OECD/NEA International Common Cause Failure Data Exchange (ICDE) Project – insights and lessons learnt
-
G. Johanson
Abstract
Events initiated by common-cause-failure (CCF) can significantly affect the availability and reliability of nuclear power plant safety systems. In recognition of this, CCF data are systematically collected and analysed in the International Common-Cause Data Exchange (ICDE) Project, which was initiated in August 1994. Since April 1998, the NEA has formally operated the project. Currently eleven countries participate in the project. The ICDE collects all events where two or more identical, redundant components of a group, fulfilling the same function, have failed or were impaired due to a shared cause (ICDE events). Complete CCFs, i.e. failure of all identical, redundant components in the group due to a shared cause are an important subset of the collected data. Currently, data exchange and analysis covers the following components: centrifugal pumps, diesel generators, motor-operated valves, safety and relief valves, check valves, reactor protection system components (level measurement, control rod drives, etc), circuit breakers, and batteries. The main findings of the ICDE reports issued by 2005 show averaged over all components that about two thirds of all complete CCF events involve faulty actions by plant personnel and contractors. The single largest contribution is from faulty testing and maintenance work due to deficient and/or incomplete procedures. Other important causes are insufficient testing and requalification of components or systems after maintenance, repair, modifications or backfitting work, as well as operator errors of commission. The probability that a reported ICDE event is a complete CCF decreases strongly with increasing number of redundant components, demonstrating the effectiveness of redundancy as a powerful defence against CCFs. However, complete CCFs cannot be completely prevented by high redundancy only.
Kurzfassung
Durch gemeinsam verursachte Ausfälle (GVA) hervorgerufene Ereignisse kön-nen Verfügbarkeit und Zuverlässigkeit von Sicherheitssystemen in Kernkraftwerken erheblich beeinträchtigen. Aus diesem Grund werden im internationalen GVA-Datenaustauschprojekt (ICDE), das im August 1994 begonnen wurde, GVA-Daten in systematischer Weise gesammelt und aufbereitet. Seit April 1998 wird dieses Projekt offiziell durch die NEA betrieben. Gegenwärtig beteiligen sich an ihm elf Nationen. ICDE erfasst alle Ereignisse, bei denen zwei oder mehr baugleiche, redundante Komponenten einer Gruppe, welche dieselbe Funktion erfüllen, aus gemeinsamer Ursache versagten oder beeinträchtigt wurden (sog. ICDE-Ereignisse). Vollständige GVA, d.h. Versagen aller baugleichen, redundanten Komponenten einer Gruppe infolge gemeinsamer Ursache sind eine wichtige Untermenge dieser erfassten Ereignisse. Derzeit werden Ereignisse an folgenden Komponenten erfasst: Kreiselpumpen, Notstromdiesel, motorbetätigte Armaturen, Sicherheits- und Abblasventile, Rückschlagarmaturen, Komponenten des Reaktorschutzes (wie z. B. Füllstandsmessungen, Steuerstabantriebe usw.), Leistungsschalter und Batterien. Ein wesentlicher Befund der bis 2005 veröffentlichten ICDE-Berichte weist im Mittel über alle Komponenten aus, dass etwa zwei Drittel aller aufgetretenen vollständigen GVA-Ereignisse im Zusammenhang mit fehlerhaften Handlungen von Anlagenpersonal oder Personal externer Auftragnehmer standen. Dabei liefern falsch durchgeführte Test- oder Wartungsarbeiten infolge fehlerhafter und/oder unvollständiger Prozeduren den größten Einzelbeitrag. Weitere wichtige Ursachen bilden unzureichende Funktionstests an Komponenten oder Systemen nach Wartung, Reparatur, Umbau oder Nachrüstungen, sowie Fehler bei der Ausführung von Personalhandlungen. Die Wahrscheinlichkeit, dass ein gemeldetes ICDE-Ereignis ein vollständiger GVA ist, nimmt mit zunehmender Größe der Redundanzgruppen stark ab, was belegt, dass Redundanz an sich eine starke Verteidigung gegen GVA darstellt. Allerdings können vollständige GVA auch durch hohen Redundanzgrad allein nicht vollständig vermieden werden.
References
1Baranowsky, P.; Rasmuson, D.; Johanson, G.; Kreuser, A.; Pyy, P.; Werner, W.: General Insights from the International Common Cause Failure Data Exchange (ICDE) Project. Paper presented in PSAM 7 Conference, Berlin, June 200410.1007/978-0-85729-410-4_12Search in Google Scholar
2NEA/CSNI/R(99) 2. ICDE Project Report on Collection and Analysis of Common-cause Failure of Centrifugal Pumps. Eds.: Werner, Wolfgang; Johanson, Gunnar. February 2000Search in Google Scholar
3NEA/CSNI/R(2000) 20. ICDE Project Report on Collection and Analysis of Emergency Diesel Generators. Eds: Wierman, T. E.; Rasmuson, D. M.; Marshall, F. M. February 2001Search in Google Scholar
4NEA/CSNI/R (2001) 10. ICDE Project Report on Collection and Analysis of Common-Cause Failures of Motor Operated Valves. Eds.: Kreuser, A.; Schulze, V. and Tirira, J. July 2001Search in Google Scholar
5 NEA/CSNI/R(2002) 19. ICDE Report on Collection and Analysis on Safety and Relief Valves. Eds.: Jonsson, Esther; Johanson, Gunnar; Pesonen, Jari; Jänkälä, Kalle and Werner, Wolfgang. October 2002Search in Google Scholar
6 NEA/CSNI/R(2003) 15. ICDE Project Report on Collection and Analysis of Common-Cause Failures of Check Valves. Eds.: Theiss, Klaus; Hessell, Philippe and Werner, Wolfgang. SAC. September 2003Search in Google Scholar
7 NEA/CSNI/R(2003) 19. ICDE Project Report on Collection and Analysis of Common-Cause Failures of Batteries. Eds.: Pereira, BegoZa; Morales, Rosa; Cid, Rafael; García Vera, José; Oxberry, Anna and Werner, Wolfgang. December 2003Search in Google Scholar
8 OECD NEA, ICDE General Coding Guidelines, CSNI Technical Note, NEA/CSNI/R(2004) 4. July 2004Search in Google Scholar
© 2006, Carl Hanser Verlag, München
Articles in the same Issue
- Contents/Inhalt
- Contents
- Summaries/Kurzfassungen
- Summaries
- Editorial
- Common cause failure analysis within the framework of probabilistic safety assessment
- Technical Contributions/Fachbeiträge
- Updated requirements on PSA methods and data for comprehensive safety reviews in Germany
- OECD/NEA International Common Cause Failure Data Exchange (ICDE) Project – insights and lessons learnt
- Protection against dependent failures, analysis of dependencies and derivation of CCF data
- Extension of the German database for common cause failure events
- International network on incorporation of ageing effects into PSA
- CCF analysis for new reactor designs
- CCF treatment in PSA: insights and recommendations from reviewing procedures
- Is mapping a part of common cause failure quantification?
- Further development of the coupling model
- The Process-Oriented Simulation (POS) model for common cause failures: recent progress
- CCF analysis in PSA applications from a licensee view
- Notes
- Radiation protection of outside workers
- Technical Contributions/Fachbeiträge
- Occupational exposure to natural radiation
Articles in the same Issue
- Contents/Inhalt
- Contents
- Summaries/Kurzfassungen
- Summaries
- Editorial
- Common cause failure analysis within the framework of probabilistic safety assessment
- Technical Contributions/Fachbeiträge
- Updated requirements on PSA methods and data for comprehensive safety reviews in Germany
- OECD/NEA International Common Cause Failure Data Exchange (ICDE) Project – insights and lessons learnt
- Protection against dependent failures, analysis of dependencies and derivation of CCF data
- Extension of the German database for common cause failure events
- International network on incorporation of ageing effects into PSA
- CCF analysis for new reactor designs
- CCF treatment in PSA: insights and recommendations from reviewing procedures
- Is mapping a part of common cause failure quantification?
- Further development of the coupling model
- The Process-Oriented Simulation (POS) model for common cause failures: recent progress
- CCF analysis in PSA applications from a licensee view
- Notes
- Radiation protection of outside workers
- Technical Contributions/Fachbeiträge
- Occupational exposure to natural radiation