Band 71, Heft 1-2

The German regulatory guide on probabilistic safety assessment (PSA) describes the fundamental requirements concerning the performance of PSA in the frame of comprehensive safety reviews. The technical details regarding the performance of PSA are set out in two technical documents (PSA Methods and PSA Data) that have been developed by a working group of PSA experts (FAK PSA). Based on the experiences from the first series of periodic safety reviews in Germany, international experiences and the fact that comprehensive safety reviews are now mandatory since April 2002 all guides have to be revised. The first guide updated was the PSA guide together with the corresponding technical documents, issued in October and November 2005. In the following the key points of the revised requirements on PSA methods and data are described.

Events initiated by common-cause-failure (CCF) can significantly affect the availability and reliability of nuclear power plant safety systems. In recognition of this, CCF data are systematically collected and analysed in the International Common-Cause Data Exchange (ICDE) Project, which was initiated in August 1994. Since April 1998, the NEA has formally operated the project. Currently eleven countries participate in the project. The ICDE collects all events where two or more identical, redundant components of a group, fulfilling the same function, have failed or were impaired due to a shared cause (ICDE events). Complete CCFs, i.e. failure of all identical, redundant components in the group due to a shared cause are an important subset of the collected data. Currently, data exchange and analysis covers the following components: centrifugal pumps, diesel generators, motor-operated valves, safety and relief valves, check valves, reactor protection system components (level measurement, control rod drives, etc), circuit breakers, and batteries. The main findings of the ICDE reports issued by 2005 show averaged over all components that about two thirds of all complete CCF events involve faulty actions by plant personnel and contractors. The single largest contribution is from faulty testing and maintenance work due to deficient and/or incomplete procedures. Other important causes are insufficient testing and requalification of components or systems after maintenance, repair, modifications or backfitting work, as well as operator errors of commission. The probability that a reported ICDE event is a complete CCF decreases strongly with increasing number of redundant components, demonstrating the effectiveness of redundancy as a powerful defence against CCFs. However, complete CCFs cannot be completely prevented by high redundancy only.

The article describes a number of activities that were part of a major Nordic co-operation project which was recently performed, and which aimed at providing state-of-the-art guidance on the handling of dependent failures in nuclear power plants, both in operation and safety management, and as a part of plant PSA:s. This includes a rather wide scope of activities ranging from reviewing and describing available sources of data on CCF and CCF modelling techniques to the analysis of the efficiency of various protective measures against dependent failures in safety related equipment. A set of guidance documents was issued. The project also included a number of data analysis pilot applications, where CCF events in the ICDE database were analysed applying the impact vector method for several types of safety critical components.

The first German data base for Common Cause Failures (CCF) had been set up for the German Risk study, Phase B, published in 1989. It was based on three sources: international operating experience from the OECD Incident Reporting System, the national operating experience reflected in the collection of reportable events and plant specific operating experience from the Nuclear Power Plant Biblis unit B. This data base was subsequently substantially extended in terms of additional events and extended observation periods where additional information was collected in the frame of further PSA studies und CCF projects. The reportable events were the key source for this extension. Using this improved data base an updated calculation of CCF probabilities has been performed which was published in the document on PSA data associated to the regulatory PSA guideline.

This paper describes the background and status of a new International Network on “Incorporating Ageing Effects into Probabilistic Safety Assessment”. The Joint Research Centre (JRC) of the European Commission organized in September 2004 the kickoff meeting of this Network at JRC's Institute for Energy in Petten, Netherlands, with the aims to open the APSA Network, to start discussion of ageing issues in relation to incorporating ageing effects into PSA tools and to come to consensus on objectives and work packages of the Network, taking into account the specific expectations of potential Network partners. The presentations and discussions at the meeting confirmed the main conclusion from the previously organized PSAM7 pre-conference workshop on “Incorporating PSA into Ageing Management”, Budapest, June 2004, namely that incorporating ageing effects into PSA seems to be more and more a hot topic particularly for risk assessment and ageing management of nuclear power plants operating at advanced age (more than 25–30 years) and for the purpose of plant life extension. However, it also appeared that, especially regarding the situation in Europe, at present there are several on-going feasibility or full studies in this area, but not yet a completed Ageing PSA leading to applications. The project's working method is a NETWORK of operators, industry, research, academia and consultants with an active interest in the area (physical networking via a series of workshops and virtual networking via the Internet). The resulting knowledge should help PSA developers and users to incorporate the effects of equipment ageing into current PSA tools and models, to identify and/or develop most effective corresponding methods, to focus on dominant ageing contributors and components and to promote the use of PSA for ageing management of Nuclear Power Plants.

Common Cause Failures (CCF) have been an issue of safety consideration in nuclear safety since a long time. For the design of the European Pressurised Reactor (EPR) probabilistic safety goals in conjunction with the limit set by CCF on failure probability that can be achieved by redundancy led to the requirement to fulfil vital safety functions by functionally diverse systems. The probabilistic safety analysis (PSA) which was performed for EPR takes into account CCFs which are modelled using the beta-factor model of the European Utility Requirements (EUR). The PSA shows that the probabilistic safety goal for core damage frequency – CDF < 10 −5 /year – is met with sufficient margin. In addition to the modelling of CCF in the PSA a deterministic CCF analysis is being performed. It is a safety function based approach on component level analysing frontline and backup systems with respect to common components or type identical components. It ensures that diverse safety functions are fulfilled by systems being sufficiently diverse including all necessary support systems. Components are identified where further diversification or additional defences against CCF are required.

Probabilistic Safety Assessments (PSAs) in Germany have primarily been conducted in the framework of Periodic Safety Reviews (PSRs). For some time, PSAs following the recommendations given by the reviewer with the final statement in the 1 st PSR have been submitted and reviewed, like the probabilistic analyses of internal fires as well as Low Power and Shutdown States. From the very beginning, the review of the adequateness of the common cause failures (CCF) treatment represented a key element in the respective regulatory procedures – given the large impact on the results depending on the CCF assessment. In this paper, our experiences and insights from the reviewing procedures in the course of time are described – also addressing background and objectives as well as working programme and results with reference to reviewer's CCF projects. Finally, possible ways and procedures are presented related to a further development in CCF treatment in PSAs according to practical requests.

Important issues in any procedure used for estimating basic event probabilities of common cause failures (CCF) for probabilistic safety assessments (PSA) are: which plants and systems to use, how to combine them, and how to transform data from systems with different numbers of similar components to obtain CCF-rates for a specific group of components. These issues are addressed with focus on the last part called “mapping”. Certain parametric models are considered for transforming CCF event experience from data-source plants to the target plant, the plant of interest. Two sets of rules are reviewed and compared for transforming rates and assessment uncertainties from larger to smaller systems i.e. mapping down. Epistemic uncertainties are taken into account in the estimation. Mapping down equations are presented also for the alpha-factors and for the variances of CCF-rates. Consistent rules are developed for mapping up CCF-rates, uncertainties and alpha factors from smaller to larger systems. These rules are not limited to a binomial CCF model. Consistency requirements are severe and dictate certain limits to possible parametric values. Empirical alpha factors are used to quantify robust mapping ratios of complete CCF-rates. Mapping is critically analyzed and practical recommendations are made.

Uncertainties arising from different sources have to be considered for the quantification of common cause failures (CCFs). At GRS a CCF model (coupling model) has been developed for the estimation of CCF probabilities. An essential feature of the coupling model is the consideration of these uncertainties by using Bayesian estimation methods. Experiences from applying the coupling model to CCF event data over several years and analyzing the results in detail has led to improvements in the application of the model. In this paper the improved methodology of the coupling model is presented. Special emphasis is given to the description of the sources of uncertainties which are considered in the coupling model and the mathematical methodology, how these uncertainties are represented and propagated through the model. In closing topics of future improvements of the coupling models are discussed.

A common-cause failure (CCF) model based on stochastic simulation has been developed to complement the established approaches and to overcome some of their shortcomings. Reflecting the models proximity to the CCF process it was called Process Oriented Simulation (POS) Model. In recent years, some progress has been made to render the POS model fit for practical applications comprising the development of parameter estimates and a number of test applications in areas where results were already available – especially from CCF benchmarks – and comparison can provide insights in strong and weak points of the different approaches. In this paper, a detailed description of the POS model is provided together with the approach to parameter estimation and representative test applications. It is concluded, that the POS model has a number of strengths – especially the feature to provide reasonable extrapolation to CCF groups with high degrees of redundancy – and thus a considerable potential to complement the insights obtained from existing modeling.

In highly redundant systems CCF dominate the calculated unavailabilities. CCF contribute over 90% to the resulting core damage frequencies of some PRAs for German Nuclear Power Plants. Because the results of PRAs can lead to costly back fitting measures, it is essential to ensure these results. The principles of CCF analysis and the efforts to establish a comprehensive data base are described. In addition the utilities have undertaken efforts to develop concepts for defensive strategies and to introduce these measures in the plant operation in order to reduce the CCF probabilities. Unfortunately these efforts are yet not fully supported by the existing models.