ML19249A312

Frantic - Computer Code for Time Dependent Unavailability Analysis

ML19249A312
Person / Time
Issue date:	10/31/1977
From:	Goldberg F, Vesely W NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES)
To:
References
NUREG-0193, NUREG-193, NUDOCS 7908210611
Download: ML19249A312 (66)

Text

NUREG-0193 FRANTIC - A COMPUTER CODE FOR TIME DEPENDENT UNAVAILABILITY ANALYSIS 790821oGu Office of Nuclear Regulatory Research U. S. Nuclear Regulatory Commission

'l63 00l'

Available from National Technical Information Service Springfield, Virginia 22161 Price: Printed Copy $5.25; Microfiche $3.00 The price of this document for requesters outside of the North American Continent can be obtained from the National Technical Information Service.

bo%

., y

NUR EG-0193 NRC-1 FRANTIC - A COMPUTER CODE FOR TIME DEPENDENT UNAVAILABILITY ANALYSIS W. E. Vessly F. F. Goldberg Manuscript Completed: March 1977 Data Published: October 1977 Probabilistic Analysis Branch Office of Nuclear Regulatory Research U. S. Nuclear Regulatory Commission Washington, D. C. 20555

6 3 M5

ABSTRACT The FRANTIC computer code evaluates the time dependent and average unavail-ability for any general system model. The code is written in FORTRAN IV for the IBM 370 computer. Non-repairable components, monitored components, and periodically tested components are handled. One unique feature of FRANTIC is the detailed, +.ime dependent modeling of periodic testing which includes the effects of test downtimes, test overrides, detection inefficiencies, and test-caused failures. The exponential distribution is used for the component failure times and periodic equations are eveloped for the testing and repair contributions. Human errors and common mode failures can be included by assigning an appropriate constant probability for the contributors. The output from FRANTIC consists of tables and plots of the system unavailability along with a breakdown of the unavailability contributions. Sensi-tivity studies can be simply performed and a wide range of tables and plots can be obtained for reporting purposes. The FRANTIC code represents a first step in the development of an approach that can be of direct value in future system evaluations.

Modifications resulting from use of the cade, along with *he development of reli-ability data based en operating reactor experience, can be expected to provide increased confidence in its use and potential application tt the licensing process.

763 D M'

TABLE OF CONTENTS Chapter Pg A.

THE BASES FOR THE FRANTIC CODE I

1.

INTRODUCTION.

1 2.

THE PUaPOSE OF THE FRANTIC CODE 1

3.

'YPES OF COMPONENTS CONSIDERED BY FRANTIC 3

3.1 Basic Definitions.

3 3.2 Constant Unavailabi',ity Components 3

3.3 Nonrepairable Comprnents 3

3.4 Monitored Components 3

3.5 Periodically Tested Components 4

3.5.1 Basic Equations.

4 3.5.2 Resulting Time Dependent and Average Unavailabilities 8

3.5.3 The Handling of Detection Inef ficiencie>

10 4.

SUMMARY

OF EQUATIONS 10 8.

INPUT DESCRIPTION.

12 1.

INTRODUCTION.

12 2.

CASES 12 3.

DATA GROUPS 12 3.1 Data Group 1: TITLE 12 3.2 Data Group 2: COMPONENTS.

13 3.3 Data Group 3: TIME.

14 3.4 Data Group 4: PRINT 16

3. 5 Data Group 5: PLOT.

17 3.6 Data Group 6: RUN 17 4.

CHANGE CASES.

20 5.

DEFINITION OF SYSTEM UNAVAILABILITY FUNCTIONS -

SUBROUTINE SYSCOM 20 6.

JUB CONTROL - GENERAL REQUIREMENTS.

22 7.

JOB CONTROL LANGUAGE TO RUN AT NIH.

22 7.1 JCL for Calcomp Plots.

23

7. 2 JCL for Printer Plots.

23 8.

LISTING OF SAMPLE INPUT DECK.

24 C.

OUTPUT DESCRIPTION 25 1.

PRINTED OUTPUT.

25 1.1 Output Section 1 - Input Componer.t Parameters.

25 1.2 Output Section 2 - Component Mean Unavailabilities 25 1.3 Output Section 3 - Time Point Data 25 1.4 Output Section 4 - System Unavailability Data.

25 1.5 Output Termination Message 29 2.

GRAPHIC OUTPUT.

29 2.1 LIN-LIN Plot 29 2.2 mag-LIN Plot 29 f

TABLE OF CONTENTS (Continued)

P^R*

2.3 LIN-LOG Plot 29 2.4 MAG-LDG Plot 29 2.5 Cutoff Option.

29 D,

APPLICATIONS 35 1.

EXAMPLE 1: TEST INEFFICIENCY SENSITIVITY STUDY 35 2.

EXAMPLE 2: TEST-CAUSED FAILURE SENSITIVITY STUDY 42 3.

EXAMPLE 3: TEST INTERVAL SENSITIVITY STUDY 46 4.

EXAMPLE 4: AUX-FEED SYSTEM ANALYSIS.

48 LIST OF FIGURES Figure No.

A-1 Two Systems With The Same Average Unavailability But With Very Different Time Behaviors (q(t)).

2 A-2 Instantaneous Unavailability Behavior When Testing Contributicas Are Ignored 5

A-3 Periodic Test Modeling Used in FRANTIC.

6 A-4 The Instantaneous Unavailability Between Tests.

7 A-5 The Instantaneous Unavailability Including Test and Repair Contributions (q and q )

9 j

2 B-1 Data Group 1 - TITLE.

12 B-2 Data Group 2 - COMPONENTS 15 B-3 Data Group 3 - TIME.

16 B-4 Data Group 4 - PRINT.

18 B-5 Data Group 5 - PLOT 19 B-6 Data Group 6 - RUN.

21 C-1 Output Section 1 - Input Component Parameters 26 C-2 Output Section 2 - Component Mean Unavailabilities.

27 C-3 Output Section 3 Time Point Data.

27 C-4 Output Section 4 - System Unavailability Data 28 C-5 LIN-LIN Plot, Unavailability Option

" FAIL" 30 C-6 LIN-LIN Plot, Unavailability Option "TOTL" 31 C-7 MAG-LIN Plot, Unavailat 'lity Option "TOTL" 32 C-8 LIN-LOG Plot, Unavailability Option "TOTL" 33 C-9 MAG-LOG Plot, Unavailability Option "TOTL" 34 D-1 Block Diagram for Examples 1, 2 and 3 36 D-2 Data Group Input for Example 1.

36 D-3 SYSCOM Subroutine for Examples 1, 2 and 3 36 0-4 Test Inefficiency p = 0.0 37 D-5 Test Inefficiency p = 0.1 38 D-6 Test Inefficiency p = 0.5 39 D-7 Time Point Data for Example 1 40 D-8 Data Group Input for Example 2.

42 0-9 Probability of Test-Caused Failure pf = 0.0 43 D-10 Probability of Test -Caused f ailure p - 9.1 44 f

D-11 Probability of Test-Caused Failure p = 0.5 45 f

D-12 Data Group Input for Example 3.

47 D-13 Average System Unavailabilities for Five Test Intervals 47 D-14 Block Diagram for Example 4 49 D-15 SYSCnM Sobroutine for Example 4 49 D-16 Data Group Input for Example 4.

50 D-17 Testing Scheme Illustration for the Bas-Case 51 0 18 Testing Scheme Illustration for Change e3 51 D-19 Te< ting Scheme Illustration for Change 5

52 0-20 A" -raed - Case 1 53 0-21 A ;x-iced - Case 2 54 0-22 A ix-Feed - Case -

55 0-23 Au<-Feed - Case 4 56 D-24 Aux-Feed - Case 5 57 D-25 Time Points for Example 4 58

%S OM

A.

THE BASES FOR THE FRANTIC CODE 1.

INTRODUCTION In WASH-1400 (1], system unavailabilities were calculated in order to predict the accident sequence probabilities and the corresponding accident risks. The system unavail-abilities which were applicable for the WASH-400 predictions were the average system unavail-abilities, averaged over a one year time peri.d.

In addition to the average unavailability, the tir,' dependent, instantaneous unavail-ability can also be important in probabilistic evaluations. If q(t) represents the time dependent instantaneous unavailability, then the average unavailability q, as computed in WASH-1400, is given by T

q=f q(t)dt (1) o where T = one year. By definition the instantaneous unavailability q(t) is the probability that the system is unavailable at the given instant of time t.

The quantity q is the average fraction of time that the system is down.

To illustrate the roles of q and q(t) in probabilistic analyses, consider a particular accident sequence consisting of one initiating event and one system whic.h is called upon to operate. Let A be the constant occurrence rate for the initiating event. The probability f(t)dt that the accident sequence will occur in some time interval dt at time t is f(t)dt = A q(t)dt (2) and hence Aq(t) is the instantaneous accident frequency, i.e.,

the probability of an accident occurring per unit time at time t.

The yearly acciaent frequency P, which is what WASH-1400 computed, is the integral of A Q(t)dt over a one year period T; P=

• q(t)dt = T 1_

q(t)dt, (3) o T

o or P=

AT,

(4)

From Equation (2) the instantaneows unavailability q(t) thus enters into the instantaneous accident frequency rate A q(t) and from Equation (4) the average unavailability q enters into the yeaily accident probability AT q.

The instantaneous accident frequency A q(t) describes the detailed time behavior of the act.ident likelihood. The time at which A q(t) is a maximum, i.L.,

the time at which the instantaneous system unavailability q(t) is a maximum, is the time at which the accident is most likely to occur. A safety system may have a low average unavailability q and yet at particular times the instantaneous unavailability q(t) may be quite high indicating the plant is most vulnerable to accidents at these times. Figure A-1 shows two systems which have the same average unavailability but which have quite different instantaneous unavailabilities.

The system with the higher unavailability " peaks" in q(t) is a more loosely controlled system and, with regard to having higher instantaneous unavailabilities, is the poorer system. In assessing system design or system operation, the instantaneous unavailability q(t), particu-la'ly the mima, or " peaks" in q(t), may therefore be examined, along with the average unaea11 ability q, for a more complete evaluation.

2.

THE PURPOSE OF THE FRANTIC CODE The FRANTIC computer code was developed to calculate both the instantaneous unavail-ability and the average unavailability of a system and to give a breakdown of the unavailability contributions from failures, testing, and repair. Accident sequences, such as constructed from event trees, can also be evaluated for their instantaneous and average probability behavior. The name " FRANTIC" is an acronym for Formal heliability Analysis including Normal Testing, Inspection and Checking. The FRANTIC code represents ona extension of the proba-bilistic methodology described in WASH-14CO.

%3 DM

e ot t

)

)

t

(

q y(

t i s l e iibt ai l l ii ab v a al ni U av ea gn aU r

1 es o

v u 4

5 2

3 1

A A o e

0 0

0 0

0 2

e*

1 1

1 1

1 ma at t

7 S n L

a et

+

h s t n h I t t inwe r

e e mf af ti 3, D 53 oiww T

t u

b

)

(q f.

3 5

)

1 2

4 t

0 0

(q 0

0 1

0 1

1 1

1

%OAc NT The FRANTIC code was developed to investigate periodic testing schemes and opera-tional and design modifications as they affect system unavailabilities and accident prob-abilities. Testing characteristics which can be input to FRANTIC include the test interval, the test duration time, the repair time or allowed downtime, the test override capability, tne test efficiency, and human-caused failure probabilities associated with the test. The system logic which is input to FRANTIC can be easily changed to investigate the impacts of operational and design modifications.

The present version of the FRANTIC ode oses the exponential failure distribution to describe hardware failures. The constant corponent failure rates can be changed to inves-tigate the effects of different hardware reliabilities. In addition to the hardware contri-bution, the system models can also include human error and common cause contributions. The subsequent sections will describe the unavailability equations used in the FRANTIC calculations and will give the input required for the code as well as the output which is produced.

3.

TYPES OF COMPONENTS CONSIDERED BY FRANTIC 3.1 Basic Definitions Four types of components are handled by the FRANTIC code, constant unavailability components, nonrepairable components, monitored components, and periodically tested components.

By definition, a constant unavailability component is described by a per demand (or per cycle) unavailability which is independent of time. A nonrepairable component is one which, if it fa ls, is not repaired during plant operation. A monitored component is a component in i

which the failure is immediately detected and repair is then begun; the dete' tion device can be an alarm, annunciator, or any other signaling means. A periodically tested c mponent is one in + 'ch tests are performed at regular intervals, such as every 30 days, and any failure of the cs onent is not detectable until the test is performed.

3.2 Constant Unavailability Components The unavailability q for this type of compe cnt is given by q=o (5) d where q is the per demand unavailability, input by the user.

Cycli navailabilities can be d

modeled in this manner, where the unavailability is time-independent and depends only on the cycle or demand. Human errors (per de>1and) can also be modeled in this way us'ng the appro-priate value for a '

d 3.3 Nonrepairable Comnonents Assuming an exponential distribution, as done in FRANTIC, the instantaneous unasallability for a nonrepairable component q(t) is given by q(t) = 1 - exp(-At)

(6) l

• At (7) where A is the component failure rate. The approximation given by Equation (7) is used in FRANTIC and is accurate to within 5% for unavailabilities less than 0.1.

The approximation is slightly conservative.

3.4 Monitcred Components For a monitored component, the instantaneous unavailability,,quickly approaches a constant asymptotic value and the asymptotic value is used in FRANTIC' The asymptotic unavailability q is given by q=1 T

M) g 1+1T g

(9)

=3T g The asymptotic value is achieved after a time period of approximately 3T into g

operation.

O

-4 where A is again the component failure rate and T is the average repair time [2]. The g

average repair time should also include the time Trom detect'an to the beginning of repair.

It is important that a statistical ave _ rag _e repair time be used for T which may o

enteil averaging over a repair time distributToii. The approximation given hy Equation (9) which is used in FRANTIC, is slightly conservative and is accurate to within 10% if the unavailability is less than 0.1.

If certain failure modes are not detectable by the monitorinC device, then the appropriate fraction of failure" can be treated as being nonrepairable (using pA for the r.onrepairable component failu-rate where p is the detection inefficiency).

3.5 Pe-fodically Tested Components 3.5.1 Basic Equatiors Periodically tested compoients are quite common in safety systems, which are gen-erally standby systems and are not operated until an accident situation occurs. To help ens re that the systems are available if needed, the components are periodically tested to detect any failures which might have occurred during standby. The FRANTIC code contains detailed modeling of the instantaneous ;qavailability associated with periodically tested components, which includes testing contt A tions as well as failure contributions.

If testing is assumed to be perfect, then the instantaneous unavailability of a periodically tested component is shown in Figure A-2.

The unavailability nas the standard sawtooth behavior and increases (approximately) linearly from 0 to AT between the tests of interval T.

(The linear approximation is used for the exponential hert-)

When testing is not perfect and testing contributions are included, the sawtooth plot will have additional unavailability contributions at the test timer Two types of testing contributions are handled by FRANTIC, a " test downtime contribution" and "a repair contribution." The test downtime contribution arises from the non-zero on-line time required to perform the test. When there is a test override or bypass capability the unavailability will be Icwered due to the override capability; however, there will still be a downtime contribution. The repair contribution arises from the non-zero on-line time required to repa:- the component if it is found f ailed.

If f is the average on-line time required to perform the test and T is the average g

repair time, then the period 1 tests as modeled in FRANTIC, will have the features shown in Figure A-3.

The first interial T is the time from plant startsp to the first test. The remaining tests on the component a)re carried out at intervals of T, from start of test to 2

the start of the next test. The first interval T can be the same as T r can be differe" i

2 to account for staggering or tests among different components.

The unavailability will consist cf the unavailability between tests and the unavail-ability during the test period I and repair period T The unavailability between tests will have the sawtooth behavior. Forthefirsttestintehv.al q(t) = At 01t1T (10) j For the second test interval, q(t) = A(t-t)

I<t1T III) 2 where t is the time from the start of the previous test. For Equation (11), it is assumed that the test detects all failures occurring in the test period I; in essence failures caused by the test are assumed to be immediately detectable. For test intervals after the second, the unavailability periodically repeats according to Equation (11). Figure A-4 illustrates the between tests unavailability behavior.

To determine the unavailability during the test period and repair period, let Q be the component unavailability immediately before the test begins From Equation (10) for the first test interval Q = AT (12) j and from Equation (11), for the remaining intervals Q = A(T -1)

(13) 2 163 W

r e PL de t

ron S

y g

g sno i

tu b

ir tn*

(

gn i

t s

g e

T er n

u e

7

]

h f

I 1

y an U

5 a

)

t (q

D% D wN\\

Fiqure A-3 Periodic Test Nodeling used in FRANTIC Ti = FIRST TEST INTERVAL T2 = SECOND AND REMAINiivG TEST INTERVALS r = AVERAGE TEST TIME

• R = AVER AGE REPAIR TIME e

e PLANT STARTUP l

T Ts T

TR T

TR i

i i

i WTj % :

T2

l T2

=l-T2

~~~

l i

I i

OT S2.V

==

\\

c

\\

\\

\\_

h 0

m e'

e M

at e

\\

\\

q

\\..

E,

~

s b

8 C

+J C

2 L

F

\\

C

\\

6-

\\

~ _

T6s DD The unavailability g during the test period I and the unavailability q2 during the repair j

period T are then calculated in FRANTIC from the following formulas:

R qj = pf + (1 pf)q + (1 pf) (1 q )Q (14) 9 9

(15) 2 'h * (1~P }0

• II'P ) (1-Q) \\ A Tp 4

f f

where pf = the probability of a test-caused failu*e (161 and 4 = the test override unavailability (l').

9 The term p is the probability that the test itself causes component failure and q istheprobabilitytbatthecomponentcannottransferfromatestmodetoanoperatemodeif a demand occurred (the test override capability). As given by Equation (14), during the test period the component can be unavailable due to either of three causes: 1) a test caused fai'ure occurs, with probability p

2) the test cannot be overriden, with probability q, or 3)thecomponenthasfailedbetweek, tests,withprobabilityQ. Equation (14) expresses fhese three contributions in a disjoint manner.

As given by Equation (15), the component can be unavailable dur'.ng the repair period due to either of three causes: 1) a test-caused failure has occurred requiring repair, with prcbability p, 2) the component has failed between tests again requiring repair, with probability Q, or k) the con.,'onent is up but then f ails during the period T with average p

probability 5 A T. For the td rd ccntribution the average unavailability N A T is used instead of the tike dependent conu.buuon, At, 0 $ t $ T,howeversinceQisikgeneral R

much larger than A T, the error is insignificant.

R 3.5.2 Resulting Instantaneous and Average tinavailabilities Figure A-5 illustrates the instantaneous unavailability behavior with the test and repair contributions 4 and q, now included along with the between test contribution. The 3

and q. Even though aowsasawtootnedplotwithtestandrepairplateausgivenbyqkbilitycontributions figure the test and repair periods t and T are of short duration, the unavail canbeimportantcontributorktothepeakandaverageunavailabilitiesattainedbythe q

qdm,pobentorbythesystem.

c The average ut. availability 4 can be computed to be the area of the time dependent, instantaneous unavailability curve divided by the total time interval, where the time interval is the interval of interest, such as one year.

If the instantaneous unavailability has a cyclic behavior, then the average unavailability can be taken as '.he area over one periodic cycle divided by thc cycle time. Considering Figure A-5 and taking T,)to be the cycle time (the effect of the different firrt test interval T) is generally smalT, the average component unavailability q 's thus approximately T

q=fA II8)

T2+91

+92 The first term on the r;ght hand side of Equation (18) is the between tests contribution, the second term is the test contributien, and the third term is the repair contribution.

(The small effect of the origin shift (1 t) is ignored in the first term A T,.)

FRANTIC 2

actually co,aputes the average unavailabiTity for a system f rom the time dependeht unavailability plot. When the system is simply one component, the difference from Equation (18) will in general be insignificant.

In certain situations, the test and repair contributions can be dominant contributors

= 1 and the to the average unavailability. For example, for no test override capability, q) hours (30 average test contribution g r/T thus becomes t/T. If i = 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and T = 720 2

j 3 whkchisrelativelylargeandhencecanbethe days),thistestingcontributickis1.4x 10 principal contributor. The maxiraum instantaneous unavailability also occurs during testing since g = 1 which implies that toe component is unavailable were an accident to occur at j

this time.

%3 OM K

N G

W C

M 4.J M

F-Om

-C^N D CT 3

-V

~~

• 2 C

f.

C C

X "

+J CT W

-c-v e

q

-- m aw LF 4 C 0

9 O k.

m --

3

'F" M

-C71 m3

>D k

C %

D+

C.

M O 3U L

Ce e9

+J fl C 0 M1 CL

+>

M C

m h

C N

g C

y g -

163 0/

s

1. I.

go t.

Even with test overrides and with smaller test or repair periods, the unavailability contributions from testing or repair can still be important. For complex systems where the results are not as apparent as for a single component, the FF%NTIC code will need to be run to obtain the various contributions. When testing and repai-contributions are ignored then I and T can be set to zero and the contributions q It must be recognized,however,thatthesesituationsrepresen[andq,willnotbecomputed.

p perfect testing and repair, and the results must be so interpreted.

3.5.3 The Handling of Detection Inefficiencies The previous equations for periodically tested components assume all failures are detectable by the tests. Detection inefficiencies can also be modeled in FRANTIC. Let p be the detection inefficiency, which is defined to be the fraction of failures which are not detectable by the test. When detection inefficiencies are modeled in FRANTIC (p >0), then all the failure rates in the previous equations (Equations (10) - (15)) are changed in the code to A(1-p) which is the detectable failure rate. An undetected unavailability contribu-tion q' is then separately added as given by q' = '.pt (19)

This undetected unavailability is thus treated as a nonrepairable contribution and when this is added to Equations (10) - (15), the total component unavailability continually increases with time until a more efficient test is performed (such as at reactor shutdown).

The dc-tection inefficiency p can be varied in FRANTIC to determine the effects of testing efficiency; when p is set to zero, 100% detection is then effectively assumed.

4.

SUMMARY

OF EQUATIONS The unavailability equations which have been previously given are summarized below for convenient reference.

(1) Constant unavailability components q=q d

where q is the constant, per demanti unavailability d

(2) Non epairable components q(t) = At where A is the constant component failure rate.

(3) Monitored components q = AT R where TR = average detection plus repair time (4) Periodically Tested Components Between test contribution:

q(t) = A(t-T)

Test contribution:

f + (1 pf)q + (1 pf)(1 g )Q qi =p o

o Repair contribution:

f * (1 ~ P )0 * (1 P )(1 - Q) AT q2

• P f

f R

where t = the time from the preceding test T = test interval 2

T = test period IR = repair period Pr = probability of test-caused failure Q = A(T - t) 2 For the first test interval T, the between test contribution is modified to q(t) =

At, and Q for the firsttestismodifiebtoAT the above equations is modified to A(1 p) anb. For periodic detection inefficiencies, A in an undetected contribution q' is added where q' = Apt.

Finally, human o tor and common mode contributions can be handled by using one of the above unavailability expressions (usually q = q )'

d f

7%

Ol'1 8.

INPUT DESCRIPi!.N 1.

INTRODUCTION The FRANTIC code is set up to calculate the unavailability from a system unavail-ability equation or equations. A subroutine called SYSCOM is input by the user and gives the formula for the system unavailability in terms of the component unavailabilities. The formula is obtained from a block diagram, fault tree, event tree, etc. using standard Boolean techniques

[3].

The SYSCOM subroutine may contain any number of system formulas to be evaluated in one FRANTIC run.

Each formula has its own identifying index in SYSCOM.

In addition te the subroutine containing the system formulas, the user must supply failure rate and test data for a FRANTIC run.

This data is broken up into cases, where each case defines the input information for a particular evaluation. The SYSCOM routine is described in Section B.5 a..

the data which comprise the cases are discussed in the sections below.

2.

CASES A given FRANTIC run consists of one or more cases. A case is described by the following data:

- A set of components which make up the system whose unavailability is to be studied.

- An index number designating the system or subsystem unavailability function to be calculated.

- Titles, print and plot option, The data input scheme allows a simple method for running multiple cases whereby only that data which differs from the p.evious case need be entered. The program run terminates when no further cases are detected in the input stream.

3.

DATA GROUPS Cases are described by six sets of data cards which are called " data groups." Each data group consists of a keyword card which identifies the data group, and one or more additional cards. A complete program run can be initiated with three data groups; the other three are optional. The six data groups are described below.

3.1 Data Group 1: TITLE This data group specifies the title for the case to be run.

It consists of a keyword card containing the characters "TITL" in the first 4 columns (only the first four characters need be entered for this and all other keyword cards) followed by a card containing 80 characters of text to be printed as a header on the output report for the case. This data group is depicted in Figure B-1.

Figure B-1 Data Group 1 - Title

/ ESE 1 - AUXILLIARY FEEDWATER SYSTEM B

C A

TirLE PP0G RAM Cols.

VARIABLE FORMAT DESCRIPTION Card Type A 1-4 ANAME A4 Veyword "TITL" Card Type B 1-80 TITLEl 20A4 Title for output tl b

] I 3.2 Dati Group 2: COMPONENTS This data group describes the components which make up the system to be evaluated.

It is identified by a keyword card beginning with the characters " COMP."

This card must be followed by a card beginning with the characters "NEW" or " UPDATE."

"NEW" indicates that the components to be input are to become the effective component set for the case, replacing previously input components (if any). " UPDATE" i..dicates that only the non-blank component parameters are to be used in updating corresponding parameters for previously input components.

Additional components may also be added to a previously existing set ander the UPDATE option.

After the "NEV" or " UPDATE" card, one card must be entered for each component. This rard contains the component number, the component name, and 10 parameters describing the reliability data for the coh.ponent. A number of the parameters will be lef t blank, depending on the type of component.

Under the "NEW" option, component numbers should be sequential, starting with one.

The program will override any violation of this rule and print a warning. The requirement for these sequential numbers is really a check for the user under the "NEW" option.

Under the " UPDATE" option, the component numbers are used as keys to identify components to be updated and non-blank fields on the following component cards replace the old values for the corresponding parameters. A negative number must be used to zero out a paras.eter, effectively making a blank field. The only exception to this rule is the first test interval field T) for periodic components. If T is altered in a change-case and T is 7

j left blank, then T)1 is input for T is set equal to T.,(instead of beTng left the same as in the previous case). Also if a -

in a change-case, T will be set to the current value of j

j T'

2 New components may be added under the "UPDAT; w. ion by using sequential component numbers starting with one greater than the large:,t component number previously input. Deletion capability is not provided. Extra components can always be added since tne system unavail-ability function need only ure a sabset of the input s.omponents. Thus it is valid tc include components which are not used in some cases. (The TIME data group, given later, discusses the use of dummy components to increase the number of time points.)

The 10 parameters on the component cards are listed in the table below:

Component Parameters Fortran Variable Symbol Name Description A

LAMDA Failurg rate per hour in multiples of 10 T

TEST 2 Periodic test interval in days 2

T TEstl First test interval in days if j

different from T2 i

TAU Average test period in hours T

REPAIR Average repair period in hours R

q Q0VR Test override unavailability g

p PTCF Probability of test-caused failure 7

p INEFF Detection inefficiency (probability of not detecting a failure)

A ULAMDA Undetected failure gate per hour P

in multiples of 10 a

QRESID Constant unavailability per demand d

s a

o If p is input as a non-zero value, the program will recompute A as follows:

Aj = A(1 p)

If p is in; and A is left blank, the program will compute A as follows:

A = Ap The 10 parameters described above allow the user to specify most types of component.

under a variety of testing schemes:

Periodically tested components - the user must provide A, T, and optionally, T,

2 j

T, T ' S ' P ' P' A, and q R

o f

y d

Monitored components - A and T must be input; T must be zero or left blank; T,

and p are ignored; and p, and q are opt onal.

If I it i..putitisadddd f

d Nonrepairable components - A, T, T,

t, and T must be ze o or left blank; q p, and q are ignored; and A mbstbeinput.

Iternatively, A may be input i s ad of A. Inthiscase,T shodld be set to a value greater than the total time 2

peri 8d of interest.

Constant unavailability - all parameters except q must be zero or lef t blank and a d

value for g be input.

d The last card of the components data group contains "-1" in the component number field. This indicates the end of the data for the group. The maximum number of components is 100.

The COMPONENTS data greep 1: cepicted in Figure B-2.

3. 3 Data Group 3: TIME (Optional)

This data group specifies the tira period over which component and system unavail-abilities are to be computed. It consists of a keyword card beginning with the characters

" TIME" followed by a single card containing the total time (in days) over which the time dependent, instantaneous unavailability is to be computed. If the data group (including the keyword card) is c.9 t+ M, or if a zero is entered for the time period, the default value, 365 days, t s effect.

The number of time points generated by the code within the time period is a function of the test intervals, testing times, and repair times of the components. A pair of points is generated wherever a change in the slope of any component unavailability function occurs.

For exarple, suppose a particular component has the following time dependent unavailability function:

b l

l I

I

}

l I

q I

I I

I I i

<z 1 I I

g D

l s'

1 I I

s ll ll /

to t 1 t2 t3 t4 t5 t6 TIME a

Figure B-2 Data Group 2 - COMPONENTS D

/ -l 00 DIESEL 42 60 0

1.5 21 C

i

/2 VALVE

.3 60 30 1.5 7

flPUMP 3

30 0

1.5 19 B

/NEW A

COMPONENTS PROGRAM COLS VARIABLE FORMAT DESCRIPTION Card Type A 1-4 ANAME A4 Keyword " COMP" Card Type B l-4 TYPE A4 Option "NEW" or "UPDA" Card Type C 1-5 INDX 15 Component number 6-13 NAME A8 Component name

-6 14-19 LAMDA F6.0 Failure rate in multiples of 10 20-25 TEST 2 F6.0 Test interva' in days 26-31 TESTl F6.0 Length of first test interval in days if different from TEST 2 32-37 TAU F6.0 Averas? testing time in hours 38 41 REPAIR F6.0 Average repair time in hours 44-49 00VRD F6.0 linavailability of the override capability 50-55 PTCF t6.0 Probability of test-caused fa il ure 56-61 INEFF F6.0 Detection irefficiency 62-67 ULAMDA F6.0 Rate of undetected failures in multiples of 10-6 68-73 ORESID F6.0 Residual unavailability i I The program will generate time poin y at t +c, t

c, t +c, t,,-c, t +c, t -c, t +c, j

j y

3 3

.t -e where e is a small number ep ilon (10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />) and t is the tbtal tTme specified in theIIMEdatagroup(orthe365daydefaultvalue). TimepcIntsforalltheothercomponents are generated in a similar manner. All the points are then merged and duplicate points discarded. Component and system unavailabilities are computed at the resulting list of time points.

The time points generated in FRANTIC are based on all the components input in the COMPONENTS data group regardle.ss of whether they are actually used in the system unavail-ability function. Thus, the user can control the spacing of the time points by adding one or more dummy components with shorc test intervals.

The spacing of the time points affects the accuracy of the comp f.ed average (or mean) system unavailability and he appearance of the instantaneous unavailability plots.

The more non-linear the system unavailability, the more time points a,e required for extremely precise evaluations. A lack of sufficient points can cause some distortione in the plots and yield somewhat conservative estimates of the average system uncvailability.

The conservatism occurs because the program computes the average system unavailability by numerical integration using the trapezoid rule (i.e., successive points are connected by straight lines and the area unc'er the resulting function is computed). This method yields the correct area for the contributions to u m ailability due to testing and repairs, but slightly overestimates any contribution due ta failures (the between tests contribution).

Rought upper _unds on the error incurred are given in the table below:

System Configuration Maximum Error Factor doubly redundant 1.5 triply redundant 2.0 quadruply redundant 2.5 As seen, the error factors are not generally large. If order of magnitude accuracies are required, then these errors will in general be insignificant. If desired, the user c d always use more tue points to check the errors made in the particular problem being analyzed.

The TIME data group is depicted in Figure B-3.

Figure B-3 Data Group 3 - TIMES B

/7'0.0 A(TIME PROGRAM COLS VARIABLE FORMAT DESCRIPTION Card Type A l-4 ANAME A4

<eyword " TIME" Card Type B l-10 TEND F10. 0 Total time period in days (default = 365) 3.4 Data Group 4 - PRINT (optional)

This data group is used to request a table printout of the system unavailabilities computed by the program over one or more time intervals (within the input time period) and to specify the number of instantaneous unavailabilities te be separately ranked. The data group is identified by a keyword card beginning with the characters "PRIN."

The keyword card must be followed by one card containing the number of time intervals desired and the number of maximum unavailabilities desired. The value input for the number of intervals may be -1, 0, 1, 2, 3, or 4.

If the value input is negative, all system unavailabilities computed are printeo and no additional cards are necessary. If the value is zero, any print options previously

[)

L specified are nullified and the default option (no print) is instituted. No additional cards are necessary. If the value is greater than zero, another card containing the end points of the intervals is read. In this case the program will print the system unavailability at all the computed time points that fall within the specified interval (s) including the end points.

A maximum of four intervals may be specified.

The maximum unavailability output lists, in decreasing order, the n greatest instan-taneous una.ailabilities computsd by the program. The number of unavailabilities printed (n) has a default value of 12 and may not exceed 100.

If the PRINT data group (including the keyword card) is omitted, 12 peaks are printed, and no other system unavailability printout is produced. The PRINT data group is depicted in Figure B-4

3. 5 Data Group 5 - PLOT (Optional)

This data group is used to specify the time intervals used for plotting the system unavtilability. It is identified by a keyword card beginning with the characters " PLOT."

The keyword card must be followed by a card containing the number of intervals.

If the number of intervals is negative, the plot interval is set to the total time period over which points are computed and no additional cards are necessary. If this value is zero. any plot intervals previously input are nullified and the default plot int?rval is instituted. The default interval is given by:

+ 2T.*

• i + Tg,)

max (T j 2

i i

i i

are the first test interval, second test interval, test where T T2i' 'i, and TRi j9 time and repair time respectively for the ith component. The default interval is thus the three largest test cycles of any component, which is often sufficient for establishing the system behavior.

If the default plot interval exceeds the total time period, then the time period is used instead.

If the number of intervals is greater than zero, another card containing the beginning and end points of each interval is read. A maximum of four intervals may be specified.

Note that unlike the PRINT data group which actually activates the system unavail-ability printout, the PLOT data group merely sets up the plot intervals which are to be used.

Plots must be raquested in the RUN data group in order for graphical utput to be produced.

If plots are re4uested in the RUN data group, one or more plots will be produced for each interval specified in the PLOT data group.

If the PLOT data group (including the keyword card) is omitted, the plot period used is the default interval described above. Data group 5 is depicted ir, figure B-5.

3. 6 Data Group 6 - RUN This data group initiates the system unavailability computations. The TITLE, COMPCNENTS and optionally the TIME, PRINT and PLOT parameters must be set up before the RUN data group. The RUN data group is identified by a keyword card beginning with the characters "RUN."

The RUN keyword card must be followed by one or more run data cart 5, where each card has the following parameters.

(1) system number - number code identifying the system unavailability function to be used (see Section B.5, DEFINITION OF SYSTEM UNAVAILABILITY FUNCTIONS).

(2) unavailability option - four letter code selecting the type of unavailability to be computed where

" FAIL" means compute the instantaneous unavailability based on contri-butions from component failures only (the between tests contribution).

"TOTL" means compute the instantaneous unavailability based on contribu-tions from failures, testing and repairs.

When the unavailability option is left blank, the default value is "TOTL."

u r-a Figure B-4, Data Group 4 - PRINT C

/n.0 60.0 275.0 365.0 B

/

2 24 A

frRINT PROGRAM COLS VARIABLE FORMAT DESCRIPTION Card Type A 1-4 ANAME A4 Keyword = "PRIN" Card Type B l-5 NPRT IS Number of time intervals for printing system unavailabilities

(-1, 0, or 1-0 6-10 NPK IS Number of peaks to be printed Card Type C 1-10 STPRT(1)

F10. 0 Start of first time interval in days (use only when number 11-20 FTNDDT(1) F10.0 End of first time interval in days of intervals is >0) 21-30 STPRT(2)

F10. 0 Start of 2nd time interval in days 31-40 FINPRT(2) F10.0 End of id time interval in days 41-50 STPRT(3)

F10.0 Start of 3rd time interval in days 51-60 FINPRT(3) F10.0 End of 3rd ime interval in days 61-70 STPRT(4)

F10.0 Start of 4th time interval days 71-80 FINPRT(4) F10.0 End of 4th time interval in days

,' / -

Q; (l,__

'OJ Figure B-5 Data Group 5 - PLOT C

/ 60.0 180.0 8

/

1

{ PLOT A

PROGRAM COLS VARIASLE FORMAT DESCRIPTION Card Type A 1-4 ANAME A4 Keyword = " PLOT" Card Type B l-5 NPLT 15 Numt:er of time intervals for nlotting system unavailobilities

(-l, 0, or 1-4)

Card Type C 1-10 STPLT(1)

F10.0 Start of first time interval in (use only days when number of intervals 11-20 FINPLT(1)

F10.0 End of first time interval in days is s0) 21-30 STPLT(2)

F10.0 start of 2nd time interval in days 31-40 FINFLT(2)

F10.0 End of 2nd time interval in days 41-50 STPLT(3)

F10.0 Start of 3rd time interval in days

$1-60 FINPLT(3)

F10.0 End of 3rd time interval in days 61-70 STPLT(4)

F10. 0 Start of 4th time interval in days 71 - P,0 FINPLT(4)

F10.0 End of 4th time interval in days

~l-f,

(3) x-scale - four letter code specifying the scaling of the points r.long the x or time axis where "NONE" means no plots are produced "LIN" means a linear scale is used for the time points

" MAG" means that the time points are spaced at equal intervals regardless of the actual elapsed time between the points. This produces a plot in which the test and repair contributions are magnified so that the structure of the system unavailability function is easier to see.

The indices of the time points are plotted along the x-axis.

"BOTH" means both "LIN" and " MAG" scales are used. Two plots are produced for each y-scale selected.

If x-scale is left blank, the default value is "LIN' when the navailability option is " FAIL", "BOTH' when the unavailability option is "TOTL."

(4) y-scale - four letter code specifying the scaling of thc points along the y or system unavailability axis where "NONE" means no plots are produced (may be omitted if x-scale = "NONE")

"LIN" means a linear scale is used for the system unavailabilities

" LOG" meam a log scale is used for the system unavailabilities "BOTH" means both "LIN" and " LOG" scales are used. Two plots are produced for each x-scale selected (e.g., if x-scale = "BOTH" and y-scale = "BOTH,"

four plots are produced for each time interval specified in the " PLOT" data group).

If y-scale is lef t blank, the default value is "LIN" when the unavailability option is " FAIL," " LOG" when the unavailability option is "TOTL."

(5) plot cutoff option power of 10 to.ge used as a lower bound on system unavail-ability for plotting (e.g., -7 = 10

).

The default is no cutoff.

(6) plot ti;1e - 56 character text to appear as a plot subheading in addition to the title for the case.

A negative system number indicate, tt.e end of the RUN data group. The RUN data group is depicted in Figure B-0.

4.

CHANGE CASES All data groups (except RUN) remain in effect until they are changed. To run change cases, simply modify or add the desired parameters using the appropriate data groups and follow these modifications by another RUN data group.

5.

CEFINITION OF SYSTEM UNAVAILABILITY FUNCTIONS - SUBROUTINE SYSCOM This section describes how to input the system unavailability function (s) for a FRANTIC run.

The input is in the form of a FORTRAN subroutine which has the following forfr=t:

SUBROL' TINE SCCOM(QC, QS, NSYS)

DOUBLE PRECISION QC(100)

GO T0 (1, 2,

, i), NSYS 1 QS = fj (QC)

RETURN 2 QS = f2 (QC)

RETURN i QS = fj (QC)

RETURN END

,7 7

,I

'Oj (jLw

.'igure B-6 Data Group 6 - RUN C /

.)

/ 3 TOTL BOTH LOG -10 ENTIRE AUX-FEED SYSTEM B

/ 2 FAIL LIN PUMPS ONLY l FAIL LIN DIESELS ONLY A RUN PROGRAM COLS VARIABLE FORMAT DESCRIPTION Ca rd Tv.,e A 1-4 ANAME A4 Keyword "RUN" Card Type B l-3 NSYS I3 System unavailab:lity function number 5-8 00PT A4 Unavailability option 10-13 XOPT A4 X-scale option 15-18 YOPT A4 Y-scale option

?0-23 ICUTOP I4 Cutoff option 25-80 TITLE 2 14A4 Plot title Card Type C 1.1 NSYS 13 End of run cards indicator (-1) 7','

7~

\\'

O l_ i where QS is the value of the system unavailability resurned by the subroutine QC is a double precision array of the component unavailabilities at a particular time point.

These values are computed and passed to the SYSCOM subroutine by the FRANTIC program. The order of the components is based on the component numbers supplied by the user in the COMPONENTS data group.

NSYS is the systen unavailability function number input on one of the RUN data cards. It tells the subroutine which system unavailability function to use.

If three functions are defired by the subroutina then NSYS would be an integer between 1 and a 1, 2

, i are statement numbers at.hich i different unavaakility fuictions are defined.3 The definition of the functions may consist of one or more 11.es of FORTRAN code in which y5 is defined as a function of one or more of the components in the array QC.

It is not necessary to use all the values in the array QC since some of them may represent durmy components or components defir.ed but not neeGed for every case The placement of the SYSCOM subroutir.e in the input stream is described in the job control language sectians.

6.

JOB CONfRCL - GENERAL EEQUIREMENTS This sectior, gives a general description of the job steps needed to execute FRANTIC on any computer system assaming that the standard Calcomp routines PLOT, SYMBOL, NUMBER, SCALE, AXIS, and LINE, GRID, and LOGRID are available in object or load module form.

The job steps are.

Step 1:

(only once) Compile the FRANTIC source code to create an object or load modu'le Step 2:

Coscile the SYSCOM subroutine defining the system unavailability function (s) for the FRANTIC run (see B.S. DESCRIPTION OF SYSTEM UNAVAILABILITY FUNCTIC'5),

producing an object module.

Step 3:

Lirk together the FRANTIC module from step 1, the SYSCOM module from step 2, and the Calcomp module.

Step 4:

Execute the module resulting from step 3. using as input the cards described in the DATA GROUPS section.

7.

JOB CONTROL LANGUAGE TO RUN AT NIH Two versions of FRANTIC are set up to run at the National Institutes of Health computer center. One produces printer plots and the other produces Calcomp plots. The turn-around time for Caicomp plots is usually 1 to 2 working days (Monday through Friday only). Printer plots are returned with the regular output. The JCL required for the two types of runs is described in the following sections. The 3YSCCM subroutine and DATA GROUP input are identical for t..e two runs.

These functions are standard reliability equations obtained from block diagrams, fault trees, etc.

(See references 2 cr.d 3 for basic dscussions).

, o,,.

lu- [m) -

7.1 JCL for Cal:omp Plots To produce Calcomp plots submit a WVLBUR file with the following format'

/ / j o!.r are JAP (aana, Ley,*),ra-r

//STrP1 EXFr Fr7CCD'a

//COPP.svstM Dn.

Sur arliTl Fr s ys re"( er, ne, ts ve s

?

Dri'*LF PCECIStre cr(?)

C crter body of 'YFCT* subroutfre Fere r

FFP

/*

// S T r P 2 F y r r r/ L Lr r.q, t l

• Np" r ' D e c'r i" r'> / ** l r. r a t C a" a ', I I "r i c e.on e na r,

// i:9 r r e ! 5 er, P L TP/ '!E

• r lo t r eme

//tro".SYstir D9

//

Dn

• IUCIUDr SYS t I"(M AIN)

F t *T P,Y PI A l t'

/*

//FO.FT0tr v1 na

/ *U FF enter DATt r.R r'1 D f rrit t Fere

/*

where the fields in lower case letters must be supplied as follows:

jobna'ne - the name of the job, eight Characters or less beginning with the user's initials aaaa

- the user's account number box

- the user's box number name

- the user's last name plotname-the name of the plot, eight characters or less beginning with the user's initials.

7.2 JCL for Printer Plots To produce printer plots or to run a job without plots, submit a VfLBUR file wits format:

// J oh name job (aaaa, box,A),name

//STFPI EXEC FDPriC0"*

//CoPP.SYSIN DD SUBROUT I NE S YS coH("e, ns, Ns ys )

C OSUBLE PortlsinN or(I)

C erter body of S YS FF'i sabroutire Fere C

FFD

/*

ry r c l p en [ r em, [ j n e As r. e t.' r r """. F " A C'i r. ra T' t * * ',1 f "9 t # v

• D9 C ' * *

//STFpy

// rT R r = 15 6r

//LCo9.SYtlit 09

//

rn

• l t rtt'a r S vt l t r ("r i +')

FUTav "tir

/*

j - ) */

_/ /

//e".TT65cer) dd.

/*um-

,)

coter "A'A

'"""'?

irrut Part O

/*

Q

//STro3 FvFr tppnraT

• E~TT.[

o JL

_ aj

_ Jt "b where the fields in lower case letters must be supplied as follows:

jobname - the name of the job, eight characters or less beginning with the uscr's initials aaaa

- the user's account number box

- the user's box number name

- the user's last name 8.

LISTING OF SAMPLE INPUT DECK

//vpBFRNTC JOB t wDC C. 3 49, B I,",OL C B F P G

//STIPL fifC FORGCOMP

// COMP.5YSIN CD

• SumRouTINE SYSCOmlGCeu%.NSY56 C

DOUBLE PRECISION CClli r

C*** SYSCCM $UpaOUf!NE FCR A $1N;lt CCMPONENT UN&vAllABILifY C 5

• CC l l )

aETURN C

EN3

/*

/ / 5 f f P2 E X E C C Al t N G'1,L l MN &mt s ' wDCC W4 8.F d AN f !C.C AL C cmp 8,L IPDISK = PD5 co6

//

CURfalSCK,PLTNAME*V"BSAMD

// LOAD.SY5LIN CD

//

CD

• INCLUDE SY5LIBIM&lND INT 4Y MAIN

/*

// GO.F f 0SF 001 CC *

/euNN TITLC SINGLE COMPUNfNT ILAMbOA=9ala**-6. TEST INT =to DAYS, 140=1.5 HRS, REPAIR =19 HR$8 CUMPONfNTS NEu IPUMP l

lo

1. 5 g1

.05 200m4Y o

lo

-1 PRINI I

5 c.o 120.0 oNu 1 Fall UNAvAllAnttiTV CUE 10 FAILUWEh rNt v 1 T0ft BOTH BOTH

-Y UNAVAILA91LifY OUL 70 FAILURF5, if ST I NG. AND REP &lR5

-l

/*

The output proauced by running the above sample problem i$ described in Section C.

3.)

C.

OUTPUT DESCRIPTION This rection discusses the output producci by program FRANTIC.

1.

PRINTED OUTPUT The FRANTIC program produces four output sections which are briefly described below. All output report; reproduced in this section may be generated by running the sample input problem from Section B.8.

1.1 Outpet Section 1 - Input Component Parameters This output is a table containing tha 10 parameters for each component input in the COMPONENTS data group. The table is printed each time a COMPONENTS data group is input.

Under the NEW option, all components are printed. Under the UPDATE option, only the updated components are printed. This output section is depicted in Figure C-1.

Note that the second component in Figure C-1 is a dummy component which has been included to increase the number of time points generated by the program.

1.2 Output Section 2 - Component Mean Unavailabilities This output is a table in which the average unavailability of each component is listed and broken down percentage wise into five contributions. These five contributions are the unavailability due to failures (the between tests contribution), the testing contribu-tion, the repair contribution, the undetected failure contribution, and the constant per demand contribution (where applicable). The table is printed every time a COMPONENTS data group is read in.

All components are listed. Output Section 2 is depicted in Figure C-2.

1.3 Output Section 3 - Time Point Data This output lists the time points generated by the program. The time points are printed whenever a new set of time points is recomputed. This occurs whenever a TIMES data group is input, time-related component parameters are changed, or new components are input.

The time point numbers or indices correspond to the point numbe{g on plots produced with x-scale = " MAG" (see GRAPHIC OUTPUT). Note that if t

's the i time point, the program actually computes the component and system unavailabilities at the 2 points t t and t

+t i

where c is a small number epsilon. Output Section 3 is depicted in Figure C-3.

1.4 Output Section 4 - System Unavailability Data This output is printed every time a RUN data group is input. The average (mean) system unavailability, averaged over the total time period, and the requested options are printed for each run data card in the input stream. The average system unavailability is broken down into the contributions due to failure, testing, and repairs according to the following rules:

(1) If at least one component is under test then the instantaneous system unavail-ability is counted toward the test contribution.

(2) If no components are under test and at least one component is down for repair, then the instantaneous system unavailability is counted towards the repair contribution.

(3) If no components are under test or repair, the instantaneou.

stem unavail-ability is counted towards the failure contribution (i.p., between test contribution).

The contributions to the average unavailability are computed by ir.tegrating over the appro-priate instantaneous unavailabilites (1, 2, or 3 above) and dividing by the total time period.

In addition to the contribution breakdowns, the n highest instantaneous unavailabilities are printed under the heading " Peak System Unavailabilities" where the default value for n is 12.

Other values of n may be specified (see Data Group 5 - PRINT). In the output shown in Figure C-4 the five highest unavailabilities are printed.

If requested in the PRINT data group, average unavailability contributions for each time increment may be printed. These average incremental contributions can be obtained for one or more time increments. In Figure C-4, incremental unavailabilities are obtained for the time period of zero to 120.0 days. The value under the heading "UNAVAIL INCREMENT" for

. -- s 7,..oa 6.=

^ 0 oo AX w3 0o a

. e_.m

w..

m

.a.

D C,-

Jw

.i umQu.m.

1. t g

.e.

L 3 em

.to m

e=

>e.

@ a.n

.b

>.a=

Q&

C L v.*

O

. w~

I L.75 9

6 %)w ra e

~

e b

'P

>7 we OC M-4 w EJM i-

.m

• • s--

I W'

l e 6.m b

g e D /

g e

o e i W

i.

sJ

-f e / 6

=

Q:

a e a w+

{

4

• e

,5 O

I e-e es.== en 4

L i.a i

- i1 4I

.m r

a

>.a m-s.

5 de t % 0

-6 y

C e

i - e a

• +

L q.;

t E.

p=

n L

0 3

g_

i es.==P

.e i w.

.

• r.

U 5

I g hmb-k O

Q "I

y a

e.*.

1e 5

e

-I w

4 4*

4 asem

=0 e e fl

==

0 ** 5 n=*%m L-4 g

u.P m

L.

I to G

.G-a J 3

>-e p

e e e

.e e >- ~.

e p

p 9

s j

==

m>r

-#.>=

&J

)O p

m.

.b y

c. i.

p=

w 5.

W 0

.,>W

.s s

. aw CC a

w 41g

& taa S.E

.D.

.JE

& S n

& Q' dL 9

P00RDilBNAL

.)

l

fipre C _2 Component Mean Unavailabilities s i sct c c omeown* i L a.e ca.. i c.

4, ef sr i.

.i3 Da,s, rav...S s* as,ai, i,,*. s.

• o**e C ePONt%T af as

.44s11apitIftts

• • ee 2........

Com>

0mp r0 fat usa v at t t rF us a v ai t t GF usavn L of u%avait t tw mE51 Dual t Of ak;> B MamE o%a v a i t Out 71 Tav at 00F fn f Uf an Luf TO TO'at Dot in f 0 f at umavait fniai F a f t 06E 5 if51846 Of Palms UNCFF Fall.

1 PV48 1.2191-06 1.376(-31 96.6) 1.0R2t-04 8.F9

%.7%IE-05 4.64 0.C 0.0 0.0 0.0 2 Durav 0.0

• .0 0.C P.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 Figure C-3 Oy Time Point Data e

Q s: %tt. c. a%. N i

.ia-,ca.

sic **-6*

fese ivre>0 env%, v aas i.S a s, e f e a t e.1, we s i

.ir,- e.....

vier iaea *****

Pet Massia Of PO IM f 5 6( 4f e 4 T 5 0

t. /

I't) T at timF P(kIGO 14 HN4 % tiffectTel vul 976F.C30 IHf f l uf Pot %f5 414 M Jtr# % ) at t Pw lNf f 3 #ftfat t =

0.0 7

• 2.4 0 :n *01 se 4.nc70fec2 4 e F.2 Vot*02 7.23%0f*02 F.40%0E*02 7 e 9.6 0 3Cr or P g

1.2 C Oc'

• 0 )

9 e 1.4400f*05 to e 1.44tSf*05 6 =

14 e L.460SE*;)

I?

t.6 9C Ff

• C 4 It =

t.1200f*05 14 a 2.16not*0%

1% =

2.16tSE*04 16 e 2.180%E*01 I?

/.4 0 'O t

• i t 19 7.6460t*01 69 e 2.8so0E*09 20

• 2.eptsf*05 21 e 2.900 %E

• 01

?? e J.1270t*Fj 2$ =

1.14CSfori 24 e 1.6000f*09 2%

• 5.601%F*05 26 1.620%F*05 27 =

t.9 4 ' 58

• J 1 2n =

4.0900f*C4 29 e 4.9100f*09 to =

4.57tSE*01 e

31 e

4. 940%t

• C l 17 =

4.5 6 MF

• 0 5 16

• 4.4 000t *6 9 14 e

%.0400E*09 IS i

%.041 %f *0 5 16 =

• DeOSE*05 t? =

%./ A " 0+

• 7 3 3e

%.%200&*09 59 e

5. 7600f

• 0 9 40 e S.76tSE*01 700%L*05 47

• 6.so OE*05 45 -

6. 7 4 0 't

• 01 44.

6. 44 00f

• 0 B 4% e 6.48t%E*03 41 e

-d 46 *

6. 5 00 S t. e n )

• 7 e

6.72^0t*01 44 4.14Pof*05 49 =

F.2000f*0%

SO =

7.26 t %f *0 5 51 e F.220%E *0 9 e

F.44Ff*:n 49 F.onr0f *C l 54 =

7. 9 7 30 E

• 0 9

%% =

7.92BSE*0%

'l's 56 =

F.9*0%E*05 47 A. 6 6 '0[

• C 4

'A p.4't7F+01 Si e

8. 6400f

• 0 9 60 e 0.64tSE*01 61 e 8.660%f*06 6? =

R.F 6 MF i 31 e

vs L1 Figure C-4 Syst m Unavailability Data S i.ci e t o..n=t = f n a..One is i O..

6 e 1:51 i f olO cavse f oei.9 ale af,aiselt wa n t

• • es* Srnit s umavait atlL I f T Ca t e

• • • • e Sun D*ll)n%s 5T5f ta f eue r I D4 ume-e t t.

P-of Def304%

Cof0f8 D9 50 A 19710%

wompf t OP f l O4 1

T Or f l DN unava lt ag lt g IT Duf 7 0 F a t t ua* 5 0 f t %r l %e e ago af pales inig

• C TM sofu

-f Sisit a af am una v a tt a 61 L i f l E 5 Bf let t 9 Fl au ago 56%.00 Dav%:

Tot al eta v a i t 1 os usa v a i t t Cp umavait t Os me se pu t 10 T 1 T at Duf t>

T Ot at out la t o t al Uta v a it f alt ual 5 f f g T 146 e t 9 614 %

1.7J Ft.C l 1.0651-05 46.6%

t.Ca**-04 G. 72 9.40%f-04 4.45

1. f aa 5T5f f # 04evalt aD it 4 f f t S t PCl47 fief tge 5eg ri a me eent e I ca rg t s wv g p o% e v al g 4

l.006 tf ec t F./l % 01

• F1

%. 0 S 4

'I to 6.00 4 4t e 01 1.4 4 t %f

• 0 5

% ? D*Pt n/

1%

9. 0 0 615 e 0 6 7.161%te9)

4. ? O4 se ; f 20 1.1006f e 02 1.ast%fe35

%.10446-11 1%

1. 90 0 6t

• 0 7 1.4 ? I %t evl s.1048F^2

%*)f f e u%avait ent L 1 t if 5 si t uef4 0.0 A NO 173.co bat 5:

pelgt T f at f l ot t;9a v a l t af u%a ra i t af 0%av a lt.

Pt e( t et Of as t a gumsf a 40av51 s w;iveI T -t P % t t om f et p%It um 1 %( e g et g i 70f at f tpf I

0.0 0.0 1.0 )Cof. j p 7

1.0000 f

• 0 8 J. 4 J^ 0f e C 2 f.? ?T v4

f. 7 ]P0f - 04

1. 0 00 f -0%

2.4947 5

1.0 000f

• 0 t 4.R0^Gfe07 4.44001 -o n

%.,4 0nF -0,1 1.4

9. 0 C not -0 %

f.essC 4

3.0006t e 01 F.10

• 3t e it 1.1610f -e n 3 % 2, - 0 i.%C00f.04 ii.4935 5.004 )F e 0 6 F.7140f ecJ

%. 70%17 - f 2

2. t e 84f -f t J.Ftt0f-0%

7.2%40 F

6 1.0 0%4 t

• S t 7.4 J4 0f

• G 7

2. t 044L Cl

%. fC00f-0%

1.441Rf*01 t.2074 e

?

4.0070f*08

• 4063!*02 f.11 %

• f - 6 4 f.1 % %9f -e4 2.94 t#f -05 2.4969 e

1. 0 000 f - s

.4 ePor *0 6 t.4 59 %t -61 t.4 55%f - el A.962%f-01 f.4447 9

6.OrGt.ect i.4 4 9 Cf

• 01

1. 8 % % %f -O n

%.704mf -07

1. 496 tf.94 t 7. 44 21 la 6.004tf*08 1 44 5 %E o 3 5

%.2 04 4f -02 2.l599f-Cl 2.7108(-0%

2.2%ft i

El 6.0944f 00 L 1.4 6* 4t e 01 1.1939*-05

%. 7000t - n4 L.44 Cat.0%

t.2 000 m

l'

'.0 00 0f

• 0 4 1.4eP0 feen F.1 % % 0t - 0 4 f.1 % %09 -04

p. 94 tat -Og 7.44t9 il 5.0007(*15 4.9/*0! e J l

1. 415 %f - 0 5

1. 41 % % f - S I 0.967%8-0%

?.4647 14 9.00COf ec t 2.h6'Cfeel 1.1 % % %f

• S )

%.704 8f -01 I.496 tt -74 a f.4e i t tg

9. 0 n t ig e f a 1.141%te3)

b. F 94 Al-01

2. t e l9t - C )

7. 710 A f -ci 2.2%fe f

it 9.0 4 94 E *01 1.10'%te0) 1.151 M -C D

%. 7 000f - C 4 1.4 4C A P -0 %

1.2000 a

if B.000 0f e 0 2 7.40 *C E + 3 %

f.1 % % CF - 04

f. 5 5% 9f -04 7.

4)#f-0%

2.4%It le 3.100ef e ct 7.649Cf e E l 1.45%%i-05 1.4 54%E -0 9 8.967 % f -0 %

f.44 4 F

[9 t.JS00fe92 1.caa0 fell 2.1%%%f-0) 1.f G4 0t -02 1.496 5t -04 17.4626 Sv% Tf # uf a4 vtav4f L A911 fif t s ef f et ts 0.0 a%D 110.00 Cav5t f 0f at Uma v a it I De u%a v a i t 3 os 3:r..

t ne 8(44 DH8 1 6

Uut 70 T Cf at Duf to T O f at U4& v a lt falkuet%

f i l l l %G Rf pale $

t.ldlE-Ol 1.076f-01 59.62 tsFilt-9%

6.fr 4.5.%E-C5 5.60 I

\\ L

(

• J l3 -

s if time period i is the area under the system unavailability function between points 1-1 and i divided by the length of the total time period (120 days in this case). The percentage contribution to the avet unavailability over the total period is given in the next column and the last column is the contribution type (T for testing, R for repairs, bla-s for failures) computed according to rules 1-3 described above.

1.5 Output Termination Message If the run terminates normally. the message "END OF FRANTIC RUN" will appear af ter the output for the last RUN data group.

2.

GRAPHIC OUTPUT The FRANTIC program is ca,able of producing fou. different kinds of plots. De plots generated depend on the options specified on the run data cards (see Data Grou, G -

RUN).

The four types of plots are described below.

2.1 LIN-LIN Plot Both the time (x) scale and unavailability (y) scale are linear. This type of plot is shown in Figures C-5 and C-6.

2.2 MAG-LIN P1ot The time (x) scale is magnified and the unavailability (y) scale is linear. The term " magnified" means that all points along the time axis are p1'tted at equa' intervals; the points actually plotted are the time point indices. Since. aort intervals are magnified, the tull structure of the instantaneous unavailability function is more readily visible.

This type af plot is shown in Figure C-7.

2.3 LIN-LOG _Plcf The time (x) scale is linear and the unavailability (y) scale is logarithmic (base 10).

The log scale is useful when availabilities vary by orders of magnitude. This will of ten occur when the "TOTL" unavailability option is used (see Data Group 6 -RUN).

A LIN-LOG plot is shown in Figure C-8.

2.4 MAG-LOG Plot The time (x) scale is magnified and the unavailability (y) scale is logarithmic.

This plot combines the advantages of the MAG and LOG options as described above. A MAG-LOG plot is shown in Figure C-9.

2.5 Cutoff Option Thecutoffoption(seeDataGroup6-RUN)maybeusedto,jnprovetheappearanceof the plots. In Figures C-6, C-7, C-3, and C-9, a cutoff value of 10 y s used for the unavail-ability. This means that values of the system unavailability below 10 are not plottad, thereby decreasing the range shown on the y-axis.

For readable LOG plots, the number of orders of magnitude plotted on the y-axis is best kept to ten or lEss.

l Figure C-5 LIN-LIN Pict, Unavailabilf *.y Ootion

" FAIL" 0.32 0.28 0.24 m

[

l l

3 L

0.20 t

d E

4 E

0.16 l

Z D

lE w

$ 0.12 ti 0.08 t

0.04 1

0.00 I

0.00 20.00 40.00 60.00 80.00 100.00 120.00 ELAPSED TIME IN DAYS l

Fiqure C-6 LIN-LIN Plot, Unavailability Option "TOTt" 0.64 0.56 i

0.48 b 0.40 e

ca 5

A k 0.32 zD 2

Y sn

$ 0.24 0.16 0.08 I

0.00 0.00 20.00 40.00 60.00 80.00 100.00 120.00 ELAPSED TIME.N DAYS

~1 f.,

.)I a,

Figure C-7 MAG-LIN Plot Unavailability Option

" TOT'"

0.64 0.56

(~

0.48 e

e 0 40 d

cc4d j 0.32 2

D 2

N 0.24 C

v, 0.16 0.08 0 00 1.00 3.00 5 00 7.00 9.00 11.00 13 00 15.00 17.00 POINT NUMBERS n'

i

,p g_

~

't Figure C-8 LIN-LOG Plot, Unavailability Option "TOTL" 10'l i

10-2 10'3 Y

/

/

/

l A

I

>2 I

1 I

=

a)

I f

10-4 a

'(

> i O

E Y

C 10-5 M

10 6 e

10'7 0.00 20.00 40.00 60.00 80.00 100,00 120.00 EL/TSED TIME IN DAYS

~

7g7 j' } /

3 Figure Cd MAG-LOG Plot, Unavailability Option "TOTL" 10-1 1

10 2 l

I I

d I

h l

I

> 103 f

f

/

+

i

/

d

/

e<>

$ 104 j

j D

I r

E

?w 10 5 l

106

]

10 7 l 1 00 3.00 5.00 7 00 9 00 11.00 13.00 15.00 17.00 POINT NUMBERS f". L 0 i n.>

D.

APPLICATIONS Four example problems are discussed here to illustrate the range of applications of the FRANTIC code.

The discussion format consists of the purpose of the problem, the input required, the output produced, and comments on the results.

1.

EXAMPLE 1: TEST INEFFICIENCY SENSITIVITY STUDY

Purpose:

To study the instantaneous and average unavailability resulting from different test inefficiencies p (the test inefficiency is defined in Section A, 3.5.3).

Input The system consists of a pump and two manual valves in series as shown in Figure D-1.

The valves are closad for the pump test and the pump and valves are thus treated as being testeo at the same time.

During the test, the pump and valves are unavailable for operation. The same test inefficiency p is applied to the pump and the valves.

(Because of the differences in failure rates, tf.e unavailability contribution from the valves is small compared to the contribution from the pump and hence the valve modeling is not really significant here.) Figure D-2 shows the basic component input (p=0) and the change-case input for p = 0.'

and p = 0.5.

A fictitious component is added to the input to increase the number of time points for the FRANTIC analysis, figure D-3 shows the SYSCCM subroutine describing the system logic.

Output:

Figures D-4 through D-6 show the FRANTIC system unavailability plots (MAG plots) for the different values of p.

In the figures the two s.. aller steps following the large testing spike are the repair contributions which result from the different valve and pump repair times given as input data.

The average system unavailaaility, cogputed over a one year interval, is a!so given with the

'oective figure.

Figure D-7 giv?s the times corresponding to the point nuk in the plots a

COMMENTS When the test inefficiency is not zero, the instantaneous unavailability contin-uously increases with time until a fully efficient test is performed (p=0) which is assumed here to occur at a scheduled shutdown (after approximately 1 year). As the test inefficiency increases, the undetected failure contribution increases and the periodic tests are less effective in maintaining an acceptable unasailability.

As shown in the figures, the average unavailability increases monotonically as the te>t inefficiency increases. From Equations A-18 and A-19, when p is non-zero, the average component unavailability q is appro>imately

- 1 1

(}

9"y A pT + y 1(1-p)T2 + q% + q T-R

?

T2 where T = one year for this problem (the time of the more efficient test).

Since T is generally larger than the periodic test interval T.3, q thus increases as p increases which is observed in the figures.

Using Equation (1), the optimum test interval T isobtainedbyminimizinghwith respect to T.,.

freating g as being approximately indepe8 dent of T and ignoring the rgpair j

2 term, which 2;enerally has a small ef f ect, the optimum test interval T is approximately g

I2 C)

T

=

%ifitI-p) 4Since the reader may wish to recompute these examples, the results are given to more significant figures than would generally be used in practice.

l 'l b' 'I n

5 The unavailability q)this problem (see Equation A-14).

will be approximately independent of T if P or q is much 2

f larger than Q, as in Figure D-1 Schematic for Examples 1, 2 and 3 y;4 VE PJ'P VALVE 1

3 2

Ffgure D-2 Data Group Input for Example 1 7iTLE

• E sart f 1.

T va g g %t e ne. T' h t 1 %tF F IC IE %CY 5F%$17tylfy v

C'J8PbgF % T $

%f e I v al W F

.I 32

1. s 7

l 1s&L Wf

.l le

1. %

7

[

Spump y

4S g, g gg g

e t,i;ma r e

[g

-l 943%f

-4

• L C f I

S. O 900.0 Rum I 70fL

- 8 C ait I - frit l %E 8 61 L i t hC f

• O

-1 Ct mPUsi%f 5

+ rP L 4 7 (

l 0.1 2

0.1 l

-t a.1 ev%

! ! vfl

- 4 L eif / - TE$f [%f F F IC l[ MC y

.[

a

-1 CO*dr% TNT 5 t'PD A I f I

C.9 2

S.5 1

0.4

-l ec4 1 IUIL

-9 CAM 3 - itst 14tfFICit%CT

..S

-1 Figure D-3 SYSCCM Subroutine for Examples 1, 2, and 3 susanur34r syscam e;;c.s,4sy s i c

DOU BL E Precis 10N WCiti c

C as i.-tt.-cctlisest.-vetzis+it.-aciis 4tTV4N f.

C tND J

8, l

e

• l m

o J

9e 7

l '

I L

o m

9 e

Y I E o

6 u

^

l 8

A m

3 l

I m.

T m

e o

]

I I

l [

o, h

p I.

1.

l.

S 5

'S

? c,

~

n o

A H

3 c

N M

O C y)

Ie f i L

g

~'%

E 8

7' y 32 N

2 o

o

.e J

o D s2 it e

-1 u

0-1 i

i i il l I N g c-C 9 L,

L z

b

\\

b m

c m,

8.

s.

a

+>

- ~

9

-s i

i i o

q)

~

~

oe QJ L

o 1e m

e e

o C

7 m

m o9o is i

X o

1 o

i r

e i

i e

i X

I 8

~i i

n n

y m

e

=-

o o

o o

o o

o o

e o,

e e

e-e-

y Ailll8V71VAVNO W31SAS

~7 / '

i) f'j

)i

Figure D-5 Example 1.

Test Incfficiency Sensitivity Study Case 2.

Test Inefficiency p=0.1 (average system unavailabili ty = 3.53x10-3) 10

~ ~'

10' 10' y.

a n

>><m

% J'% J

'd*W 7

} %l l

{

V f

V

10 f

a 5

g 3

4 4 10 2

D E

N 10 sw

-6 10

-7 10

-8 1.00 5.00 9.00 13.00 17.00 21.00 25.00 29.00 33.00 37.00 41.00 45.00 49.00 POINT NUMBERS Le C

_p

' a' 00 94 W'

00 5

4 00 s

1 4

a 0

a 0

y 7

d 3

u

)

t 3

S

'0 0

y 1

0 t

x 3

3

5. 8 i

3 v

i 0

t

= 4 i

p s

=

0 n

y 0

e cy 9 S S

nt 2 R ei E

y il B

6 c

ci n

i b

^

0 M D

e f a 0 U i

fl 5 N e

i na T

c ei 2

ru f

I v NI g

f a

i e

t n 0 O F

n su 0 P I

e T m 1

t e

2

.t se s

T 3 y 0

s 0

ese

,V 7

1 ag 1

C a e

r l

e p

v 0

m a

0 a

(

f, 3

x 1

E

=

00 9

'J 00 5

0 0

0 l

2 3

4 5

4 7

8 1 0

0' 0

0 0

0 0

0 0

1 1

1 1

1 1

1 1

1 ea; ><ZD E#?,u E

y J

1

Figure D-7 Time Point Data for Example 1 Fx4MPLE 1.

TURBINE PUMP - TEST INEFFICIENCY SENSITIVITY

• • • • • TIME POINT DATA *****

THE NUMBER OF POINTS GENERAgr0 62

=

TOTAL TIME PERICO IN HOURS (DEFAULT,1 YR) 8760.000

=

THE TIME POINTS (IN HOUR $1 ARE PRINTEU RELOW:

1 =

0.0 2

3.5000E+02 3 =

7.2600E+02 4 =

7.2150E+02 5=

7.2850E+02

=

7.4050E+02 7 =

6 =

1.0800E+03 8

1.4400E+03 9 =

1.4415F+03 10 =

1.4485E*03

=

11 =

1.4605F+03 12 1.8 000E + 0 3 13 2.1600E+03 14 =

2.1615E+03 15 =

2.1685E+03

=

=

16 =

2.1605E+03 17 2.5 2 00E + 0 3 18 2.8800E+03 19 2.8815E+03 20 =

2.8885E+03 o

=

=

=

21 =

2.9005E+03 22 3.2400E+03 23 3.6000E+03 2,

3.6015E+03 25=

3.6085E+03

=

=

a 26 3.6205E+03 27 3.9600E*03 28 4.3200E+03 29

=

4.3215E+03 30 =

4.3285E+03

=

=

=

31 4.3405E+03 32 =

4.6800E+03 33 5.0400E+03 34 =

=

5.0415E+03 35 =

5.0485E+03

=

36 5.0605E+03 37 5.4000E+03 38 =

5.7600E+03 39 =

=

5.7615E+03 40 =

5.7685E+03

=

41 =

5.7805E+03 47 6.12 00E + 0 3 43 =

6.4800E+03 44 =

6.4815E+03 45 =

6.4885E+03

=

6.5005E+03 47 =

46 =

6.9 4 0 0E + 0 3 4H 7.2000E+03 49 =

7.2015E+03 50 =

7.2085E+03

=

51 =

7.2205E+03 57 =

7.5 6 0 0E + 0 3 53 7.9200E+03 54 =

7.3215E+03 55 =

7.9285E*03

=

56 =

7.9405E+03

>T 8.2 800E +0 3 58 8.6400E*03 59 =

8.6415E+03 60 =

8.6485E*03

=

=

61 8.6605E+03 62 R.7600F+03

=

=

As the test inef ficiency p increases, the optimum test interval therefore increases and the component should be tested less frequently. The system unavailability can be sensitive to test inef ficiencies particularly when the system is redundant and test inef ficiencies compound one another (such as when the same test is cerformed u.i all similar redundant components).

s U m' hk/

2.

EXAMPLE 2: TEST-CAUSED FAILURE SENSITIVITY STUDY

Purpose:

To determine the unavailability effects of test-caused failures having prob-ability p.

f Input:

The system model is the same as for Example 1.

Figure D-8 shows the basic component input (p =0) and the change case input for p =0.1 and p =0.5.

f f

f Output:

Figures D-9 through D-Il show the FRANTIC plots (MAG plots) corresponding to the different values of p, the one year average unavailabilities are included f

with the figures.

Comments The computer run is similar in format to that of Example 1.

It should be noted that Examples 1 and 2 could have been executed in one computer run (in fact all four examoles could have been). Increases in the test-caused failure probability in general cause the test and repair contribution (g and q ) to increase.

When the override unavailability (q,c)ausing is 1, j

2 as in this problem, then only the repair contribution (q increases. In addition to higherpeaksintheinstantaneousunavailability,theavkr)ageunavailabilityalsoincreases as p increases. As the test caused failure p qbability increpses from 0 to 0.5, the average 7

syste.n unavailability increases from 3.39 x 10 to 2.00 x 10 Higher test caused failure probabilities, e.g. p, J.1, can thus impact the system unavailability.

f Equre D-8 Data Group Input for Exrnple 2 TIT 1E rTAMPLF 2.

T U R B I '.: Pt,MP - T r S T-C '.US E D rA! LURES SENSITIVITY C ow nf)1:N T S Ww IVALVE

.3 30

1. 5 7

1 2 VALVE

.1 to

1. 5 7

1 WuMP 3

39

1. 5 19 1

4 DUMMY 0

15

-1 P1 INT I

0.0 180.0 luN 1 Init

-6 CASi ! - P4JUAdfLITY OF TEST-CAUSED FAILUKE

=0

-l film Pil'4 [ N T S UPDATE I

0.1 2

0.1 3

0.1

-1 quN I TOTL

-9 CAS. 2 - P m) B 13 ! L j T Y JF TEST-CAUSFD FAILU7E

.1

=

-1 COMPONFN T S U"DATE 1

0.5 2

0.5 0.5

-1 con I TUTL

-H CASL 3 - Pit) H A d ! L I T Y UF TE5T-CAUSFD FAILURE

.5

=

-l i

t Figure D-9 Example 2: Test-Caused Failure Sensitivity Study Case 1.

Probability of Test-Caused failure p

=0.0 f

(average system unavailability = 3.39x10-3) 0 10 10'l 10-2

'94

'MW, d 10 y

cn I

/

i

/

/

,g Z

f D

1 Y

h 10-5 106 10'7 10-8 1.00 3.00 5.00 7.00 9.00 11.00 13.00 15.00 17.00 POINT NUMBERS 7.. '

1 F_igure 0-10 Example 2.

Test-Caused failure Sensitivity Study Case 2.

Probability of Test-Caused failure pf = 0.1 (average system unavailability = 7.62x10-3) 100 10'l 10-2 10-3 j

a 3

I J

!,,0<

/

/

D E

Y 10-5 m

4 10 f

10'7 10'8 1.00 3.00 5.00 7.00 9.00 11.00 13.00 15.00 17.00 POINT NUM8ERS

)

Figure D-11 Example 2.

Test-Caused Failure Sensitivity Study Case 3.

Probability of Test-Caused failure pf = 0.5 (average system unavailability = 2.00ml0-2) 100 10-1 10'2 h

10-3 e

/

/

e i

i f

f

$ 104 r

5 E

10-5 h

4 10 10-7 4

10 ~

3.00 5.00 7.00 9.00 11.00 13.00 15.00 17.00 1.00 POINT NUMBERS

~1 i;

(,~*

r:

b.,

a 3.

EXAMPLE 3: TEST INTERVAL SENSITIVITY STUDY

Purpose:

To determine the approximate, optimum component test intervals which minimize the average system unavailability.

Input:

The system is again the same as for Example 1.

Figure D-12 shows the basic component input and change case data for the different test intervals. (The same test interval is used for all components.)

Output:

Figure D-13 shcws the average system unavailability versus test interval obtained from the FRANTIC run.

Comments In addition to obtaining time dependent behaviors, the FRANTIC code can be used to obtain average unavailabilities in which the time dependent information is suppressed, as in this problem. As Figure D-13 shows, the optimum test interval for this particular system is approximately 38 days, with different test intervals near the optimum causing little increase in the unavailability (i.e., the optimum region is fairly broad).

Many schemes may be used to determine optimum or near optimum test intervals and a simple one was used hare.

Referring to Equation (2) of Example 1, the approximate, optimum test interval T, for a component is o

and if p is zero, Equation (2) becomes T

2qir

=

o A

Using component data and Equation A-14 for q the value of T for each component can therefore be minually calculated using the above ehu,ation. The FRARTIC code can then be run to investigaie different change case about these initial, optimum test interval values as was done here. Applicable test intervals or bounds on applicable test intervals which are near optimum and which satisf3 practical consideration, can thus be determined. When the system is mor complex and more redundant than the one analyzed here, the system unavailability will depend not only on the test intervals but also on the way the tests are staggered. This will be illustrated in the nett example.

.p

)b oa e

Figure 0-12 Data Group Input for Example 3 YIfLE EsasPLE 3.

Tu#BIME Pump - f t $f 14fERv4L SEN$1fitti?

COmPO4f4f5

%tM iv4Lvt

.)

5 L. i i

1 2vatv1

.)

S

1. 5 7

L IPumP 5

l. S 19 I

40ummV O

-1 eum i 10fL NC%f 40%E CA$f 1 - S D AT TEST INf tewat

-1 CupF0%f%f$

UPcaff 1

30 2

30 5

50

-t som 1 70fL NONE v,4 [

C aif 2 - 30 047 ff 57 I*ffavat

-1 ComPO%thf$

if p 0 A T E L

18 96 B

19

-l egg I fdfL N0%E 40%F Cast 3-37 04V ff %f Ikttevat

-1 CL*PONt %f 5 IsP C 4 f E I

to 2

60 B

60

-i eu=

1 70fL 40%E NONE C&5i 4 - 6C 04r f tST !%f E Rv &L

-i CO*Pomf%f5

(;PC4 f f 8

ISO 2

100 3

190

-i

.u%

1 FUfL 40%E 50%E CASE 5 - IPC ;; A f TE$f INTEnvat

-1 Figure 0-13 Average System Unavailabilities for Five Test Intervals Test Interval One Year Average System Unavailability

-2 5 days 1.26 x 10-3 30 days 3.39 x 10-3 38 days 3.19 x 10 3 60 days 3.64 x 10-3 180 days 8.06 x 10 7 /; J

~

~~~

o v.

4.

EXAMPLE 4.

AUX-FEED SYSTEM ANALYSIS

Purpose:

To determine the effects of different testing schemes on the instantaneous and average system unavailability.

Input:

The system schematic is shown in Figure D-14.

The system consists of two diesels in parallel with a pup; two valves are in series with the pump (the subsystem of the aump and two valves was analyzed in the previous examples).

The model is a simplified persion of one of the auxiliary feedwater system models given in WASH-1400;# the model here contains those major, active com-ponents which are periodically tested. One base case and four change cases are analyzed in the FRANTIC run.

For the base case, the pump test interval is 30 days and the diesel test intervals are 60 days with the diesel tests being staggered; the pump test is assumed to be performed at the same time that a diesel test is perfotned. The four change cases study the effects of 1) test oterrides on the diesel, 2) staggering the pump and diesel tests, 3) staggering the pump and diesci tests with test overrides on the diesels, and 4) staggering the pump and diesal tests with 60 day test intervals used for the pump.

Figure D-15 shows the SYSCOM system function input. The basic component inptt for the computer run is showr, in Figure D-16.

Figures D-17 through C-19 depict the difterent testing schemes investigated.

Output:

The FRANTIC MG plots for the base case (Case 1), and four change cases (Cases 2-5), are showr in Figures D-20 through 0-24.

The times corresponding to the points in the plots are given in Figure 0-25.

Comments

,,dditional output was generated by FRANTIC, i.e., tables, etc., however, the MAG plots graphically illJstrate the effects of the different testing schemes.

The base case testir,g scheme is deggeted in Figure @ l7.

This testing scheme gives an aygrage system unavailability of 6.37 x 10 and a peak instantaneous unavailability of 3.0 x 10 as illustrated in Figare 0-20.

The peak unavailability occurs 12 times a year, at the time of each pump test. For this base case, because one diesel is tested at the same time that the pump is, the ins,tjnte.*eous unavailability during the test is the unavailability of a single diesel (3.0 x 10

).

Thus because of this testing scheme, a triply redundant system is reduced to a single failure system 12 times per year.

The affect of test overrides on the diesels (Case 2) was investigated by changing the diesel override unavailability (q riding the test and placing the dieseis) to 0.1, which represents a 90% probability of over-in operation if demanded. The base case testing schemeremainedthesameandallothercomponentdataremained4hesame. As shown in Figure D-21,theaveragesysymunavailabilitydecreasedto1.11x10 and the peak unavailability decreased to 4.7 x 10 As compared to the base case, the test overrides thus decreased the average unavailability by a factor of 5.8 and decreased the peak unavailability by a factor of 6.4.

For Case 3, no diesel override capability (q = 1) was again assumed as in the ba case, and instead only the testing times were changed Ao that the pump tests were staggered with the diesel tests. The diesel pump staggering scheme is depicted in6 9 U"

thisnewtestingschme,theaveragesystemunavailabilityis2.46x10 and the pea'k unavail-ability is 6.9 x 10 as shown in Figure D-22.

As compared to the base case, the new testing scheme decreased the average unavailability by a factar of 25.8 and decreased the peak by a factor of 43.5.

In WASH-1400, the diesels were included as part of the aux-feed system model because they were in the same accident sequence (i.e., the same event tree sequence). The above results of Case 3 show the beneficial effect of staggering tests not only within a subsystem (staggering between diesels) but across subsystems within the same accident sequence (pump test staggered between the diesel tests). The diesel pump test staggering, involving test procedure changes, resulted in a greater availability improvement than the diesel override change case (Case 2), which might invo!ve design changes. Even if only the peak were 6Appendix II, Page 11-109, Case d., Loss of Net (Start + 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />).

l guy yJ lb' Figure D-14 Block Diagram for Example 4 VALVE RNP 3

r-l W

7

.I l

1 D

a DIESEL 5

Nj F gure D-15 SYSCOM Subroutine f(= Example 4 5URROUTINE SYSCUM(OC.QS NSYS)

C COUBLE PRECISION GClia C

C C5=t1.-(1.-CCItil*(1. "C(7)l*(I.-QCllill*0Cl41*WC15)

RETURN C

C CND

? f-.

~s asa Figure D-16 Data Group Input for Examp'e 4 TlTLf E s aret t 4.

'UE-Pft0 575 fen amALT5tl COMPO45 4f 5 4Ee tvetWE

.9 10

1. 9 7

JgalVf

.)

10

1. 4 L

1 SPUNP l

50

8. %

L it 1

40tf 5f t 42 60 13

1. 5 21 1

%DIf5fL 42 60

1. 5 21 1

60Vamf 0

15

-t P414f L

210.0 240.0 Pl o f 2

6.0 120.0 2LO.0 24C.0 es s

1 f0TL pag LOG

-9 C 454 1 - PtmP-39 Dav%, r d F SF L 5-%r1 Oyf ARICE,%Q Sf 4GGE t t4G

-1 C f >mPS%f =f 5 e tPC & T E 4

0.1 0.t

-1 som 1 Trit paa LOG

-9 C a5E 2 - PsmP-33 C AVie Oll sf L 5-OWf RRIDf e%0 Sf 4GGE 4lNG

-1 C omPDH =f %

1.rP C & T E 4

1%

1

• S

• \\

eum i TGft #4G LOG

-4 Cait 3 - PEP-33 D475. Dif58.5-NO OvfPalOF, mGEaf0

-1 r ampa%t %f 5 s tP O 4 T E 4

0.t C.I

-l an a

l IOTL e4G LOG

-1 ( 4 5( 4 - PtmP-53 G4VS, O f f SF L 3-pWT AR I C(,514GG{ R E D

-1 C Dm p 14t hi 5 t'P0a T E L

60 S3 2

63 11 3

63 10 4

i 1

-1 Pet %T I

'!0.0 273 0 PL O f 2

6.0 120.0 210.0 273.0 SUN I Toft m&G LOG

-9 C&5[ 5 - Pump *67 04T5, OtE5rLb-%r1 rygestDE.5f4GGlefD r a_

% 6

(,. I Y e

Figure D-17 Testing Scheme Illustration for the Base Case DIESEL 1

?

l DIESEL 2 45 i?

PUMP il

'I O

30 60 90 120 (DAYS)

Figure D-18 Testing Scheme Illustration for Change Case 3 DIESEL 1 O

O DIESEL 2 O

PUMP 4) il fl 0

30 60 90 120 (DAYS) 7 (n J

{,\\ t,

r 1

v..) i Figure D-19 Testing Scheme Illustration for Change Case 5 DIESEL 1 O

O DIESEL 2 O

g PUMP da n

0 30 60 90 120 (DAYS)

jq,

/ ( _,

usv

Figure D-20 Example 4 Aux-Feed System Analysis Case 1.

Base Case (average system unavailability = 6.37x10-)

10'l 10-2 3

10 D 104 s

5 10 5 j

j j

4 10 y

1 1

w 1

/

/

/

/

10.,

m

.u

\\_'

/

/

/

/

e 10 u

u L-,_

i 1

1 1

ai

<l

,[

10-9 10-10 __

1.00 3.00 5.00 7.00 9.00 11.00 13.00 15.00 17.00 19.00 21.00 POINT NUMBERS O

O, N

~

8s v*

L 8-n e=

O 9

3 w-5 o

h W

e e-h k $n d M E

L x

-e Q

L

+J uJ e

o> e O

e y

N h

CP g

e ta D

c

- =

y Z D

G-Me

• W L

0 0 e 2

3 A

~

C1 i

O 9 O

x C

Q 1 k

3 3

O*

g y

et A @

s 9 h e

U e O

O c1 O

E L"

e m

x L

Ga D

OO e

oOb N

O A

O N

M T

9 9

D 9

S C

S S

S S

S y

Ailll8VilVAVNO W31SAS r.,

00 72 0

/

0 52 0

0 j

32

/

00 1

2 00 y

9 I

1

/

)

s 6

i s

g0 0

y n1 0

l i x 7

a r6 1

n e4 A

g i,

S i

g2 m

a I

R e

t =

/

0 E

t S

0 B

2 s

y 5

M 2

y pt 1

S mi U

=

0 ul N

d Pi 0 T e

b 0

e ya N

u F

al 3

g Di 1

I O

i x

a F

u 0 v P

A 3 a 1

0 n

/

u 0

1 4

3 e 1

g e

ea sr lp ae 0

m C v 0

a a

9 x

(

E

/

00 7

00

/

5 1

I, 00 3

/

00 s,

01 2

4 9

3 4

5 1

0 0

0 0

0 0

1 1

1 0

1 1

1 1

=b1 <Rs g v>

N gC_

J 7

7

(

Figure D-23 Example 4.

Aux-Feed System Analysis Case 4.

DieselOverridesand30DayPumpStaggering (average system unavailability = 2.40x10 )

100 4

10 10-5 g

,m z

i

_.e

, ),,

o

<mn, m

,, <~'

3, s

)

$ 304 R

I I

I

?

,0 7

/

/

/

/

/

/i

/

/

lE N

/

l d

<i vs 10~8 10-9 10 10 1.00 3.00 5.00 7.00 9.00 11.00 13.00 15.00 17.00 19.00 21.00 23.00 25.00 27.00 POINT NUMBERS

'.')

t.

u

'08 00 3

j 2

a w

00 1

2 0

/

0 9

1

=-

00

)

6 7

1 0

s 1

i x

,)/

0 s

g7

/

y n7

/

0 l

i 5

a r2 1

n e

A g=

S g

R m

a y 0

E 0

e tt B

t Si 3

/

M 4

s l

1 2

y pi U

S mb D

ua N

d Pl 0 T

/

e e

i u

F a v 0 N f,

r e

ya 1

I g

D a 1

O i

x n

P F

u 0 u A

6 m

0 e

0

.t 9

4 5 s

/

y f

e es o

l s

p ae 0

m C g 0

a a

x r

7 E

eva

(

00 5

/

s 00 3

i 00 g

9 01 8

1 3

4 5

6 0

0 0

0 0

0 1

1 1

1 1

1 0

1 N2m ak: Ygm

, p(

COL w

Figure D-25 Time Points for Example 4 Cases 1 and 2

%Y%f f e Umst att ARtt lif f 5 of f m'L%

213.00 4%D 240.00 0475:

ect%f f l at fl*E tW4valt af UNavait af UNav ait.

Pfa(Egf CF Acta NomBtd

'Pavit (HUve53 I-L P5!L dN f *f filt ON 1%CRf uf %T 10T at Typf 99 2.100St*01

%.0490t

• 0 5 1.0t?FF-02 40 2.1006Fe02

%.041%E*31 A 0240E-C2 4.412%F-06 6.2934F-0%

9F.3198 f

41 2.101%E*02

%.c44%E*wn 4.8%91F-06 4.064 5E -06 4.FC16f-OR 0.0 F2 7 a

42 2.10 E%E

• 02

% 06*St*34 4.1449f-06 1.2914f-07 6.8410f-08 0.1040 R

45 2.4094f*02

%.36?%E*05 1.45t2E-OF 2.0FS2E-09 3.7884f-10 C.0006 A

44 2.2%00f*01 4.4J*CE*05 8.900 7E -0 F 9.800 Ff _O F

2. 04 F%[-0 7 0.9198 45 i.40ccE.0i S. 76^0c.a i 4.Fi4it-c6 i.0! r Fr ci 1.19e%r-c6

2. i 6 :3 Cases 3 and 4

% V %if e I A4W Alt #81L i t lE % RFf t%

210.00 a%D / 4 0. 01 0 4 v 5 :

_____.=5............. ___.....__.

POINT TlmF fInt ogavalt 4T u%avalt 4I tahav t it.

Pt #!t %f Of att&

%9mnt4

((: a y % l l + hm ', g i-tp%!LJN f e L p$ g g pg

[ g( et ut g f Iaf Al TYP8 4F 1.1000E*02

5. ;*

• 0i *, l 6.8214F-04 48 2.130AF+02

%.]*l56*))

6.9%445 04 1.F945f-06 1.424*f-06 44.5625 i

4)

. in9%f*72 5.04*%Es31 4.8410F-06 1.539ef-06 1.F6Flf-04 0.6 F6 F R

%4 2.10951*01 S.06*%E*;)

1.6130E-06

%.C2%6E-P4 2.62?lt 09 1.0061 R

48 1.1 % C )f

• 12 S.40^0t*01 2.1516t-06

1. 8 4 89F - 0%

%.66%CE-07 21.6929

%2 1.2%06F*C/

%. 4 21 % f

• G A 1.1144F-05 2.lal4F-04 A.llF9f-06 1.1162 Y

41 l.1494f**

%.4 / 2 5t * ? )

/.%36/F-C6

1. 7 0 4 tf - 0 R F.2622E-SA 2.7809 R

54 2.4300t*02

%. Fb"CE em i

1. 761 % E - 36 6.4234t-^4 4.1214E-07 16.1649 Case S

%v$ffe UNavellA98ttfif% OFimFE1 113.00 a%D 2FC.00 Dav%:

POINT fimf 7848 UNavait af UNavait af U%avait.

Pfp(fgf 0F ARfA NunnE R 10arSi IH304%B t-fPiltCN f *t P % I t rl%

INCRf*E%f i t1T at tvpf 18 1.100Ct*02 9.04*0f

• 0 5 6.9204f-04 19 2.1006f*01 S.341%f*J3 6.h%e4f-04 l. %6 99f - 06 F.12 44f *0 7 2 5.0 74 F T

40 2.135%E*02

%.04

• S E

• 01 l.6619f-06 1.0598f-06 1.7580f-08 0.it 74 A

41 2.1084t*02

%.0665t*03 1.2000E-06

%.CJS6E-CD 2.6082f-09 0.0448 R

42 2.2%C"F*02

%.406 3E * ? l

2. 5%2 6f -06

5. 91 t +f 0 4

2. 8 92%E -O F 9.1740 49 2.2%06f*01 5.4 01 %f

• G l l.1184!-05 2.1966f-06 4.0609E-09 1.l178 f

44 2.2494 fend 5.42?%t*31 2.59626-06 1.7644f-OR l.63tlF-00 1.1760 e

4%

2.4000E *02

%.76501*01 1.7654E-06 t.F61%F-06 1.110 Ff -S 7

6. 8 5^ ?

46 2.54^0f*01

6. t. " 3t

• O 1 F.3 F4 9E -C6 1.1F10f-04 t.1049E-06 15.F820 47 J.4 Sn6E *02 6.l2146*'l 1.1 F % I f - 0 4 F.449If-06 4.1119E-0F l.9%7%

f 48 2.Si94Ee**

6.142%e*?)

F.4 t# %f - f 6 1.0974F-01 L.C68 t t -O F 3.4%92 R

49 2.FOO0f*01 6.4n*Cl*JS l.Sl4 lE *P 6 6.4204l-04

4. lb l4f -O F 11.A091

.I decreased and the average unavailability did not change, the diesel pump staggering would be considered a test improvement because the system is never reduced to a single failure system with the diesel pump test stagoering.

For Case 4, Figure D-23 shows the effect of including test overrides on the diesels, using the diesel pump staggering as in the second change casg. The additiogal improvement is slight;theaverageunavailabilitydecreasesfrom2.4gx10 to 2.40 x 10 and the peak unavailability is not changed, remaining at 6.9 x 10 (the peak instantaneous unavailability arises from the pump test and not the diesel tests). This analysis shows that diesel test overrides have small effect when the pump test is staggered with the diesel tests.

The last change case, Case 5, uses the diesel pump staggering concept but increases the pump test interval to 60 days. This modified testing scheme is illustrated in Figure 0-19.

Ascomparedtothe30daypumptestinterval(thesecondchange,gase),whenF0_ gays are used, the average unavailability increasgs slightly frcm 2.46 x 10 to 2.77 x 10 and the peak unavailability remains at 6.9 x 10 (Figure D-24).

There are now 6 peaks instead of 12 because of the less frequent testing. These results show that staggering of the diesel and pump tests allow less testing to be performed on the pumps with little increase in the average unavailability. Moreover, the reducticn in the number of peaks is a beneficial effect.

The above analyses, though only performed on a simple block diagram model, show the significant effects that different testing procedures can have. The analyses show that the times at which different components are tested can have a large impact on the peak and average system unavailability which are attained. By improving the testing schemes, the system unavailability can be significantly decreased, or less testing may need to be done.

1 /, I REFERENCES 1.

Reactor Safety Study an Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants, WASH-1400 (NUREG-75/014), October 1975, 2.

B. V. Gnedenko, Y. K. Belyayev, and A. D. Solovgev, Mathematical Methods of Reliability Theory, Academic Press, New York, 1969.

3.

R. E. Barlow and F. Proscian, Statistical Theory of Reliability and Life Testing:

Probability Mode s, Holt, Rinehart, and Winston, New Yurk, 1975.

/ /

UNITED STATES NUCLE AR REGUL ATORY COMMISSION W ASHINGTON. D. C.

20555 POST AGE AND F E E S P AIO M

OFFICI AL BU$1NE55

,,N

'tt states s

.ta N

G E M AJL y,.

,,,g,,

,,yy,,,3,

.y PE N A LT Y F OR PRIV ATE USE. $ 300

{

2

\\)

%