineering safety features), . their functions are related to the accomplishment of plant-operating services (e.g. reactor auxiliary systems).

A Reference System Classificatio p R /4/Unitu LW s bee t ;r sha se nfo n more thasystems0 18 n , grouped int system-groupings3 1 o , have been singled out. Genera lreferenca guidelinep u t se e o plant s t classifi- cation scheme are illustrated by /5/. The LWR classification has been extende coveo t d r also GCR/AG PHWRd an R .

2.2.3 Failure_classification scheme and regort_form

The Failure classification scheme adopts the following basic defi- nitions:

a) Component failure; is defined as the termination or the degradation of the ability of a component to perform a required function; it is a component malfunction which requires some repair. A "functional"

226 unavailability (i.e. a lack of performance because of,the absence of a proper input or support function) or a shut-down of the compo- o conditiont nen e tdu s externa t procesconsideree no th e o t lar s d as a failure.

b) Failure mode: it is the effect by which a component failure is ob- served. Failure mode type e correlatesar d witcomponene th h t opera- tion mode e failurTh . e mode subdividee ar s d into generatw o l classes (TABLE IV): - "(not demanded) chang f operatineo g condition r state)(o s comr fo "- ponents asked to accomplish a function during a certain time; - "demanded change of state not achieved, or not correctly achieved" for components whic e callear h operato t d n demandeo .

A set of reliability parameters (failure rate or failure-on-demand pro- bability, repair rate) correspond o eact s h relevant component failure mode e classificatio.Th n adopte CEDy b dpresentes Ei TABLn i d E III. Among the codes related to failure mode on demand, codes A, B, C and F appl componento t y s suc valvess a h , breakers, actuators. CodeE , D s and F apply to rotating components such as pumps, electric motors, diesel generators, etc. As far as the second class of failure modes is conerned, "chang operatinf o e g condition r state(o s t required")no , two categories have been singled out, namely: - degree of suddenness; - degre f seriousnesso e . e firsTh t category describes whethe unavailabilite th r componene th f o y t is contemporar e detectioabnormalite th th e failur o f th t yo f r no eo y or whether the unavailability of the component could be deferred. The second category refers mode mainl componene changth f eo th o t yf eo t function s leve, it f degradatio i.eo lo t . outputo (n n , outside specifi- peculiarits it cation o t r )o y (operation without request, erratic output).

227 TABLE III: Failure modes classified by CEDE

FAILURE MODE

On demand

A Wont'open

B Wont'close

C Neither opens nor closes/does not switch

D Fails to start

E Fails to stop

F Fail o reacst h design specification

On operation

. suddenness

A Sudden failure

B Incipient failure

C Not defined

degre seriousnesf o e s

A No output

B Outside specifications

C Operation without request

D Erratic output (false, oscillât, instability, drift, etc.)

228 A failure-event is characterized by the failure mode, failure cause, failure descriptors, failure detection, parts failed, plant status at the time of failure, effect of failure on the system to which the component pertains, on other systems/components, on plant operation, corrective and administrative actions. The repair action is mainly characterized by the repair time, the unavailability time, the parts involved in the failure, the cor- rective action taken (component replacement, overhaul, modification, above-mentionee etc.)th l .Al d information itema failure-even n so t are recorded by the data collector in a "Failure Report Form" (Fig. 4)

2.2.4

e componenTh t yearly operating timnumbed an e cycles/demandf o r s are recorde e datth a y dcollectob Annuae th n li r Operating Report Form (Fig onc) 5 . yeara e .

2.2.5 Some improvements under |tudy_to meet_PSA needs

In orde mako e CEDt r th esuitabls B a possibls a e r PSAfo ee ,th following areas are being investigated:

- enlargin CEDe th gE component classification mak o CEDe t , eth E ablo t e equipmene th cove l al r t importan A (e.gPS r monitoo .t tfo r alse th o electric/electronic control equipment) ; - better characterizin actuae th g l function that some components- ,im portant for the safety, perform in the plant, by revising some engi- neering/operating attributes (such as the component application) ,- - better characterizing the component unavailability due to maintenance, by recording also the reactor status during the repair (as an addi- tional failure attribute) , the average test frequency adopted by the operator and the observed average duration of the component unavail- ability, if this is so, during the test with plant in operating con- ditions (as two additional component operating attributes) . It could als e convenienob colleco tt preventive t th dat n ao e mainte- nance (by the introduction of a "maintenance report form"), to answer the request f somso e Utilities intereste maintenancn i d e policy ana- lysi optimizationd san . This woul lese db s importan o PSAr t tfo e ,du the fact that preventive maintenance causing unavailabilit mostls yi y performed in shut-down conditions.

229 2.3 Data retrieval and processing l larg e CEDEal Th es a 2.3.,computerize 1 d component event data banks, allows, throug s enquirit h y procedure:

- the selection of a set of specified components and of the relative f failureo t a specifiese f o s d type; - the statistical treatment of this set of failures (and of the asso- ciated repairs); e retrieva e th displal informatio th - al d f o yan l n items e storeth n i d bank, such as the characteristics of a component and the report of each failure it suffered.

2.3.2 TABLES IV, V and VI give lists of the component, operation, failure attributes, wite indicatioth h r eacfo nh attributs i t i f i e questionabl e r noto eth ,n o i.e selectioa t f .made no i b r en o ca n basi f thiso s attribute. Through stepwise refinementse th mad y eb "SELECTION" command e usen selectth ,ca r r examplevalvesf o fo , t se ,a , installed in PWR's, pertaining to the "condensate and feedwater system", globe-valve type, of a specified diameter range, operating at a cer- tain temperatur e failureeth rangel al sf o ;whic h occurre o thit t d se s of valves, the user car now select those corresponding to the failure mod operation-degren i e f suddenneso e s "incipient" o thiT . s last se t of failures selected, the user can apply all the statistical applica- tion programmes inserted in the on-line enquiry procedure.

230 TABLE IV : Attributes of the entity COMPONENT

ATTRIBUTE EXTENDED ATTR «UESB TA T CLASS TYPE INDEX

CLA CODES/STANDARD/SAFETY Y CLASY S A 0

COMP-COOE REACTOR COMPONENT CODE Y A 0 CON-DA DATE OF CONTRUCTION Y D 0

CYCLES ANNUAL PROGR. NUMBE F CYCLEO R N S N 0

EN-CH-COO ENGIN. CHARACTERISTIY C ENG A 0

EN-CH-NU ENGIN. NUMERICAL PARAMETER Y ENG F 2

FIRST-CYCLES FIRST PROGR. CYCLES N N 0

FIRST-HOURS FIRST PROQR. NUM. OPER. HOURS N N 0

HOURS ANNUAL PROGR. OPERATING HOURN S N 0

IA-COD IAEA REACTOR CODE Y A 0

ID Y IDENTIFIER ENG A 0

MAN MANUFACTURER CODE Y Y A 0 MODEL MANUFACTURER MODEL Y A 0

NA NATION Y Y A 0

REA-PO REACTOY R Y POUER RANGE A 0

REA-TY Y REACTOR TYPE A 0

SC-DA DATE OF SCRAPPING Y D 0

SER-NUH MANUFACTURER SERIAL NUMBEY R A 0 SE-OA Y IN SERVICE DATE D 0

SY CRDS SYSTEM Y Y A 0

YTA»-CYCLI8 Ytft f CYCLO N Q E PROGR. N 0

YEAR- HOURS YEA F OPERATINO R N G HOUBS N 0

Y-8TAR Y STARTING YEAR N 0

231 TABLE V Attributes of the entity OPERATION

ATTRIBUTE EXTENDED ATTR GUESB TA T CLASS TYPE INDEX AL ALTITUDE Y Y A 0

CLI CLIMATE Y Y A 0

Y CORRO Y CORROSION A 0

H HUhlDITY Y Y A 0

IND Y Y TYP F INDUSTRO E Y A 0 INS Y Y INSTALLATION A 0 MAI MAINTENANCE TYPE Y Y A 0 MODE MODE 0F OPERATION Y Y A 0

OP-CH-COD OPER. CHARACTERISTIY C ENG A 0

OP-CH-NU OPER. NUMERICAL PARAMETEY R 2 F ENG

OP-DA Y OPERATION DATE D 0 PR PRESSURE y y A 0 RA RADIATION Y Y A 0 TE TEMPERATURE Y Y A 0 V VIBRATION Y Y A 0

232 TABL: AttributeI EV entite th f yso FAILURE

ATTRIBUTE EXTENDED ATTR QUEST TAB CLASS TYPE INDEX

AC-AD ADMINISTRATIVE ACTION TAKEN Y Y A 0

AC-CORRE CORRECTIVEY ACTIO Y N TAKEN A 0

CA CAUSE Y Y A 0

CYCLES CYCLES AT FAILURE OCCURRENCE N N 0

DES DESCRIPTOR Y Y A 0

DET DETECTION Y Y A G

EF-OT EFFECT ON OTHER SYSTEMS Y Y A 0

EF-REA EFFECT ON REACTOR OPERATION Y Y A 0

EF-SY EFFECT ON SYSTEM Y Y A 0

FA-DA FAILURE DATE Y D 0

HOURS HOUR T FAILURA S E OCCURRENCN E N 0

MODE-DEH MODE ON DEMAND Y Y A 0

MODE-OP-DEG Y MOD Y E OPER. DEGREE A 0

MODE-OP-SU MODE OPER. SUD. Y Y A 0

PA PART-FAILED Y Y A 0

REA-STAT Y Y REACTOR STATUS A 0

REL RELATEY B FAILURES A 0

REMARKS REMARKS N A 0

REPAIR-TIMy E REPAIR TIME N 0

RES START-UY P RESTRICTION Y S A 0

U-DA DAT F UNAVAILABILITO E Y Y D û

UNAV-TIHE UNAVAILABILITY Y TIME H 0

233 2.3.3 ǣDB_data_processin

Throug e CEDth h E interactive enquiry procedure e analysth , n ca t estimate reliability parameters for a specific component category in which he is interested. The on-line statistical processing includes at present:

a) Point and interval estimation (for complete and censored samples) of: a.l) constant reliability parameters (time-independent failure rate in operation, constant una vail ability on demand, time-indepen- dent repair rate) /6,7,8,9/y b , r

. Bayesian parametric approach (with priors: beta, uniform, log-uniform, log-normal, ) ; . classical approach (maximum likelihood, confidence interval). 2. a ) non-constant reliability parameters (time-dependent failure rat n operationi e , time-dependent repai re Bayesia rateth y b ) n non parametric approach (with prior identified by a sample of time a failure-timo failurt sy b r o e e analytical distribution)

b) Test of hypothesis on the law of failure and repair time distribution: - exponential (for complete and censored samples) ; - Weibull, log-norma gammd an l a distribution, increasing failure rate, decreasing failure rate (only for complete samples) .

Effective graphical tools can give on-line the representation of an observed time-dependent failur e posterio eth e prio rated th f an ro ; r distributions (Bayesian parametric approach e cumulativth f o ); e failure distribution function F of the observed, the prior and the posterior sample (Bayesian non-parametric approach), etc. In refinin a selecteg d sampl f failureo e a statistica r fo s l ana- lysis e analysth , retrievn ca t revied an e w each even o identift t d an y delete froe samplmth e those failures whic e independentb h o appeat t no r . exampln Aa s f off-lino e e statistical processing tool mentioe w , n the recently implemented interface which allows the application of the SAS statistical package, available at the JRC /12/, to the full set of data relate a sampl o t d f componentso e .

234 3. CEDE use and data analysis

3.1 On-line inquiry for inference of reliability parameters

Some examples of data treatment by using a Bayesian parametric approach (with the necessary assumption of constant failure rate or constant unavailabilit demandBayesian e yo th d )an n non-parametric approach (in the case that the test of exponentiality of the failure time distribution is rejected and, as a consequence, failure rate cannot be assumed constant) are given in /13/. The CEDE, with the full package of data processing programmes inserted in its on-line enquiry procedure, effectivn ia s d versatilan e e safeteth toor yfo lanalyst . Nevertheless, e experiencbasie th oth nf so e gaine datn i d a treatment have ,w e verified that the number of reported failures, characterized by a sudden and complete loss of the function, is often very small, even when the size of the sample observed is remarkable (TABLE VII). This is due, of course, hige tth oh reliability feature categoriee th mosf so f to compof so - nents monitored. It is to be noted that, when the number of failures is too small, the implemented test of exponentiality cannot be made and, as a consequence, the Bayesian parametric approach (with the assumption of constant reliability parameter obligatore th exploio s t )i y ywa t the stored information. The application of the test of exponential distribution (when it can be made) shows that a constant parameter can be assumed in a few cases only /14/,- nevertheless, we noted that when the sample refers to complete failure f componentso s performin e samth ge functio similan i n r plants (i.e. components having similar design-relate d applicationan d - related attributes), the test of exponentiality is accepted with a certain frequency.

3.2 CEDE - Reliability Data Book

Generic reliability data for pre-defined classes of components, derived by a statistical processing of the contents of the CEDE, are being collected in a Reliability Data Book (RDB-) /14/. This book is produce organizen a s da d banoutpue wild th periodicalle an k lb f to y updated givest I . eacr fo ,h item considered:

235 to TABLE VII Examples of CEDE on-line data treatment for the pumps of the Auxiliary Feedwater System of PWR's (constant failure rate) Saaple observed Prior (fail./ r fail./do h ) Posterior (fail./h or fail./d) Component/ Systei/ lo coap.t „ ,. 95th , Median Source Median /function /failure aade Operating tiae/deiands percent He No failures/repairs 32coap.s Electric aotors/ BIO/ 952 7d 1 2.4" lu 76.6* 10 5 2.25 10"5 S.89 10"5 /drivers /fails to start 0 failures 10 coap.s Stea« turbines/ BIO/ 966 d 1.6 lo" 1.6 10" 2 4.78 10~* 1.95 10"3 /drivers /fail o start s t 0 failures BIO/ 10 coap.s Steaa turbines/ 2 " 10 3 n /fail4. ru o t s ~ 10 7 4. 1047 5h 2.56 10" 1.68 10~* /drivers once started 1 failure Eaergency feed 31 coap.s BIO/ puaps 5079 d 2 10~ 1.9 10* 2 4.53 10** 1.06 10"3 /fails to start (without drivers) 3 failures Eaergency feed BIO/ 31 coap.s puap2 s " lo 3 /fail4. s t" o lo ru 7 n 4, 2614 h 5 2.6* 10 2 4.5" lu 9 (without drivers) once started 8 failures Eaergency feed 18 coap.s BIO/ n rep•i . h tia 1 e puaps - 13. D 6h h (totST 9 .50 h rep2 1 .- tiaeR MU ) /all fail, aodes x rep•a .h tia 0 5 e (without drivers) 42 repairs (failures detected with reactor in operation)

NOTES BIO Auxiliary feed water systea Sourc t IEE I eT 500 S E , 1977 pag, 20

Be merely consulting this book analyste th , , without accessine th g bank, can quickly obtain generic reliability data for the item he is intereste evaluat, in d e their credibilit sample basie th th f eso n yo size from which they have been derived, use them as priors for Bayesian updatin basie th plant-specifi f so n go c data, etc.

3.3 Analysis of linked multiple failure events (MFE's)

A study on linked MFE's (such as the CCF's), based on the esta- blishment of a comprehensive classification scheme of these event- types and on a search method performed through an extensive screening of the data base, was carried out between 1983 and 1985 /15/. The pro- posed general classification schem combinatioe bases th i e n o d f no these four possible linking factors: failure-cause, failure-mode, temporal distributio linkee th f dno failure-events, failed component(s) involved. Through some practical application of the above-mentioned search method, the authors have shown how component failure databases can effectively be exploited for identifying potential hazardous dependent failure d gaisan n knowledg r improvinfo e g - desigre d nan ducing operation errors and malpractices. This way of investigation appear e verb yo t spromisin wild continuedge an lb .

3.4 Application of multivariate analysis techniques

3.4.1 The results of a first application of covariate analysis to a of 543 gate valves, with the associated 156 failures, are reported in /16/. All the failures are considered in the study, irrespective of their failure mode (145 failures are classified as "incipient", 11 as "sudden"). According to the results obtained, the failure rate related

237 to this sample of valves, which had (nearly all) incipient failures (i.e. failures with degraded performance of the function) is a constant valvee th r s fo which operate givea n i dn engineering system insida e given plant unit changet i ; valus it s e from syste o systet m m (inside the same plant unit d fro)an m uni unito t plane .Th t unit dependency presumable th more coulo du t e e b d e differences existing betweee th n criteria followe varioue th y b ds data collector r recordinfo s g partial failures (differences between the criteria adopted by the data collection schemes, subjectivity in their interpretation) than to differences in component performance. Nevertheless, ascertainin e importancth g f eo e factoth r "manufacturer d "maintenanc"an e policy determininn i " g the component real performance remain mose th st crucial problem. These results, demonstrativ effectivenese th f o e methodoloe th f so - gie r sfurthe fo used k ras , investigatio verifo t n l theial y r signifi- cance froengineerine th m g poin f viewto .

3.4.2 Multiple correspondence analysi beins i s g performe data n ao d pumps7 41 sef ,to taking into account only their "sudden" (i.e. complete) failures. This techniqu e firsapplies i eth tr timfo dr CED fo eE data analysi conclusivd an s availablet ye e t resultno e note .W sar e that some interesting discrimination obtainee e graphicaar s th n i d l repre- sentations of failure data coming from plants of different type (PWR, BWRr froo ) m plants pertainin o different g t countries. This- in lin f o e vestigation appear e verb o yst promising.

. Conclusion4 s

Experience has shown that the CEDE structure is well suitable to operat centralizea s ea d bank (i.e receivo .t e data from national banks through a computer-aided transcoding process) or to a direct collection of data, in the CEDE format, in the NPP's. Due to the package of data treatment programmes inserted in its enquiry procedure, it is an effectiv usee eo infeth t r too r rfo l good reliability parameterse .Th line of investigation based on the application of multivariate analysis techniques appears to be very promising for failure trend analysis, failure root cause analysis, failure dependenc component-attrie th n yo - butes, etc.

238 A progressive increas CEDe e futurth th E f n o edati a baseo t , be guaranteed by the joint effort of the European data collectors, will enabl e use mor o th emord t r an ee exploi s capabilitiesit t .

REFERENCES

/!/ G. Mancini, J. Amesz, P. Bastianini, S. Capobianchi, "The European Reliability Data System - ERDS: an organized information exchange operatioe o th nEuropeae th f no n Nuclear reactors", Nuclear Power Experience, Vol.2, IAEA CN 42/311, Wien, 1983. / "CED/2 B Handbook" 1.05.Cl.84.66N ,T 855/84R ,PE JRC-IspraC ,CE , 1984 (internal document, restricted distribution). Besi. A ,/ "Componen/3 t Event Data Collection", , A. Amendol Sai. A Bustamante zd d an a e (Eds.), Reidel Publisher, Dordrecht, in press. /4/ M. Melis, G. Mancini, "LWR Reference System Classification for the ERDS", EUR report 7905 EN, CEC, 1982. /5/ A. Besi, "Reference classification for event data collection", Reliability Data Bases, 57-84, A. Amendola and A.Z. Keller (Eds.), Reidel Publisher, Dordrecht, 1987. / A.G/6 . Colombo, R.J. Jaarsma, "Bayesian estimatio constanf o n t failure rate and unavailability", IEEE Transactions on Reliability, Vol. R-31, No.l, pp.84-86, April 1982. / A.G/? . Colombo Costantini. ,D , "Ground-hypothesi betr fo sa distribu- tio Bayesias a n n prior", IEEE Transaction Reliabilityn so , Vol. R-29, No.l, pp.17-21, April 1980. /&/ A.G. Colombo, R.J. Jaarsma, "BIDIPES - a conversational computer programme for point and interval estimation of constant failure rate, repair ratunavailability"d an e , Repor R 764, 1982tEU 5 EN . / A.G/9 . Colombo, R.J. Jaarsma, "BAESNU conversationaa - M l computer programme for the Bayesian estimation of a parameter by a numerical method", Report EUR 7900 EN, 1982. /10/ A.G. Colombo, R.J. Jaarsma, "Bayes non-parametric estimatiof no time-dependent failure rate", IEEE Transactions on Reliability, Vol.R-23, No.2, pp.109-112, June 1985. /I I/ A.G. Colombo, R.J. Jaarsma, "BANPES - a conversational computer programme for point and interval estimation of time-dependent failure rate by a Bayesian non-parametric method", Report EUR 10183 EN, 1985. /12/ "SA SStatistica- l Analysis Sytern" S InstSA , . Inc., Versio , 19855 n . /13 Balestreri. /S Besi. ,A Carlesso. ,S , A.G. Colombo, R.J. Jaarsma, "Use of CEDB for PSA", ANS/ENS Top. Conf. on PSA and Risk Manage- ment, Zurich, September 1987. /14/ S. Balestreri, A. Besi, A.G. Colombo, R.J. Jaarsma, "CEDB - Relia- bility Data Book" R 1124/8PE , 6 (draft) JRC-IspraC CE , , September 1986 (internal document, restricted distribution). /15/ A. Games, P. Martin, A. Amendola, "Multiple related component failure-events: risk, design, maintenanc cost"d an e , Reliability "85, Birmingham, July 1985. /16/ A.G. Colombo, P. Ihm, "Use of qualitative covariates to estimate failure rate" preparationn ,i .

239 EVALUATIO RELIABILITF NO Y DATA SOURCES IN CHINA

X.Y. CHEN Research Institute of Nuclear Power Operation, Ministr f Nucleayo r Industry, Wuhan, China

Abstract

The paper first review e developmenth s f probabilistio t c safety assessment in the last few years in China. We have done the following work: (1) Trainin d improvinen g e personnel'th g s capabilitief o' s performing PSA. (?) Organizing activities forputting emphasi e solvinth n o s g PSr Qinshafo A d Guangdoinan n g NPPs. (3) e Workinprojecth t r settine Reliabilitfo ou gtth p u g y Beta Ban n Researci k h Institut f Nucleao e r Power Operation. Secondly e papeth , r introduce e developmen th a spla n o n f o t PSn Researci A h Institut f Nucleao e r Power Operatioe th n i n near future. The plan includes: (1) Investigating and translating the information from abroad so as to train personnel's capabilities continuously. (?) Importing part of the applied analysis procedure and putting into computer M-240D. (3) Sending some people to Qinshan NPP to attend the commission- ing there for collecting operating data. Settin e Reliabilitth p gu y Data Bank. (5;; Developing the analysis model and multifunction computer codd improvinan e methodologyA PS g . The paper finally expresses our hope to co-operation and exchange experiences with other countrieA e fielPS th f o dn i s technology.

A. Revn ie Sincn 197 i I inciden TM P en 9U.S.A,nuc i NP f o t r safet1ea y measures have been widely enhance e countrieth n i dl oveal s r the world.The organizations which are specially engaged in nuclear safety research e aftehavon p eru beeanothet se n r f effectivo t lo an a de wors beeha k n done. widels i s yA known,Chin a developin s I a g country.Nuclear power development in China has just started.A 300 megawatt -electric

241 site in Qinshan after the first phase of construetion.This project will be completed and put into commercial operation soon after 1993.China has devoted much attention to the nuclear safety.In 1986,The Ministry of Nuclear Industry decided to foun a Researcd h Institut f Nucleao e r Power Operatio t Wuhaa n n city in Hubei province as a direct technical supporting uni f NPPs.Tho t e Institute 6 divisionset p u s s followsa s : e divisioTh f operatioo n n managemen f NPPso t ; e centeTh f operatino r g personnel trainin f NPPso g ; The center of quanlity assurance of NPPs; e centeTh f in-servico r e inspection; The division of NPP's components research and design; e divisioTh f informatioo n n material. There are 300 members of nuclear engineering experts covering wide field f expertisp s n thii e s Institute. About 150 members are specialists possess ing nuclear engineering experiences over ten years.The first engineering stage of the Institute's elementary constructio s completewa n n 1985i d . Now,It is proceeding to the second engineering stage.After the second phase is completed,the Institute will be a technical supporting unit with wide technical service. Becaus cite th f eWuhayo s locatee i r centen th ou n f i o rd country,it has developed water,land and air transportation. This is advantageous to makeing the Institute become a nationwide center of technical service and information communication. The probabilistic safety analysis (PSA) is now increasingly applied to design,1icensing and operation of NPPs.It is an important part of NPP's operation research.In order to elaborate using PSA for finding out where the weak points lie and searchin r theifo g r possible improvemen n desigi t d operatioan n n s earla s possiblea y , from 1983 Ministr f Nucleao y r Industry set about organizing some people to translate and publish U.S.NRC publications NUREG-2300,and through these activities to train personnel's capabil ities.National Nuclear Safety Administratio d Ministran n f Nucleao y r Industry organized together two expert teams to solve PSA issues for Qinshan NPP and Guangdong NPP.These activities have been supported by international experts.The agreement d betweeGRSan , I MN n

242 Federal Republic of Germany,for PSA of Qinshan Plant will be completed in two years.Now PSA level one is near completion, f Guangdono A PS e gth Pland s participatean ha t e IAEA'th n i sd inter-regional projec f PSA,havino t e greath t t go gconcer n from the division of Nuclear Safety Reliability and Risk Assessment,IAEA. Nowadays,I r countrou n y Some units like Ministrf o y Electronic Industr d Ministran y f Aviatioo y d Spaceflighan n t Industry have established the research center of complete system reliabil ity.AI l important universities also have estabilished PSA research courses.All these will give Nuclear Industry an advantageous technical support. MNI Authority has made a project which plans to Set up a big reliability data bank of NPPs at Research Institute f Nucleao r Power Operatio n Wuhai n n ordei n o develot r A PS p more effectively,and it will be gradually expanded to be a cente f nationwido r e information commumicatio r Nucleafo n r Power. B. e neaPlanth rn i sfutur e e divisioTh f NPP'o n s operations management whica s i h subordinate unit of RINPO (Research Institute of Nuclear Power Operation) undertakes the PSA research tasks.Now,there are 37 members in this division.21 members are engineers with experiences e fieldoven yearth te rf n reacto o i ss r physics, thermalhydraulics,loops, electrotechnics,control.radiation on,computei t c te o pr r softwar d hardwaran e e etc.Among them there are ten senior engineers.Now,we are putting apropriate persons A intresearce fielPS th of o d als e teaan hth o m wile b l expanded increacingly. For creating reliability data bank,the division organized people to make overall investigations in the hardware area and get prepared to construe t.For example,To select computer Model and interface component for data bank and communication network;and large engineering simulato r datfo r a analysis.A consultant meetin f internao g l expert s hel n Ma s1987.Chinesi d e government will allocate funds for purchasing computer and maivuf ac tur i ng components . The data bank is required to start- collecting and storing operating experience data before the first Chinese Nuclear Power Plant is put into operation.

243 In the software area, The main task is training personnel capabilit r datfo y a collecting, analysi d retrievaan s n i l next two years. The scope of research will be expanded and deepened step by step. The plan is as follows: 1. Training personnel capability y B mean f holdino s g seminars g stsspei in l t a tci i o comv in e to give lectures,investigating and translating information materials from abroad,the division makes researchers recognize and know wele P statusysteth NP l f o sm reliability research, s developinit g trend,research directio d methodan n . Two terms of seminar were organized in 1987.The lecturers were Professors of Jiao Tong University.Meanwhi1e,according e investigation,th o t a par f informatioo t n materia Isabout National Centre of systems reliability in England were translated into Chinese. . 2 Creating co-operative relationship A long term co-operative relationship betwee e divisioth n n d Jiao-Tonan versity,Shanghai un g s beeha i n established.The University send teachers to help the division to introduce computer programs about fault tre t intei analysit o pu d an s computer M-240D which is Located in the computer center nearby. e completew l Firsal f o 3 tprogramd s whic e prograar h m PREP for qualitative évalua tions,program FTAP for quantitative evaluations and program KITT for maintainable system reliability analysis,Then,both sides will join together to prepare a sythetic fault tree analysis program which will possess functions of "Sample" and "Importance" and also include functions 3 program e oth f s above. 3. going to in-situ e divisioTh n will organiz o in-sit t s member o it eg o ut s o attent d an d commissionin f Qinsharo g t NPP.It will maks it e members gras e regularitth p f collectino y g engineering operation datd solvan a o fount e d specific field tîata collection compaigns.Base n this,construetioo d f communicatioo n n network wil e completedb l . . 4 creating reliability data bank The plans to establish engineering data bank will cover abou 0 systems,4003 t o 500t 0 0 components.lt must start collecting,storin d retrievinan g g data befor e firsth e t Chinese NPP is put into operation.

244 . 5 settind developinan p u g g analysis model. On the basis of the PRA level one we trend to develop the PRA level 2 or 3, 6. setting up the specialist network. o fount e specialisth d t networ r evalvatiofo k f o n reliability in PWR des ign,operation and maintenance. . 7 developin w computene g r programs. o develot p multifunction computer analysis prograd an m new calculation method programs,the latter including those o uncertaintt e du y effect assessment,human reliability factors and common cause failure effect. C. Conelusi on Befor e firsth e t Chinese Nuclear Powe rt intPlanpu os i t operation,there is a precious term.During this time we must 1-ear d applan ns mana y y experiences (both positiv d negativean e ) as possible from advanced countries to avoid unnecessary repetition and never follow roundabout way.So,We hope to establish the co-operation relationship and exchange experiences with other countries all over the world in the PSA technical research field. e openion Th s followsa e ar s : e sincerelW ) 1 y hope foreign experts would com o China,tt e o give 1ectures,exchange experiences and train personnel cap- ability.We also hope IAEA would giv s moru e e hel n thii p s field. e woulW ) d 2 lik o takt e e par n internationai t l co-operation o tacklt y problem ke eA methodologie PS n i s s improvemend an t w calculatione n program development. e welcomW 3> e foreign expert o Chint s o consult a d direcan t t us in creating reliability data bank including hard-ware and software. woule W d ) sugges4 d supporan t a Co-ordinatet d Agency's Research Programme on reliability data bank organized by IAEA,and will participate actively.

245 DATBASE: A COMPUTER CODE FOR THE HANDLING OF RELIABILITY DATA SOURCES IN PSA STUDIES

F.J. SOUTO, R.A. CANO Comisiön Nacional de Seguridad Nuclear y Salvaguardias, Mexico City, Mexico

Abstract

DATBAS a compute' 5 1 E - cod o obtait e n component unavailabilit/ from generic or specific failure rate data sources and to generate e propeth r numerical inpu e followine th tuséb n i dateo t ga fault-tree analysis computer codes: FTAF ( F_ault J_ree Analysis Progra t , m) Se Equatio 5E ( TB n Transformation d Systean ) m TREE - MASTER. The code includes an option to modify the unavailability of basic events in the fault tree of a system which makes it a complementary tool in sensitivity studies. Also it can be appliee screeninth o t d f evento g n i commos n cause failure analysis. The code was developed for an IBM-PC or compatible microcomputer using dBASE III plus.

. I INTRODUCTION

e ComisioA grouth PS n e i pobjective th ne th f Ono ef o s Nacional de Seguridad Nuclear y Salvaguardias ( CNSNS ) - the Mexican Nuclear Regulatory Body - is the development, validation and applicatio f o risn k analysis methodologie d theian sr corresponding computer codes t presenA . t these technic e usear s d for the Laguna Verde Nuclear Power Station AC Blackout Assessment.

Within the scope of this assessment - and due to the fact that a key element in the estimation of a system s reliability is the availability of appropriate failure rates for the components which make up the system [1] - it was recognized the need to develop a to handle failure data and to compute component unavailability for application in quantitative fault tree analysis.

The "DATBASE" compute e rresul th codf o s -fulfillini et e gth above need. The main features of the code are the following:

1. DATBASE includes a failure rate data base that incorporates updated information from various sources. f e o codequationTh t e se . use2 a s s that describee th s stochastic failure behavioe variouth f o rs componenta n i s time dependent model.

A progra3. s i minclude d that usee abovth s e equationo t s calculate the unavailability for specific components or events in terms of the failure rate in the data base and the particular conditions assumee eventh n questioni r t fo d .

4. It prepares the proper numerical input data for the FTAP [2], d TREE-MASTEan SET 1 [3 S ] [4 Rfaul t tree analysis computer codes.

247 5. Allow e e useth screeninth s r f o eventg s e witsamth he predetermined e screeninlocatio e planth th r o tn i n f thoso g e events with unavailability greate r equao r o somt l e selected value.

6. DATBAS s programei E s compilei t i n dBASi d dI an II Plu E] [5 s IBM-Pn a r n i compatiblo C e us s foit er microcomputer.

f n SectioI o thi sI I n worpresene w k e basith t c equations used in the program and their particular application to different types of components. Section 111 describes the failure rate data base used in the code, whereas Section IV presents the DATBASE program structure. Finall n i e Sectioysuggesw V n t further application e DATBASth r fo ^ E computer code.

II. BASIC EQUATIONS

We shall assum d onle ar on ye on tha a n componeni t e b n ca t possiblo otw f e states: availabl r unavailablo e - whice wile w hl respectivel1 d an denotthad 0 an ty , b e- sucy a componenh o g n ca t randomly from one state to the other. Then the equations that describe this random behavioe ar r

dP (t)

A (t)P (t)Py Q (t= ) x(t) (1)

anci dP_ (t) = \ (t)Pg(t) (2)

where

PQ(t) Probability that the component is in state O at time t,

P (t) Probability that the component is in state 1 at time t,

X (t) = Probability per unit time that the component goes from state 0 to state 1 at the time instant t,

= Probabilit ) p(t r unipe y t time thae componenth t t goes fro e mtim th stat eo stat t t a instan1 e0 e . t t

e solveb n r fo ca d ) (2 Equationd an ) (1 s and namely

(t) = (3) ' X+y y X+ and

Lf -l1-~(X+y)t (4)

where we have assumed X(t) and y(t) constants and Pn(0)=L.

248 For periodically tested standby components, which constitute most of the Emergency Core Cooling Systems (ECCS), there are at least four kinds of contributions to the component unavailability, namely [6]: hardware -failures, unavailability due to test, unavailability due to unscheduled repair and unavailability due to scheduled maintenance. In PSA applications its common practice to include these four contributions as four different events in the syste ms fault tree [6]unavailabilitiee Th . o schedulet e du s d test (Q ) and maintenance (GL,. _) are not random and are given by

QTEST = + and

e averagth s i where i tese time t th duratione s i interva g T , l

between tests, f IB tnp scheduled maintenance frequency, and Tm e schedule th e tim f th o e d maintenance action.

The average unavailabilit o t hardwar e du y e failurea r fo s periodically tested standby components ^av 5 1 derive' d from equation (4) and is given by

sTs ) (5 QAV l-e[ (T s")=l- ^--^ ] s s

wit X hdenotin e standbth g y failure rate. S

For untested standby component e averagth s e unavailability cae obtaineb n d from expressio p T whery replacin b y ) b e(5 n T g the latter e faulstandth r t fo exposurs e time [1].

The average steady state unavailability ^GGNT^ continuously monitored standby components is derived from (4) as

X T S R T_ 5 b

where T_ = — is the mean time to repair R y

In the case of nonrepayable online components the unavailability, according to equation (4), is

e operatinth . T» g d failuran witQ e missioeX hth ratd an en time respectively.

For online repairable components the average steady state unavailability (D_pp ) is obtained from equation (6) by replacing ' X y b x

249 III. FAILURE RATE DATA BASE

DATBASE can obtain component unavailability either from specifi r o generic c data bases. However, presentlt havn do e e w y readly available specific data and therefore we have installed generic or baseline data in the code. Although various data sources were used for the development of the DATBASE failure rate data base e th NUREG/CR-2B, 35 dats selecteawa bas] s a [1 de baseline source. When some data was not available in this reference, it was selected from specific PSA studies [7-8], or from references [9], [6] or [1O] respectively. Our data base contains the information distributed in nine arrays: CODE, COMPONENT, FAILURE MODE, MIN, MEAN, MAX, DISTRIBUTION, REFERENCE d REMARKSan .

IV. DATBASE PROGRAM STRUCTURE

The program structure and the interaction of files are schematically described in figs. 1 and 2 respectively. DATBASE require a dats a base (file DATBASE.dbf) which includee th s information containe e fieldsth n i d : CODE, COMPONENT, FAIL-MODE, MIN, MEAN, MAX, DIST, REFERENCE and REMARKS. Also an alphabetic index file (DATBASE.ntx) is generated from the field CODE of DATBASE.dbf e prograTh . m also use a mastes r file (BASEOUT.dbf) which contains the arrays: CODE, LABEL, TYPE, TIME, LOCATION, COMPONENT, FAIL-MODE, MEA d UNAVAILABILITYan N .

The program creates another dBASE file (SYSTEMDT.dbf) copying the structure given in BASEOUT.dbf . This new file contains the whole information about the basic events of the system's fault tree to be analyzed, i.e. the event code (field CODE), the label e e system'eventh th give r n i fo tn s fault tree (field LABEL)e th , affected componen s it locatio d an t n (fields COMPONENT, FAIL-MUDE and LOCATION), the corresponding failure rate (field MEAN) and the information neede o t dcalculat e unavailabilitth e y (fiel fro) dQ m the component type (field TYPE) and the required mission time or time between tests (field TIME).

Th ee syste th nam f o mes faul te analyzed b tre o t e , together with the information corresponding to the fields: LABEL, CODE, TIME, TYPE and LOCATION are supplied in an interactive way by the user. The remaining information is obtained from the data base ana the program own calculations.

Following the input of all the component data, the program proceed o t calculats e unavailabilitth e r eacfo y h event. DATBASE usee appropriatth s e equation accordin e typ th f componento eo t g , periodicalla s i t i i.e f i y. tested standby component untesten a , d standby component a continuousl, y monitored standby componenta , nonrepayable online component or a repairable online component. s possibli Als t i o o t handle failure th e e pprobabilit demann o y d as basic information instead of the failure rate.

The suitable failure rat s i obtainee d froe datmth a basr fo e each event. The component name and its failure mode are also obtained from the data base.

250 C st-r Results __ Program \ ( outputs y

f—"Tault-tree bcilc events Ant a FTAF data input

Baseline Calculations data base SETS data Input

TREE-HASTES /Progra data Input ,——4putfi and screen}—v \lng options y

Fault-Tree numerical values ___

Results ©0 C End f Return J

FIG.1. DATBASE program structure

DATBA5E gives -four different format outputs for the computed results firse Th .t output option e numericaprintth l al s l values generate e e basith prograth r cy b dfo evente m syste th f o mss fault e treeremaininTh . g three output options correspone th o t d proper data input files for the FTAP, SETS and TREE-MASTER fault tree analysis computer codes.

. V DATBASE FURTHER APPLICATIONS

DATBASE was designed to provide support in screening component r evento s s bot r sensitivitfo h commod an y n cause failure preliminary analysis. This typf o e analyseeb dony b en ca s searching all the events that have some feature or characteristic n commoni n particularI . r presenou , t interes n componenti s i t s withi e samth ne e locationucleath t a nr power station, with unavailabilities greater or equal to some specified value and further with the same failure mode.

251 npuc of the selected location

YES

YES

ReBults

FIG.1. (cont.)

DATBASE also permits the automatic change -from the actual unavailability int a opredetermine r thosfo e e on devent s within the same selected location. This allows to detect events with the same given location and to measure the impact of these events in the system's global unavailablity.

252 DATBASE.dbf USER System's fault PRINTING Data Bank tree. CODE, COMP., P.M., CODE, LABEL, System's fault MIN, MEAN, MAX, TYPE, LOCA., tree numerical DIST., REF., TIME. SYSTEMDT.dbf data REM. SYSTEM CODE, LABEL, _ i>TYPE , LOCA., TIME SYSTEMOU.FTP DATBASE.ntx COMP., P.M., MEAN ,Numerical PROGRAM Index control values in from CODE Calculation of FTAP format Q from TYPE, MEAN, TIME SYSTEMOU.SET Numerical values in SETS format BASEOUT.dbf Master file CODE, TYPE, LABEL, TIME, LOCA. SYSTEMOU.TRM COMP., F.M., Numerical MEAN hvaluen i s TREE-MASTER format

FIG.2 DATBASE interactio f filesno .

Since specifi t cavailablno dat s t i e presena a th e r fo t Laguna Verde Nuclear Power Plant, it was decided to incorporate generic data as a failure rate data base for the program. In addition e comminth n i , g futur e prograth e m e wiladpateb l o t d update the generic failure rate data with site specific data. To achieve this objectiv e theoreth e f mBayeo s wilusee b lo derivt d e plant specific distribution e failurth r efo srat f componento e s e generith f o c t datou a bank distributions uses prioa d r distributions. e Theresultinth n g posterior distributione b n ca s used as updated inputs in plant specific reliability or risk analysis [11],

REFERENCES

[1] Probabilistic Safety Analysis Procedures Guide, NUREG/CR-2815, (BNL-NUREG-51559), USNRC, January 1984.

[2] Willie, R.R., FTAP Computer-Aided Fault Tree Analysis. ORC78-14, Univ. of Calif. Berkeley, August 1978.

[3] Worell, R.B. SETS Reference Manual, NUREG/CR-4213, (SANDB3-2675), USNRC, May 1985.

253 ] [4 Wild . TREE-MASTEA , FaulA R t Tree Processing Code Designed Specifically for your Personel Computer, 1983.

[5] dBAS I PlusII E , ,Asthon-Tate II Vol& I . , 1985.

[6] Interim Reliability Evaluation Program Procedures Guide, NURE5/CR-2778 (SAND82-210O), USNRC, January 19B3.

] [7 Interim Reliability Evaluation Program; Analysie th f o s Millstone Point Unit 1 Nuclear Power Plant. NUREG/CR-3OB5, (SAND-721.2) 4 VOLS., , USNRC y 1983Ma , .

[8] Shoreham Nuclear Power Station Probabilistic Risk Assessment, Long Island Lighting Company, 1981.

[9] Reactor Safety Study. An Assessment of Accident Risk in U.S. Commercial Nuclear Power Plants. WASH-1400 (NUREG-75/014), USNRC, October 1975.

[10] IEEE e CollectioGuidth o t e Presentatio d an n f Electricalo n , Electronic and Sensing Component Reliability Data for Nuclear-Power Generating Stations, JEEE Std. 5OO-1977, June 1977.

[113 Apostolakis . KaplanS , G. , , B.J. Garric d R.Jan k . Duphily, "Data Specialization -for Plant Specific Risk Studies", Nuclear Engineerin d Desigan g 6 (19BO5 n ) 321-329.

254 METHODS FOR COMBINING PLANT SPECIFIC OPERATING EXPERIENCE DATA WITH DATA FROM OTHER NUCLEAR POWER PLANT PRA/PSN SI A STUDIES

E. LEHTINEN, U. PULKKINEN, K. KUHAKOSKI Electrical Engineering Laboratory, Technical Research Centre of Finland, Espoo, Finland

Abstract Based on the operational achievements measured by the availability performances, scram frequencies and other performance indicators the nuclear power plants can be regarded to form quite an inhomogeneous population also with respect to their performances. The studies have shown that i.e e availabilit.th y performances achieve e nucleath y b d r power plants are correlated with several factors: the unit design and vintage e degreth , f standardisationo e e equipmenth , t supplierse th , competence and co-operation of all the nuclear energy parties in the site country, etc. e heterogenitTh f nucleao y r power plants with respece planth o tt type and main characteristics, on the one hand, and the differences between e operationath l achievements e otheth n ro , hand, resul n estimatioi t n problems when we are evaluating for example failure rates and initial event frequencies for plant specific PRA/PSA studies. These estimation problem e usuallar s y solve y usinb d g empirica r subjectivo l e Bayesian methods. The empirical Bayesian method utilizes the prior distribution based on the operating experiences from a population of some nuclear power plants and the plant specific evidence. In the subjective Bayesian method the operating experiences from other plant e weightear s n somi d e subjective way and after that combined with the plant specific evidence. In this paper botempiricathe h subjectivand l e Bayesian methodare s described and compared. In the subjective Bayesian method the rules for selecting weights are discussed. The weighting criteria can be based on some characteristics of the nuclear power plants or on some factors contributed to the plant performances. f subjectivo e us e Th e weights make t possibli s o utilizt e e largesth e t evidencee n impacuncertainta th t alss i n e ha o estimatesot th bu , f o y . These uncertainties are also considered in the paper. Finally the characteristics of the different methods are illustrated with some examples of practical nature.

1. INTRODUCTION

In PRA/PSA studies, when we are estimating component failure rates and initiating event frequencies e lac th f ,relevano k d sufficienan t t a probledat s i a m whics i h often encountered. Earlier, in particular, the problem must have been solved by

255 generating purely subjective estimates or subjective probability distributions, based e.g. on "engineering judgements", for unknown parameters.

Nowadays there are several reliability data sources available. The power plant utilities, suppliers and the international organizations collect operating experiences from the nuclear and conventional power plants.

e BayesiaTh n metho a statistica s i d l estimation method used frequentl n PRA/PSi y A studies when there is no or very little plant specific operating experience available e quantitth f I .f interes o y a failur s i t e e Bayesiaratth X e n theorem can be written f(x)L(E/X) f(X/E) = —————————, (1) C/ f(x)l(E/x)dO x o failur= ewher \ rate = evidencE e data f(X/E) = the probability density function of X given evidence E (posterior distribution) f(X) = the probability density function "prior" to having evidence E (prior distribution) L(E/Xe likelihooth = ) d functio e probabilitth r no y distributioe th f no evidenca give r nfo . valuE eX f o e

A plant specific estimate for the component failure rate to be used in the PRA/PSA study is obtained from the posterior distribution which thus is dependent both on e "prioth r information e "evidenceth d an " " accordin e equatioth o t g n (1).

Although the Bayesian approach is well-established in reliability and PRA/PSA studies, it seems that no unique procedure exists for how to choose, interprète and trea e "prioth t r information" e "evidence th ,e plan th d t an specifi" c datr fo a obtainin propea f go r estimat componena f o e t failure rate r examples fo , ha t I . been stated in the PRA procedures guide /!/: "The prior information reflects the analyst's degree of belief about the parameter before the evidence; the posterior represents the degree of belief after incorporating the evidence." We have seen e availablth tw e o us way o et s plant specific data analyse on : t does, another does t includno e availablth e e plant specifi ce prio th dat ro t a information wite hth other corresponding data obtained fro e othemth r plants n additioI . n i d nan particular, because some other data than/with the potential plant specific data are planeth use r t fo dspecifi c estimatio e componenth f o n t failure rater fo , example, some analysts are sceptically inclined towards the Bayesian approach and consider it too a non-objective statistical principle.

256 In this pape e shal w rt concentratno l y probleman n o e s relatin e validitieth o t g s of the "objective" and "subjective" statistical estimation principles. Nevertheless e shalw , l discus o methodtw s r combinatiofo s f componeno n t performance data from other nuclear power plants, including the plant under the PRA/PSA study. Both the methods considered are based on the Bayesian approach.

. PROBLE2 M

The heterogeneity of the nuclear power plants with respect to the main characteristics of the plants, on the one hand, and also to the differences between the operational performances, on the other hand, results in an estimation problem: how relevant or useable are the available reliability data from different sources or the operating performance data from other plants when we are evaluating r examplefo , , plant specific failure rate f componento s r PRA/PSfo s A studies. Although the components and the plants are quite identical with respect to their engineering characteristics, there can be some plant operation and maintenance related factors, which correlate wite performanceth h e plantth f o s and their components. (Of course, it can not be expected the performance data of different valves, for example, or of plants operated in different "environments" do not differ from each other statistically.)

In this pape e shalw r l presen o techniquetw t o appl t e Bayesiaw th yho s n theorem e firsth (1)n tI .cas e performanca sample th f o e e data from other nuclear power plants are used for the estimation of the prior distribution of the component failure rate se seconwhilth n i de case thos ee evidenc datth e use s ar aa d e datn i a the likelihood function, and the relevance of the used evidence data is evaluated.

3. METHODS

1 Empirica3. l Bayesian method

3.1.1 Likelihood function

The most common forms of likelihood functions encountered in the Bayesian reliability estimation problems are the Poisson and binomial distributions. When e evidencth e e numbedate giveth ar ay f failureb o rn k sove n operatina r g tim, T e e.g. to estimate the failure rate, the likelihood function is given by a Poisson distribution

_ L(E/\) - — ~j— e . (2)

257 3.1.2 Gamma prior distribution

In Bayesian method applications e so-calleth , d "conjugate priors" have often been a distributiouse s a d n representin e prioth g r information. Probabl e reasoon yr fo n e choicth f conjugato e e prior s thai e sposterio th t r distributio e obtaineb n ca n d analytically with such priors. In particular, when the available empirical data base is minor, as it is in many cases of practice, any approximative discrete function, instea a continuou f o d s prior distribution t feasiblno e s b i ,o t e formed, but a continuous prior distribution is to be chosen. In this case there is no preferred prior distribution, and the choice of the prior distribution type is subjective and can be based on a computational convenience. Moreover, according to the PRA guide /!/, "since noninformative priors contain no generic information, it e preferablb y ma o avoit e d thei e wheus r n even minimal generic prior date ar a available." ("Noninformative" prior distribution a clas e f prioro sar s s that loosely minimiz e relativth e e importanc e priorth f o e, compared wite datath hn i , generatin a posteriog r estimate e reliabilitth ; y dat ae reliabilitgiveth y b n y data banks, handbooks, etc., are usually regarded as "generic" data.)

We assume that we have obtained from several nuclear power plants the operating historie N component f o s s deeme o correspont d o that d t being analysede Th . operating histories are given as the failure number k. and operating time T. of each component in the form:

E[l,2,...,N] = [(Hi, Ti), (k2, T2),...,(kN, TN)}. (3)

e operatinTh g histore specifith f o y c plant being analyse s givei d n respectively

by E|O J= I(k 0, To)}.

e classicaTh l maximum likelihood estimato e failurth r fo ers i rat . x e x. = k./T., i = Oj..., N. We choose the gamma prior distribution which is the natural conjugate distributio e Poissoth o t nn likelihood (2). e failurThenth f i ,e rate X is assumed to have a gamma distribution for its prior,

g(\;a,ß) = -ffcJ T^', X>0, (4)

e likelihooth f i d dan functio e Poissoth s i n n distribution (2) e posterio,th r distribution can be expressed in closed form also as a gamma distribution: e positivTh . T) e + shapß g(X;, ek + parameteae interprete b n e ca prio th a r s ra d numbe f failureo r ß prio n i s r total operating time.

258 The task is to estimate the parameters a and ß of the gamma prior distribution (4) from the available sample E(l,2, . . . ,N) . There are several approaches to this estimation task. A "two-stage" Bayesian procedure is represented in the PRA procedures guide.

Two basic statistical estimation methods, among the others, can be used to estimate a and p: the method of matching moments and the marginal maximum likelihood method, whic e describear h y Mart b dd Walle an z r 111, r examplefo d an , programme e Technicath n i d l Research Centr f Finlano e d /3/.

Afte e parameteth r r estimatio e posterioth n r mean, median, variancd an e 100(1 - j)% symmetric probability interval are given by the formulas /!/

+ k) Posterio0 a )/(TO ( + ß r mean:

2 Posterio x bo(2r median+ 2ka 0)/(2: + 2Tß 0) 2 Posterior variance: (a + ko)/(ß + TO)

Posterior 100(1 - y)% symmetric probability interval:

(2< + 2kx 0)/(2 + 2Tß 0); X_(2 a+ 2k0)/(2 2T- H ß 0)]

(The respective characteristics of the gamma prior distribution (4) are obtained

from the above formulas by setting k0 = 0 and T0 =0.)

Subjectiv3.2 e method combininfor s g data sources

The phrase "subjective method" is here used to emphasize that the estimates or the distributions obtained by using such a method are not totally based on statistical observations. The observations are often interpreted in various ways which are always effected by some analyst dependent factors. These factors originate from e experiencth e whic e analysth h s gatheredha t e base;b then y statisticao d ma y r o l empirical observation t thebu sy canno e formulateb t r examplfo d s likelihooa e d function s othea r o rs similar concepts.

As opposite to "subjective methods" it is possible to speak about "objective methods" which includ e empiricath e l Bayesian statistic d classicaan s l statistical techniques. The objectivity of these methods can, however, be questioned because e enormouth f o s numbe f possiblo r e interpretation w datra a e materialth f o s e Th .

259 objectivit e "objectivth f o y e methods" canno increasee b t y forgettinb d g these uncertainties.

3.2. " mixtur A 1 e method"

In the PRA-procedures guide /!/ a method referred to as the "mixture method" is discussed. It involves fitting a suitable prior to each generic source and then combinin e individuath g l prior distributions f.U forminy )b mixturea g ,

N H f(M = I u.f.(\), 0 < u. < l, l u. = 1, (5) 1=1 1 1 n 1=1 n

where N is the number of sources.

If the mixture (5) is used as a prior distribution, the corresponding posterior distribution will also be a mixture of the individual posterior distributions, namely

N fU/E) = I u'.f.U/E), (6) 1 = 1 1 1 w (updatedne wher e th e ) weighte ar s

(7) I co. / f.U)L(E/\)d\ 1=1 1 0 '

According to the PRA-procedures guide /!/ several methods are suggested tor determining the weights

3.2.2 A subjective Bayesian method for combining evidences

Another method for combining several evidences has been proposed by Pulkkinen et al /4/. Basicly the same ideas have been applied be Mosleh and Siu in estimation of common cause failure probabilities /5/. Both approaches utilize the possibility o defint a esubjectiv e probability distributio l relevane spacal th f n o ei n t evidences.

260 Again s assumei t i , d that N independenther e ar e t data source r evidenceo s e th s i +• h evidenc . failure(k ee = for beinth . n timE i m sf o eg T.). Furthers i t i , 1 assumed thae relevancth t r useability(o ei evidence th e use b f s o )a o d t e th evidence casth e r beinfo e g analyse e interpreteb n ca d a probabilisti n i d c way:

P(E.j is relevant) = OK , 0 < UK < 1, i = 1.....N. (8)

The evidence En is from the specific case under analysis and it is perfectly rel evant

P(EQ is relevant) = a>Q = 1. (9)

The probability that the only relevant evidence is En is

N n (1-u..) e= .L , 1=1 1 (10)

e Anprobabilitth d y thal evidenceal t e relevanar s s i t

N = no) eM . (11) 2N 1=1 n

Between these extreme cases there are numerous combinations of evidences for each f whic o e probabilitie th n easilh ,...,ca 2 , e evaluated= b y ~ 2 j e , th e. s f I . J evidence , ieC-E. s , s somwhert i {l,2,...,N} se e. C ee subse th f o te relevan ,ar t i J * J e have w evidencth e , E. e •J

T l + T = * T , i k l + k = (12* k : E* ) U ieC. U icC. J 1 J 1 J J J

The probability of having this evidence is

n (1-u « . u. .) n e= . (13) 3 . J J

If the prior distribution for X is f(\) then the posterior corresponding the evidenc s f(\/E. i e hav w . E d ee )an thi s posterior with probabilit e "finaTh . le. y J J * J posterior" is the mixture of the posteriors fU/E.) J

(14)

261 e posterioanth d r mead seconan n d momene ar t

.. J •*• and

2N MpostU) - 1 eJM j -i-

o where E(-) and M (•) are notations for the mean and the second , respectively e posterioTh . r varianc expresses i e e th e mea d n termth i dan n f o s second moment

Dpost(XM Î= UU) -[WU)]2- <17>

If we use the approximately noninformative gamma prior, i.e.

f(x)~ \"1/2, (18)

e obtaiw e posteriorth n s

Ml/* * 2 . -M -1/* . 2k (T.) J . J i-e — — s ——— = ) 3 fU/—X E (19)

The "final posterior" is obtained by using equation (14).

The most essential feature of the above method is the interpretation of the evidence weight s subjectiva . w s i e probabilities. This make t possibli s o combint e e ^ the distinct evidences E. ,i = l,. . . ,N, to form the "extended evidences" E., j=l,...,2 N . This interpretation also makes it possible to obtain the probabilitie^ s e extendeth f o d evidences.

The probabilistic interpretation of the weights w. is not the only possibility. However, if u.s are subjective probabilities there is no difficulty of conceptual r technicao l natur o includt e e obtaineth e d posterior e e wholth th f o o et s PRA/PSA. When other interpreations (for instance fuzzy set r membershio s p functions) are preferred many difficulties are immediately encountered.

262 e firsTh t proble s connectei m d wite combinatioth h f evidenceo n e th d an s determination of the weights of the extended evidences. Other problems include the difficulties to include and interprète nonprobabilistic concepts in the PRA/PSA whic e notiobases th i h n f probabilityo o dn .

The w.s describe the probability of the evidence E. being usable or relevant to be use s data d e afailur th e.g r fo .e rate estimatio e planth f to n under analysiss A . subjective probabilities w.s can be, in principle, determined rather arbitrarily to describe the analysts degree of belief about the relevance of the evidence E..

e relevanci Th evidence th e decomposeb f n o e ca e o somt d e factors. Assume that s interestedi e on e occurencer instanceth fo , e us o f somt o ,s e initiating transients at some nuclear power plants as the background data for the estimation e initiatinth g event frequenc r onen plantfo yow s e weightTh . - describeu s a n i , sense, the similarity between the plants and own plant. This similarity is partly e similaritth y betwee e planth n t design d partl an se similaritth y y betweee th n plant operational characteristics or principles. The design similarities can further decomposed to similarities between the plant sizes, plant vintages and plant suppliers etc e operationa.Th l characteristic e decomposeb y ma s o factort d s dependin e utilitth n o g y usin e plantth g e infrastructurth , e sitth e f o countre y e authoritan th de sit th en i ycountry e figurTh . 1 describee e abovth s e hierarchy of similarities.

RELEVANC F DATO E A

OPERATIONAL CHARACTERISTICS

MAIN SUPPLIER UTILITY INFRASTRUCTURE OF SITE COUNTRY /\

MAINTENANCE OPERATION ORGANIZATION ORGANIZATION

hierarche FigurTh . 1 f esimilaritieso y .

263 The index of similarity of the plants (i.e. w.) can be obtained, for example, by using the analytic hierarchy process (AHP) /6/. In AHP the factors in some hierarchy leve e comparear l pairwisn i d y witwa e he nex respecth e goa tt th a l o t higher level. The comparisons are continued until the lowest level and then the global weights of the factors at the lowest level (i.e. the evidences E.) with respece highesth o t t goal (i.e e relevanc th .e evidence th f o e e evaluatedar ) . These weights can be scaled to be used as probabilities w.. s originalli P AH e yTh intente r comparisofo d f alternativo n e decisione th n i s situations there the decision criteria are conflictive. It can also be used to compare the probabilities of some events /?/. There are several computer codes for performing AHP-analyses, in this context we have used the code EC /8/.

Another possibilit e multiattributth f o o e obtait yus e weighte th nth e s utiliti s y decompositio / whicf somi /9 n s equivaleneP i h AH suitabl e th o t e weighte ar s used.

4 APPLICATIO METHODF O N S

e followinIth n g bote empiricath h l Bayesian methods, represente e chapteth n i d r e subjectivth 3.1d an , e Bayesian method, represente e chapteth n i d r 3.2e ,ar demonstrate f practicao a datt f se ao d l dai nature wite th he operatin th , g historie e componentth f o s s correspondin o that g t under study have been collected from four nuclear power plants, Plantl, Plant2, Plants and Plant4 for the PSA study of the specific plant, PlantO. The task is to estimate the failure rate of this componen y usinb te abovth g e methods.

e e numbefailuresTh th f o r , durink. , e accumulateth g d operatine gth timesf o , ,T. component t eaca s h plant until toda e presente ar yn additione tablI th . n 1 ei d , some general information about each plant is given in the table 1. this information is used for the evaluation of the relevance of the evidence data from e nucleath r power plants.

e samth ee f planto basiTh e ar sc type. However e planth , t vintagee th s wel a s a l capacities vary from one plant to another. Furthermore, the suppliers of the reactor d othean s r component e different situatear se plantno e th th e d n ar si an t d same country.

The availability performance studies of nuclear power plants /10/ have indicated that some factors relate o desigt d n characteristic e competencth o t wels a ss a le and co-operatio e nucleath f o n r energy parties (the power utility wits it h

264 Table 1. The operating histories of the components with some general plant information and the relevance probabilities

Plant Size Comm. Main Site Power Evidence Relevance (MW) oper. suppl ier country util ity probability

k T (x>

Plantl 50Ü 10/71 A a I 22 99400 0.407

Plant2 520 1/74 A a I 4 91700 0.412

Planta 1300 7/84 B b II 2 31800 0.332

Plant4 750 7/80 C c III 4 53400 0.505

PlantO 750 5/85 A d IV 0 14000 1.000

operational and maintenance staff, the national nuclear authority, the research institutes e componenth , t suppliers e sit, th etc.en i countr) y contribute th o t e availability performance e nucleath f o s r power plants.

We have taken these results into account in assessment of the weights for the factors whic e havw h e assume o characterizt d e relevanc th ee evidenc th f o e e data from the plants. We have collected the factors effecting on the evidence relevance inte hierarchth o ye figurgiveth n . Thei 1 n e e havw n e done subjective pairwise comparisons between the factors at each hierarchy level with respect to the goal at the next higher level and obtained the global evidence weights of the plants P procedur 4 AH usin 0- e th g e wite computeth h r cod e obtaineC /8/E Th e . d weights were then scaled to be used as the relevance probabilities w. (W= 1 was fixed, e equatioth e se n e probabilitie(9))Th . e table giveth . ar Thesn 1 ei n. u s e Q probabilities are used in the application of the subjective Bayesian method.

The application of the empirical Bayesian method is straightforward and well known and thus it is not considered in more detail here.

e posteriorTh s obtained wite methodth h e presente ar se e figur th Th n . i d2 e central characteristic e distributionth f o s s (mean, median) obtained with both methods are in good agreement. The posterior variance obtained with the empirical Bayesian metho s significantli d y smaller than that obtained wite subjectivth h e e facmethodth to t tha e empirica.e th tdu Thi s i s l method doet take no s th e

265 uncertainty caused by the irrelevance of the data sources into account. However, the posterior variance obtained by using the subjective method is strongly effecte e weightth y b d s effece co.Th .f weightino t g could have been analysey b d various sensitivity studies n thiI . s smal t perforlno exampld y di m an e w e detailed investigations.

EMPIRICAL BAYES METHOD

CUMUL/S/TIVE DISTRIBUTION 1.00

O.BO /

0.60 /

0.40 /

POSTERIOR MEA - N5.3E- 5 0.20 POSTERIOR VARIANCE - 9.4E-10 POSTERIOR MEDIA 6E-. 6 5 N- / III1 1 !1 1 Illl1 l! 0.0 I I II 1 Hil0 Illl \ 1 l ^ 1 l 1 1 1 FAILUR10 E HAT10E 0/I.OE- n Si/ tQOO 10OOO WEIGHTED SUBJECTIVE BAYES METHOD CUMUL/\TIVE DISTRIBUTION 1.00

O.BO __ /

0.60 —— /

/

0.40 —— /

POSTERIOR MEA - N9.2E- 5

0.20 POSTERIOR VARIANCE - 3.7E-9 / POSTERIOR MEDIA 7E-. 7 5N-

0.00 — f— r-rTTÏïïr ! l M Illll ! l l l lui! 1 l 1 l lin 1 FAILURE HATE /i.oE-e Î/H 0( 300

posterioe FigurTh . e2 r distributions.

5 CONCLUSIONS

We have considered two different Bayesian estimation methods in the cases where evidencw fe a e data from bote planth h t under analysi othed an s r plante ar s available. The methods were both of empirical and subjective nature.

266 In the empirical method the sample of operating histories N components, given in the form E|_1,...,N] =| (k, ,!-,),... .(k^J^)} ,(k.= the number of failures in time T. r componenfo obeyin) i t e Poissoth g n distribution s beeha ,n interpreten a s a d usable prior information and the plant specific operating experience EQ=(kQ,T,J has been used as evidence data. Because of the computational convenience the gamma prior was chosen to represent the prior information E[1,...,NJ. The parameters of this prior have been estimated both with marginal maximum likelihood method and with method of matching moments after which the gamma posteriors have been directly determined.

In the subjective Bayesian method the possible incompatibility of the evidences from components 1.....N was taken into account. The incompatibility was described by introducing the evidence relevance probabilities w. for each of the components = 1,...,Ni e evidencTh . e relevance probability represente n indeth a s f o x similarity between the specific plant and the plants from which the data have been gathered e uncertaintth n thiI y . wa s y cause y partlb d y non-relevant data coule b d analysed.

e evaluatioTh e evidencth f o n e relevance probabilitiee y th rol ke n i es ha s suggested subjective Bayesian method. Here we have proposed the use of the analytic hierarchy process (AHP) which is a systematic procedure for representing elements of any problem, in particular, the the decision problem hierarchycly.

r applicatioIou n e hierarchth n f similaritieo y s constructewa s d e baseth n o d availability performance on one hand, and on purely subjective intuition on r evaluatinfo r anothefo P gAH r rapplicatioe f lighou o handth e f n o tI us . e th n probabilities was encouraging. Other possibilities, such as multiattribute utility decomposition, lead probably rather similar results.

The différencies between the empirical and the subjective approaches are connected with the uncertainty of the estimates. The central measures (mean, median) do not differ significantly e advantagTh . e gaine y usinb de subjectivth g e methon i s i d the possibility to use the largest possible data base and to evaluate the uncertainty caused by judgements about the relevance of data. The probabilistic interpretatio e datth af e onlo nrelevancth y t possibilityno s i e t suiti t sbu , perfectly to the probabilistic risk assessments.

267 REFERENCES

1. PRÄ Procedures Guide, A Guide to the Performance of Probabilistic Risk Assessment for Nuclear Power Plants, NUREG/CR-2300, Vol. 1. Washington DC, January 1983.

. Martz, Waller2 F. . BayesiaA . . ,H R , n Reliability Analysis w YorkNe . , John Wiley John Wile Sons& y , 1982.

. Huovinen3 , GAMMT. , - vikataajuuksieA n analysointiohjelma, Technical Research Centr f Finlando e , Research Notes 509, Espoo 1985 Finnish)n (i . .

4. Pulkkinen, U., Huovinen, T., Kuhakoski, K., Combination of Several Data Sources, Probabilistin c Safety Assessment and Risk Management PSA'87, Volume 1, Verlag TUV Rheinland GmbH, Köln, 1897.

5. Mosleh, A., Siu, N. 0., On the Use of Uncertain Data in Common Cause Failure Analysis, Probabilisti» c Safety Assessment and Risk Management PSA'87, Volum , Verlal e V RheinlanTU g d GmbH, Köln, 1897.

6. Saaty, T. L. The Analytic Hierarchy Process, McGraw-Hill, New York, 1980.

. Akersten7 , Metode,P. r utnyttjandfo r v expertinformatioa e i säkerhetsarbeten , SRE Symposium '84, 16-17 Oktober 1984, Växjö, Sweden, Societ f Reliabilito y y Engineers, 1984 Swedish)n (i . .

(R) . EXPER8 T CHOICE Decisio, * n Support Software, Incorporated, 1300 Vincent Place, McLean, VA 22101, 1986.

9. Embrey, D. E., SLIM-MAUD - A Computer Based technique for Human Reliability Assessment, Proceedings: International Topical Meeting on Probabilistic Safety Method d Applicationsan s . Volum . EPR2 e I NP-3912-SR o Alt l oPa , 1985.

Lehtinen. 10 , TrenE. , d Analysi r Lighfo s t Water Reactor Unit Performance. Availability Predictions for Finnish nuclear Power Units, Technical Research Centre of Finland, Research Report 382, Espoo 1985.

268 DATA SPECIALIZATION FOR RELIABILITY STUDIES- AN APPLICATION TO DIESEL UNITS

E. FELIZIA Comision Nacional de Energia Atömica, Buenos Aires, Argentina

Abstract

The failure rata failurr o a e probabilitie componentf so r fo A s PS use n i d specifio plant e generallaar y determined throug applicatioe th h Bayee th a f no 1 theorem. Starting from information availabl literaturee th n i ederives i t i , d the generic distributions a priori which later on are specialized on the basia of statistics related to the behaviour of auch components in. the specific plant. Consistent with the interpretation that those generic distributions express the plant-to-plant variabilit failure th f o ye rate failurr so e probabilities of similar components bees ha nt ,i suggeste convenience th d considerinf o e g the elements of the same type -in the same plant- as nominally identical and consequently, of grouping their individual statistics in one single value. This implie t onlderivatioe sno y th specializef no d distributions commo suco nt h elements, but also that these should be considered as completed dependent if the intention is not underestimate tha uncertainties associated to the failure probabilitie systea f so m constitute sucy db h elements» This work contain analysin sa sprecedine baseth n o d g concepts, made wite hth purpose of determining the failure probabilities on demand corresponding to two systems, each one constituted by two redundant diesel units. These units are respectively part of the emergenoy power supply and the emergency water supply systems of the Embalse's Candu-600 station. thosf o e e on systems n I derivatione th , specializee th f so d distributionf o s the failure probabilities on demand has special interest dua to the fact that periodic operation tests during three years has shown a zero failure result. It demoatrates i d thahypothesie th t groupine th f s o statisticdatf go a relateo t d component same th e f typso e implies thin ,i s case ,displacemena e th f to specialized distributio nlefte curvth optimistio ,o t t e tha , tis c valuef so the system failur1s e probabilit demandn yo . On the other hand, it shows the calculation of the failure probability on demand regardin systemo tw e gth s -starting frosame ath e apriori distributiont bu - obtaining specialized specific distribution eacr sfo h dieael unit n otheI . r

269 words, components of the same typo in a specific plant ar« troated as if they were distinguiahables. Tho résulta show that, in this casa, the full dependence assumption lead to more "broadened distributions than those of tha formsr approaoh.

. 1 INTRODUCTION

Bayes1 theorem is frequently used for deriving data on rates and probabilities of component failures in reliability studies or in PSA developments for a specific plant.

Apostels k is, Kaplan et a 1. [1] introduced a calculation method consisting, as a first step, in an assessment of an a-pricri probability distribution for a given data, as from generic information available in literature. Then, such distribution is specialized by applying Bayes' theore d statistican m s obtained from operational experience in the specific plant. The analytic expressio e specializeth f o n d distributioe th f o r o n a-pcsteriori probability density function is: P (f/E)oC P (f) . L (E/f)

wher. e-

f : is the random quantity of interest (rate or probability of failure);

P(f):i e a-priorth s i probability density functiof o n random quantit; f y

L(E/f) e likelihooth s ;i d function (probabilitf o y obtaining evidence E, given an f value);

P(f/E);is the a-posteriori probability density function , givef f o n evidenc ; andE e ,

E; is the evidence (statistical data corresponding to e specifith c plant). s beeIha t n understood thae a-priorth t i probability density function, P(f ) , expresses the behaviour of individual components withi a generin c population concerning v a r i a b - ! i t y in failures. Such variability has beer, associated to different manufacturing qualities, to different plant-to-plant operatio d maintenancan n e conditions o different , t designs, etc. The same authors [2] suggest that it is convenient to consider component e samth ef o styp e -withi a given n plant- as nominally identical elements and as members of the generic population represented by function P(f).

270 Consequently e individuath , l failure statistics concerning those components are given a single value, thin turn-i s - implyin e derivatioth g a singl f o n e function, P(f/E), expressin e degreth g f knowledgo e e attained on the distribution of the failure probability r rato e among those components.

Being consistent with this interpretation, the authors ] demonstrat[2 e that, whee failurth n e probabilitf o y systems composed by similar elements is calculated, the failure behaviour being represente y identicab d l P(f/E) functions, these functions mus e considereb t s fulla d y dependent so as not to disregard uncertainties in the value f suco s h failure probability. This paper introduces the analysis of two systems, each one of them composed by two redundant diesel units, to which the above described methodology is applied in order o calculatt e failure-to-starth e t probabilit f thoso y e systems.

However, the treatment of the evidence -that is, of the statistical data correspondin e operationath o t g l experienc n boti e h systems o differens basetw i - n o d t hypothesis concerning the distinguishability of the units in each system. The first hypothesis considers the diesel units in each system as identical elements and, consequently, the number of failures, r-j, and the number of tests, n-j, are shown as two single values. The set of data :

I ' |nl) " i - 1,2 represent a sfailur e statistics tha s commoi t o bott n h component e systemsth f o n eace i .s on h

The second hypothesis assumes that the diesel units in each system are distinguishable; consequently, the information on the number of failures and on the number of tests corresponding to each one of the units is retained. The set of data:

î n » 2 r ( > ) ( < n r.» i represents, in this case, failure statistcs for each one of the components in each one of the systems.

Sectio 2 shown e developmenth s f calculationo t n o s specialization in the probability distribution correspondin e formulateth f o o eact e g on dh hypothesis. In section 3 , the reliability is calculated for start-up demand in both systems. Considering the first hypothesis e failure-to-starth , t probabilit s assessei y d by assuming a system model with two fully dependent in-parallel components, the calculation being adjusted to whas expressewa t n [2]i d . Concernin e seconth g d hypothesis, the same model was assumed but the

271 calculatio e failurth f o n e o probabilittw e th r fo y systems was performed by applying the Montercarlo technique with Generalized Knowledge Dependence . Waidevelope. R CookM d j. R an e[3] y b d .

Finally, sectio 4 providen a discussios e resultth f o n s obtaine y considerinb d g both hypothese d formulatean s s the corresponding conclusions.

. DAT2 A SPECIALIZATION

2.1. D_e_s_cLul_P_t_i_o_.p -._°JL±Jl?_§.y_.?.*.ejNjS The analysis was applied to the diesel units in the Emergency Power Supply (EPS d Emergenc)an y Water Supply (EWS) systems of the CANDU-600 Embalse nuclear power plant. These systems are aimed at supplying essential electrie c th powe r fo r instrumentatio e comanth f d t valveo a dan nd an s feeding water to the steam generators, respectively, in cas f occurrenco e a sever f o e e earthquake (OBE).

S systeEP s e constitutei mTh o redundantw y b d t diesel moto-generators, each one with a generating capacity of 50 KW - 380 V AC. The EWS system is consituted by two redundant 75 HP diesel engines, couple o theit d r respective pumps. Both systeme ar s absolutely autonomous theia r rfa auxiliars a s y services are concerned, seismically qualified and house n separati' d e seismic-résist t buildingsan .

2.2. G,e_ne_rJ_c_d_a_t_a The fa i l ure-t o-s t a r t probability, f, was taken from the Reactor Safety Study [ 4 ] ; it was assumed that this random quantit s a-priori y i log-normal distributed with the following parameters:

l.OE-. = 5 2f0 3.16E-« 0 f5 2 l.QE-= 5 f9 1 5 corresponf3 d an wher 5 de f0 e witth e lowe d th h an r upper bound, respectively e failure-to-starth f o , t probability , show j n Q< Tabl,i n e III.2.3e th f o . Reactor Safety Study [4]. The f log-normal distribution is discretized in the interval between 5 percentileZ9 Z0.d e correspondinan 5th f o s g normal distribution (Tabl . Twent1) e y class intervals were used in order to attain an acceptable accuracy in the results of the a-priori distribution calculation.

272 TABLE 1. DISCRETIZATION OF THE A PRIORI LOGNORMAL DISTRIBUTION OF f

Cor nto z X of r. ln.au P (r) -i.ü!04 -2.0932 -5.33'J7 ,004d .005 -2.5759 -2.45.1? .0057 .005 -2.3414 -5.0105 -?.1069 -S.W. .0067 .003 -1.8724 -i.y ii)7 .0079 .013 .0093 ,020 -1.6379 -1.7552 -4.6023 -1.5207 -4. 51 "2 .0109 .030 -1.4034 -1.1 ouy -1.21.02 -4.3^41 .012U .041 -4.1900 .0152 -0.9344 -1.0517 .054 -0.6999 -0.3172 -4.0259 .0178 .067 -3.Ö61Ü .0210 -0.4654 .079 -o. 3/)!-!2 -3 . (>

- X.

2.3. Assessment of the_a - p o s t_e_r i _O£_l__dji^s t^r--[p Li_t i o_n_ of the f3i1ure-to-start probability The statistics on failures to start -obtained from periodical tests performed regularly in both systems- show the following figures for the first three years in operation [5]:

Number of tests Number of failure: (n) EPS System

Unil G t 101 0 Uni2 G t . 56.. 0 Total EPS 197

EWS System

UniI P t 1 2 Uni2 P t • 11 i Total EWS 3

FIG.1. Failure statistics.

273 A binomial distributio s e adoptewa th n r fo d assessment of the likelihood function of the evidence, considering that such distribution was compatible with the failure-to-start model, Its analytical expressio: is n ,71 -if (E

where : L ( E/f ) ; i s the likelihood function of the evidence;

f ; is the failure-to-start probability; e numbeth f s testo i r s performed; n ; r; is the number of failures occurred during the n tests.

e a-postericrTh i distributio s calculatei f f o n n o d the basis of two different hypothesis concerning the distinguishabilit e dieseth f o ly unit n eace i s on h of the systems. These hypothesis were: s assumei t Hyppthesi : d j a tha ( ti s both unite ar s nominally identical. Their failure statistice ar s thus reduce a singl o t d e pai f valueo r s (See Figure 1) : EPS System: r = 0; n = 197 EWS System: r = 3; n = 237

3 shoe resultTablee d calculationth wth an f 2 so s s performe r thipe ss a dhypothesis e th r fo , a-posteriori distributions of f.

H ypot hes i s_{ bJ : it is assumed that the diesel units o systemtw e e differenith ar sn d distinguishablan t e entities. Their failure statistics are (see Figure 1) : 1 10 = , n S System; EP =0 , r : 6 9 = P n ; 0 r ;= , 2 12 = , fi ; S System1 EW = , r : r, = 2; n-, = 115 Tables 4, 5, 6 and 7 show the results of the calculations performe r thipe ss a dhypothesis r fo , e a-posteriorth i distribution. f f o s

. RELIABILIT3 E SYSTEMTH F O Y S

3.1 pothesiy H . ) (a s As stated under 2.3., it is assumed that both diesel unit n eaci s h syste e nominallar m y identicad an l that their behaviour concerning failure o start s t

274 e describeb y a ma singl y b d e distribution function P(f/E) and is applicable to both units. Consequently, the calculation of the failure probability of the system, Q, is adjusted to the procedure developed in [2] for a configuration in para 1 lei . Below are the mean, variance, median and 5 and 95 percentil Q distributioe e valueth f o s n corresponding to the EPS and EWS systems, respectively, calculate e above basith th f e o n so d described e alreadconditionth f o yd knowan s n ratios among parameters of the log-normal distribution.

S systeEP m 2. 1 1.7E-= ^ + 4 < = Q C( Mean: Variance: fi>£ « 3.4E-8

Q05 = 2.5E-5

Q50 = 1.1E-4

Q95 = 4.8E-4

jEW_S_ system 3.8E-- ^ ( + 4 2 4 = ^ Mean« : Variance: fî>^ = 1.1E-7

Q05 = 7.9E-5

Q50 = 2.8E-4

Q9 = 5 9.9E-4

e calculatioTh s performei n y usinb d g results shown i. n 3 Table d an 2 s

275 TABL . CALCULATIOE2 POSTERIORA E TH F NO I DISTRIBUTION OF f FOR THE EPS SYSTEM

,OÜ4Ö .OOj .3110 1.94 .070 .0057 .O'.j .327 1.51 .061 .0007 .00) .207 2.13 .OL'j .0079 .01, .211 2-Î5 .110 .0093 .Oe'O .loO 3.22 .129 .0^09 .030 .115 3.40 .13o .012t) .0.11 .07b 3.20 .!?!} .0152 .054 .0.19 2.66 .10? .01ÏU . 0-/7 .029 3-93 .077 0 1 2 0 . .079 .015 1,20 ,04!! .0243 .U-,) .007 .63 ,0?> .0292 .090 .003 .20 .010 .0344 .095 .001 ,10 .004 .0405 .0!)o - .03 .002 ,047U .0/0 - .01 - .0563 ,0uu - - - .0663 .053 - - - .0702 .O.|l - - - ,0921 .029 - - -

1.000 24.97 1.000

HiBtogrcua mooi- .01< c n 2

Logiioruial porcon ti lao: TOp • 5-OC-3 fj - O1.1E-; : 19 - 52.2IÏ- 2

TABLE 3. CALCULATION OF THE A POSTERIORI DISTRIBUTION SYSTES EW E MTH R FO f F O EffS S.vulum.

,004U .005 .079 .39 .005 .0057 .005 .105 .4L! .00 S .0067 , (."M .13o 1.03 .014 .00(9 .013 .1Ü8 2.10 .029 . 0093 .OJO .197 3.97 .053 .0109 ,030 .21U 6.45 .Oüo .012U .O.|l .225 9.23 .ü3 .0152 .05} .214 11.52 • I'j3 .0178 ,0ü/ .Iü4 12.33 .164 .0210 .079 ,141 11.11 .14U .024Ü ,o:,U .094 U. 25 .110 .0292 .090 .053 4-7? .063 .0344 .09') .025 ?.3f» .031 .0405 .OJ, .009 .10 .011 .0478 .07i .003 .20 .003 ,0^ü3 .Üju .001 .03 .001 . 0663 .Oj3 - - - .0/Ü2 .041 - - - .0921 ,0?9 - - - . 1036 ,o;,0 - - - l.CMO " 75.15 1.000 U s/r) -ft'Kd-rr"

JUsbo^ram - .Olloorui ^ ° ßi

. vaxiunn!? - b f oi

Logiiormal porooiitiJeut f05 = 0.9^-3 15 0- 1.7Ü- 2 f9 - 53.1K- 2

276 Hypothes is J__b_) _ n thiI s case calculatioth e o tw s madi r n fo e distributions with different failure-to-start probabilities, corresponding to each one of the S systemEW d an dieses S (TableEP l e , unit th 4 s n i s 5, 6 and 7). The fa i lure-1 o-s tart probability of the parallel system is simply the product of the failure probabilitie f theio f eaco e s ron h components.

Such produc s performedwa t r differenfo , t degreef c s knowledge dependence, between the probability distribution e componentth f c n eac e i y smean b on sh s of the application of the Montecarlo sampling technique with Generalized Knowledge Dependence, developed in [3] .

Below are the mean, variance, median and 5 and 95 percentile values cf the Q distribution S systemsEW d correspondinan ,S EP e th o t g respectively, resulting froe Montecarlth m o sampling for different values of parameter d[3] in the rangs betwen 0 (total independence) and 1 (total dependence) .

TABLE 4. CALCULATION OF THE A POSTERIORI DISTRIBUTION SYSTES EP l UNIG E M— TTH R FO f F O ru) mvo -£i£rj wo

.00413 ,00) .olb 3.07 .033 .0057 .OJ'j .'ji>4 2.60 .028 o, uJ 00. 6f .509 4.04 .044 • Ü079 .013 ,4o3 6.0? .065 .0093 ,o^u . 3'J1 7.137 ,0<35 .0109 .030 .330 9.75 .103 .0120 .041 .271 11,10 . 120 .01,2 .C',,4 .214 11.. ^2 .125 .01713 .Ou? . J ? JO.Uu .117 .0210 .07^ .11? 9.21 . 100 U.l, j .i'24J .079 6.90 .075 .Oi'J2 .0^0 .0^)0 4. 'jl ,049 .0344 .09') .ors 2. 713 .030 .0405 .0,3,) .015 1.34 .'-15 .0478 .0713 .007 • 56 , OOu .0^63 .Ü..U .003 .19 ,002 .Oùt,3 .0)3 .001 .05 .001 .OJU? ,ojl - .01 _ .0321 .1006 9?.44 l.ooo IXE/O .

,016

Iliato/iruja varidJico - (.IK-^ > f t j

Loyrioi«\al puroBJi tile:i i fO^> -. 6. 3Ü-3 f^O - 1.4L-2 f9 • 53.2E- 2

277 TABLE 5. CALCULATION OF THE A POSTERIORI DISTRIBUTION O FFOf R SYSTE THS UNI2 EEP G T M-

.0048 .005 .030 3.15 -031 .0057 .00 o 5b 5. 2.67 .027 .00-J7 .003 .526 4. lli .04? .0079 .013 .469 6.10 .061 .OO33 .020 .409 U. 25 . Ou2 .0109 .030 .349 10.30 .103 .0228 .041 ,2iJ9 11.84 ,11« .0152 .054 .231 12.43 .124 .ul7J .Ovf .111 11.bJ .119 .0210 ,079 ,130 10.25 .102 .0240 ,0'jll .090 7.09 ,0?9 .0292 . Oyo . 05J 5.23 ,052 .0344 .095 .035 3.31 .033 .0405 .OLIO .019 1.65 .oio ,047'J ,07U .009 . /I .00? . 05u3 .000 .004 .26 .003 .Ou63 .053 .00 7 .0 1 .001 .0102 .041 - .02 .0921 .029 .10.J- O .050 ooo 100.19 i.ooo 96 L(B/f - (1-f) )

Jliatogram ma tun c{ _ ,016

Hiatogroja varionosip - 7.7^-5

f95

TABLE 6. CALCULATION OF THE A POSTERIORI DISTRIBUTION SYSTES I EW UNI P E M— T TH R FO f F O

.0048 .OU5 .327 1.63 .01) .0057 .005 .347 1.60 .013 .0067 .uuu .362 2.6U .024 .00/9 .U13 .369 4.L(0 .039 ,0093 .020 .367 7.39 .Oui .0109 .030 .353 10.42 .006 .012Ü .0,11 .320 13.43 .110 .0152 ,054 .291 15.69 .129 .017Ü .OG/ .246 16.50 .135 .0210 .079 .196 15.45 .127 .0240 ;OtU .145 1^.74 -1U5 .0292 .oyo ,099 C.f7 .073 .0344 .095 .061 5.BO .047 ,0405 .OUI! .033 2.90 .024 .0476 .OfU .016 1.22 .010 .05»3 .O'.io ,006 ,41 ,003 .0663 .053 ,002 .11 .001 07i.'. 2 .041 .002 .0 1 .0921 .029 - - - .]OII6 .Oil) - -_ - l.OiK) IPl.Uo l.OOO

I,(E/f) -(YJf (l-f)C1

moani c< = ,O19 Hlutogroni vuriaiicoifvuriaiicoi (l1 ~" porconL- 15 lui'f0 i

195 -

278 TABLE 7 CALCULATION OF THE A POSTERIOR] DISTRIBUTION O FFOf R THE EWS SYSTE UNI2 P T M-

P(£)L(L/f)

,0046 .005 .OOb .44 .003 .0057 .005 . m .51 .003 . 006 f ,ouu .137 1.09 .007 .0079 .013 .l'j(, 2.16 .015 .0053 ,020 .196 3.96 .027 ,0109 .OjO .226 C.67 .045 ,0120 .041 .251 10.20 .0/0 .0152 .054 ,?60 14.13 .090 .0178 .007 .273 10.27 .124 ,0210 .079 .263 20.70 .140 , 024Ü .Ooh .23b 20.74 .141 ,0292 .090 .196 17.65 . 120 .0344 .095 .14U 14. 1U .Ü96 .0405 .OllU .100 8.79 .060 .0478 .0?d .059 4.65 .032 ,0563 .006 .030 1.9Ü .013 ,0063 ,0j3 .012 .(6 .005 , 07b2 .041 .004 .16 .001 C921 .0?9 .001 .03 - 10U6 .0^0 - .01 _ l.ooo 147.36 1.000

- ineon.02 < ° 4i

Histogram varijuice - 1.2E— b f i 4

Lognormal poroejitil« - 1.6^- 5 f0 2 i u f50 . 2.2E-2

EPS System d=0.6 d=0.8 d=1.0

<* 2.6E-4 2.8E-4 2.9E-4 3.1E-4 3.3E-4 3.4E-4 P»a 4.3E-8 6.1E-8 8.9E-8 1.3E-7 1.6E-7 1.8E-7 Q05 6.5E-5 5.8E-5 5.2E-5 4.7E-5 4.3E-5 4.2E-5 Q50 2.1E-4 2.1E-4 2.1E-4 2.1E-4 2.1E-4 2.1E-4 Q95 6.5E-4 7.3E-4 8.3E-4 9.2E-4 l.OE-3 l.OE-3 EWS System 0 d=0.2 d=.0.4 d=0.6 d=0.8 d=1.0 <*

279 3.3. Comparison of results

The results shown under 3.1. and 3.2. above are shown as a graph in Figure 2, so as to facilitate their comparison. The mean, median and 5 and 35 percentile e failure-to-starvalueth f o s t probability for both systems are represented in a logaritmic scale. For the case of hypothesis (a), the graph shows the values calculate n sectioi d n 3.1 d correspondinan . g o totat l dependence betwee e failurth n e probability distributions of both components. For the case of hypothesis (b), the values shown correspond with different degrees of dependence that are expressed by the values of parameter d.

EPS System

Hyp(a) -J——————t—— d -«—1 0.0 o.o

0.2 0.23 0.4 0.50

-*-t- 0.6 0.74 0.8 0.93

1.0 i.o

.(-

10~5 10"H 10' 10

EWS Syatea

Eyp(a) -I ——————————— »-— 1— JL

-4- 0.0 0.0

0.2 0.23

0.4 0.50

0.6 0.74

0.8 0.93

„_ 1.0 1.0

-3 10 -5 10-^ 10 10

References

51 , 5T5° s^ peroen-tile5 9 s —I—. mean : d degre positivf o e a dependence parameter p : correlation coefficient

FIG.2. Compariso f resultsno .

280 . CONCLUSION4 S The first conclusion arises from the comparison of the e parametervalueth e f failure-to-staro sth n i s t probability distribution of the EPS system. This system shows a singular condition -which appears frequently in component failure statistics-: it did not fail at all throughout all the periodical tests performed during three years.

It may be observed that hypothesis (a), in which a grouping of the data is considered, leads to a distribution tha s sensibli t y displaced towar e leftth d , that is, to optimistic Q values, if compared with the distribution resulting from considering hypothesis (b), in which the individual information corresponding to each component in the system is maintained.

e informatioTh n provide e statisticaon y b d l approach s essentialli } 7 S I = ? yn differen+ , n ; 0 t= 2 r + , r { from that provided by the other {(r, _ Q (r., = 0; n ,, = 96)'), this explaining the displacement observed in the failure probability distributions of the EPS system.

In the case of the EWS system, the displacement between the probability distributions derived on the basis of s practicalli ) hypothesi(b d an y ) regardless(a s n i ; other words o relevann , t differences exist betweee th n respective mean and median values.

e seconTh d conclusion concern e dispersioth s n parameters e failure-to-starth f o t probability distributiof o n e dependenceth d an S r couplino EW , d systeman S g EP s degree, of the probability distributions corresponding to each one of the diesel units involved in those systems.

Considering the distributions derived within the framework of hypothesis (b) as fully coupled does not seem to be adequate because, although they originate from a single distribution -that describing the population-, thee latear y r specialize o componenttw r fo d s showing different failure behaviours, thus resulting in different distribution f thoso r eace fo eson he componentb y ma s (a s seen in Tables 4 through 7).

However, the distinguishability hypothesis concerning both diesel units is compatible with reality, since it is improbable that they sho n identicaa w l failure behaviour during their lifetime. In fact, this hypothesis implies a more complex model and a higher complexity brings along a higher degre f associateo e d uncertainty. s Thuswa t i , considered convenien o assumt t e thae probabilitth t y distributions developed on the basis of hypothesis (b) be fully coupled. Thi e seeb sn Figur i y nimplie ma es -a d - thae 2 failure-to-starth t t probability distributions r botfo h system e morar s e broadened than those developed on the basis of hypothesis (a).

281 REFERENCES G. Apostolakis, S. Kaplan, B.J. Garnie k and R. J. Duphily "Data Specialization for Plant Specific Risk Studies", Nuclear Engineerin d Desigan g 5 (19SO5 n ) 321-329.

. ApostolakiG . KaplanS d an s , "Pitfall n Risi s k Calculationds", Reliability Engineering 2 (1981) 135-145.

R.M. Cooke and R. Waij, "Montecarlo Sampling for Generalized Knowledge Dependence with Application to Human Reliability", Risk Analysis, Vol 6, No. 3 (1986)

4. U.S. Nuclear Regulatory Commission, Reactor Safety Study, Appendix III Failure Data, WASH-1400 ( NUREG- 7 5/01 4 ) ( 1 975 )

5. Resumen de la EstacMstica/ Pallas del Sistema Suministro de E n e r g 1 a de Emergencia - DIP/ 48/86. Resumen de la EstacMstica/Fallas del Sistema Suministro de Agua de Emergenci - DIPa / 28/86. J.C. Devegil - Deptoi . IngenieMa y Planificaciô - Centran l Nuclea n Embalse r - CNEAe , Cordoba, Argentina.

282 A REVIEW OF INITIATING EVENTS SELECTION AND FREQUENCIES FOR PSA STUDIES

D. ILBERG Department of Applied Physics and Mathematics, Soreq Nuclear Research Center, Israel Atomic Energy Commission, Yavne, Israel

Abstract

Initiating events (lEs) are the occurrences that initiate accident sequences that potentially lea o cordt e damag Nuclean i e r Power Plants (NPP). These occurrences can be experienced during the operating life of a plant, recorde n casei d san d that their frequency appeare b o t s unexpectedly high, may initiate corrective actions.

One of the tasks in performing a Probabilistic Safety Assessment (PSA) call r initiatinfo s g events selectio frequencd an n y estimatione Th . review given here discusse e datth s a sources utilize r performinfo d g this task t I bring. s examples from actual PRAs somd an e, special probabilistic studies that were published.

Two types of sources for lEs identification and frequency estimation are discussed:

a) LER compilations intended for presenting IE frequencies. The history of these data sources for transients, for Loss of Offsite Power (LOSP) and for Loss of Coolant Accident (LOCA) is given, b) Fault-Tree analyses r otheo , r probabilistic studies n whici , a h mode s i constructel analyzed an d o computt d a certaie n frequencf o y a specia . ThiIE l s metho s i used d mainl n casei y f infrequeno s t lEs havin a gsmal l probabilit f occurrenceyo .

The discussion of initiating events selection and frequencies is presented a e breakdowpape ith a n vi r n into several subgroups discussed separately:

(1 ) Transients

(2) Loss of Offsi te Power (LOSP)

) Los(3 f Coolano s t Accident (LOCA) including Interfacing LOCA

(^) Special Initiating Events

(5) Internal Flooding

283 Relevant methodologie d datr thesan fo sa e topic e papee giveth ar s n ri n and the treatments performed in several types of PRA are reviewed and compared. Several recommendation e more giveth ar s en o nsuitabl e data sources for PSA and for further data improvement.

1 . INTRODUCTION

Initiating events (IBs) are the occurrences that initiate accident sequences that potentially lead to core damage in Nuclear Power Plants (NPP). These occurrences can be experienced during the operating life of a plant, recorded and in cases that their frequency appears to be unexpectedly high, may initiate corrective actions.

e taskth On n f performini so e a gProbabilisti c Risk Assessment (PRA) calls for initiating events selection and frequency estimation. The review given here discusse e datth s a sources utilize r performinfo d g this task. t I brings examples from actual PRAs d soman e, special probabilistic studies that were published. n generaTheri e typeo ar e tw f lsource o s s for lEs indentification and frequency estimation: compilationR LE ) a s intende r presentinfo d E frequenciesI g e Th . history of these data sources for transients, for Loss of Offsite Power (LOSP) and for Loss of Coolant Accident (LOCA) is given.

b) Fault-Tree analyses, or other probabilistic studies, in which a mode s i constructel analyzed an d o computt d a ecertai n frequencf o y a specia . ThiIE l s metho s usei d d mainl n casei y f infrequeno s t IBs having a small probability of occurrence.

The data on failure rates for the above task (b) is derived from LERs as well. It is rather difficult to collect the data from the plant-specific failure and corrective action program. A large number of events may be needed for establishing an adequate data base for failure rate derivation. If sufficient plant specific data is not available, generic failure rates are utilized to evaluate the frequency of the special low frequency IBs. E AfrequencI n e madb n e ca plant-specifiy usiny stago b ctw a ge Bayesian update process. In this case the generic compilations of IE frequency data e usee collectear s priorth a d d an , d plant specific occurrence e usear o st d evaluat e posteriorth e same Th e . techniqu e useb n d alsca e r updatinofo g failure rates for the use in Fault-Tree analyses for IE frequency estimations.

284 The discussio f initiatino n g events selectio frequencied an n s i presentes d a e breakdowpape th a vi n ri n inte followinth o g subgroups whice ar h separately discussed in the subsequent sections: (1) Transients

(2) Loss of Offsite Power (LOSP)

) Los(3 f Coolano s t Accident (LOCA) including Interfacing LOCA

(4) Special Initiating Events

(5) Internal Flooding

This discussion, however s i limite ,typS U e o t dBW d PWRan R plants.

Relevant methodologies and data for these groups of IBs are given in each section and the treatments performed in several types of PRA are reviewed and compared.

. 2 TRANSIENT INITIATING EVENTS

Two classes of transient lEs are discussed in this section: transients with successful scram and Anticipated Transients Without Scram (ATWS). The data for the frequency estimation of both classes is obtained from the same data source, using different treatment e basith n co s data.

2.1 Transient Data Base

The initial revie f o initiatinw g event dats performe wa e aReacto th y b d r Safety Study^1^ (RSS). Twenty transient IE categories were selected for BWRd twenty-threan s r PWRsfo e . Electric Power Research Institute (EPRI) publishe n 197i d s firsit 8 t stud f anticipateo y d transients . ' ^ This work which will be referred to as NP-801, included compilation of operational occurrence 0 3 r PWRs BWR BWR2 d Fo t 1 i reportean s . sn i s 9 event45 d s in 37 selected categories of different lEs. For PWRs it reported "1000 events categorized in 41 different lEs. The data in NP-801 covered NPP experienc o t 197 p e u equivalene9 th whic s plan7 wa h4 f / o t tÏ3 year d an s plant year r BWfo s d PWRan R respectively n 198I . 2 EPRI publishen a d ( update in report NP-2300 3). It reported 903 events for BWRs and 2093 events for PWRs under the same IE categories. The number of plants covered increased to 16 BWRs and 36 PWRs and the amount of plant years covere s 101.wa d 5 plan 3 plant 21 year d t R an years r PW BWfo sd Ran respectively.

285 e changeth Som f o e s mad n NP-223i e 0 relativ e NP-80th o t e1 study are:

a) NP-801 had used an "effective in-service date" as supplied by the utilities. NP-2230 uniformly used the first day of commercial operatio e startinth s a n g poin r reportinfo t g plant anticipated transients. Becaus f thio e s change 7 event13 , f NP-80o s 1 were excluded from NP-2230 update.

b) NP-801 reports 191 events within 37 plant years that occurred in the years subsequent to the first year of plant operation (less than hale totath f l numbe f events)o r . NP-2230 report event7 6^ s n i s 85.5 plant years (70$ of the total).

It is clear that NP-801 included very early periods of plant operations, such as from criticality to commercial operation, whereas NP-2230 included events that occurred only after commercial operation was initiated. In general this is about a half year later. Table 1 is a comparison of the evaluatio f severao n l initiator frequencies base n thes o ddato tw ea sources.

Tabl : 1 e ResultL SNPS-PR BN r Initiatod fo s an A r Frequency and Sources of Differences

BNL Review: SNPS-PRA: BNL Review: Two-Stage EPRI-NP-801 Data5 EPRI-NP-2230 Data6 Baye sai n

SNPS-PRA 1st Subseq. All years Weighted 1st Subseq. All Years Weighted Subseq. All Transient Year Years Average Average* Year Years Average Average Years Years**

Loss of Condenser 1.6 0.38 0.67 0.41 0 1. 0.38 0.47 0.40 0.40 0.50 Vacuum (2,4,8)

Turbine Trip 16.9 4.13 7. 4 4.46 13.4 6.39 7.39 6.59 6.85 7.89

MSIV Closure (5) 2.2 0.19 0.67 0.24 1.67 0.27 0.47 0.31 0.29 0.57

Loss of FW (22) 6 0. 0.16 0.27 0.18 0.27 0.11 0.13 0.12 0.11 0.13

LOOP (31) 0.4 0.11 0.16 0.08+ 0.13 0.12 0.12 0.08+ 0.12 0.15++

IORV (11) 0.7 0.08 0.20 0.09 0.53 0.15 0.21 0.16 0.19 0.25

CRW (27, 28) 0.1 0.03 0.04 0.03 0.13 0.10 0.11 0.10 0.11 0.12

Total 22.5 5.03 9. 9 5.49 17.1 7.59 8. 2 7.76 8.07 9.65 Base+ n SNPo d S grid data. ++Base n NSAC-8o d 0 reportJ0. *Used in the PRA. reviewL BN e **Use.th n 1 d

286 The first four columns of the table show a BWR-PRA results. The next four columns represent results obtained from applyin e samth g e methodologo t y the more recent data source (NP-2230). The two last columns present results using the updated source and the two stage Bayesian methodology^- ' 5 . It can be seen that most of the increase in B ML reviews initiator frequencies derives fro e updatemth d experienc f BWo e R related events, rather than from the use of the Bayesian methodology.

The BWR-PRA differentiated between the impact of failures during the first year of plant operation and failures occurring in later years. However, in the review^' it was argued that the data base of NP-801 used was not sufficiently refined for this purpose. The latter update, given in NP- 2230, showed thae impacth t f ignorino t e firsth g t yea f plano r t operating experience causes a reduction of about 2Q% in initiator frequencies (see laso columntw tn addition I f Tablo s . e 1) e"weighte th , d average" approach utilized in the BWR-PRA weighted the data from the first year as e datth (1/35 ad froan ) m subsequent year s a (34/35)s . This approach apparently results in small underestimation of initiator frequencies, since we lack experience from aging plants (after 30 to 40 years of operation) .

Table 1 depicts that the number of shutdowns due to anticipated transients s i higher than experience e recenth n i dt years. Thi s i apparentls y becaus e NP-223th e 0 data base extend o t 198s 1 onlyupdaten A . d revief wo e experientiath l dats publishewa a n 198i d y b 5

The INEL study updates the data base and covers additional 10 BWR and 14 PWR plants t I updateoccurrenceE I . e th d s until December 198 3o thas e th t data base includes 251 BWR plant years with 1832 events and 423 PWR plant years with 3574 events. Now most of the events come from years following the first two years of operation.

The INEL study reviewe e datth d a bas f NP-223o e d determinean 0 d that:

) a INEL basically concurs wit e choicth h f initiaf o ecommerciao y da l l operation as the starting point for event recording.

b) INEL judges that the NP-2230 categories of IBs are adequate*, but in need of better definitions to accurately describe the event data.

*"adequate - "includ e "fine" categorization which allo e PRwth A analyst much flexibilit n combinini y g events into transients groups accordin e specifith o t g c plant responses.

287 INEw Thne Le data fall o manto s y times inte morth o e broad categories PWR~3 d BWR-SiJan 7 . More detailed breakdow f theso n e categorie n hel e ca PRs th p A analyst.

c) The BWR and PWR IE categories are comparable in most events and the main difference treatmenth e condensen i th f s i o et r originated transients.

d) While acceptin e NP-223th g 0 categorization INEL suggestw ne a s E I (instea R ) 41 PW f 6 o dschem5 0 BW5 d f Ran o (insteae ) 37 f o d categories for study in the future. Full event definitions should be developed for the new scheme to enable their future use.

The above findings were basea thoroug n o d h compariso e NP-223th f o n 0 data e NRth basCd Graan e y Book'°'* dat 1 planta1 bas r sfo e which were selected for comparison. For each plant selected the events that occurred during the third and eighth year of operation were carefully compared. It was found tha 6 (27%6 t ) events were categorized differently e evenbaseth n o td descriptio sourceo tw e sth n eac i n comparedf o h . However, abou e thiron t d e discrepancieth of s were becaus e Grath e y Bood havdi k e less information than in the NP-2230 description. The final conclusion was that on the whole the NP-2230 data was found to be valid and is indicative of US commercial NPP experience. This is because the deviations were small (and t randomn generali no t cros d no an d )s di ,"borders e broath f do " groupf o s transients used in the PRA studies. Another important conclusion was that sufficient amount of detail in the event descriptions is crucial for correct categorization.

Many PRAs used the NP-801 data source'^'. Only newer PRAs such as the Oconee PRA^) that were prepared after 1983 used the NP-2230. None of the publishe todaA PR yd use e INEth d L data base.

Application A 2 2. _ NP-223e of Oconenth A n i 0PR e

The Ocone a plan s i e t thas threha t ef theo unit ml al operatins r fo g several years. Therefore, a significant plant-specific experience was accumulated. These plants' specific records were used to modify the

*USNRC's Operating Units Status report (Gray Book)

288 generic data give n NP-223i n o stag tw y usinb e0e Bayesiath g n methodn I . additio i ant-specip e th n c eventi f s were also use modifo t d e listh f y o t initiators, i.e., additiona s werlE l e considered beyon e standarth d 1 4 d IBs of NP-2230 (e.g. "Loss of ICS bus K I" or "Low PZR pressure signal"). Furthermore, based on the original list of the lEs in the RSS^1' (Table 1.4-9 s decidethere)wa o t includt i d, e steam-lin FW-lind an e e break initiators in the list of Oconee transients. Thus, the Oconee P RA include s collapselE 0 1 d d fous beyonan 1 PWlE d4 r s e froRe lE th d th m standard lis f NP-223o t r INEL)(o 0 .

The Oconee PRA frequency evaluation provides additional insight on the use f NP-223o 0 dataPRe ATh . analysts reevaluate e record e dth plan th f o ts transient events and coime out with a different number of events than in the NP-2230 transient categories for Oconee; the main difference was in e numbeth e f "partiacaseo th r f o s l los f MFWo s " transient. Man f theso y e events were recategorize s "turbina d e trip n Oconei "instea A PR ef o d "partial loss of MFW" in NP-2230. In the course of the review^10-1 of the Oconee PRA additional considerations were included which resulte n somi d e small changee frequencth e see b n i n si n n ca y s determinatioa s IB e th f o n e tablTh Table . 2 providee s als a ocompariso n with three other probabilistic studies.

Tabl : 2 e Compariso InitiatoL BN f OPRo nd an Ar Frequencies With Several Other Studies

B/W Arkansas1 Midland Owner BNL Initiator IREP PRA3 Group OPRA Review

.Turbine trip 6.1 v 7.1 {4.1 (4.9 (4.9 Reactor trip 1.9 T2: Loss of MFW 1.0 0.7 0.9 0.64 0.5 Partial loss of MFW 0.69 0.69 V 1 1,. Loss of condenser vacuum 0.21 0.21 5 LOOP 0.32 0.135 0.14 0.17 0.12 lT 6: Loss of air 0.17 0.21 .Excessive FW flow 0.22 V - 0.22 0.092 1MUPS malfunction 2.9E-3 0.092 T8: SpuriouF ES s - - - 0.01 0.01 TfailurV :TB d SLean B - 3. -3 0.053 9 6.7E-3 }0.052 T10: FW-line break - - - 9.3E-4 9.3E-4 TM' ICS malfunction - 0.055 0.048 0.02 0.05 T12:S ,LosSW f o s 2.6E-3 3.7E-6 - 4. OE-3 4.9E-3 W *LosCC f o s - 4.1E-5 - - - T 13: Stuck open spray - - - 0.044 0.044 .Loss of ac power bus 0.035 - TI„: 5.4E-3 5.4E-3 c powed Loss f bu o sr 0.036 _ R: SG tube rupture - 0.014 0.017 8.6E-3 8.6E-3 RPV: RPV rupture - - - 1.1E-6 1.1E-6 Août : Interfacing LOCA - 7.7E-7 - 1.4E-7 VS: Very small LOCA 0.020 5. OE-3 8.3E-3* - 3. OE-3 S: Small LOCA 6.9E-4 3.3E-3 4.E-4 3. OE-3 3. OE-3 M: Medium LOCA 1.6E-4 4.7E-4 _ .. A: Large LOCA 8.7E-5 2.0E-4 I } 9.3E-4 }9.3E-4

*Taken from the ORNL precursor study NUREG/CR-2497. It includes Induced LOCAs (about 40%).

289 3 ATW2. S Selectio d Frequenciean n s

The data base of NP-2230 or INEL is suitable for the derivation of ATWS frequencies and for the selection of several types of ATWS which require a different plant response. Tabl 3 (takee n from Ref ) provide10 . n a s example of how the NP-2230 data is used for the evaluation of ATWS in the Oconee PRA.

Tabl ' 3 Meae n Annual Frequencie f Transieno s t Categorie t Oconea s e (from EPRI-NP-2230)

Power Level Greater than AI l Power Levels 25* AI l Subsequent All Subsequent EPRI-NP-2230 years years years years Transient Category Grouping (19.8 years) (16.8 years) (19.8 years) (16.8 years)

Loss of condenser vacuum 25,27,30 0.25 0.12 0.20 0.12

Turbine trip 3,9,12,15,19, 5.10 4.40 4.30 3.70 21,23,28,33, 34,36-40

Loss of main feedwater 16,22,24 0.70 0.48 0.35 0.18

Loss of offslte power 35 0.05 <0.01 0.05

Load Increase 26,29 0.05 0.06 0.0 <0.01

Loss of RCS flow 1,14 0.25 0.18 0.15 0.12

Control rod withdrawal 2 0.10 0.12 0.10 0.12

RCS depressurlzotlon 4,5,7 0.05 0.06 0.05 0.06

Boron dl lut Ion 11 <0.01 <0.01 <0.01 <0.01

Excessiv (dowo eco n 6,20 <0.01 <0.01 <0.01 <0.0t

IS VM closure 17,18 N/A N/A N/A N/A

Inactiv S looRC e p startup 13 <0.01 <0.01 <0.01 <0.01

Total 6.60 5.50 5.20 4.30

The first column show e groupinth s g whic s performei h d accordine th o gt specific plant response frequence Th . f eaco y h ATWS categor s i evaluatey d for all years including first year of operation (column 2) and for subsequent years afte e firsth r t yea f operatioo r n (colum . 3) Becausn n a e ATWS from power level smaller than 25% is considered benign, the frequencies for this case are also evaluated, and they are used in the PRA analysis.

290 e Shorehath f NP-80o n i e Ae frequencms ni us 1 Th examplPRA'e th . f yo e of ATWS challenge e scrath mo t s syste s evaluatema r powefo d r level greater than 25% was 3.87 per year. In the review^ the NP-2230 was used and the ATWS challenge frequency raised to 7.34 per year which is higher by almost 100?. Thi s i becausse dat th af o froee % NP-801th m60 s ha , first year of plant operation which includes many cases of low power testing n NP-223I . e timth 0 e period before commercial operatios wa n removed. Thus, in the latter, only 33% of the data are from the first yea f plano r t operation. This figur s furthei e r improve e INEth Ln i ddat a base.

3. LOSS OF QFFSITE POWER (LOSP)

3.1 Data Sources

Loss-of-Offsite-Power (LOSP) experiential data have been reviewed in four studies since 1980:

1. Schol ) reviewe^2 l e datth d a received from licensees followina g June 1980 NRC request to submit licensee experience with LOSP events. This review include occurrence9 10 a liss f o t f LOSo s P events. 2. A SAI study was summarized in EPRI-NP-2301^3) which used data collected fro7 nuclea4 m r power plant sitese reporTh . t presents frequenc d duratioan y f LOSno P fro occurrence5 4 m s through April 1981, representin plan5 37 g t year f experienceo s . 3. A NSAC/ORNL study was reported in NSAC/SO^1^ which covered 52 nuclear power plan te periositesth r dfo , prio o Decembet r r 1983- It summarizes 47 LOOP events in 530 plant years. 4. An USNRC study for the resolution of the "Station Blackout" issue was reported in NUREG-1032. The study covered 52 NPPs (all the US NPP sites of December 1983 excluding three with one offsite power connection) t I summarize. plan3 event5 5 53 s tn i syears .

The e reviedatth af wo source s resulteha s n severai d l findings:

Schole Th al ) data bas s rathei e r conservativ needd an e s additional evaluations prior to its utilization in PRAs. b) The NP-2301 data base is more realistic. A few events are apparently missing from this source s recoverIt . y probability information is relatively conservative for use in PRAs.

291 c) The NSAC/80 data base appears to be suitable for realistic PRA analyses. It recommends exclusion of several total LOOP occurrences during shutdown which it judges to be "impossible" during operation. Our judgment is that these are inadvertent human errors that shoul e includeb d r completenessfo d .

The above three studies reported the LOSP events by plant and per geographical regions which have similar weather conditions and an interconnection agreement with respect to keeping a reliable electric supply in that region.

d) The NUREG-1032 data(15) are based on almost the same data base as the NSAC/80 however, it includes the "shutdown" events as well. The main improvement of this study is that it provides a breakdown e LOSth P l oal eventf s into well defined causes which allows tailoring of the LOSP frequency of a new plant according to its design and also allows for evaluating the improvement that may be expected by a in an older plant.

2 Som3. e Applications

Ref. 16 presents a review of the results of applying the first three data source applicatioe a BWR o Th t s. s base nwa n usin do e LOSgth P eventn i s the geographical region of the new BWR plant for generating a prior to serva firs s a et estimat e planth o t t e LOSP frequency (One-Stage Bayesian). The NUREG-1032 study^ ^' presents several comparisons between PRAs results using plant or regional LOSP experience, and the results of the general methodology suggested taking into account plant specific features such as plant protection against weather conditions in the region, grid related desig d planan n t specific desig d proceduresan n t I . concludes that the generic models can usually provide good "ball park" result r generifo s c application perspectivesd an s t I woul . e lesb d s suitable for plant-specific LOSP frequency determination at least until better data would be accumulated on the design features associated with each LOSP occurrence.

It may be concluded that while NUREG-1032 may be more suitable for the newer plants, NSAC/80 woul e b mord e suitablo stagtw er Bayesiafo e n updating of data for older plants.

292 4. LOCA FREQUENCIES

Tne Reactor Safety Study (RSS) evaluated tne Loss of Coolant Accident (LOCA) frequencie y inferencb s e from generic dat n n pipo ano e e oreatn n i * nuclear industries. Tnis is tne oasj.3 for the /aljes snown in Taole 4 fsr the RSS. Tne Reactor Pressure Vessel (RPV) rupture probaoility /vas also n nucleabaseno n o dr vessel experience, dhil e frequenctn e e lattetn f D yr t changno d edi muc y neweb h r PRAs ''mosvalue)S f o theRS t me ,tn stil e us l the LOCA frequencies ^ere reevaljated in tne new-^ PRAs. M -11 and' 1 7D ',

ComparisoA Tabl : 4 e f o LOCn A Frequencie n Varioui s s PRAs

LOCA Type Very Small Small Medium Large RPV Interfacing SG Tube Initiator^*) LOCA LOCA LOCA LOCA Rupture LOCA Rupture

S V PRA V RP AoûS t A M R

ARKANSAS 0.020 6.9E-4 1.6E-4 8.7E-5 -- I REP

MIDLAND 5.0E-3 3.3E-3 4.7E-4 2.0E.4 -- 7.7E-7 0.014 PRA

B/W Owner 8.3E-3 4.0E-- - 4 - - - - 0.017 Group

OCONEE 3.0E-3 9.3E-4 1.1E-6 1.4E-7 8.6E-3 PRA

LIMERICK 0.010 2.0E-3 4.0E-4 -- PRA

SHOREHAM 8.0E-3 3.0E-3 7.0E-4 3.0E-7 1.8E-7 -- PRA

BWR-6 1.2E-3 6.7E-4 2.1E-4 -- 1.7E-7 — PRA

SEABROOK 1.7E-2 4.7-4 2.0E-4 2.7E-7 1.8E-6 1 .4E-2 PRA

RSS-PWR 2.7E-3 8. IE-4 2.7E-4 1.0E-6 1.1E-5 —

PumD CR RSS-BWp R 2.7E-3 8.1E-4 2.7E-4 1.0E-6 —

*VS:Very Smal - lles s thainc5 1. nh diameter break; SrSmall LOC - Ales s tha4 n inch diameter break; LrLarge LOC - AGreate r tha 4 incn h diamete f i "Mediumr " is not considered, otherwise greater than 8 inch diameter size.

293 *' and Seabrook^ ' <<*> PRAs used experiential data for the evaluation of part of the LOCA frequencies rather than pipe break data used in the RSS. The Oconee PRA'^ considered the following events in a population of 35 plants: Largo evenn : et LOC) occurre(A A d Small LOCA (S) : one event that occurred at Zion Unit 1 in 1975 SGRuptur : Thre ) (R e tubG eventS e f ruptureo s s with leakage rates greater than 100 gpm : Surry Unit 2 (Nov. 1972), Point Beach Unit 1 (Feb. 1975), and Prairie Island Unit 1, (Oct. 1979).

A two-stage Bayesian analysi applies e abovwa sth o et d generio ct datd an a the Oconee plant-specific experience which reflects none of the above events in any of the three units on site. The BNL review of the Oconee PRA(1°) added another event: Very Small LOCA (VS): One event that occurred at H.R. Robinson Unit 1975)y (Ma .2

Thi s addeha s a dfrequenc x 10~ 3 f 3 o (y see Tabl n additioi ) e H e th o t n NP-2230 transient no. 6. B/W owner group^ ^ based their estimate of "VS" 18 on the precursor study (NUREG/CR-2497)^1 9^ which introduced the "Robinson event" mentioned above.

Tabl 4 summarizee e lis th f sinitiatino t g event e consideresb than ca t d under the "LOCA" category and their frequencies according to several PRAs. t I includes both PW d BWRan R plants.

The Table includes LOCA frequencies from two types of origins:

a) Based on pipe break frequencies such as in the RSS. b) Based on LERs such as in some of the newer PRAs.

The frequencies of Interfacing LOCA (Août) has been derived in a process simila e smalth rupturo G t rl S LOCd estimateS an Ae RS cases e s Th it d. frequency base n generio d c check valve failure rates. Later PRAs, used generic valv d pipan ee break data^20" 2o estimatt ^ e Interfacing LOCA 11 2 frequencies^ 7,24,25)^ The publication by NRC^ ^ of a number of casées in which a testable check valve was inadvertently activated while another check valv s leakingwa e , learfto several recent studies which uses LEr Rfo a PWR^2^ and for BWRs^25»27) experience to improve the valve and pipe break data in order to provide a more pi ant-specific frequency determination e NRTh C dat. a reported nine failure r operateai f o s d check

294 valves in 1361 BWR valve years. Tables 5 and 6 present a comparison of several source valvn o s e failure, ruptur leakagd an e e rate s usea s n i d several PRAs and other special probabilistic studies. While the RSS used data from non nuclear sources, the NUREG/CR-1363 uses LERs for many plants, most of them include small leakages as well as very small ones (Tech spec exceedance) lase sourceo Th tw t . s (se ) usee6 Table d s an 5 s more recent LERs. The data provided in the tables is used to estimate the Interfacing LOCA frequencies according to the number of valves available n everi y leak path identifie e particulath n i d r plant under reviewn o d an , the basis of the testing intervals used on each leak path's valves.

Table 5: Motor Operated Valves Failure Rates

Component Source Failure Mode Assessed Range Mean Value

HSS<1> Failure to 3x10^ - 3x10"3/d 1.3x10~3/d operate (include Motor command )

Operated ,OQ, NUREG/CR-1 363U3} Failure to 8x10~3/d Valves (for BWRs) operate (include (MOV) command )

NUREG/CRH363 Failure to —— 6x1(T3/d (for BWRs) operate (w/o command)

Command Failure Failure of —— 2x10~3/d f o both MOVs Inboard an d (Inboard and Outboard MOVs

SNPS-PRA— — (11) MOV 1.6x1 0~7/hr App. A. 2* Spurious Opening

CHU-198?(25) MOV Spurious — — 9.2x1CT8/hr Oppni n g CHU- 1987 Failur o t e —- 3.9x10~6/d reclose

CHU- 1987 Inadvertent 1.2x10~3/d opening

*Based on GE evaluation

295 Tabl : 6 eValv e Ruptur r Excessivo e e Leakage Rates

Component Source Failure Mode Assessed Mean Value Range ] [hr"~ [hr~^]

Check RSS^ 1 ^ Internal Leakage 10~6 -10~7 3.8xlO~7 (severe ) Valves

NUREG/CR Interna - -- l Leakage 1x10 -1363(23) (all sizes)

SEABROOK PRA Internal Leakage 5x1(T8 -1x1Cf10 10~9 update(17) (severe ) (all sizes) 5xlO"6 -5x10~8 5x10~7

CHU-1987(25) Internal Leakage —— 3.4x10-7 (all sizes)

Check RSS Rupture 10~7 -10"9 2.7x10 Valves NUREG/CR External —— 7xlO"8 or -1363 Leakage /Rupture Motor SEABROO — — K PR<5x10~A Ruptur9 e Operated update Valves CHU- 1987 Disk —— 1.4x10"7 Separation

*Never occurre n mori d e than 10,000 valve-years

5. SPECIAL INITIATING EVENTS Tne nor et e transiensolelrecenth no e o d Rus yD At s t data sourcer fo s identifying and evaluating lEs. They include a treatment to identify events of the loss of support systems. Some lEs of this kind are loss of instrument air, DC power buses, service water or component cool ing water. These events n spiti , f beino e g relatively infrequent, hav a large e impact because several suppor subsequentld an t y frontline system s a resulfai s a l t of the IE.

Aa resuls f theio tfrequenc w lo r f occurrenceo y , sufficieno thern s i e t plant specific experience. Thus, their potential frequency is estimated by a special analysis; in most cases a fault tree analysis. Such an analysis was performe e Oconeth n i de PRA^' .n exampl a e evaluatioTabl th s i f 7 o e n of the loss of instrument air initiator frequency performed in Reference 9 by the fault tree method.

296 Table •7. Loss of Instrument-AI r-ln I tlator Frequency Contributors

Initiator Frequency (yr ) Event Description Dominant Se t Cu t OPRA BNL««

Contaminât Ion Inadverten systeA I t m con- AIAPICF 0.102 0.133 lamlnatlon withl wateoi r o r

Pipe rupture IA pipe rupture not repaired AIAPILF* 0.052 0.059 n 10mI l nutes" F O 1 L 1 P A 1 A

A I e on d an A S Los f o s Pip systeeA S lead n mI an k ASAPILF» 0.006 0.007 tra 1 n compressoA I failure on f eo r AIACPCF»3 to run

Loss of SA and one IA In Pip esysteA S lead n I mkan ASAPILF» 0.003 0.004 ma 1 nfonancs oncompressoA I e n mainteI r - A 1 ACPAM»3 nance

d losf an o sA S Los f o s Pipe leak In SA system and ASAPILF* 0.002 0.003 A I RO o Wt RCW fallA valvI o st e closed ARCWIASVO»3

OntraA I e lfalln d an s IA falls mechanically to run, AIACPCF«3* -O 0.001 SA Interconnect and anInterconnecA S d t falls (ASAIAVDf O- fallo to s ASAIAVVH)

Total 0.17 0.21

"The ability to repair or isolate a major leak In the IA sysvem Is complicated by the fact that the system was not Included In the detailed deslnn drawings — which make the recovery operation more difficult. Some pipes and valves are not vlslb.le or accessible (OPRA, page A.15-10). "»Differencea facto L roovaluatlof o o BN BNL'f t 0.8 o re e e us ,th sdu n rathe I e s ar n r than 0.7o ,t account for unit 3 being at power during the fault, and to correctly use the.failure data given on page A15-I9 of OPRA.

The data require kindso r thestw fo d f :o e e speciaar s lE l

a) Experiential data (LERs n theso ) e special event n similai s r plants. This is used to identify the existance of the potential for these kinds of IBs. b) Failure rates of equipment either generic or plant-specific for the quantificatio e faulth f to n tree s constructethawa t r fo d estimating their potential frequency.

6. INTERNAL FLOODING

Internal flooding is another initiating event that is treated in a detailed specia o commol tw studye n Th approache. s that were referreo t d in the previous sections were also used for evaluating the internal

297 flooding frequencies:

) a Estimation experienceP froNP m d flooding events combined wite th h plant-specific flooding-event experience. b) Estimation from detailed fault-tree models for several internal flooding rates based on plant design and on the basis of pipe rupture rates, expansion joints rupture rates, valves' failure rates and human error n maintenancei s .

Three important internal flooding studies were performee th n i d past^>11 >17). These three PRAs all used a combination of both approaches. e Ocone e th cas th f o een I PRA^ ' ° thre1 e iterations were eth carrien o t ou d flooding analysis e firss accordinTh wa t. o approact g ) above(a he th , second was a combination of (a) and (b) and the third iteration was a combination of (a) and (b) with very detailed (b) approach. In the case of e Seabrooth k PRA"'^, approacs usewa d ) mor(a h e extensively than approach (b). However, pipe failure rate datuses o asseswa t ad e frequencth s f o y the very large flooding category for which no event has been experienced by the industry. The approach in the Shoreham PRA^11^ took into account the NP-801 transien E frequencieI t n combinatioi s n with unavailabilitf o y isolation system (due to maintenance and human errors) when the transient occurred, leading to a flooding event.

All the above application indicated a need for flooding event records from NPP operating experience r effectivfo d an , e pipd valvan e e failure rates.

7. SUMMARY

A discussio f o initiatinn g event selectio d frequencan n y determinatios wa n presented by a breakdown into transients, Loss of Offsite Power, LOCAs, Special events (mainly infrequent support system failures internad an ) l flooding. The methodologies used were examplified from the treatment employed in recently published PRAs. There are two main approaches used:

a) Study of LERs and plant-specific occurrences which are combined by the two-stage Bayesian methodology. b) Fault tree analyse similad an s r studie o probablisticallt s y evaluate the frequency of a certain initiating event.

Many studies combined the two approaches in their detailed analysis.

298 Our review reveals the need for accumulating LERs for use in PRA for the purpose of initiating event selection and frequency determination. It identifie a maste e neer th sfo dr lis f initiatino t g event categories with well defined event description analystA PR o hel t se n additionI th p. e th , neer bettefo d r failure rate n somi s e particular drea - smainl r pipefo y s d valvean n determinatios i identifiei s e us r fo df LOCAo nd internaan s l flooding events.

REFERENCES

1. Reactor Safety Assessmenn Stud"A - y f Accideno t t Risk n U.Si s . Commercial Nuclear Power Plants-, WASH-1400, NUREG/7b-014, October 1975. . LeverenL . F . z2 . . KorenLellouch Jr.S . Erdman M . C . G . ,J R d , an n , "Anticipated Transients A Reappraisal," CPRI NP-801, July 1978. 3. A. S. McClymond and B. W. Poehlman, "ATWS: A Reappraisal, Part 3" Frequency of Anticipated Transients," EPRI NP-2230, January 1982. 4. D. Ilberg, K. Shiu, N. Hanan and E. Anavim, "A Review of the Shoreha-n Nuclear Power Station Probabilistic Risk Assessment", NUREG/CR-4050, November 1985. Stago Tw . e S Kaplan a Bayesian . "O 5 . n Procedur r Determininfo e g Failure Rates froe Experientiath m l Data." PLG-0191, June 1981. . PapazoglouA . I . . 6 . AnaviE LedermanL , d man . "Bayesian analysis Under Population Variability with an Application to the Frequency of Loss of Offsite Power and Anticipated Transients in Nuclear Power Plants." BNL-NUREG-31794, February 1983. 7. D. P. Mackowiak and C. D. Gentillon, "Development of Transient Initiating Event Frequencies for use in Probabilistic Risk Assessments," NUREG/CR-3862 y 1985Ma , . 8. USNRC's Operating Units Status report (Gray Books). Published quarterly under NUREG. 9. A Probabilistic Risk Assessment of Oconee-Unit 3, NSAC/60 June 1984. 10. N. A. Hanan, D. Ilberg, D. Xue, R. G. Fitzpatric, T-L. Chu, "A Review of the Oconee - 3 Probabilistic Risk Assessment", NUREG/CR- 4374, March 1986. 11. "Probabilistic Risk Assessment Shoreham Nuclear Power Station Long Island Lighting Company, Final Report", Science Application Inc., June 1983.

299 . F Scholl . R 12. , "Los f o Offsits e Power Survey Status Report." Revisio , e Repor3 Systematin th f o t c Evaluation Program Branch, Divisio f o Licensingn , USNRC. . . PoehlmanS McClymon W . A . B d . an .13 d "Los f o Offsits e Powet a r Nuclear Power Plants: Data and Analysis." EPRI-NP-2301, March 1982. . WyckoffH 14. , "Losse f o Offsits . S Nucleae . PoweU t a rr Power Plants through 1983." NSAC-80, July 1984.

15. P. W. Baranowsky, "Evaluation of Station Blackout Accidents at Nuclear Power Plants", NUREG-1032, 1985. . AnavimE . . . IlberShiD 16 K ,Revie A " d u gan f Transienwo t Initiator Frequencie a BW f o Rs PRA" , Proceedings ANS/ENS Int. Topical Meeting on Probabilistic Safety Method Applicationsd an s n FranciscoSa , , Feb. 24 - Mar. 1, 1985. . 17 Pickard Löwd Garrican e k Inc., (a) "Seabrook Station Risk Managemen d Emergencan t y Planning Study," PLG-0432, December 1985. (b) "Midland Nuclear Plant - Probabilistic Risk Assessment," Consumers Power Company and PLG Inc., May 1984. 18. "Owners Group Probabilistic Evaluation of Pressurized Thermal Shock Phase 1 Report," BAW-1791, June 1983- 19. "Precursor o Potentiat s l Severe Core Damage Accidents: 1969-197A - 9 Status Report," NUREG/CR-2497, June 1982. 20. R. E. Wright et al, "Pipe Break Frequency Estimation for Nuclear Power Plants," INEL, NUREG/CR-4407, EGG-4407, May 1987. . T Burns . . E BasiL ,d . "Characteristican S n21 . f o Pips e System Failure n Lighi s t Water Reactors, "EPRI-NP-438, August 1977. 22. H. M. Thomas, "Pipe and Vessel Failure Probability,: Reliability Engineering, Vol. 2, pp. 83-124. 23. W. H. Hubble and C. F. Miller, "Data Summaries of LERs on Valves at U.S. Commercial Nuclear Power Plants," NUREG/CR-1 363, EGG-EA-5125, May 1980, and NUREG/CR-1963, June 1985. 24. K. N. Fleming, R. K. Deremer and J. H. Moody, "Realistic Assessment of Interfacing Systems LOCA Scenarios in PWR Plants," Proceeding Int. Topical Meetin Probabilistin o g c Safety Assessmen d Risan tk Management, Zuric 1 Aug 3 h4 Sep - . . 1987. . 25 T-L. Chu . FitzpatricR , . StoyanovS d an k , "Interfacing Systems LOCAs t a Boiling Water Reactors," Proceeding Int. Topical Meetinn O g

300 Probabilistic Safety Assessment and Risk Management, Zurich 31 Aug. Sep4 1 - . 1987. 26. D. Ilberg and N. Hanan, "An Evaluation of Unisolated LOCA Outside e Drywelth a BWR, n i l " BNL Technical Report A-37^0, June 1985. 27. U. S. Nuclear Regulatory Commission, "Preliminary Case Study Report - Overpressurization of Emergency Cooling System in Boiling Water Reactors," February 1985.

. . IlberHananD N e Revied A Turbin " . th gan , 28 f wo - eBuildin g Flooding Study of the Oconee PRA," Proceeding Int. ANS/ENS Topical Meeting on Thermal Reactor Safety, San Diego, February 2-6, 1986.

301 LIS PARTICIPANTF TO S

ARGtN fN t lr Mr. K. F~e 1 i / i a Comision Nacional fneryia Atomic.» Avda. del Libertador Rft 14?9 Buenos Aires

CHINA, Mrs. X.Y. Chen Research Institute of Nuclear PLOPLF 'S Ri P. Oh Power Opérâti on Guan Shan Roa0 2 d Wuhan

FEWLAWD inet eh nl . E . Mr Fechnical Research Centre of Finland Electrical Engineering Laboratory Otakaari /B o po s t W 1 St-02 r RANCH: , MesliT , Mr n I OF See. de la Production Thermique 3, rue de Messine 7b384 Paris Cede8 0 x

17KRMAWY, . RurnpJ , fDr Staatliche . Atomsicherheif t Am s t Democratic Rep. und Strahlenschut/ Waldowailee 117 Berlin 1157

HUNGARY HollE. oMr, Enstitut r Electricafo e l Power Research 3 23 x Bo P.O. H-1368 Budapest

, TotJ h. Mr Paks Nuclear L Powen a l P r U?emvitel. 0 i /03l Paks, Pf71

[SRAFL . Ilbt-rD . Mr g Soreq Nuclear Research Center Chairman Dept. of Applied Physics and Mathematics Yavrie 70600

ETALY . CurcurutS . Mr o F.NEA -D ESP Italian Directorat r Nuclearfo e - Safet d Healtan y h Protection Divisio f Reactoo n r Safety Via Vitaliano Brancat8 4 i I"- 00144 Rome

Mr, G. Grimaidi ENF.A-DISP Italian Directorat r Nucleafo e r Safet d Healban y h Protection Division of Reactor Safety Via Vitaliano Brancati 48 I-00144 Rome

303 JAPAN Mr . K. Nakai Power Recto d Nucleaan r r Fuel Development Corp. 9 11, 1 chôme, Aka:>aka, Minatoku Tokyo

Mr . K. Ohta Nuclear Power Seife t y Informât.! on Research Conte f NUPKo r ] Shuw<* Kami y si Cho Rldq. 3-13, 4 chôme Toranornon Minatoku Tokyo 10 '3

KORtIA, RhP. OK Mr, J.H. I ee Ycounq Gwanq Nuclear P Joint hrigi noprjng l^anrnria gM Sunm 167Sa g , Dong Köind IMoim Ku SPOU 1

MKX n :o Mr. K.J. Soiito (]omision IMacional de Sfguridad Nuclea y SôduaguardJar s rtv. Tnsurgentes sur 1006 Coj JoridF . a 01030 Mexico, D.F,

POI Mr . c/ OntraJ Laboratory for Radiological Protection Konwaliowa Street, / Warsaw 03 -194

SPfUN Mr. M. de Aguinaqa- fecnatom 7apata 9 KC.N1 m ] . (Madrid FJurgos) San Sebastloin de los Reyes Madrid

Mr. M, Malavo CII-MAT Au. Complu tense ?? Fdifici6 o 28040 Madrid

. M.--RMr , Morales Consej e Seguridaod d Nuclear Sor Agnela de la Cru? 3 280?0 Madrid

IJNLR , KubiDJ KINGDO . eMr M CEGB, HSI) Courtoriay House Warwick 1 ane London, FC4P 4EB

. WellC . sMr CK1B Nuclear Coordination Group Sudbury House I*) Newgate Street London KC1A /AU

304 r;n; Mr A tu-si en; JR<; T'ïpr a !"'> KibJ i 'J'iru /HVO )->pr

0 10 x Bo O l P f'df.-mi.ii . I r iM TAflrt A J400 VJOMIK.I

0 10 . x (-.niM ßo . l . inqforMr 0 P d i AK u i J40c i V 0

Mr K. Mich,ms P 0. Box HM) A MOO VJfMina

Mr, B. Foinif. P.O. Box 100 O Vioiiii.MO A i

Sc i f n b i f i r, Set. r< -1 ar y : l . I odor m in

M LHD j T< Choi nioir i n :

305 HOW TO ORDER IAEA PUBLICATIONS

exclusivn A e sales agen r IAEfo t A publications whoo t , l ordermal s and inquiries shoul addressede db bees ha ,n appointed in the following country:

UNITED STATES OF AMERICA UNIPUB, 4611-F Assembly Drive, Lanham, MD 20706-4391

followine th n I g countries IAEA publication purchasee b y sma d froe mth sales agent r booksellerso s liste r througdo h major local booksellers. Payment can be made in local currency or with UNESCO coupons.

ARGENTINA Comisiôn Naciona Energi'e d l a Atômica, Avenid l Libertadoade r 8250, RA 1429 Buenos Aires AUSTRALIA Hunter Publications, 58 A Gipps Street, Collmgwood, Victoria 3066 BELGIUM Service Courrier UNESCO, 202, Avenue du Roi,B-1060 Brussels CHILE Comisiôn Chilena de Energi'a Nuclear, Venta de Pubhcaciones, Amunategui 95, Casilla 188-D, Santiago CHINA IAEA Publications in Chinese China Nuclear Energy Industry Corporation, Translation Section, P.O2103x Bo . , Beijmg IAEA Publications other than in Chinese China National Publications Impor Expor& t t Corporation, Deutsche Abteilung , Beijm,88 P.Ox gBo . CZECHOSLOVAKIA S.N.T.L.,Mikulandska4,CS-11686 Prague 1 Alfa, Publishers, Hurbanovo nämesti , CS-81e3 Bratislav9 58 a FRANCE Office International de Documentation et Librairie,48, rue Gay-Lussac, F-75240 Paris Cedex 05 HUNGARY Kultura, Hungarian Foreign Trading Company, P.O149x Bo . , H-1389 Budapes2 6 t INDIA Oxford Boo Stationerd kan y Co. Par, ,17 k Street, Calcutta-706 001 Oxford Book and Stationery Co ,Scmdia House, New Delhi-110001 ISRAEL Heiliger & Co. Ltd Kere3 2 n Hayesod Street, Jerusalem 94188 ITALY Librena Scientifica, Dott. Luci Biasie od o "aeiou", Via Meravig , 1-2012h16 3 Milan JAPAN Maruzen Company, Ltd, PO Box 5050,100-31 Tokyo International PAKISTAN Mirza Book Agency, 65, Shahrah Quaid-e-Azam, P O. Box 729, Lahore 3 POLAND Ars Polona-Ruch, Centrala Handlu Zagramcznego, Krakowskie Przedmiesci , PL-00-06e7 8 Warsaw ROMANIA llexim, P O. Box 136-137, Bucharest SOUTH AFRICA Van Schaik Bookstore (Pty) Ltd, P O Box 724, Pretoria 0001 SPAIN Di'a Santose zd , Lagasc , E-2800a95 6 Madrid Di'az de Santos, Balmes 417, E-08022 Barcelona SWEDEN AB Fritzes Kungl. Hovbokhandel, Fredsgatan 2, P.O. Box 16356, S-10327 Stockholm UNITED KINGDOM Her Majesty's Stationery Office, Publications Centre, Agency Section, 51 Nine Elms Lane, London SW85DR USSR Mezhdunarodnaya Kniga,Smolenskaya-Sennaya 32-34, Moscow G-200 YUGOSLAVIA Jugoslovenska Knjiga,Terazije 27, P 0 Box 36, YU-11001 Belgrade

Orders from countries where sales agents have not yet been appointed and requests for information should be addressed directly to: Division of Publications International Atomic Energy Agency Wagramerstrass , P.O100ex 5 Bo ., A-1400 Vienna, Austria