ML19239A261
| ML19239A261 | |
| Person / Time | |
|---|---|
| Issue date: | 12/31/2015 |
| From: | Paul Rebstock NRC/RES/DE/DICB |
| To: | |
| Rebstock P | |
| References | |
| Download: ML19239A261 (10) | |
Text
DG-1363 Nonconcurrence Support Documents Caveats and Limitations Concerning Documents Released to the Public Limits on Interpretation and Regulatory Significance THE DOCUMENT TO WHICH THIS NOTICE IS ATTACHED HAS NOT BEEN ISSUED, APPROVED, OR ENDORSED BY THE UNITED STATES NUCLEAR REGULATORY COMMISSION.
THE SUBJECT DOCUMENT PRESENTS THE IMPRESSIONS AND OPINIONS OF THE AUTHOR AS OF THE TIME OF ITS PREPARATION, CIRCA 2015.
THE SUBJECT DOCUMENT HAS NO REGULATORY SIGNIFICANCE.
The United States Nuclear Regulatory Commission (NRC) has issued revision 4 to regulatory guide 1.105 (RG 1.105), Setpoints for Safety-Related Instrumentation, (Agencywide Document Management System (ADAMS) Accession No. ML20330A329). The NRC issued draft regulatory guide (DG)-1141 (ADAMS Accession No. ML081630179) in June 2014, as proposed revision 4 of RG 1.105. Interested persons and organizations outside the NRC submitted a substantial number of comments concerning DG-1141. NRC staff prepared draft responses to all of the comments, and updated the draft regulatory guide in preparation for final issue. In anticipation of a significant revision to the industry standard associated with the regulatory guide, the American National Standards Institute (ANSI)/International Society of Automation (ISA) Standard 67.04.01, Setpoints for Nuclear SafetyRelated Instrumentation, the NRC terminated all efforts related to DG-1141 and to the comments provided in response to it. The revised regulatory guide and comment responses related to DG-1141 were not issued. After the revised standard was issued, the NRC produced DG-1363 (ADAMS Accession no. ML20055G823), a second draft of revision 4 to RG 1.105. The issued revision 4 to RG 1.105 is based on DG-1363 rather than on DG-1141.
The principal author of DG-1141 indicated disagreement with two specific aspects of DG-1363, and documented the disagreement in a nonconcurrence statement. The nonconcurrence statement is available in ADAMS, at Accession No. ML20181A524. The nonconcurrence lists several reference documents that were not, at the time, available for public access. The NRC has determined that those documents should be made available to the public, with minor modifications to ensure that they are not interpreted as NRC policy or positions.
The document to which this notice is attached is one of the documents cited in the nonconcurrence statement, and has been modified and released for public access as described above. The changes to the document as released for public access, as compared with the document as it existed at the time of the nonconcurrence, are not germane to the nonconcurrence.
October6,20161:33PM 9595andSSS page1of9 D R A F T D R A F T D R A F T SETPOINTS FOR SAFETYRELATED INSTRUMENTATION Draft Regulatory Guide DG1141: Proposed Revision 4 to Regulatory Guide 1.105 InDepthAnalysisofSelectedPublicComments 95/95andSingleSidedSetpoints Introduction Several comments express concern over the application of the statistical 95/95 criterion1 to setpointrelated uncertainty data. In addition, several comments indicate that SingleSided Setpoints2 (SSS) should be accepted, or, equivalently, that a 5% probability of an actual trippoint (ATP) in excess of the Analytical Limit (AL) should be considered acceptable. Some comments assert that past guidance has indicated that a probability of 5% is already acceptable, or that such a condition has already been accepted by the NRC in specific applications.
Both of these considerations failure to meet the 95/95 criterion, and acceptance of SingleSided Setpoints can increase the probability that the safety function will fail to be initiated when the measured variable crosses the Analytical Limit. Both of these considerations can therefore increase the likelihood that the plant will operate in a manner that is inconsistent with the plant safety analyses. Both of these considerations thus increase the likelihood of operation outside analyzed conditions, and so each of them can reduce the assurance of plant safety.
The key question is: Is this reduction in safety assurance small enough to be considered acceptable?
This analysis seeks to quantify the amount by which failure to meet 95/95, and/or the use of singlesided setpoints, would increase the likelihood of operation outside the analyzed conditions.
1The95/95criterionappliestotheestimationofstatisticalparametersonthebasisofobserveddata.Itstipulates thattheassumeddistributionandtheestimatedparametersforthatdistributionshouldhavea95%probabilityof encompassing95%ofthepopulationfromwhichtheobservedsamplewasdrawn.
2SingleSidedSetpointisatermoftenusedtodescribeasetpointcomputedbyassertingthatallerrorsoutsidethe establisheduncertaintyarepermittedtofallonthenonconservativesideofthenominalsetting.Thisresultsina5%
probabilityofATPinexcessofAL.Thisisoftenconfusedwith,butisnotrelatedto,onesidedortwosided statisticalconsiderationsintheestimationofuncertaintylimitsfrommeasurederrordata.Thispointisaddressedin greaterdetaillaterinthisdiscussion.
SetpointsforSafetyRelatedInstrumentation InDepthAnalysisofSelectedpublicComments 95/95andSingleSidedSetpoints page2of9 9595andSSS October6,20161:33PM D R A F T D R A F T D R A F T All plant safety analyses include margins and other conservatisms. Operation slightly outside the analyzed conditions might, in fact, be safe. But slightly is not defined, and the amount of safety degradation corresponding to a given degree of violation of AL is not generally predicted. If analyses show that exceeding AL by an amount x would indeed be safe, then those same analyses could be used to reset the Analytical Limit and take advantage of some of that unused margin. The problem of a potential small violation of that revised limit, however, would remain. In addition, the operation of a system might not be linear or even mathematically continuous beyond the analyzed limit. Therefore there is no credible alternative to strict adherence to the limits in the safety analysis, if safety is to be, in fact, adequately assured.
Measurement error and therefore the uncertainty in the value of the monitored variable at which an actuation would actually occur is typically composed of two parts: a random component, generally modeled by means of a zerocentered Gaussian distribution, and a bias component, generally estimated as a single limiting value. In addressing the significance of 95/95 and of singlesided setpoints in this analysis, we shall be concerned only with the random component. The bias component is typically handled separately and is not subject to the concerns addressed here. For illustrative purposes, the random component is assumed in this analysis to be Gaussian with zero mean, but other distributions, including asymmetrical distributions, are possible. The probabilities presented here would, of course, change if a nonGaussian error distribution were assumed.
Terminology In general, the terminology used herein is as defined in the draft regulatory guide. Two additional terms are used here:
Basic Exceedance Probability:
The probability that the Actual Trippoint will exceed the Analytical Limit NotethatthisisbasedsolelyupontheATPdistribution,theLimitingSetpoint,andtheAnalyticalLimit.Itdoesnot takeequipmentfailureprobabilitiesintoaccount.AnExceedanceProbabilitymaybeassessedforasinglesensing channelorforallsensingchannelscombinedbyanidealizedvotingfunction.
Composite Exceedance Probability:
The probability that the safety function will not be initiated when the measured variable reaches the Analytical Limit.
ThisistheBasicExceedanceProbabilityforthesensingchannelsandvotinglogic,modifiedtoincludethestatistical unavailabilitiesofthesensorsandrelatedelectronics,ofthevotinglogic,ofthemechanicalequipmentthatperforms thesafetyfunction,andofthemotivepowerandassociatedpowercontrolsforthemechanicalequipment.
The terms setpoint and trippoint as used here are the same as in the draft regulatory guide, but because of their key roles in this analysis reiteration is warranted: A setpoint is a measured value at which a channel trip is observed to occur, or a target value for the trip setting. A trippoint is the value at which the trip actually does occur. So setpoint is a specific value, whereas trippoint is a random variable whose actual value can never be known. Trippoint is influenced by such things as measurement error, environmental conditions, calibration drift, and other conditions that can be bounded statistically but that change with time, further blurring the relationship between the setpoint established under some specific set of conditions and the trippoint as it will exist at some time in the future when the actuation is actually needed. A key element of this analysis is to establish and examine the probabilities associated with the statistical relationship between a trippoint and the associated setpoint.
SetpointsforSafetyRelatedInstrumentation InDepthAnalysisofSelectedpublicComments 95/95andSingleSidedSetpoints October6,20161:33PM 9595andSSS page3of9 D R A F T D R A F T D R A F T 95/95 The 95/95 criterion establishes the magnitude of the random component of the uncertainty estimate for the channel trippoints. Under 95/95, the random component of uncertainty is estimated so as to have a 95% probability of including at least 95% of the actual error values. The 95/95 criterion was adopted tacitly by the NRC in the second revision to the subject regulatory guide, in 1986. The 2sigma reference in the final sentence of the first full paragraph on page 2 of that guide clearly indicates an intent that the total loop uncertainty be based on two standard deviations of the anticipated error distribution (the actual value is 1.95996 standard deviations for symmetrical 95% coverage of a normal distribution). The 95/95 criterion is adopted explicitly in paragraph C1 of revision 3 of the guidance (issued in 1999).
The 95/95 criterion establishes the value of each element of instrument uncertainty, and therefore of the total loop uncertainty as a whole. Acceptance of lesser assurance would lead to lower uncertainty estimates and therefore to lower confidence in the protection of the analytical limit: if the range of credible errors in the actual trippoint is greater than the value used to establish the limiting setpoint, then the likelihood that the actual trippoint will exceed the analytical limit will also be greater than expected.
The key point is the estimation of the value of the standard deviation of the various elements of uncertainty, and therefore of the standard deviation of the overall trippoint uncertainty as a whole. There is an essentially infinite number of possible observations of a particular element of instrument error, and so any set of measurements used to determine the magnitude of the corresponding uncertainty necessarily includes only a portion of the possible values. The standard deviation of the sample is therefore related to but not necessarily equal to the standard deviation of the population as a whole. It is the standard deviation of the population that establishes the overall trippoint standard deviation, and that population standard deviation can only be estimated and cannot be known with certainty. The 95/95 criterion establishes statistical limits on the degree to which the estimated value of an element of uncertainty may differ from the actual but unknowable value. Failure to implement 95/95 could therefore cause the uncertainty in the uncertainty values themselves to be greater than expected, and so the resulting total loop uncertainty to be underestimated.
The degree to which TLU might be underestimated could theoretically itself be estimated on the basis of the statistical details of the criterion applied in lieu of 95/95, but the comments point out in essence that the concern with 95/95 stems primarily from a lack of readilyavailable information concerning the details of the uncertainty statistics. This same concern would therefore apply to any attempt to quantify the degree of underestimation as well.
In summary, failure to meet 95/95 could result in underestimation of TLU. This is equivalent to having an actual standard deviation for ATP that is greater than the value used in the uncertainty analysis. This increased standard deviation could result in an increase in the basic exceedance probability, regardless of whether singlesided setpoints are used or not.
Staff recognizes that 95/95 can be difficult or impossible to meet in many cases. The draft guidance therefore allows for the construction of arguments to justify the use of data that cannot be shown to meet the 95/95 criterion. But such data should not be used blindly, or without consideration of how they might relate to the ideal case. If 95/95 cannot be met, the alternative is not simply to use some arbitrary or apocryphal value: the numbers used should have some basis to justify their use. Perhaps a bounding value could be used, with confidence that it is reasonably representative of the quantity in question. Or perhaps a value could be shown to be such a small
SetpointsforSafetyRelatedInstrumentation InDepthAnalysisofSelectedpublicComments 95/95andSingleSidedSetpoints page4of9 9595andSSS October6,20161:33PM D R A F T D R A F T D R A F T part of the overall uncertainty that the total loop uncertainty would not be affected very strongly if the true value were to exceed the assumed value by some reasonable amount although the combined effect of multiple small uncertainties could be significant, thereby diminishing the credibility of such an argument. But a simpleminded assertion that its too hard so we will use something easier, which is, in essence, advocated in some of the comments, seems difficult to justify.
SingleSidedSetpoints The 95/95 criterion allows for 5% of anticipated trippoints to fall outside the specified range. Socalled SingleSided Setpoints (SSS) are constructed so as to allow that full 5% to be in the nonconservative direction, in conflict with the bidirectional nature of random errors, in conflict with the industry standard concerning this issue, and in conflict with the reasoning presented above.
The industry standard associated with this regulatory guide includes a provision requiring that the limiting setpoint be separated from the analytical limit by an amount not less than the total loop uncertainty. There is no provision in the standard for reduction of this separation. Single Sided Setpoints, then, are inherently inconsistent with the standard and therefore contrary to the alreadyestablished regulatory guidance. That some such setpoints have been accepted by the NRC in some particular cases does not necessarily constitute a precedent for other applications: there are many factors involved in assurance of adequate protection, and modification of some factors in some cases is not necessarily applicable to all.
The standard defines the total loop uncertainty as the overall uncertainty in the measurement. Instrument uncertainty is typically bidirectional that is, the associated errors are equally likely to be positive or negative. Uncertainty is usually modeled by means of a Gaussian probability distribution having a zero mean (bias is usually handled separately), with half of the possible errors on the nonconservative side of the mean and half of them on the conservative side.
The draft guidance therefore points out that adherence to the 95/95 criterion will result in a basic exceedance probability of 21/2%: If 5% of the actual trippoints differ from the AsLeft setpoint by more than the total loop uncertainty, and if the errors are distributed symmetrically about the mean, then only half (not all) of the errors are nonconservative. Therefore, the instance of actual trippoints in excess of the analytical limit would be 21/2%, not 5%.
In many cases, the claim that an exceedance probability of 5% should be considered acceptable seems to be based on an interpretation of the 95/95 criterion that is in conflict with the foregoing discussions.
Note that NRC has not established a formal target for the probability of success in protecting the analytical limit: the 21/2% statement in the draft guidance is a consequence of the provisions of the industry standard, not a dictate by the NRC.
MathematicalModel The mathematical model addresses three actuation voting schemes: 2 of 4, 2 of 3, and 1 of 2 taken twice these are identified as Voting Types (VT) 24, 23, and 122, respectively. The model also addresses two mechanical equipment schemes: two trains, with at least one train needed for successful operation, and three trains, with at least two trains required for successful operation these are identified as Mechanical Types (MT) 12 and 23, respectively.
SetpointsforSafetyRelatedInstrumentation InDepthAnalysisofSelectedpublicComments 95/95andSingleSidedSetpoints October6,20161:33PM 9595andSSS page5of9 D R A F T D R A F T D R A F T It can be shown that, for a given set of channel statistical characteristics, the basic exceedance probability for VT122 will always be greater than that for VT24 and will always be less than that for VT23. Therefore, VT122 needs not be considered explicitly in the remainder of this analysis.
An MT12 system has only one way to fail: the function will fail only if both trains fail. An MT23 system has four ways to fail: the function will fail if any two trains fail or if all three trains fail.
Therefore the overall unavailability of an MT23 system is higher than that for an MT12 system that has the same unavailability characteristics for each train. MT23 systems are not nearly as common as MT12 systems, and including them in this analysis would double the alreadylarge number of possible combinations of conditions. Because of their relative rarity and inherently increased probability of failure, consideration of MT23 systems would tend to obscure the central objective of this analysis without providing significant additional insight. MT23 will therefore not be explicitly addressed in the remainder of this analysis.
NetEffects Given strict adherence to the 95/95 criterion, that is, given an accurate estimate of the standard deviation for the actual trippoint, the basic exceedance probability for VT24 using TLUbased setpoints is 6.13x105. For a singlesided setpoint, the basic exceedance probability grows to 48.1x105 larger by a factor of 7.85.
For VT23, the probabilities are 184 x105 for TLUbased setpoints and 725 x105 for single sided setpoints. The factor is reduced to 3.93, although that factor is applied to a considerably increased base probability.
Underestimation of the standard deviation significantly increases the exceedance probability. If the standard deviation is 25% higher than the assumed value, the basic exceedance probability for VT24 increases to 76.4 x105 for ideal equipment and a TLUbased setpoint a factor of about 12.5. At 50%, the VT24 exceedance probability becomes 325 x105 and the factor rises to slightly more than 53. For singlesided setpoints, the probabilities are higher and the factors fall to about 6.4 and 19 for a 25% or 50% higher standard deviation, respectively.
Table1:BasicExceedanceProbabilities Actual
VT24 VT23 DSS SSS Ratio DSS SSS Ratio 1
0.613x104
4.81x104 7.85
18.4 x104
72.5 x104 3.93 1.25 7.64 x104 31.0 x104 4.06
98.5 x104
249.0 x104 2.53 1.5 32.5 x104 91.2 x104 2.80
257.1 x104
507.5 x104 1.97 1.25 ratio 12.5 6.44
5.35 3.43
1.5 ratio 53.0 19.0
14.0 7.00
One common source of error in the estimation of standard deviation is a tacit but erroneous assumption of equivalency between the standard deviation of an observed sample and the actual standard deviation of the population as a whole. To achieve 95/95 confidence, the actual standard deviation for a large population should be taken to be:
27%
higher than the standard deviation of a sample set consisting of about 40 elements 50%
higher than the standard deviation of a sample set consisting of about 15 elements 160% higher than the standard deviation of a sample set consisting of about 5 elements
SetpointsforSafetyRelatedInstrumentation InDepthAnalysisofSelectedpublicComments 95/95andSingleSidedSetpoints page6of9 9595andSSS October6,20161:33PM D R A F T D R A F T D R A F T For example, a large population requires about 1.96 standard deviations to encompass 95%
of the population with 95% confidence. To achieve the same coverage and confidence based on a 40element sample set, one would need to go to 2.448 sample set standard deviations.
2.488÷1.96=1.27, so the actual standard deviation of the population should be taken to be about 27% higher than the assumed value, if the assumed value is taken from the 40element sample set without correction.
Therefore an actual standard deviation 50% higher than the assumed value does not seem to be unreasonable, and even higher values seem credible. On the other hand, the effects of sample size are well known and easily corrected, and other considerations can also influence errors in the assumed standard deviation. Therefore we can use 125% and 150% as roughly representative of anticipated actual values.
When sensor and electronics unavailabilities are taken into consideration, the use of SSS increases the VT24 exceedance probability by a slightly smaller amount, down to a factor of about 7.6 for sensor and electronics unavailabilities of 103. For unavailabilities of 104 the factor is about 7.8. For unavailabilities as high as 102 the factor remains more than 5. Inclusion of mechanical equipment and motive power unavailabilities further reduces this factor. The foregoing values all assume that the standard deviation is as expected.
For various combinations of sensor and electronics unavailabilities together with various factors by which the actual standard deviation might exceed the assumed standard deviation (due to nonadherence to 95/95), the use of SSS in a VT24 system would result in increases in the exceedance probability by factors ranging from about 2.8 to about 7.8. Adding in mechanical equipment and motive power unavailabilities reduces the similar factors marginally, or even to slightly less than 2 for exceedingly poor equipment availability. For this analysis, unavailabilities ranged from 104 to 102 for sensors and electronics and from103 to 102 for mechanical equipment and electrical power. The standard deviation of the actual trippoint was modeled as up to 150% of the value assumed in the uncertainty analysis. In all cases, the reduction in the factor by which SSS increases the exceedance probability is accompanied by an increase often a substantial increase in the exceedance probability even for LSPbased setpoint limits.
In general the exceedance probability ratio (the factor by which the use of SingleSided Setpoints increases the exceedance probability) tends to decrease as the equipment unavailability increases, and as the underestimation of the standard deviation increases. The factor is on the order of 2.6 to 2.9 for VT24 when the actual standard deviation is 1.5 times the assumed value, for all but the very highest of electronic equipment unavailability rates. For electronics unavailabilities as high as 102, it remains above 2.4. For VT23 it is about 1.9 or 2.0 for an actual standard deviation 1.5 times the assumed value, regardless of equipment unavailability rates within the range explored.
In summary, the use of SingleSided Setpoints increases the VT24 exceedance probability by a factor of about 7.85 if the equipment is perfect and the standard deviation is estimated accurately.
For credible unavailability rates and accurate standard deviation, the factor is on the order of 3 or
- 4. Underestimation of the standard deviation results in lower factors, with a factor of about 2 when the standard deviation is 11/2 times the assumed value and equipment unavailability is included.
The Appendix to this evaluation presents exceedance probabilities and the effects of single sided setpoints in tabular and graphical form for various combinations of equipment unavailabilities together with various degrees by which the actual standard deviation may exceed the assumed value.
SetpointsforSafetyRelatedInstrumentation InDepthAnalysisofSelectedpublicComments 95/95andSingleSidedSetpoints October6,20161:33PM 9595andSSS page7of9 D R A F T D R A F T D R A F T The foregoing discussion shows that the impact of using SingleSided Setpoints is significant in theory, but tends to be washed out when realworld limitations on equipment availability are taken into consideration. Underestimation of the standard deviation of the actual trippoint, resulting from failure to adhere to the 95/95 criterion, also tends to diminish the impact of using SingleSided Setpoints.
The use of limitations in one area to justify relaxation of requirements in another seems generally to be unwise. If the limitations were to be mitigated, the relaxations would nevertheless remain resulting in a generally subpar product. Nevertheless, limits on equipment availability are real, and their impact cannot be eliminated.
As for the impact of standard deviations in excess of the assumed values (that is, of failure to meet the 95/95 criterion):
Examination of the exceedance probabilities and the factor by which the actual standard deviation exceeds the assumed value shows a strong correlation between these two quantities, both with SingleSided Setpoints and without them. Increasing the actual standard deviation by a factor of 1.5 increases the basic exceedance probability by a factor of about 53 for VT24, and of about 14 for VT23, for TLUbased setpoints. For SingleSided setpoints, the corresponding factors are about 19 and about 7, respectively.
Conclusion The use of socalled "singlesided setpoints can result in a significant increase in the probability that a safety function will not be initiated as assumed in the plant safety analyses, and therefore of operation in an unanalyzed condition. While it may be tempting to point out that the potential nonconformance to the safety analyses is probably small, there is no way to quantify it nor to quantify the consequences of such an exceedance. If analyses are performed to show that some degree of exceedance is acceptable, then those analyses can be incorporated into the safety analyses and the analytical limit adjusted accordingly then the setpoint limit could be adjusted to suit the new analysis.
Failure to adhere to 95/95 is potentially even more significant than the impact of SSS, even though adherence is even more difficult.
The combined effect of both failure to meet 95/95 and acceptance of singlesided setpoints is obviously greater than the individual effect of either one. Therefore if SSS are to be accepted, then adherence to 95/95 would become even more important.
SetpointsforSafetyRelatedInstrumentation InDepthAnalysisofSelectedpublicComments 95/95andSingleSidedSetpoints page8of9 9595andSSS October6,20161:33PM D R A F T D R A F T D R A F T APPENDIX Table2:ExceedanceProbabilitiesandRatiosforVariousConditions Actual
Unavailability3 VT24 VT23 I&C Mech DSS SSS Ratio DSS SSS Ratio 1
0 0
0.613 x104 4.81x104 7.85 18.4 x104 72.5 x104 3.93 104 0
0.617 x104 4.83x104 7.82 18.5 x104 72.6 x104 3.92 103 0.659 x104 4.87x104 7.39 18.5 x104 72.7 x104 3.92 102 4.60 x104 8.80x104 1.92 22.5 x104 76.6 x104 3.41 103 0
0.651 x104 4.94x104 7.59 19.1 x104 73.8 x104 3.86 103 0.711 x104 5.00x104 7.04 19.2 x104 73.9 x104 3.85 102 4.81 x104 9.10x104 1.89 23.3 x104 77.9 x104 3.35 102 0
1.28 x104 6.46x104 5.05 26.3 x104 86.1 x104 3.28 103 1.52 x104 6.70x104 4.41 26.5 x104 86.3 x104 3.26 102 7.18 x104 12.4 x104 1.72 32.2 x104 91.9 x104 2.86 1.25 0
0 7.64 x104 31.0 x104 4.06 98.5 x104 249. x104 2.53 104 0
7.65 x104 31.0 x104 4.05 98.6 x104 249. x104 2.53 103 7.69 x104 31.1 x104 4.04 98.7 x104 249. x104 2.53 102 11.6 x104 35.0 x104 3.01 103. x104 253. x104 2.47 103 0
7.81 x104 31.4 x104 4.02 99.9 x104 251. x104 2.51 103 7.87 x104 31.4 x104 4.00 100. x104 251. x104 2.51 102 12.0 x104 35.5 x104 2.97 104. x104 255. x104 2.45 102 0
9.72 x104 35.3 x104 3.63 114. x104 270. x104 2.38 103 9.95 x104 35.5 x104 3.57 114. x104 271. x104 2.37 102 15.6 x104 41.2 x104 2.64 120. x104 276. x104 2.31 1.5 0
0 32.5 x104 91.2 x104 2.80 257. x104 507. x104 1.97 104 0
32.6 x104 91.2 x104 2.80 257. x104 508. x104 1.97 103 32.6 x104 91.3 x104 2.80 257. x104 508. x104 1.97 102 36.5 x104 95.2 x104 2.61 261. x104 512. x104 1.96 103 0
32.9 x104 91.9 x104 2.79 259. x104 510. x104 1.97 103 33.0 x104 91.9 x104 2.79 259. x104 510. x104 1.97 102 37.1 x104 96.0 x104 2.59 263. x104 514. x104 1.95 102 0
36.9 x104 98.6 x104 2.67 279. x104 534. x104 1.92 103 37.2 x104 98.8 x104 2.66 279. x104 534. x104 1.91 102 42.8 x104 104.
x104 2.44 284. x104 539. x104 1.90
3SensorandElectronicsunavailabilitiesaretreatedseparately,witheachhavingtheindicatedvalue.50%ofsensor andelectronicsfailuresareassumedtopreventchanneltrip,and50%toresultdirectlyinchanneltrip.Mechanical equipmentandmotivepowerarealsotreatedseparately,eachhavingtheindicatedvalue.Allmechanicalequipment andmotivepowerfailuresarepresumedtoinhibitactuation,withnoneresultinginspuriousactuation.
SetpointsforSafetyRelatedInstrumentation InDepthAnalysisofSelectedpublicComments 95/95andSingleSidedSetpoints October6,20161:33PM 9595andSSS page9of9 D R A F T D R A F T D R A F T EXCEEDANCEPROBABILITIESANDEXCEEDANCEPROBABILITYRATIOS Theverticalscalesfortheexceedanceprobabilitygraphsarelogarithmic.
RedbarsrefertoVT24,bluebarstoVT23.
DarkbarsrefertoLSPbasedsetpoints,lightbarsrefertosinglesidedsetpoints.
Thehorizontalaxesincludethreesetsofdata.Theyare,readingupfromthebottomforeachaxis:
Standarddeviation,valuesof1,1.25,and1.5 Foreachvalueofthestandarddeviation,electronicsandvotingunavailabilitiesof,104,103,and102.
Foreachsetofstandarddeviationandelectronicsuncertainties,mechanicalequipmentandpowerunavailabilitiesof 0,103,and102.Avalueofzeroispresentedtoshowtheexceedanceprobabilitythroughthevotinglogiconly.
0.1 1
10 100 1000 0
1E03 1E02 0
1E03 1E02 0
1E03 1E02 0
1E03 1E02 0
1E03 1E02 0
1E03 1E02 0
1E03 1E02 0
1E03 1E02 0
1E03 1E02 1E04 1E03 1E02
~
1E04 1E03 1E02
~
1E04 1E03 1E02 1
~
1.25
~
1.5 VT24DSS VT24SSS 0
1 2
3 4
5 6
7 8
9 0
1E03 1E02 0
1E03 1E02 0
1E03 1E02 0
1E03 1E02 0
1E03 1E02 0
1E03 1E02 0
1E03 1E02 0
1E03 1E02 0
1E03 1E02 1E04 1E03 1E02
~
1E04 1E03 1E02
~
1E04 1E03 1E02 1
~
1.25
~
1.5 VT24Ratio VT23Ratio 0.1 1
10 100 1000 0
1E03 1E02 0
1E03 1E02 0
1E03 1E02 0
1E03 1E02 0
1E03 1E02 0
1E03 1E02 0
1E03 1E02 0
1E03 1E02 0
1E03 1E02 1E04 1E03 1E02
~
1E04 1E03 1E02
~
1E04 1E03 1E02 1
~
1.25
~
1.5 VT23DSS VT23SSS