PRA Methodology Overview

22.39 Elements of Reactor Design, Operations, and

Safety

Lecture 9

Fall 2006

George E. Apostolakis Massachusetts Institute of Technology

PRA Synopsis

Figure removed due to copyr i ght restrictions.

Futron Corp . , International Spa ce Station PRA, Dec . 2000

NPP End States

• Various states of degradation of the reactor core.

• Release of radioactivity from the containment.

• Individual risk.

• Numbers of early and latent deaths.

• Number of injuries.

• Land contamination.

The Master Logic Diagram (MLD)

• Developed to identify Initiating Events in a PRA.

• Hierarchical depiction of ways in which system perturbations can occur.

• Good check for completeness.

MLD Development

• Begin with a top event that is an end state.

• The top levels are typically functional.

• Develop into lower levels of subsystem and component failures.

• Stop when every level below the stopping level has the same consequence as the level above it.

Nuclear Power Plant MLD

Ex c e ssiv e Re le a s e of

Non- Core Materia l

Ex c e ssiv e Core D amage

RC S pres sure Bo un dary Fa ilure

Co ndi ti o n al Conta i nment Fa ilure

Insuffi c i ent Reac tiv i t y Contro l

Insuffi c i ent Core-he at Remov a l

Insuffi c i ent RC S Inv entory Contro l

Insuffi c i ent RC S Heat Remov a l

Insuffi c i ent RC S Pressure Contro l

Insuffi c i ent Iso l at io n

Insuffi c i ent Pressure & Temperature Contro l

Insuffi c i ent Co m b us t i bl e Gas Co ntrol

NPP: Initiating Events

• Transients

– Loss of offsite power

– Turbine trip

– Others

• Loss-of-coolant accidents (LOCAs)

– Small LOCA

– Medium LOCA

– Large LOCA

ILLUSTRATION EVENT TREE: Station Blackout Sequences

S eal

LO S P DG s LO C A EF W E P R e c . C o n t .

EN D ST AT E

From : K. Kiper, MIT Lecture, 2006 Courtesy of K. Kiper. Used with permission.

LOSP Distribution

Epistemi c Uncertainties

5th 0 .005/yr (200 yr)

Median 0.040/yr (25 yr)

Mean 0.070/yr (14 yr)

95th 0 .200/yr ( 5 yr)

From : K. Kiper, MIT Lecture, 2006 Courtesy of K. Kiper. Used with permission.

Offsite Power Recovery Curves

1

0. 9

90t h P er c ent i l e 50t h P er c ent i l e 10t h P er c ent i l e

0. 8

0. 7

0. 6

0. 5

0. 4

0. 3

0. 2

0. 1

0

0 2 4 6 8 10 12 14 16 18 20 22 24

Ti m e A f t e r P ow e r Fa i l ur e ( H r )

From : K. Kiper, MIT Lecture, 2006 Courtesy of K. Kiper. Used with permission.

STATION BLACKOUT EVENT TREE

Co urtesy o f U.S. NRC.

NPP: Loss-of-offsite-power event tree

LOOP Secondary Bleed Recirc. Core Heat Removal & Feed

OK

OK

PDSi PDSj

Human Performance

• The operators must decide to perform feed & bleed.

• Water is “fed” i nto the reactor vessel by the high- pressure system and is “bled” out through relief valves into the containment. Very costly to clean up.

• Must be initiated within about 30 minutes of losing secondary cooling (a thermal-hydraulic calculation).

J. Rasmussen’s Categories of Behavior

• Skill-based behavior: Performance during acts that, after a statement of intention, take place withou t conscious control as smooth, automated, and highl y integrated patterns of behavior.

• Rule-based behavior: Performance is consciously controlled by a stored rule or procedure.

• Knowledge-based behavior: Performance during unfamiliar situations for which no rules for control are available.

Reason’s Categories

Unsafe acts

– U nintended action

• S lip

• L a p s e

• M i s t a k e

– I ntended violation

Latent conditions

• Weaknesses that exist within a system that create contexts for human error beyond the scope of individual psychology.

• They have been found to be sign ificant contributors to incidents.

• Incidents are usually a combination of hardware failures and human errors (latent and active).

Reason’s model

J. Reason, Human Error , Cambridge University Press, 1990

Pre-IE (“routine”) actions

Median EF

Errors of commission 3x10 -3 3

Errors of omission 10 -3 5

A.D. S w ain and H.E. Guttmann, Handbook of Human Reliability Analysis with Emphasis on N u clear Power Plant A pplications, Report NUREG/CR-1278, US Nuclear Regula tory Commiss ion, 1983.

Post-IE errors

• Models still being developed.

• T ypically, they include detailed ta sk analyses, ident i fication of performance shaping factors (PSFs), and the subjective assessment of probabilities.

• PSFs: System design, facility cult ure, organizational factors, stress level, others.

The ATHEANA Framework

Plant Desig n ,

Error- Forcing Context

Perf ormance

Human Error

PRA

Logic Models

Risk

Operation s and Maintenanc e

Sha pi n g Factors

Error Mechanisms

Unsafe Actions

Human Fai l ure Events

Management Decisions

Plant C onditions

NUREG/CR-6350, May 1996.

Risk Models

1 O K

2 T => 4 TR AN1

3 L O V

4 T => 5 TR AN2

5 L O C

6 L O V

AA

A1 A2

BB

B- G AT E1 B- G AT E2

B- G A TE3

EVEN T - B1 EVEN T - B2 EVENT- B3

B- G A TE4

EVEN T - B4 EVEN T - B5

B- G A TE5

B- G A TE6

B- G AT E7

EVEN T - B6 EVENT- B7 EVEN T - B8 EVEN T - B9 EVENT- B1 0 EVEN T - B1 1

FEED & BLEED COOLING DURING LOOP 1-OF-3 SI TRAINS AND 2-OF-2 PORVS FOR SUCCESS

Co urtesy o f U.S. NRC.

HIGH PRESSURE INJECTION DURING LOOP 1-0F-3 TRAINS FOR SUCCESS

Co urtesy o f U.S. NRC.

Cut sets and minimal cut sets

• CUT SET : Any set of events (failures of components and human actions) that cause system failure.

• MINIMAL CUT SET : A cut set that does not contain another cut set as a subset.

S

E

E

Indicator Variables

1 , I f E j i s T

X j =

0 , I f E j i s F

Important Note: X k = X, k: 1 , 2, …

Venn Diagram

X T = φ ( X 1 , X 2 ,…X n )  φ ( X )

φ ( X ) is the structur e o r switchin g function .

It maps an n-dimensional vector of 0s and 1s onto 0 or 1.

Disjunctiv e Norma l Form :

X T  1 

N

 ( 1 

1

M i ) 

N

 M i

1

Sum-of-Product s Form :

N N  1 N

N  1 N

X T 

 M i    M i M j

 ...  (  1 )

 M i

i  1

i  1

j  i  1

i  1

Dependent Failures: An Example

B 1 a nd B 2 ar e i d e n t i cal

C o m pone n t B 1

r e dunda nt c om pone nt s

MCS: M 1 = {X A } M2 = {X B1 , X B2 }

Example (cont’d)

• In general, we cannot assume independent failures of B 1 and B 2 . This means that

P(X B1 X B2 )  P(X B1 ) P(X B2 )

• How do we evaluate these dependencies?

Dependencies

• Some dependencies are modeled explicitly, e.g., fires, missiles, earthquakes.

• After the explicit modeling, there is a class of causes of failure that are treated as a group. They are called common-cause failures.

Special I ssue on Dependent Failur e Analysis, Reliability Engineering and System Safety, vol. 34, no. 3, 1991.

The Beta-Factor Model

• The

β -factor model assumes that common-

cause events always involve failure of all

components of a common cause component group

• It further assumes that

   CCF

 total

Generic Beta Factors

0. 2

0.18

0.16

0.14

0.12

0. 1

0.08

0.06

0.04

0.02

0

A ver age

Data Analysis

• The process of collecting and analyzing information in order to estimate the parameters of the epistemic PRA models.

• Typical quantities of interest are:

 Initiating Event Frequencies

 Component Failure Frequencies

 Component Test and Maintenance Unavailability

 Common-Ca use Failure Probabilities

 Human Error Rates

General Formulation

X T = φ ( X 1 ,…X n )  φ ( X )

X T  1 

N

 ( 1 

1

M i ) 

N

 M i 1

N N  1 N

N  1 N

X T   M i

   M i M j

 ...  (  1 )

 M i

i  1

i  1 j  i  1

i  1

X T : the TOP event indicator variable (e.g., core melt, system failure)

M i : the i th minimal cut set (for systems) or accident sequence (for core melt, containment failure, et al)

TOP-event Probability

P  X

  N P  M

      1  N  1 P  N M 

T  i

  i 

1  1 

N

P  X T  

 P  M i 

1

Rare-event approximation

The question is how to calculate the probability of M i

P ( M i ) 

P ( X i

... X i )

RISK-SIGNIFICANT INITIATING EVENTS

Risk-Sig nif i cant Init iat i ng Event	Period	Number of Ev e nts	Mean Frequency	Tren d
General Transien ts	1998 – 2004	2120	7.57 E-1
B WR General Transie n ts	1997 – 2004	699	8.56 E-1
PWR Ge neral Transie n ts	1998 – 2004	1421	7.10 E-1
Loss o f Fee d w ater	1993 – 2004	188	9.32 E-2
Loss of Heat Sin k	1995 – 2004	259	1.24 E-1
B W R L o ss of Heat Si n k	1996 – 2004	154	1.88 E-1
PWR L o ss of Heat Si n k	1991 – 2004	105	9.23 E-2
Loss o f In strument Air (BWR)	1994 – 2004	19	7.60 E-3
Loss o f In strument Air (PWR)	1990 – 2004	17	1.19 E-2
Loss of Vital AC Bus	1988 – 2004	43	2.98 E-2
Loss of Vital DC Bus	1988 – 2004	3	2.35 E-3
Stuck Open SRV (BWR)	1993 – 2004	14	2.07 E-2
Stuck Open SRV (PWR)	1988 – 2004	2	2.30 E-3
Steam Generator Tube Rupture	1988 – 2004	3	3.48 E-3
Very Small LOCA	1988 – 2004	5	3.92 E-3

Department of Nuclea r S c ien ce and Engineering 35

P. Baranowsky, RIODM Lecture, MIT, 2006 Courtesy of P. Baranowsky. Used with permission.

5

PW R gene ral t r ans i e nt s , and 90% i n t erv al s

M a x i m u m l i k e l i h ood es t i m a t e (n / T ) (ba se l i ne p e ri od)

90% i nt er v al (pr edi c t i o n l i m i t s )

Fi t t ed l i n e

4

3

2

1

0

198 8 1 990 199 2 19 94

1 996

Y ear

19 98 2 000

Lo g m od el p - v al ue < = 0. 00005

200 2 2 004

PQ PL Nov . 1, 2 005

5

BW R gener al t r a ns i ent s, and 90 % i nt e rv al s

M a xi m u m l i k el i hoo d es t i m a t e (n/ T ) (bas el i ne per i od)

90% i nt er v a l ( pr edi ct i on l i m i t s )

F i t t ed l i ne

4

3

2

1

0

198 8 1 990 199 2 19 94

1 996

Y ear

19 98 2 000

Lo g m od el p - v al ue < = 0. 00005

200 2 2 004

BQ PL Nov . 1, 2 005

1. 2

1. 0

BW R l os s of heat s i nk , and 90% i nt erv a l s

M a xi m u m l i k el i hoo d es t i m a t e (n/ T ) (bas el i ne per i od)

90% i nt er v a l ( pr edi ct i on l i m i t s )

F i t t ed l i ne

0. 8

0. 6

0. 4

0. 2

0. 0

198 8 1 990 199 2 19 94

1 996

Y ear

19 98 2 000

Lo g m od el p - v al ue < = 0. 00005

200 2 2 004

BLPL N o v . 1, 2005

INITIATING EVENT TRENDS

PWR General Transients BWR General Transients

PWR Loss of Heat Sink BWR Loss of Heat Sink

P. Baranowsky, RIODM Lecture, MIT, 2006 Courtesy of P. Baranowsky. Used with permission.

Department of Nuclea r S c ien ce and Engineering 36

INITIATING EVENTS INSIGHTS

• Most initiating events have decreased in frequency over past 10 years.

• Combined initiating event frequencies are 4 to 5 times lower than values used in NUREG-1150 and IPEs.

• General transients constitute majority of initiating events; more severe challenges to plant safety systems are about one-quarter of events.

P. Baranowsky, RIODM Lecture, MIT, 2006 Courtesy of P. Baranowsky. Used with permission.

Department of Nuclea r S c ien ce and Engineering 37

ANNUAL LOOP FREQUENCY TREND

0.25

0.20

0.15

0.10

0.05

0.00

Y ear l y 86- 96 T r end 86- 96 U pper B ound 86- 96 Low er B ound 97- 02 T r end 97- 02 U pper B ound 97- 02 Low er B ound

Department of Nuclea r S c ien ce and Engineering 38

P. Baranowsky, RIODM Lecture, MIT, 2006 Courtesy of P. Baranowsky. Used with permission.

ANNUAL LOOP DURATION TREND

1000. 00

100. 00

10. 00

1. 00

0. 10

0. 01

T r end 1986- 96 5% Low er B o und 95% U p per B o und O b s e r v ed w i th B ounds T r end 1997- 2003 5% Low e r B ound 95% U pper B o und

Department of Nuclea r S c ien ce and Engineering

P. Baranowsky, RIODM Lecture, MIT, 2006

Courtesy of P. Baranowsky. Used with permission.

39

LOOP FREQUENCY INSIGHTS

• Overall LOOP frequency during critical operation has decreased over the years (from 0.12/ry to 0.036/ry)

• Average LOOP duration has increased over the years:

– Statistically significant increasing trend f o r 1986–1996

– Essentially constant over 1997–2004

• 24 LOOP events between 1997 and 2004; 19 during the “summer” period

• No grid-related LOOP events between 1997 and 2002; 13 in 2003 and 2004

• Decrease in plant-centered and switchyard-centered LOOP events; grid events are starting to dominate

Department of Nuclea r S c ien ce and Engineering 40

P. Baranowsky, RIODM Lecture, MIT, 2006 Courtesy of P. Baranowsky. Used with permission.

SYSTEM RELIABILITY STUDY RESULTS

Department of Nuclea r S c ien ce and Engineering

P. Baranowsky, RIODM Lecture, MIT, 2006

Courtesy of P. Baranowsky. Used with permission.

41

0. 030

ED G un av ail a b i l i t y ( n o r e c o v . ) ( FTS m o de l) an d 90 % i n t e r v als

F i tt ed m o d e l

90 % c o nf id en c e ba nd

0. 025

0. 020

0. 015

0. 010

0. 005

0. 000

19 97 1 99 8 19 99 2 00 0 20 01 2 00 2

Lo g m o del p- v a lu e = 0 . 00 062

Fisca l Y e ar

20 03 2 00 4

U 0 nr L A u g. 31 , 2 0 0 5

0. 00 14

0. 00 12

A F W un av a i l ab i l i t y ( F T S m o de l ) an d 90 % i nt er v al s

Fi t t e d m o d e l

9 0 % co nfi d en c e b an d

0. 00 10

0. 00 08

0. 00 06

0. 00 04

0. 00 02

0. 00 00

19 8 8 19 9 0 19 92 19 94 19 96 19 98 20 00 20 02 20 04

Lo g m o del p- v a lu e = 0 . 44

Fisca l Y e ar

U 0 L A u g . 3 0 , 20 05

0. 0 07

0. 0 06

H P I 8 - ho ur un r e l i a b i l i ty ( C N ) an d 90 % i n ter v al s

Fi t t e d m o d e l

9 0 % co nfi d en c e b an d

0. 0 05

0. 0 04

0. 0 03

0. 0 02

0. 0 01

0. 0 00

19 88 19 90 19 92 19 94 19 96 19 98 20 00 20 02 20 04

Lo g m o del p- v a lu e = 0 . 02 9

Fisca l Y e ar

U 8 L Jan . 3 1 , 20 06

0. 00 40

0. 00 32

0. 00 24

0. 00 16

0. 00 08

0. 00 00

19 8 8 19 9 0 19 92 19 94 19 96 19 98 20 00 20 02 20 04

Lo g m o del p- v a lu e = 0 . 23

Fisca l Y e ar

U 8 L O c t. 1 1 , 20 0 5

PWR SYSTEM RELIABILITY STUDIES

EDG Unavailability (FTS) AFW Unavailability (FTS)

HPI Unreliability (8 hr mission) AFW Unreliability (8 hr mission)

P. Baranowsky, RIODM Lecture, MIT, 2006 Courtesy of P. Baranowsky. Used with permission.

Department of Nuclea r S c ien ce and Engineering 42