P11-Insights of Common Cause Failure Analysis for …...Insights of Common Cause Failure Analysis for New Nuclear Power Plants’ Design IAEA Technical Meeting on Probabilistic Safety

Insights of Common Cause Failure Analysis for New Nuclear Power Plants’ Design

IAEA Technical Meeting on Probabilistic Safety Assessment for New Nuclear Power Plants’ Design

Vienna, Oct.1-5, 2012

Mr. Song Minghai, Nuclear Power InstituteChina Power Investment CorporationBeijing, the P. R of China

Introduction of the Author

� Chinese Regulator Registered Nuclear Safety Engineer from2005.� Aug.1998 to May 2012: Qinshan CANDUProject, Third Qinshan

Nuclear Power Company Ltd.� Aug. 1998 to Dec. 2005, PSA, reliability and nuclear safety engineer.� Jan. 2006 to April. 2009, PSA supervisor.� May 2009 to May 2012, Section head of safety analysis sectionand

supervisor of safety analysis department.� Jun.2012 to now: Beijing, Director of Nuclear Safety & Radiation

Environment Department, Nuclear Power Institute, China PowerInvestment Corporation.

Overview of China Power Investment Corporation

�CPI is one of the five state-owned electricalcorporations in China, founded in Dec. 2002.

�Owns 220 member companies/institutions and 15joint venture companies with over 126,000 employees.

�Involve of thermal power, nuclear power, hydropower,renewable energies, coal and transportation, coalchemical industry and aluminumproduction etc.

� One of the three corporations in mainland of Chinaqualified to develop nuclear power.

� Controlling shareholder of Shandong Haiyang NPP(AP1000).

Overview of China Power Investment Corporation

Shandong Haiyang AP1000 Project

Overview of Nuclear Power Institute of CPI

� Nuclear Power Technology Research andDevelopment Center, Technical Support Center ofChina Power Investment Corporation.

� Developing of AP1000 and Small Module Reactor(SMR) Technology in CPI .

1. Introduction 2. Status of Common Cause Failure Analysis in PWR

New NPPs’ Design3. Practice of Unified Partial Method (UPM) Common

Cause Failure Analysis in CANDU NPP4. Insights of Common Cause Failure Analysis for New

NPPs’ Design5. Suggestions to Future Development of CCF Analysis

in New NPPs’ Design

Contents

�Common Cause Failure (CCF) is a dependent failureevent where simultaneous or near simultaneous multiplefailures result from a single shared cause, e.g., commondesign faults, manufacturing or installation error, systemmaintenance error or environmental effects.

�Common cause failures are infrequent, but can lead,when they occur, to severe consequences: to fail severalredundant trains or systems simultaneously or nearsimultaneously, and they are almost certain to beimportant to the Probabilistic Safety Assessment (PSA)results.

1. Introduction

1. Introduction

�CCFs are difficult to predict and model. The mostcommon methods to model CCFs areβ factor method,Multiple Greek Letters (MGL) method and Alpha factormethod.

�The level of redundancy designed into the newnuclearpower plants and the relative lack of critical supportsystems for passive plants will lead to an increased focuson CCFs.

�Common cause failure parameters, and especially forthose lack of experiential data, whose assessment canrelied heavily on engineering judgment and these datamust be interpreted in a plant-specific sense to determineapplicability.

2. Status of Common Cause Failure Analysis in PWR New NPPs’ Design

�The Advanced Passive pressurized water reactor AP1000and the European Pressurized water Reactor (EPR) arethe most recent new nuclear power plants underconstruction and commissioning in the world. They aretypical to be selected for the well understanding of thestatus of common cause failure analysis in newPWRnuclear power plant’s design.

�The analysis framework for CCFanalysis in AP1000 andEPR are almost similar and based on Nuclear RegulatoryCommission Report NUREG/CR-4780 by applying theβfactor method and Multiple Greek Letters (MGL) method.

�AP1000 CCFAnalysis Process�Step 1: Identification of Common Cause Component

Groups� Step 2: Quantitative Evaluation� Step 3: Replacement of Common Cause Failure in the

Fault Tree and Quantification� Step 4: Re-quantification (If necessary)� Step 5: Documentation


Stage 1 - System logic Model DevelopmentSteps

1.1 System Familiarization1.2 Problem Definition1.3 Logic Model Development

Stage 2 – Identification of CommonCause Component Groups

Steps2.1 Qualitative Analysis2.2 Quantitative Screening

Stage 3 – Common Cause Modelingand Data Analysis

Steps

3.1 Definition of Common CauseBasic Events3.2 Selection of ProbabilityModels for Common Cause BasicEvents3.3 Data Classification andScreening3.4 ParameterEstimation

Stage 4 - System Quantification andInterpretation of Results

Steps

4.1 Quantification4.2 Results Evaluation and Sensitivity Analysis4.3 Reporting


�Procedural Framework for CCF Analysis in NUREG/CR-4780

�there are two important aspects which are essential for thecorrectness of modeling CCFs.

�Firstly, the identification of common cause componentgroups is one of the essential aspects for the correctness ofmodeling CCFs.

�Common cause failure within a systemshall be modeledand quantified. Consideration of the potential for commoncause failure of groups of components in different systemswill be relatively more important for the passive plants,since there are much fewer inter-systemdependencies thatresult from links through support systems, common causefailure among more systems shall be modeled andquantified.


�Secondly, the selection of common cause failureparameters is also one of the essential aspects for thecorrectness of modeling CCFs. The development of thefailure data base is more important to the results than thechoice of the model.

�The CCFparameters in AP1000 and EPRare respectivelytaken from the superseded URDand EUR as the genericCCF data.


�In the design phase of Qinshan CANDUNPP, theparametric CCF analysis was not performed in thesystem models of PSAdue to previous CanadianCANDU PSApractice.

�In order to analysis the impact of CCFs on systemreliability and plant safety, the pilot studies of CCFanalysis have been performed by using the UnifiedPartial Method.

3. Practice of Unified Partial Method (UPM) Common Cause Failure Analysis in CANDU NPP

�The Partial Beta Factor method was originally proposedas a way of decomposing the overall assessment of asimple beta factor into a series of judgments relating toidentifiable topics, which all have an impact on redundantcomponent vulnerabilities to CCF.

�UPM represents the development and simplification of theoriginal partial beta method. Eight causal groups (it iscalled eight sub-factors) are evaluated to calculate thebeta factor. Each of the sub-factors relates to a differentaspect of system design, operation and workingenvironment, including its effectiveness in defendingagainst CCF.


�Eight sub-factors①①①① Redundancy, it presents the status of redundancy and

diversity of common cause components group.②②②② Separation, it presents the isolation status and layout

of common cause components group.③③③③ Understanding, it presents the maturity status of the

technology used in common cause components group.④④④④ Analysis, it presents the status of previous analysis

experience of fault analysis and operation experiencefeedback.


⑤⑤⑤⑤ Man machine interface, it presents the status ofprocedure and human error likelihood.

⑥⑥⑥⑥ Safety culture, it presents the status of training andsafety culture.

⑦⑦⑦⑦ Environmental control, it presents the status ofaccess control to common cause components group.

⑧⑧⑧⑧ Environmental testing, it presents the status ofenvironmental qualification of common causecomponents group.


�There are five major steps to performthe CCFanalysis byUPM.

①①①①Selection of Common Cause Component Groups andFault Tree Reconstruction.

②②②②Screening Analysis.③③③③Calculation of Beta Factors by UPM.④④④④After obtaining the beta factor, the CCFbasic event

probability should be calculated according to the formulasand the value should be incorporated into the fault treemodel in order to replace the screening values for theseselected CCFbasic events.

⑤⑤⑤⑤Then fault tree should be re-evaluated to obtain the finalresult.


� Calculation of Beta Factors by UPM.①①①① Define systemboundary.②②②② Determine the level of assessment. A component

level of assessment should be performed for faulttree quantification of common cause componentgroups.

③③③③ Consult the UPMestimation table to determine thevalues of each beta sub-factors. See Table-1 for theestimation table. The analyst must choose thedescription that most closely matches the systemunder consideration to determine each of the valuesof beta sub-factors.


④④④④ The justification for the choices of beta sub-factorsmust be recorded in judgement table (see Table-2 forthe practical process of beta factor calculation forEmergency Core Cooling(ECC) systemPV1 andPV2 fail closed common cause failure event), whichsummarizes the judgment made in the previous stepand is used to calculate the beta factor. This step canbe combined with the above step, and these two stepsconstitute the bulk of the analysis.

⑤⑤⑤⑤ Finally, the value of beta factor can be calculated.


A A+ B B+ C D EDesignRedundancy 1750 875 425 213 100 25 6Separation 2400 580 140 35 8Understanding 1750 425 100 25 6Analysis 1750 425 100 25 6OperationMan machine interface

3000 720 175 40 10

Safety culture 1500 360 90 20 5EnvironmentEnvironmental control

1750 425 100 25 6

Environmental testing

1200 290 70 15 4

Table-1 Partial Beta Factor Estimation Table for UPM




ECC 3432-PV1 and 3432-PV2 in One Room 6 Quick Opening Valves in One Area

3 Emergency Water Supply Pumps in One Room 2 EDGs in adjacent Rooms


16 Main Steam Safety Valves(MSSVs) in One Room


Applied CCFBasic Events

3432PV1/2—FCCCF

3432-PV1/2 FAILCLOSED(C&I FAILURES INCLUDED)-CCFSub-Factor Judgement Decision Category/

NumericalValue

Comments

Redundancy 1 out of 2 for success. A/1750

Separation The two valves arelocated in same room.

A/2400

Understanding The design Experienceis over 10 years;novelty, complexityand misfit can beconsidered as small.

E/6 As CANDU 6 has more than 200 reactor years ofoperation experience and the design has passed long timeof verification, furthermore there is no very importantdesign change or new technology applied in the QinshanCANDU units. This is the general consideration in all ofthe ECC analysis, and no software is involved in thedesign of ECC.

Analysis General Considerationof Special SafetySystems of CANDUreactor.

D/25 This is the general consideration in all of the ECCanalysis, as reliability assessment of Special SafetySystems is mandatory for regulation in Canada and thereliability performance of Special Safety Systems aremonitored in each CANDU units. Designers apply SafetyDesign Guides in their design work and can get feedbackform reliability and PSA analysis.


Man MachineInterface

General Consideration. C/175 The estimation of the sub-factor of Man MachineInterface is based on written checklist and normalinteraction.

Table-2

Safety Culture The general safetyculture level isappropriate to assign.

C/90 The sub-factor of Safety Culture can be assigned acategory of C, as the Qinshan CANDU units have comethrough years of operation experience with operatorshaving got sufficient simulator training of normal andemergency conditions. The treatment is conservative andit is acceptable.

EnvironmentalControl

The valves are locatedin service building,and it is limited accessarea.

D/25 According to the location of ECC equipment, the sub-factor can be assigned to category of E when equipmentof common cause component groups are located in MainControl Room as the strict access control. For ECCequipment located in Service Building, Reactor Buildingor E-101, the sub-factor of Environmental Control can beassigned as category of D as for special safety systemsthey are very important and only trained personnel areallowed to work in this limited access area.

EnvironmentalTesting

Environmentalqualified according tothe requirements inSafety Design Guide.

D/15 ECC is one of the four special safety systems and it isstrictly designed according to the requirements in SafetyDesign Guide. The compliance verification with theSafety Design Guide has been performed (see 98-03650-ASD-001); the sub-factor of Environmental Testing canbe assigned to category of D.

Total Numerical Value (Summation of Sub-factors) 4486Beta Factor (β)=Total Numerical Value /50000 8.97E-2Beta Factor of air-operated valves fail to operate inURD (Revision 8, Issued 3/99)

8.80E-2


�The UPM CCF analysis result is illuminated in Table-3, and itillumined that the CCF contributions are certain to beimportant to the Probabilistic Safety Assessment (PSA) results.

System or Plant Without CCF With CCF (UPM) CCF Contributions

Shutdown System No.1 2.41E-4 6.29E-4 61.7%

Shutdown System No.2 (Updated Analysis, 2010)

2.25E-4 6.71E-4 66.5%

Emergency Core Cooling System

1.01E-3 7.10E-3 85.8%

Containment System 2.61E-3 8.90E-3 70.7%

Severe Core Damage Frequency (SCDF)

3.57E-6/reactor year

8.39E-6/reactor year

57.4%

Table-3 UPM CCF Analysis Result of Qinshan CANDU PSA


�In the early development stage, in order to determine theappropriateness of using UPM, some demonstrationanalyses have been performed to study the UPMandother CCFmethods.

�The CCFanalysis result of the demonstration analysis isilluminated in Table-4, and it illumined that withdifferent plant (CANDU and PWR), different system(Shutdown SystemNo.2 and High Pressure SafetyInjection System) and different CCFMethod (Alphafactor method, MGL method and UPM), the deviation toUPM for the analysis results are relatively negligible.


System With CCF(Different CCF

Method)

With CCF(UPM)

Deviation to UPM

Shutdown SystemNo.2 of CANDU(Early Stage Analysis,2007)

6.49E-4(Alpha factor

method)

6.29E-4 3.2%

High Pressure SafetyInjection System of300MWPWR

6.41E-5(MGL method)

6.29E-5 1.9%


Table-4 CCF analysis Result of the Demonstration Analysis

�Compared theβ factor method and Multiple Greek Letters (MGL)method in AP1000 and EPR by applying of the generic CCF dataof URD and EUR with the practice of Unified Partial Method(UPM) common cause failure analysis in CANDUNPP, someinsights of important technical points were realized:

①①①①Common Cause Failures are certain to be important to the PRAresults and plant safety. Special attention is required whenperforming CCF analysis.

②②②②The definition of the common cause component group is the mostimportant and perhaps the most difficult task in the component-level CCF analysis as it is related to the final results of theanalysis. Common cause failure within a systemand amongmore systems shall be modeled and quantified in order to identifydesign vulnerabilities of new nuclear power plant.

4. Insights of Common Cause Failure Analysis for New NPPs’ Design

③③③③ The selection of common cause failure parameters is also veryimportant for the correctness of modeling CCFs. Thedevelopment of the failure data base is more important to theresults than the choice of the model. It is acceptable toapplying of the generic CCF data of URDand EUR, orapplying the data fromthe Common-Cause Failure Databaseand Analysis Systemdeveloped by USNRC and INEEL(NUREG/CR-6268) and the International Common CauseData Exchange (ICDE) by SKI, USNRC and OECD, sincethese data are the culmination of research by manyorganizations worldwide and represents an industry consensus.In order to identify design vulnerabilities of new nuclearpower plant, special attention is required to check the realdesign of common cause component groups, not just simplyuse of these data in PSA’s calculations.


④④④④ Based on the above UPManalysis, the UPMmethod can beused for CCF analysis in new nuclear plant design. UPMgivesthe analyst the opportunities to check the real design, locationand operation of common cause component groups, and it canbe a useful tool for engineering practice to estimate CCF and tohelp designers to identify the defenses for CCF.

⑤⑤⑤⑤ The consolidation and simplification of UPMreduces theamount of analysis and time required. Estimation table andjudgment table of UPMmake the consistency between differentanalysts easier to achieve, although specific guidance on theinterpretation of the systemdescriptions may still be requiredfor particular project.

⑥⑥⑥⑥ The source of the values in estimation table of UPMis not clear,which may be based on expert judgment or operationexperience. The future development of UPMneeds toincorporate real operation data into the UPMprocess.


�As the limitations of current CCF analysis methods, it is requiredto develop new or improved methods or useful engineering tool toestimate CCF and their defenses in new NPP’s design. Thetechnical suggestions are raised as follows:

①①①① In order to easily screen out the common cause component groupwithin a system and among more systems, computerizedequipment data base shall be developed during the design phaseof new NPPs.

②②②②The UPM method and operation experience data shall becombined together to create a new method to simply the analysisprocess and easily to identify the design vulnerabilities forcommon cause failures. The new method shall emphasizequalitative analysis, careful event interpretation, screening, andparameter estimation. The new CCF data must be interpreted ina plant-specific sense to determine the applicability.

5. Suggestions to Future Development of CCF Analysis in New NPPs’ Design

Documents

P11-Insights of Common Cause Failure Analysis for …...Insights of Common Cause Failure Analysis for New Nuclear Power Plants’ Design IAEA Technical Meeting on Probabilistic Safety