APSA in risk informed applications

State of the art report Part 4

List of Contents

4. Incorporating Ageing effects into PSA models ......................... 2

4.1 Introduction..................................................................... 2 4.2 PSA models, basic assumptions and questions............... 2 4.3 Main steps to incorporate ageing effects ........................ 5

4.3.1 Alternatives of an APSA scope or purpose...............................................6 4.3.2 Selection of ageing SSCs/mechanisms .....................................................7 4.3.3 Active versus passive components............................................................8 4.3.4 Modifications of both parameter values and PSA model structure .........9

4.4 Various approaches to quantitative modeling............... 13 4.4.1 Limited-scope APSA on the basis of Taylor expansion .........................13 4.4.2 General Modeling of Aging Issues .........................................................14 4.4.3 An Average or Time-dependent age-related failure probability.............16 4.4.4 Full-scope APSA including ageing-physics PSA models ......................17

5. Discussion of ageing impact to NPP’s safety ......................... 19 5.1 Ageing PSA insights..................................................... 19 5.2 Results example of the CCW and RHR systems

assessments ................................................................... 21 5.3 Maintenance program evaluation.................................. 21

5.4 Conclusions...................................................................... 22 References ............................................................................. 23

Figure 4-1: Incorporating ageing effects into PSA /4-2/ ………………. 4 Figure 4-2 -Incorporation of the ageing into APSA case study ([2], Fig14) ………………………………………………………………….. 5

1

4. Incorporating Ageing effects into PSA models 4.1 Introduction The current standard PSA tools do not adequately address important ageing issues, which could have a significant impact on the conclusions made with support of PSA applications. Lack of treatment of ageing issues with respect to advanced NPP ageing represents one of the aspects, which could have significant impact on the practical use and credibility of PSA tools and following decision-making. Incorporation of ageing effects into PSA models would also increase the credibility of PSA applications especially in advanced age operation and in plant extended operation and enhance then their capability to practically support safety related decision making in sense of treatment ageing effects on risk assessment results. Explicit consideration of the risk effects of ageing is an important feature of ageing risk assessment evaluation. By this considering the risk effects of ageing and ageing contributors can be prioritized according to their risk importance and ageing management activities can thereby be focused on important areas and the ageing management strategies can be made cost effective. Ageing contributors should include then both active and passive components, which are susceptible to ageing. 4.2 PSA models, basic assumptions and questions As a main basic assumption, current PSA methods and resulting PSA studies assume that initiating event frequencies as well as component failure rates are constant in time. It is not so clear for which type of components this assumption might be acceptable under certain conditions and for which it clearly results in under-estimation of risk due to equipment ageing. Effects from passive components are essentially limited in current PSA models to the treatment of pipe breaks and various damage and fragility models used for external events. Most recent work in developing estimates for piping system failure rates is based on service data with piping failures due to various degradation mechanisms /8/. However, the assumption that pipe breaks are dominated by degradation mechanisms is inconsistent with the assumption of constant failure rates. Further, it is evident from recent work that there are uncertainties in the existing models for predicting the degradation rates and failure modes

2

of degradation mechanisms of passive components, see e.g. /4-1,4-9/. This issue is of particular importance for example in RI-ISI applications that attempt to introduce such models in to characterize the failure rates of piping system components. Ageing degradation mechanisms may be divided in two groups based on resulting failure modes: those that may cause rupture and those that may cause cracking. For example radiation embrittlement, thermal ageing of cast stainless steel components and vibratory fatigue of small diameter piping may cause rupture. Low-cycle fatigue, high cycle thermal fatigue and stress corrosion cracking of components may cause cracking. The mechanisms that have potential to cause rupture are likely to have significantly more risk impact and are candidates to be incorporated into more realistic APSA models /1/. In summary,

• the effects from equipment ageing would not be completely addressed by models that are based on the current PSA structure and current PSA failure rates.

• It is not clear in which cases the current simplifications are sufficient and in which not (both for active and passive components).

• Active or passive components that the basic PSA model neglect, as having very small failure probabilities and the principal degradation mechanisms, e.g. fatigue, embrittlement and erosion-corrosion, must be also considered in appropriate way, see Figure 4-1 /2/ for illustration.

• When incorporating ageing effects into PSA a cost effectiveness should be also taken into account

3

Figure 4-1: Incorporating ageing effects into PSA /2/

4

Selection of Aging SSCs/Mechanisms

Expert Opinion

Operating Experience

List of Selected SSCs/Mechanisms

Fatigue Embrittlement Corrosion/Erosion

Other Aging Mechanisms

Inspection, Test, Maintenance

Probability of Failure Modelling Aging Mechanisms

PSAPlant Information

Event TreeAnalysis

Fault TreeAnalysis

PSA Results

4.3 Main steps to incorporate ageing effects This section is focused at the task how to use given plant-specific PSA to quantify and prioritize plant ageing mechanisms of interest with currently available software tools and models. There are several useful studies on the incorporation of ageing effects since the year 1990, e.g. [1] to [4]. The four major findings of the NUREG/CR-6157, [2], may be briefly formulated as:

1. Issues of ageing cannot be addressed by models that are based solely on the current PSA structure and failure rates.

2. Probabilistic ageing models allow the effective use of a variety of ageing information (in addition to just failure events).

3. Probabilistic ageing models allow for risk management studies to be performed since the model incorporate specific ageing related stressors.

4. The methodology can build upon existing PSA models. In [4-1], there is described the APSA case study to adress these findings. The framework of this study is given in the figure below. The study started with information gathering of relevant ageing mechanisms along with the selection of an appropriate, existing PRA/PSA model. The PSA model was modified to include important passive (or other) components not currently in the model. In parallel with the PSA model adjustment, probabilistic ageing models were utilized to determine proper inputs into the PSA and links of the ageing reliability-physics models into the PSA for an overall risk management framework.

Figure 4-2 -Incorporation of the ageing into APSA case study ([2], Fig14)

5

Thus, an integrated ageing risk analysis encompasses the following three main steps:

I. Selection of ageing SSCs/mechanisms II. Modeling ageing mechanisms III. Modification of PSA parameters/models and calculation of PSA results

In addition, the following issues should be taken into account: /10/

♦ the system fault trees need to be developed in sufficient level of detail, to permit the modelling of ageing effects

♦ the modelling of passive component failures in the system logic should be included and improved in order to allow sensitivity evaluations

♦ component unavailability should include age dependent failure contributors

♦ component test and maintenance models should include the effects of test and maintenance in terms of “good as old” and “good as new” cases, and should include replacements and renewals of components

♦ any additional dependency caused by age related degradation of components and structures should be included

♦ appropriate computer packages should be used 4.3.1 Alternatives of an APSA scope or purpose There are several important practical issues or the purpose/scope alternatives to be decided in the process of incorporation of the ageing effects on interest into PSA model to evolve some given plant-specific PSA to an APSA model:

1. limited-scope APSA, e.g. to investigate only ageing of some specific system, or

only of limited set of component, to cover only some specific ageing effect/failure/mitigation

mechanisms, to cover impact only on active components, or to modify only values of affected PSA parameters

(without adding any new basic event nor initiator)

2. full-scope APSA: to investigate all related systems, structures, and

components (SSCs) at given plant, to model all important ageing effect/failure/mitigation

mechanisms, to cover impact on both active and passive components,

and modify only values of accected PSA parameters as well

as the PSA model structure when necessary

6

3. APSA quantitative results of interest

time-dependent total risk indices (or time-dependent contributions to them)

time-averaged total risk indices (or average contributions to them)

4. APSA qualitative results of interest rank investigated items (ageing effect impacts, specific

failure modes, specific set of components) according their importance to the risk index (risk indices) of interest

4.3.2 Selection of ageing SSCs/mechanisms As noted in [2]: “Probabilistic structural analyses and fracture mechanical analyses are difficult and costly to perform. Therefore, evaluating every single component in a plant would be extremely expensive. Identifying all input parameters (stresses, material, properties, etc.) for a given component is often difficult and subjected to variation. In addition to the analytical complexity, data gathering also involves a major effort, particularly when projecting the effects of ageing in the future. Simplified method that screen out less risk-significant components and prioritize the most risk-significant ones would be very useful in this context. The time-consuming probabilistic structural-analysis techniques or fracture mechanical analysis then could be used for those selected components for which detailed evaluation is necessary.” The selection of ageing components and mechanisms for further investigation should be based on two categories of criteria: risk-based and reasonable assurance. The risk-based criteria are to ensure that resources are spent on areas of risk significance, and the reasonable-assurance criteria are to ensure that items of large uncertainty get proper attention. There are three tool that can be used in the screening process: engineering judgment, operating experience, and risk-significance analysis. Engineering judgment will be used as a vital resource in the screening process pf the ageing-risk analysis, especially for identifying components for which the current knowledge involves large uncertainty. Failure modes of components of a passive nature are more likely to fall into this group because of the lack of data. For components so identified, more detailed analyses will be needed to be reasonably sure of their reliability. A second tool that can be used for screening is the analysis of operational experience. In data are sufficient for making statistical inference, statistical data analyses also can be used to determine time-dependent failure probability parameters in risk evaluation. Unfortunately, related studies have shown that existing data sources are not sufficient for statistically validating

7

the existing ageing models. The uncertainty level remains high in the estimate of failure rates and in the rate-of-change of failure rates. Risk-significance analysis also can be used in the screening process. This approach uses information gained from existing risk analyses to estimate the risk significance of plant components. Risk significance will be considered in terms of both frequency and consequences of component failures. Limited sensitivity analysis can be conducted to estimate the ranges of risk significance. This technique will be used to screen out a significant number of components for which the consequences are too low to be worthy of further analysis. 4.3.3 Active versus passive components Typical core damage frequency models generally focus on the possible failures of active components. The possible failures of passive components is given little consideration except incorporation their failures as a part of some initiating event. Traditional probabilistic risk assessments do not include passive systems, structures, and components since they are much more reliable than the active components. Ageing phenomena, however, may make passive SSCs less reliable than assumed. Further, operation of power plants over durations of decades may lead to degradation of material properties and component strength, and eventually, if not mitigated, to ageing-related failures. There are three ways to incorporate passive components into a PSA. The first way, the straightforward one which is not easy to implement, is to add the component to the model and treat it with standard PSA approaches. In some cases, new initiating events may have to be added and new sequences of events considered. The second way, which is much simpler to implement, is to identify active components which are included in the current PSA analysis to serve as surrogates for the corresponding passive component. The failure probabilities of these active components are increased to account for the contributions from the corresponding passive components. The third way involves a system-level approach which calculates the risk contributions for a particular component as a product of the risk significance of the system and the failure probability of the component. This approach can be implemented relatively easily but (1) it does not directly account for interaction of multiple ageing components; (2) it is over conservative because of its main assumption that failure of a passive component in a system fails this system; (3) it calculates approximately the same risk significances for the components within the system, while they can be considerably different.

8

4.3.4 Modifications of both parameter values and PSA model structure The case study described in the report [1] gives detailed discussion on the possible extent of necessary PSA parameters/structure modifications. The PSA parameters that may be affected due to ageing impacts are listed in Table 4-1. The ageing-caused impacts to the structure of a PSA are listed in Table 4-2. For each tabulated item, a note is made to indicate whether or not it was necessary to model the ageing-caused impact in the case study. Information is also provided for each item to lend insights as to why (or why not) impacts for a particular PSA parameter/model is to be investigated.

9

Table 4-1 - Ageing-caused impacts to PSA parameters (cont.) Category Treated

in [1] Note

Component Basic Event Probabilities

Failure rates Yes As a function of a physical ageing model (e.g., corrosion, fatigue, stress corrosion cracking), component failure rates can be affected. Also, the possibility of conditional ageing-related failures needs to be investigated (e.g., failure given initiator, initiator given failure).

Mission times No The basic event mission times are determined by decay heat removal times, recovery and isolation times, arrival rates of offsite resources, etc. Ageing could affect some of these parameters, but it is expected to be a secondary impact on core damage frequency. As such, this parameter is not evaluated.

Repair times and maintenance durations

No The repair times and maintenance durations could be affected by ageing. Assumed plant operational practices for repair and maintenance should be incorporated into the plant PRA model where appropriate.

Testing intervals No The test intervals and duration could be affected by ageing. Assumed plant operational practices for testing should be incorporated into the plant PRA model where appropriate. Related to testing intervals is the positive benefit from inspections. Many ageing mechanism may be managed (i.e., reduce the risk) by proper inspections. These inspections should be credited in the analysis when possible.

Common Cause Failure Modeling

Dependent failures

Yes It is assumed that the total failure rate for a component could be affected by ageing impacts. The ageing-affect on the allocation of failures (e.g., the beta, gamma, delta parameters for the Multiple Greek Letter model) is not known and is not within the scope of the analysis. Dependent failures that arise due to a common ageing mechanism such as FAC are included in the study.

10

Table 4-2 - Ageing-caused impacts to the structure of a PSA (see [1], Table 9)

Category Treated

in [1] Note

Initiating Events

New initiators Yes The possibility exists to have “new” initiators become important that may have been previously excluded due to low likelihood. Examples could include pipe break or flooding scenarios that were thought to be unlikely. The quantification of the new initiating event frequencies and their subsequent inclusion into existing initiator groups is important and is addressed.

Initiator assumptions

No Since ageing could incorporate failure modes or mechanisms not previously addressed, it is important to review the existing PRA initiator assumptions. Initiators that have been grouped (e.g., transients, main steam line break) may need to be broken out.

Consequential events

Yes Consequential events could be important given the potential for safety system degradation in conjunction with internal flooding. For example, rupture of feedwater piping may impact other important systems due to localized flooding.

Event Trees

Sequence timing issues

No Ageing affects on batteries, seals, etc., could affect multiple basic events that rely on timing considerations (e.g., recovery actions) as part of an accident sequence.

Sequence ordering and success criteria

Yes The accident sequence events will need to be reviewed to ensure that ageing affects will not change the attributes of the sequence.

Intersystem dependencies

No Intersystem dependencies may need to be added to the PSA model to better treat ageing effect. For example, poor water chemistry control may affect multiple piping segments in more than one location.

11

Table 4-2 - Ageing-caused impacts to the structure of a PSA (cont.) Category Treated

in [4-1] Note

Fault Trees

Incorporating of passive components

Yes The fault tree logic should be changed to represent new basic events (e.g., passive components) important to the feasibility study. Examples could include reactor vessel and piping events.

Changes to lower logic structure

Yes Other changes to fault tree logic (e.g., change in success criteria due to heat transfer capacity or pressure capacity changes) will be made to incorporate the physical ageing models that are used.

Additional maintenance/testing

No While ageing of components may result in changes to maintenance and testing practices, these types of effects will not be explored as part of this feasibility study. Note that the analysis performed in this report does not credit maintenance or testing on passive components before potential failures. A larger-scope assessment should credit maintenance and testing where appropriate.

New common cause failure mechanisms

Yes

Dependent failures may be modeled as part of the fault tree adjustment to incorporate the passive components. For example, failure of a piping header may defeat redundant trains of a safety system.

Previously ignored failure mechanisms

Yes If an ignored failure mechanism become evident during the analysis, it should be added. The feasibility study will not attempt to identify new failure mechanisms, but ageing mechanisms are, in general, not accounted for in current PRA models.

Other

Plant damage state definitions

No The feasibility study scope of work stops at the definition of core damage.

Binning of Level 1 sequences

No The feasibility study scope of work stops at the definition of core damage.

Treatment of non-dominant sequences

Yes If non-dominant sequences become more important, the applicability of existing recovery rules and logic modeling will have to be evaluated.

12

4.4 Various approaches to quantitative modelling As mentioned above, there are two basic approaches to APSA calculations, the first one is a limited-scope study, where the incorporation of ageing effects impacts only some PSA parameters, in contrast to the second one where both PSA parameters and the PSA model structure is to be modified. An example of the first approach is described in the next section. 4.4.1 Limited-scope APSA on the basis of Taylor expansion The approach described in this section utilizes a Taylor expansion to separate the PSA models and the ageing models, allowing available PSAs to be efficiently used in calculating ageing effects.

The Taylor expansion of an infinitely differentiable real function f defined on an open interval (a − r, a + r) is the following power series

Here, n! is the factorial of n and f (n)(a) denotes the nth derivative of f at the point a. The Taylor expansion may be [4-6] generalised to functions of more than one variable with

This expression may be simplified a lot in case that the risk index of interest, denoted below as the R, is equal to the value of Core Damage Frequency (CDF), or of other function, generated by the help of the Boolean algebra from the set of basic events, characterized by their occurrence parameter denoted below as the qi. After the model conversion to the form of minimal cut sets (MCSs) the expression for the R becomes a multi-linear form. It follows that each partial derivative (∂ ni / ∂ xi

ni) in the Taylor expansion above becomes zero when ni >1. Thus, to calculate an impact of ageing effects on the value of R, i.e. to obtain the value of the R(q1+∆q1, q2+∆q2, ..., qd+∆qd) from the R(q1,q2,...,qd) value without ageing effects, we can use the following form of Taylor expansion: ∆R = R(q1+∆q1, q2+∆q2, ..., qd+∆qd) - R(q1,q2,...,qd) = = ∑ Si ∆qi + ∑ Si j ∆qi ∆qj + ∑ Si j k ∆qi ∆qj ∆qk + ... + S123...d ∆q1 ∆q2 ... ∆qd i i>j i>j>k

13

where the set of “sensitivity coefficients” Sx is given by the following relations: Si = ∂ R(q1,q2,...,qd) / ∂ qi

Si j = ∂ 2 R(q1,q2,...,qd) / (∂qi ∂qj ) , etc. Remark:

When limited to the first two sums, the values of the Si, Si j partial derivatives can be computed either by means of some numerical way, e.g.

Si = [ R(q1,..., qi+δqi,...,qd) – R ] / δqi

Si j = [ R(q1,..., qj+δqj,..., qi+δqi,...,qd) – R ] / (δqi δqj)

where R= R(q1,...,qd), and δqi, δqj are some suitable small numbers, or via the following MCSs considerations: Si = (1 / qi) * ∑ all MCSs, where the i-th basic event is present = = [ R - R(q1,...,qi = 0, ...,qd) ] / qi Si j = [1/(qi qj)] * ∑ all MCSs with both i-th and j-th basic event present= = [Si *qi + Sj *qj + R(q1,..., qj = 0, ...,qi = 0, ...,qd) – R ] / (qi qj)

The next step in quantitative modeling is how to obtain the set of the ∆qi values. 4.4.2 General Modelling of Ageing Issues Ageing issues such as intergranular stress corrosion cracking (IGSCC) and flow accelerated corrosion (FAC) are complex, multi-parameter phenomena, and the susceptibility of a given site or SSC cannot be determined by considering only a few parameters. Even though ageing models can predict observed results fairly well in some cases, such calculations are subject to large uncertainty. Since the development of detailed ageing models based on reliability physics is still in its infancy,[4-1] and chapter 3, an approximate model that modifies the failure rate directly has been proposed [4-7]. The time-dependent failure rate of a component is written as

λ(t) = λ0 + a * t

14

where λ(t) = total component failure rate, λ0 = component failure rate due to “random” failures, a = ageing related factor (or Ageing Rate), t = component age.

The linear failure rate model shown above assumes that the total failure rate, λ (t), is the sum of random failures, λ0, and ageing, a*t. Remarks (quoted from [1]):

This assumption of linearity in time has been questioned; in fact, it is shown in the NUREG/CR-6157, [2], that the failure mechanisms discussed earlier do not necessarily lead to failure rates that are linear in time.

A general drawback of the linearly-increasing failure rate model,

equally shared by the other reliability distributions that have been proposed in the literature [2], is that the model essentially represents a parametric approximation, made at a relatively high level, of failure processes and mechanisms that usually have a rather complex physical behavior.

Thus, although a particular parametric reliability distribution may

adequately fit the available failure data, it will always constitute a drastic simplification when examined from the point of view of the underlying physical phenomena. The obvious danger under these conditions is that a careless or superficial choice and application of parametric reliability models may obscure the understanding of the role played by important physical processes and may inhibit the management of ageing.

In 1986, the U.S. NRC established the TIRGALEX (Technical Integration Review Group for Ageing and Life Extension) to structure a plan to integrate the NRC's ageing and life-extension activities. One of the major results of the TIRGALEX plan has been the identification of the safety-related structures and components that should receive high priority in the subsequent phase of the NPAR program. The TIRGALEX expert panel utilized a set of risk criteria to set priorities in the evaluation of ageing structures and components. The same data set used in this process (now called the TIRGALEX database) was also used as the database in later PRA studies under NPAR program. An example taken from the TIRGALEX database is given in the table below:

15

Table 4-3 - The TIRGALEX value of Ageing Rate (adopted from [3], Table 1)

Component

Ageing Rate “a” (in Units of Per Hour Per Year)

AC bus 1E-09 Air-operated valve 4E-07

Battery 3E-07 Check valve 4E-09

Circuit breaker 2E-08 DC bus 1E-09

Diesel generator 4E-06 Fan 2E-07

Heat exchanger 1E-08 Motor-driven pump 2E-07

Motor-operated valve 4E-06 Power-operated relief 7E-07

Relay 3E-07 Safety/relief valve 7E-07

Transformer 2E-09 Turbine-driven pump 3E-06

4.4.3 An Average or Time-dependent age-related failure probability To evaluate core damage frequency, a maintenance and surveillance program needs to be characterized by its overhaul intervals and surveillance intervals which apply to each component. Overhauls and surveillances have specific reliability definitions as applied to ageing evaluations. At an overhaul, the component is renewed of ageing effects, and the component age is basically reset to zero (“good as new”). At a surveillance, the component is assured to be in an operational state, however the component age is not reset to zero; the component age is similar to what it was before the surveillance (“good as old”). When a component is periodically overhauled, or is renewed, at intervals of L with no intermittent checking for ageing effects, then ∆q(L) at the end of the overhaul interval is given by the formula L L

∆q(L) = exp(- ∫ dt) - exp( - ∫ (λ + at)dt ) 0 0 or, to first order,

∆q(L) = ½ a L2

16

The corresponding average unavailability, ∆q, over the overhaul interval is, to first order,

∆q(L) = (1/6) a L2 The overhaul, or renewal, interval, L, at which the component is restored to essentially as good as new with regard to the pertinent failure modes in the PSA. When surveillance is performed at effective intervals of T, and overhauls (renewals) are performed at effective intervals L, the change in unavailability ∆q(t0, u) is then given by t0+u

∆q(t0, u) = 1 - exp( - ∫ λ( t') dt' ) t0 The time t0 is the time of the last surveillance test measured with regard to the point of last overhaul. The value u ranges from 0 to T. Using the linear ageing model and the linear term of the exponential, ∆q(t0, u) is then approximately given by the formula t0+u

∆q(t0, u) = ∫ a t' dt' = ½ a (2 t0 * u + u2) t0 Averageing u between 0 and T gives the average unavailability change ∆q(t0) at t0, thus ∆q(t0) = ½ a [t0 T + T2/3] Finally treating to as a continuous variable and averageing ∆q(t0) over t0=0 to t0 = L - T (since the last surveillance test is at L - T), gives the overall average unavailability, ∆q as

∆q = ½ a [(L – T/2) * T + T2 / 3] 4.4.4 Full-scope APSA including ageing-physics PSA models Differences between traditional PSA study and full-scope APSA including ageing-physics PSA models are illustrated in the following table:

17

Table 4-4 - Comparison of traditional PSA to a study with ageing-physics PSA models (according to [1], Figure 1)

Traditional PSA Ageing Physics Model PSA 1. Obtain component failure data (active components), generic data, or combination of both

1. Determine applicable ageing mechanisms and affected components

2. Determine appropriate component reliability model (e.g. 1-exp(-λ*t) )

2. Develop “ageing physics” model

3. Use statistics (e.g. Bayes) to determine appropriate failure rate

3. Determine loading condition on component

4. Calculate component failure probabilities

4. Incorporate physics model and loading conditions into PSA via fault/event trees

5. Put probabilities into fault/event trees

5. Use physics model to determine ageing-related probabilities

18

5. Discussion of ageing impact to NPP’s safety 5.1 Ageing PSA insights The performed ageing assessments with application of PSA models enable :

• to evaluate the component ageing impact to the unavailability of the safety systems,

• to extrapolate the system unavailability curves to the end of plant lifetime,

• to evaluate an increasing of core damage frequency due to the ageing of safety important components and structures,

• to propose optimal periodical test and preventive maintenance intervals for active and passive components.

Performed sensitivity studies shows that the core damage frequency could increase significantly due to the ageing degradation of components : from 10 to more then 1000% of increasing by year in operation [4]. This impact strongly depends from the data considered to estimate the ageing model parameters, from the periodical tests frequency and from the maintenance Intervals and the level of renovation of the component during the maintenance.

At the system level, the main results of an Ageing PSA are the following :

• the system unavailability is expected to increase with age,

• components relative importance may change with age, so the components considered highly reliable may have an increasing contribution to the unavailability with age, that might become significant to the end the plant of lifetime,

• passive components that are not taken into account in the fault tree models of classical PSAs may have an increasing contribution to the unavailability with age.

If the failure rate of a component increases more rapidly with age than other components, the relative importance of that component may change. The effects of ageing could, therefore, make a component with an initially low relative importance become more important as the system ages, Figure 5-1, 5-2.

19

1

10

100

0 5 10 15 20 25 30 35 40 45 50

REL

ATI

VE IM

POR

TAN

CE,

%

mov's pressure sensors mov maintenance sensor calibration

BASED ON EXPTRAPOLATED FAILURE DATA

Figure 5-1. RHR system’s component importance changing with plant age.

0

20

40

60

80

100

0 10 20 30

SYSTEM AGE(YEARS)

REL

ATI

VE IM

POR

TAN

CE,

40

%

CCW VALVES SW VALVES PUPMS HX'S

Pumps

CCW Valves

Figure 5-2. CCW system’s component importance changing with plant age.

20

5.2 Results example of the CCW and RHR systems assessments

The overall unavailability of the RHR system, based on a linear extrapolation of the failure rates, was found increased by a factor between 1.7 and 3.5 depending of operating mode, over a 50-years time period. The unavailability calculations performed for the RHR system have shown the effects of ageing on the importance of various components, especially for the motor-operated valves. Thus, the importance of motor-operated valves was found to increase from 37 % to 70 % over a 50-years time period. The unavailability calculations performed for the CCW system have shown that the CCW pumps become more and more important over 40 years, until they become dominant at 81 % in year 40. Comments Due to plants and systems complexity, ageing analysis was not applied to all components of CCW and RHR systems. Groups of components were selected on the basis of their importance to safety and of the effects of ageing on their reliability. The non-aged importance of the components were calculated using a current PRA in order to select the components on which to focus the ageing analysis. An Ageing Failures Modes and Effects Analysis (AFMEA) was used in conjunction with an ageing data analysis to provide the ageing failure rates of the selected components. The results were feed back into the computerized PRA model for a second iteration to calculate new importance measures that take the effects of ageing into account. If new the importance result provides a difference in the prioritization of the components, the ageing FMEA is repeated and new age-dependent failure rates are calculated until they are determined to be valid.

5.3 Maintenance program evaluation

As an important part of ageing risk assessments, the effects of maintenance and surveillance programs in controlling ageing are quantified. To demonstrate the methodology, two PSAs, one PWR and one BWR, were used to calculate the increase in core melt frequency caused by ageing for given ageing data and for assumed surveillance and maintenance programs [4]. Calculated core melt frequency increasing values are different for the different surveillance and maintenance programs. When core melt increasing value are high for a surveillance and maintenance program, then examination of the detailed ageing contributors shows that relatively few components contribute. This implies that a « prioritized » maintenance program can effectively control the core melt frequency increase due to the ageing.

21

Specific study to identify optimal in-service test interval for the check valves was performed [12]. The main assumption used in the study is about different degrees of component restoration due to the maintenance. Check valves unavailability was used as a parameter to optimize. It was found that in-service test interval between 2 and 3 years will be near optimal in providing minimal unavailability for assumed range of check valve ageing rates.

5.4 Conclusions

The results of the examined studies show that :

• PSA could be applied to evaluate ageing impact to the safety important systems unavailability as well as to the global safety of the NPP,

• several reliability models are available to introduce the ageing effects into the PSA models,

• estimation of the reliability model parameters requires the raw data analysis especially for failure data, periodical tests and maintenance data, stress and loads affected the components in real operation.

22

References [1] C. L. Smith, V. N. Shah, T. Kao, G. Apostolakis, 2001. Incorporating Ageing Effects into Probabilistic Risk Assessment — A Feasibility Study Utilizing Reliability Physics Models, NUREG/CR-5632, USNRC [2] Sanzo, D. P. Kvan, G. Apostolakis, J. Wu, T. Milici, N. Ghoniem, and

S. Guarro, 1994. Survey and Evaluation of Aging Risk Assessment Methods and Applications, NUREG/CR-6157

[3] Vesely, W.E., Incorporating Aging Effects into Probabilistic Risk Analysis using a Taylor Expansion Approach, Reliability Engineering and System Safety, 32 (1991) 315-337 [4] Vesely, W. E., R.E. Kurth, and S.M. Scalzo, 1990. Evaluation of Core Melt Frequency Effects Due to Component Aging and Maintenance,

NUREG/CR-5510 [5] Meyer, L. C., 1989. Nuclear Plant Aging Research on High Pressure

Injection Systems, NUREG/CR-4967 [6] http://en.wikipedia.org/wiki/Taylor_series [7] Vesely, W. E., 1987. Risk Evaluation of Aging Phenomena: the Linear Aging Reliability Model and Its Extension, NUREG/CR-4769 [8] Poloski, J. P., et al., “Rates of initiating Events at U.S. Nuclear Power

Plants: 1987-1995“, NUREG/CR-5750, February 1999. [9] Fleming, K.N., “Issues and Recommendations for Advancement of

PRA Technology in Risk-Informed Decision Making“, NUREG/CR-6813, April 2003.

[10] IAEA TECDOC-740, Modelling and data prerequisites for specific

applications of PSA in the management of nuclear plant safety, Vienna, April 1994

[11] Rodionov, Incorporating Ageing effects into PSA applications (IRSN contribution into JRC Network on Incorporating Ageing Effects into Probabilistic Safety Assessment (APSA)), 2005 [12] Vesely, W., Poole, A., Jackson, J., Component unavailability versus Inservice Test Interval (ITI) :evaluation of component aging effect with applications to check valves. NUREG/CR-6508. US NRC, July 1997

23