ML20151T831
| ML20151T831 | |
| Person / Time | |
|---|---|
| Issue date: | 08/10/1988 |
| From: | Serkiz A NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES) |
| To: | Kniel K NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES) |
| References | |
| FRN-57FR14514, REF-GTECI-B-56, REF-GTECI-EL, TASK-B-56, TASK-OR AE06-1-012, AE6-1-12, NUDOCS 8808180307 | |
| Download: ML20151T831 (106) | |
Text
{{#Wiki_filter:s~ 6 t l
- f.Kf0 %,,
kT UNITED STATES i NUCLEAR REGULATORY COMMISSION i n s! WASHINGTof t, D. C. 20555 l i AUG ! 01983 i fiEliORAliDUf4 FG Karl Kniel, Chief Reactor and Plant Safety Issues Branch 91 vision of Safety Issue Resolution, RES l FR0li: Tleck W. Serkiz, Senior Task lianager deactor and Plant Safety Issues Branch Division of Safety Issue Resolution, RES
SUBJECT:
liEETIfiG F1IfiUTES - EPRI'S EDG RELIABILITY SIliULATI0il CALCULATI0fiS Dr'e: July 27, 1988 Location: Roora 10 B-11, One White Flint tiorth Building Rockville,11aryland Attendees: See enclosed attendance listing. Agenc'a : See enclosed agenda. lleeting
Purpose:
The purpose of this meeting was to provide EPRI an opportunity to present the results of recent calculations dssessing the utilization of a IImited sample size (e.g. 20, 50, 100 load demand tests) to estimate EDG reliability levels and the effects of statistical uncertainties. Enclosures 1 and 2 were provided to the tiRC staff prior to this meeting. lieeting Suraaory: is a copy of the "visuals" utilized by EPRI and ERIf4 speakers. Significant points brought out at this meeting are as follows: 1. EPRI believes that the 20 demand sample is statistically unsound and should not be utilized to calculate EDG reliability-levels for comparison with selected target levels. 2. EPRI recommends using a 50 and 100 demand size sample and to limit data "reachback" to 2 years for a 50 demand sample, and 4 years for a 100 demand sample. 3. A major portion of EPRI's presentation (Enclosure 3) if dealt with using failure rate data to set "trigger" /p) I levels to assess compliance with EDG reliability levels selected for compliance with the Station q"O 7 s esosteoso' esosto POR TOPRP EXIEPRI B PDC
4 t j i i j l K. Kniel Blackout rule. This condition "alert" concept was developed in fiUREG/CR-5078. 4. The "Discussion" session identified 3 different concepts for assessing EDG reliability levels. There were: a) EPRI's "graded" approach would rely on a 50 and 100 demand test dar,a base to assess reliability levels and identify levels of action to be taken. At this point actions associated with the "trigger" levels have not been identified. b) The l(UREG/CR-5078 approach, which is similar to EPRI's approach, is not the same. Appendix A of fiURE'.?-5078, Vol. 1 outlines a concept for interp.ccing failure progression based oli a 20, 50 and 100 demand start sampling. This concept outlines associated alert levels and actions which should be taken. Tracking and calculating reliability levels are discussed in Appendix C of this report. c) f(RL's Generic Letter 84-15 approach which would acceinrate demand testing from once per month to once per wa k until the required level of reliability :is met using a 20 dernand sample size. It should also be noted that the GL 84-15 approach does away with cold fast starts and allows for suitable EDG pre-conditioning such as prewarming, etc. flonetheless, if the EDG has experienced two or more failures in the last 20 demands, the maximum time between tests is reduced to seven days. This test frequency is maintained until seven consecutive failure free demar:ds have been performed and the number of faill:res in the last 20 tests has been reouced to-one or less. Outstanding Actions: 1. A. Serkiz will assemble written comments and/or i questions obtained from NRR, RES and SAI resulting from this meeting and their review of Enclosures 1 and 2, and will forward them to i IlUMARC and EPRI. The extent and diversity of the l discussion sessiori warrants assembling such a package. ~ e e ~wme~
K. Kniel 2. NUMARC plans to continue these EPRI studies (and others) and would like to share such findings with the NRC staff during the B-56 resolution period. Two examples are: a) actions which would be taken based on EPRI's "trigger" level concept, and b) the results of a NUMARC survey of utilities to identify elements of successful EDG programs that result in high EDG reliability. 3. Concluding discussions identified that a proposed revision (Rev. 3) to RG 1.9 has been prepared for issuance FOR COMMENT. NUMARC expressed a desire to obtain a public copy of the draf t Regulatory Guide and to interact with the staff in a manner similar to the resolution of USI A-44. h. Aleck W. Serkiz, Senior Task Manager Reactor and Plant Safety Issues Branch Division of Safety Issue Resolution Office of Nuclear Regulatory Research cc: w/o Enclosure T. Speis, RES R. W. Houston, RES W. Minners, RES A. Thadani, NRR F. Gillespie, NRR W. Schwink, NRR S. Crockett, OGC Attendees Identified on Attendance Enclosure w/ Enclosures PDR ' Central Files
s MEETING AGENDA July 27,1988 EPRI EDG RELIABILITY SIMULATION CALCULATIONS 10:00 - 10:15 Opening Remarks 10:15 -12:00 EPRI Presentation of Calculations 1:00 - 3:00 PM Discussion Period 3:00 - 3:30 PM Identification of Follow-Up Actions
Participants:
NRC, EPRI and NUMARC Staff (see Attendance Sheet) t 1 t
MEETING ATTENDEES July 27,1988 EPRI EDG Reliability Calculations Attendee Affillntion Phone Number Al Serkiz NRC/RES/RPSIB 301/492 3555 Ilarvey Wyckoff EPRI 415/855 2393 Mike McGarry NUMARC/BCP&R 202/872 8226 Alex Marion NUMARC 202/872-1280 W. Joe Ilarnden TU Electric 214/812 8226 Chuck Ondash NUMARC/DEVENRUE 617/426 4550 Bill Layman EPRI 415/855 2013 Jack Burns NRC/RES/EMEB 301/492 5642 R.J. Colmar NRC/NRR/PMAS/ILRB 301/492-3076 J.II. Flack NRC/RES/ARGIB 301/492 3741 E.V. Lofgren SAIC 703/821-4492 Doug True ERIN 415/943 7077 John Gaertner EPRI 415/855-2933 Paul Norian NRC/RES/RPSIB 301/492 3538 Om Chopra NRC/NRR/SELB 301/492 0835 A. Notafrancesco NRC/NRR/SPLB 301/492-1052 Dominic Tondi NRC/NRR/SELB 301/492 0804 Faust Rosa NRC/NRR/SELB 301/492 0837 l
Encloruro 1 EPRI/NUMARC/NRC M:Gting of 7/27/88 Diesel Generator Reliability Calculations 01ESEL GENERATOR RELIABILITY OISCUSSION ELEMENTS FOR NUMARC/NRC MEETING ON JULY et,1988 27 ELEMENT 1: PRESENTATION AND DISCUSSION ON USING LAST 50 AND LAST 100 DEMANDS TO JUDGE EDG RELIABILITY. Discussion of limitations on sample size (reach back and confidence considerations) A detailed methodology for ccmbining start and load-run failure data to give a ccmposite failure figure ELEMENT 2: PRESENTATION AND DISCUSSION ON HAVING A GRADED RESPONSE THAT IS BASE 0 ON EDG RELIABILITY PERFORMANCE. ELEMENT 3: PRESENTATION AND OISCUSSION ON DETERMINING THE 50 DEMAND AND 100 DEMAND FAILURE TARGETS. This is a major topic that includes discussions on sliding sample characteristic and the EPRI/ ERIN Monte Carlo simulations. ELEMENT 4: PRESENTATION AND DISCUSSIONS RELATIVE TO 20 DEMAND FAILURE TARGETS HLW:3350NS8-A
~ THE DIESEL GENERATOR RELIABILITY ISSUE - THE ELEMENTS - ELEMENT 1: USE LAST 50 AND LAST 100 DEMANDS TO JUDGE EDG RELIABILITY Industry believes that an effective way to judge the reliability performance of an EDG is to include in the consideration the number of failures in both the last 50 and the last 100 demands. There are two principal considerations in selecting the number of demands to include. One consideration has to do with the maximum number of demands that should be included and :he other influences the minimum number of demands that should be included. The maximum number of demands that are included determines had far back in time the sample reaches. Clearly it is not desirable to reach back so far that the experience of that time is no longer relevant. Individual EDGt typically experlence something between 25 and 100 start demands per year, and between 12 and 50 load demands per year. A 100 start demand sample for an individual EDG reaches back between 1 and 4 years while a 100 load-run demand sample would reach back between 2 and 8 years. An 8 year reach-back has little meaning and very probably will represent an EDG state of condition that no longer exists. Therefore, for individual EDGs it is judged that a 50 demand load run sample is the largest that should be used unless the reach-back for a larger sample is not excessive. The minimum number of demands that are included in a sample determines how much confidence can be placed in the reliability information from the sample. A sample size of 100 will give excellent representation. A sample size of 50 should yield usable results. However, as explained under Element 4, a sample size of 20 is too small and uncertain to provide useful information. 1
l ) i How to Combine Start and Load-Run Failure Data to Give a Comoosite Failure Fiaure Industry and the NRC have agreed to use the principals presented in NSAC-108 to indicate EDG reliability. In NSAC-108, EDG reliability is defined as follows: EDG reliability = (start reliability) x (load-run reliability) where: number of successful starts start reliability = total number of valid demands to start number of successful load-runs load-run reliability = total number of valid demands to load-run It can be shown that for EDG reliabilities in the range of interest, the following definition is a very close approximation to the above: EDG unreliability = (start unreliability) + (load-run unreliability) If both the start and load-run samples are the same size, the start and load-run failures can be directly added. Fcr any one 100 demand sample, the indicated EDG unreliability is: EDG unreliability = (Start failures) + (Load-run failures) 100 For any single 50 demand sample, the indicated EDG unreliability is: 7 EDG unreliability = (Start failures)-+ (Load-run failures) 50 2
1 The discussions relative to elements 3 and 4 show that there are major statistical complications that must be dealt with. Nevertheless, the starting point for all determinations is the ccmbined number of start and load-run failures in 100 demands, and in 50 demands. The following sections provide specific guidance and comments bearing on combining start and load-run failures. I. For a reliability performance assessment using combined nuclear unit data for 2 EDGs Typical number of demands cer year Start 50 to 200 Load-run 25 to 100 For 100 demand sample, include failures from: Data reaches back Last 100 start demands (0.5 to 2.0 years) Last 100 load-run demands (1.0 to 4.0 years) For 50 demand sample, include failures from: Last 50 start demands (0.25 to 1.0 years) Last 50 load-run demands (0.50 to 2.0 years) COMMENTS: Note that the start and load-run samples each include the specified 50 or 100 demands. This means the start and load-run samples reach back different lengths of time. This is to be contrasted to having them cover the :ame number of start demands and same calender period. The chosen method was necessary to avoid long reach-backs or unacceptably small sample sizes, both relative to load-run demands. For example, with identical calendar periods, a 50 demand start sample might have a 20 demand load run sample. However, as previously indicated, a 20 demand sample is too small and the results too erratic to be useful. 3
II. For a reliability performance assessment using data for individual EDGs. Typical number of demands oer year Start 25 to 100 Load-run 12 to 50 For 100 demand samole, include failures from: Data reaches back Last 100 start demands (1.0 to 4.0 years) Last 50 load-run demands and multiply by 2* (1.0 to 4.0 years)
- It is preferable to use a sample of more than 50 load-run demands (with appropriate scaling to 100) if the reach-back is not excessive.
For 50 demand samole, include failures from: Last 50 start demands (0.5 to 2.0 years) Last 50 load-run demands (1.0 to 4.0 years) COMMENTS: Particularly note the load-run failures for the 100 demand sample. With some plants having as few as 12 load runs per year, the reach-back could approach 8 years. It is not reasonable to assume 8 year old reliability experience is relevant. It therefore seems appropriate to use a load-run demand sample size whose reach-back is not excessive and multiply by the appropriate scaling factor. This figure can then be added directly to the number of failures in the last 100 start demands. HLW:3850NS8
ELEMENT 2: INDUSTRY RECOMMENDS A GRADED RESPONSE THAT IS BASED ON EDG RELIABILITY PERFORMANCE Industry believes that it is desirable to have a graded reliability program structure that is suitable for a range of plant EOG reliabilities. The graded response approach would require a varied level of response by the utility, depending on the observed EDG reliability. With this approach, exceedence of only the 50 demand failure trigger, or only the 100 demand failure trigger signifies marginal EOG reliability performance and justifies certain additional utility actions (see Element 6). Exceedence of both the 50 demand failure trigger and 100 demand failure trigger justifies more extensive actions (see Element 7). The exceedence of either the 50 or 100 demand trigger will provide an early warning that a problem may exist. This will give the plant a chance to come to grips with the situation and hopefully prevent exceeding both the 50 and 100 demand triggers and the need for more extensive corrective actions. A graded response approach, based on EDG reliability performance, creates the p-oper incentives for maintaining good EDG reliability. It should eliminate surprises and the need for more extensive remedial actions by providing advance notice of problems. Moreover, for plants that have their EDG upkeep under control, there should be only a minor cost impact. For plants with acceptable levels of reliability performance, little change would be required. If their reliability is acceptable, their maintenance is acceptable. They would be asked to keep certain performance records, evaluate cases of observed failures and correct any comonalities in the observed failures. Marginal plants, those who have exceeded either the 50 or the 100 demand failure triggers, would be asked to review the observed EDG failures and identify actions to address these failures. Any plants whose EDG's exceed both the 50 and 100 demand failures targets would be asked to take more I extensive actions. l l l HLW:3850NS8-2 i
ELEMENT 3: DETERMINING THE 50 DEMAND AND 100 DEMAND FAILURE TRIGGERS NUREG/CR-5078 introduced the concept of using failure rate triggers to assess compliance with EOG reliabili'y goals. Elements 1 & 2 endorse this concept. Element 1 discusses certain situations that must be avoided including excessive reach back and unacceptably small sample sizes. It also describes a precise methodology for determining a single overall failure rate from start and load-run failure rates. This methodolcgy has been crafted to avoid the reach back and small sample limitations. Using these methods a plant will be able to determine the composite number of failures (start & load-run) that occurred in the previous 50 demands and the composite number of failures that occurred in the previous 100 demands. But what number of failures is acceptable and what number is excessive? For a goal of 95% reliability, what maximum number of failures is acceptable in the last 50 demands? What is the target? Also for a 95% reliability goal, what should be the failure target for the last 100 demands? Likewise, what should be the 50 demand and 100 demand failure targets when the goal is a 97.5% reliability? While at first glance the answers to these questions would~ appear straightforward, they are not. In fact, determining what the failure targets should be is a complex undertaking. Two phenooenon account for the complexity. They are 1) statistical uncertainty and 2) the sliding sample technique that is used, and for which there is no obvious alternative. In particular, using a sliding sample can cause order of magnitude overestimates of unreliability if the methodology is not correctly understood and the results interpreted appropriately. The next section discusses the peculiarities of the sliding sample. The Sliding Samole The monitoring of nuclear plant EDG reliability is characterized by an inherent small amount of data. EOG's typically start between 25 and 100 times per year, with the average at 50. They typically load-run between 12 and 50 1
times per year, with the average at 30. Thus, sufficient data is not available to acquire multiple independent samples of useful size. A single load-run sample of even 50 demands can reach back 4 years and a 100 demand sample can reach back 8 years. The small amount of data leads to both statistical uncertainty and to long reach-back times that include data for an EOG state that may no longer exist. The sparsity of data situation is aggravated by the desire to have a continual update on EOG reliablity. It has come to be that this update is made with each new demand. The desire for a continual update, along with the small number of demands per year has led to the use of a sliding sample technique. With this technique, each sample has been formed from the previous sample by replacing the oldest demand with the latest demand. With each new demand, an indication of reliability has been sought by counting the number of failures in the previous 50 or 100 demands (or whatever is the chosen sample size). For the sake of this discussion and example, a 100 demand sample will be referenced. In doing this, each new demand has been treated as giving rise to an entire new sample of 100 past demands. The probability of having more than X failures in the last 100 demands, accompanies each new single demand--all 100 of them. Thus, the way the arithmetic has been done, the probability of exceeding X failures during 100 demands, actually has been determined in a way that yields the probability of exceeding X failures in 100 samples (not one) with each sample having 100 demands. This is because a new sample of 100 past derands is brought into being with each new demand. A simple numerical example can show the combined effects of the sliding sample technique and statistical uncertainty. Assume that an EDG's underlying unreliability is 95%; in an infinite number of demands, 5% would be failures. However, these failures will not occur exactly every 20 demands. 2
Some intervals will be longer and some shorter. Even though the underlying reliability is 95%, in limited sized samples, there will be variations in the number of failures observed. Some 100 demand samples will have less than 5 failures and some will have more. It ca" be shown statistically that for an underlying 5% unreliability, there is a 38% chance that o!Le sample of 100 demands would include more than 5 failures. This means that for 100 samples each having 100 demands, 38 of the samples (.38 x 100) would include more than 5 failures. However, with the EDG sliding sample technique, 100 demands are synonymous with 100 samples of 100 demands. Thus, in 100 demands, one would expect to have a 5 failure exceedence (of the previcus 100 demands) 38 times. This averages to be an exceedence every 2 to 3 demands. These conclusions, which have been confirmed by Monte Carlo based simulations, may at first appear counter to what appears to have been observed. However, the truth is that the statistical behavior of the sliding sample technique has been obscured by the use of common sense in judging what has been observed. In practice, most of these exceedences have had little meaning for a very understandable reason. They have been exceedences caused by an old group of failures that still were inching backward in the last 100 demands, while the current new demands were successful. While statistically these are exceedences, practical good judgement has recognized that successful new demands are favorable, even if there is an old exceedence somewhere back in the last 100 demands. i l Now industry and the NRC are striving to assure EDG reliability by a more structured approach. It would seem important that the means of determining compliance with reliability goals should be better defined, so that both industry and the NRC understand and agree upon how compliance is to be determined. Industry has worked to develop such a methodology. It is l described in the sections that follow. l l l
Selectina the 50 and 100 Demand Failure Tarcets The inherent small amount of data and use of sliding samples create major complications in selecting failure targets for nuclear plant EOGs. Nevertheless, no sampling alternatives are obvious when it is necessary to reassess reliability with each new demand. This means that the capability had to be developed to analyze the sliding sample situation so that targets could be selected. This capability was developed by ERIN Engineering and EPRI. A particularly important aspect of this effort was a determination of the level of incorrect and missed exceedences that can be expected solely due to statistical variations. Such statistical variations would be small and not be significant if the samples were very large (hundreds of demands). But with sample sizes of 100 demands and 50 demands, statistical variations are an important factor. These come about because failures are not exactly evenly spaced in time. For the exact same underlying unreliability, different samples of 50 demands (or 100 demands) will encompass somewhat differing numbers of failures as normal variations. It is important not to penalize plants for normal statistical variations; that is to ignore normal, favorable statistical variations, but claim an exceedence when normal but unfavorable statistical variations occur. Similar considerations also apply to missed exceedences. One must balance the failure trigge.'s so that a poor performer is identified in a reasonable period, even allowing for favorable variations that can be expected. Another practical matter that was addressed had to do with deciding when an exceedence is really important. This relates to the question of how to keep score when a cluster of old failures, whose number constitutes an exceedence is moving backward through the sample, while at the same time the new demands are successes. It ultimately was judged that the exceedences that count are those thct occur when the new demand is a failure (and triggers an exceedence or extends a previous exceedence). These are the exceedences that trigger the l 4 l i L
need for corrective actions. These are the exceedences that should be considered in determining failure triggers. Stated another way, the quantity that should be understood is the expected number of new exceedences, not how many times a previous exceedence is in effect at the time of a successful new demand. The Monte Carlo Simulation Neither EPRI nor its consultants are aware of any statistical analytical method that readily can be used to predict expected numbers of EDG failure exceedences per year. But to select failure targets intelligently, precisely such information is needed. This information is needed for a spettrum of combinations of assumed 1) underlying reliabilities, 2) sample sizcs, and 3) numbers of failures ' hat constitutes an exceedence. The answer was to develop a Monte Carlo method of simulating the sliding sample technique, so as to predict EDG new exceedence behavior. Monte Carlo simulations were run for assumed underlying EDG reliabilities of 90% through 99% in 1% increments. For each of these underlying EDG reliabilities, three sample sizes were evaluated, 100, 50 and 20. For each of the above combinations a range of assumed failure triggers was examined. For the 100 demand sample 8 failure triggers were examined; these were 3 through 10 failures in 100 demands. For the 50 demand sample, 5 failure targets were examined; these were 2 through 6 failures in 50 demands. For a 20 demand sample, failure triggers of 2, 3, and 4 failures in 20 demands were simulated. The following table summarizes the 50 demand sample and 100 demand sample failure triggers that were simulated. The 20 demand sample is more fully discussed under Element 4. l 5 l
POTENTIAL FAILURE TRIGGERS - X OR MORE FAILURES - 50 Demand 100 Demand Samole Samole 2 3 3 4 4 5 5 6 6 7 8 9 10 Note: Each of the above was simlulated for underlying EDG reliabilities of 90-99% in 1% increments. In order to help maintain perspective, the simulation assumed 50 demands per year. The fifty demand sample is synonymous with one year and the 100 demand sample with two years. One can translate between years and any sample size in this manner. Each simulation was run for ten years prior to time zero to bring the data to equilibrium and to attenuate startup effects. After time zero, the simulation was run until a failure initiated or extended a target exceedence. The year after time zero when this first exceedence occurred was noted. The Monte Carlo simulation was repeated for each combination of conditions at least 500 times and the results merged to give the distribution of exceedences as a function of year after time zero. The randomness of each run was achieved by utilizing the computer clock as the random number generator seed value. Results from the Monte Carlo Simulations The simulations provided a first-ever chance to see what results from the EDG sliding sample technique mean and how they should be interpreted. The magnitude and importance of the increase in cumulative probability of exceedences with time is a matter of the greatest importance. ( 6 i
The selection of failure trigger values requires the consideration of both the solely statistical variation exceedence rate that can falsely penalize good performers, and the solely statistical variation missed exceedence rate that can allow a poor performer to go undetected. The approximate criteria that were used to balance off the potential for statistical variation caused incorrect and missed failure exceedences were as follows. The goal was to hold the probability of incorrect exceedences for 97% underlying reliability plants to less than 10% per year. The goal was to keep the likelihood of target exceedence for 93% underlying reliability plants at greater than 50% per year. These are referenced to a plant whose target is 95% reliability. Similar criteria were developed for plants whose reliability target is 97.5%. For underlying EDG reliabilities below 97%, the cumulative probability of target exceedence rises rapidly with time. This rise is sufficiently steep that it must be a factor in selecting failure trigger values. For this reason, rough criteria were also set forth pertaining to target exceedence within 3 years. The goal was to keep the 3 year incorrect exceedence rate (that is caused solely by statistical variations) for 97% underlying reliability plants at less than roughly 25%, and the likelihood of target exceedence for 93% underlying reliability plants at greater than 65%. The results of the Monte Carlo simulations indicate that the failure trigger values shown below are best in yielding a reasonable overall balance between statistical variation caused incorrect and missed exceedences, and in meeting the criteria that were set forth. 7
t RECOMMENDED TRIGGER VALUES EXCEE0ENCE TRIGGER VALUES RELIABILITY TARGET FAILURES IN FAILURES IN 50 DEMANDS 100 OEMANDS 0.95 5 8 0.975 3 5 These failures trigger values would be expected to perform in the following manner. 5/50 Failure triqqer For units > 0.97 reliability < 7% per year Statistically caused incorrect exceedence rates <16% in 3 years For units 5 0.93 reliability Exceedence rates >55% per year >87% in 3 years For units 0.95 reliability Exceedence rates = 28% per year = 55% in 3 years This target is an early warning for the 8/100 target >80% of time i I
8/100 Failure tricqer For units > 0.97 reliability a Statistically caused incorrect < 3% per year exce.edence rates < 6% in 3 years For units 5 0.93 reliability Exceedence rates >60% per year >84% in 3 years For units 0.95 reliability - Exceedence rates = 26% per year = 47% in 3 years 3/50 Failure trigger For units > 0.985 reliability <12% per year Statistically caused incorrect exceedence rates <25% in 3 years For units 5 0.965 reliability Exceedence rates >45% per year >80% in 3 years For units 0.975 reliability Exceedence rates = 27% per year. = 55% in 3 years This target is an early warning for the 8/100 target >85% of time 9
5/100 Failure triacer For units > 0.985 reliability - Statistically caused incorrect < 8% per year exceedence rates <12% in 3 years For units < 0.965 reliability - Exceedence rates >40% per year >65% in 3 years For units 0.975 reliability - Exceedence rates = 20% per year = 37% in 3 years ) Figures are included herein that show the cumulative probability of exceedence, as a function of years, for the recommended trigger values, and for a selection of other trigger values that were examined. These figures show that even EDGs with excellent reliability can expect to have an exceedence before too many years purely from statistical variations even though their underlying reliability is acceptable. For EDGs whose underlying reliability is 95%, the recommended failure trigger values appear highly liikely to cause an exceedence within 5 to 10 years. This is most undesirable, but a practical, direct means of preventing the ever increasing cumulative probability of incorrect exceedences with time is not apparent. The graded response approach is one way of at least accommodating the inevitability of cumulative probability. While one cannot stop cumulative probability from triggering an incorrect exceedence, the graded response approach provides an alert. With this alert a plant can move to further improve so as to compensate for cumulative probability, or to take corrective actions when a real problem is identified. With a graded response, this alert requires only limited actions and provides a chance to understand the situation. Exceedence of both triggers would be needed to require major 10
corrective actions. It is doubtful that a double exceedence would come about solely because of normal cumulative statistical variations. Those pursuing this topic are encouraged to refer to a report prepared by ERIN ENGINEERING for EPRI: "Technical Bases for EOG Reliability Program Trigger Values", July, 1988. The failure trigger analyses described in the ERIN report serve as the basis for the recommendations made herein. The report provides further insights and additional detail on this topic. This effort links NSAC-108 to a araded response approach to assurina EDG reliability In resolving the Station Blackout Issue, industry and the NRC agreed to use the principals, methodology, and criteria for judging EDG reliability that are set forth in NSAC-108. Wh!.; is described herein is the methodology for linking the output of NSAC-108 to a graded response EDG reliability approach. NSAC-108 articulates criteria for judging whether a demand is a success or failure. These criteria remain unchanged. The methodology in NSAC-108 is based on the principle that overall reliability is the product of start reliability and load-run reliability. This principal continues to be in force. It is at this point that NSAC-108 stopped. The next step has been to determine how the results from NSAC-108 should be linked to a graded response approach for assuring EDG reliability. This linkage is the function of the methodologies that have now been developed and are described in the preceding pages. 11
6M e 9 __g N M T d b o Q m m m m m 9 9 m, 9 2 .{ d d d d d o o o o o 4 { + 4 4 i f cll 4 1 -N -n __n z g _n 4 -2 _m o z \\ _g u. 3 o U gw __ c o = dzd gw \\ gSE _~ = 0 m d E W 3. m ~e g ~ w>Ua k R o u. \\ _o w \\ a m k 2 O I a s n o i m N O \\\\ g \\ n \\ \\ ->e '{ \\ -15 \\ \\ N il E \\ _s \\ s 3 \\ j-N,E s s _e .l s \\'h'N N ^ 's _n ' s,. 1( 6 A%. 'Y.: 'r, l 6 6 i Wbd pa z hO i og a 20 O o DC
- M; O Q.
W l
6 9 e Cn CD 01 Cn Cp Cn Cn Cn Cn Cn d d d d d d d d d d i f 4 4 4 1 + 4 4 5 s --g ll r -g a g Il s is s k -y E 1 \\ li is A !s ( j \\ 's g o. I \\ s z s a b<a o[sa tw ( o oo l t \\ = d zsn o a MW l \\ \\ -a g8Z a a gag \\ -: = il \\ ., d
- a. x m
\\ p wp n a k s[c,6 E ii s o \\ 5=50 6 "\\. N m; 2 O l \\ \\ o 2 ->i N a o 's m a\\ N 0 g .\\.N -i,q T N -s 3, a 'b'% .N \\ N s \\ \\ N e a N N. N t a A N., w_ 4,' N. \\ ~~ ~ s 4 4 4 4 4 4 4 o o o o o o o o o o pa z 55 e og d EebW u 0. w
O E o m Cn el C1 c) Cn Ut 01 01 Cn d d d d d d d d d d i k 4 4 4 l k N I n --g ll \\ 4 -g s a 11 \\ { --g a a S 4 -n s i \\ ( a s I \\ ( --N >a m \\ \\ ( 'o a I \\ ( -N no a ( -N ia u ( .a s \\ \\ L k 3 -R o ia u tw 1 ( o a -oo g g ( =! z o a s mW \\ \\ ( -b g8E q i s ( -: q gag s s o = ( . w mxm j \\ m\\ wm a 3 w ( -2 a 2:bq a m w w \\ \\ ( n. $w$m .i a g m ( --5 R t a a\\ m o s ( m 2 6 s N o s ( -2 m b\\ a\\ 0 ( s k- -e a N N (- -- a l x x (- -- s q (- -o N s\\ a (- -< a s N N \\- -n a a N[N 'b.I~~- N p 4, m o o o o o o o o o o p _s, a z $g 0 o EebW u a. w L
2 3 4 5 6 7 8 9 0 1 9 9 9 9 9 9 9 9 9 9 0 0 0 0 O 0 0 0 0 0 + + + D =. 0 [ $i3 T 8 _~ 0 i 2 _ W U T 8 i 2 A T 7 i 2 1" 8 g i 2 T 5 i 2 ~ 4 0 4 2 f 3 i2 ) S 2 4i2 D D N 1 4i2 U A F M 0 te2 0 O E + D YE o U i t T IC0 + 8 L N5 g e 1 IBE 7 ADN O + BEI / 1 R C E / + 8 R OES g i 1 A PX R g + 5 E i Y E 1 U E / + V TIL 4 = g e 1 iEA e + TGF 3 AR g i 1 L A E + 2 U TR e 1 x. M O ~ 1 U M i 1 C +~_ o R G, i t O ee 5 / ( g! aia i7 G es 'y-a5 e4 <jB i3 if i2 / 8l Ee1 1 0 9 a. 7 8 4, 3 m 1 0 O 0 0 a 0 0 E EYTC VTIE T LG N I E I ABR D L AA U B TE E MG RC UR CP O X E
'I 1 2 3 4 5 6 7 8 9 9 9 9 g 9 9 9 9 0 0 0 0 0 0 0 0 0 + + + D = 0 [ i3 9 D = t2 t2 8 g = = t 7 2 t2 8 J V# K D = tS 2 G l42 3 = l = 2 ) H= 2 S g l 2 D N 1 t F, J 2 A F M 0 l E ? J O 2 D 9 YE ~ j 1 ~ 1 T ._ + IC0 8 LN5 5 g 1 IBE 7 ADN . i 1 BEI - 8 R OES l7 A RCE - 5 E PXR l Y - 1 E U E L 4 VTI 1 1 IEA TGF 3 i p AR 1 L AE 2 _ i UTR 1 M O 1 U M 1 C 0 I R 1 O I8 6( I5 I7 I6 ?5 ?= 4 ?3 y Y2 D 1 ~ e. 5 7 8 4 3 1 t. O 1 0 0 0 o 0 0 a o E EY T C VTIE TLG N I E I ABR D L AA E U BT E MO FC UR OX CP E
CUMULATIVE PROBABILITY OF TARGET EXCEEDENCE (4 OR MORE FAILURES IN 100 DEMANDS) 1 -x 2_ u--u i:l=ts-"-"-"- ,_,_. E.rE E 8 <e ,./ ,s' 0.e -" u / O.n-- ~ 0.9 0 .f + 0.91 o.7-. ./ /
- 0.92 e
a o.s-- [ + 0.93 / CUMULATIVE p 4 0.94 PROBABILITY "p o,_ = 0F TARGET - 0.95 EXCEEDENCE 3 s' + 0.96 o.4__ = / r' -D- 0.97 ,/ o.3-- p .. 0.9 8 7 / ^ O*00 ,s /* / / /' o.1 -- p / a l l l-l l l l l l l l l !l l l l l l l l l l l l l l l l 1 2 7 4 S S 7 8 9 to 11 12 13 14 IS 18 17 18 18 20 21 22 23 24 25 26 27 28 29 30 YEAR
l CUMULATIVE PROBABILITY OF TARGET EXCEEDENCE (5 OR MORE FAILURES IN 100 DEMANDS) 1- -.-- n...... 3a =e=e=w-a-a-a+ A~ 7 / >,g g,G-D ~ I ' O.S ,,. = o' s '..- 0.8-~ / ~ 0.90 c.7- ./ + 0.91 7 ,f
- 0.92 G
./ + 0.93 / CUMULATIVE "/ _x. 0.9 4 PROBABluTY ~*~ 0F TANGET EXCEEDENCE ./ - 0*95 =' _G + 0.9 6 o,4_ -D- 0.97 ./ a.3... O,9 8 / - 0.99 o.2 -- / e"" y / w. .m.= A A # p D.1 ^- ,.= # y J'== # P G "s "s 'a s' 'a a' s a s 6 s s a a a a s a a a s 1 2 3 4 5 s 7 8 9 10 11 12 13 14 15 le 17 ta 19 20 21 22 23 24 25 28 27 ~3 29 30 YEAR m
+B l l 0 e N M T in to 5 53 Cn L73 m Ut Un Cn 01 Cn Cn 01 U1 d d d d d d d d d d i k k i k h N i 1 3 --g q ( --g a s \\ \\ (--a n q 4-q s 4--: i q s. 1--: q 1 (--a s q 4--: s g } g (- o o a z l \\ 4--E s g q 4--a o g a tw b 4-ago s \\ 4-o a e gw- ] {--b g@z i e g% 1, {--= = '$e L k t--n@ o N \\ 4--: Wes jed ,3 1 k 4--e 05e k <--= EgI \\ 1 N. <--e = N N.N o %x 8 4 -. k 4 -s a'N \\s 4-. x x 5-m I G E \\ 1 4 ) a N,m \\ W N a\\ -a N.i }m \\.((- p\\\\ i 6 i 6 i 6 6 i sk d b A3 05 $mm o&#a Ee'$ c> c' ' 0
2 3 4 5 6 7 8 9 0 1 9 9 9 9 9, 9 9 9 9 9 0 0 0 0 o 0 0 0 0 0 ~ + + + U 0 A_ 5 3 j 4-L 9 r J 4 2 g a.. 5 h._ 5 2 7 h_ M 5 2 L 8 5 2 L 5 I2 4 n_ g .I 2 L 3 82 ) .42 S 2 h_ } A D N 1 0 42 A F M k 4 o, O E 2 D 9 YE 13 } 5 1 C 0 T I LN 0 1-5 E 1 I 1 BE 7 1 AD N 5 1 n ~ BEI 8 R OE 1 4 A 1 RCS PXE L 5 EY 5 ER 1 E U L 4 VTL I 1 IEI 3 TG A / 2 AI ARF 1 LAE g LI U TR 1 -I M O 1 1 U 1 M 0 C 15 1 R O 7 G L49 / L88 ( g[ = 167 146 G =. g / 145 o y,' 144 L83 42 o/ )1 /- _a g_41 x,. L-O t. 5 7 8 5 s. o o o 8 o o 1 E EY T C VTIE TLG N I E I ABR D L AA E U BTE MO FC UR0X CP E
O h 9 9 9 9 9 9 9 9 9 9 o o o o o o o o o o i Y 4 4 4 I i 4 4 i '-8 l 1 1 JJ 3 i -A W j q 5 -n [ q j a jf -N e a j q = f-5 -= a M l \\ l -N m j' 3 sf 3 i -a m a y [ R O hw q a \\ \\ DNa o a gw-q t -b $0E a a g .1 t gum A = 'de 1 5 w a i l - >- 2:b:d '-2 a.. I 3EI .c i Le osg ,l.. 2 l a a B1 3--:# M l 3.a - I o i ai-o ( B *i-a h 5... -s a e k f. i ,\\ \\ s<-a ' +\\ I i U N,. _ f sy ~, - - i, 1 o = = n n x n n o o o o o o o o a 5a05 5mm a 255w 1owd Um oX I UA w l [
i 2 3 4 5 6 7 g S 0 1 9 9 9 9 g 9 9 9 g 9 0 0 0 0 o 0 0 0 o 0 + + + 0 ^- 0 i3 9 U e2 8 o - e2 7 j i a 2 8 0 a2 5 0 i 3 4 0 ,e2 3 D 2 ) S 2 = 2 2 D N 1 - i2 A F M 0 i O E p 2 D 9 YE M e 1 T C 0 I 8 LN 0 1 I 1 BE 7 AD N 1 BEI 8 R OE a a 1 A RCS E PXE 5 ER o Y 1 E U 4 V TL o_ i 1 EI ITG A 3 ARF i 1 L AE v 2 U T R e 1 M O 1, A U M C 3 0 . a 1 R O a9 9 ( e8 ~ a7 y-eS ..aS _e 4 ~ a3 D.e2 k,e1 _a e. J 7 8 3, s. 2 1 1 o o o o O c o EY E T C VT E tug N I l E ABR D L AA E U BT E MO FC UR 0X CP E
N M 4 m to 5 a3 c1 O
== 01 U1 01 01 01 U1 Q1 Un CD 01 d d d d d d d d d d i + 4 4 4 I + c 4 1 u a 5 --S I \\ ( -g ) a l \\ ( -g .) a 11 \\ { -g c a i \\ { -g In s I \\ { -g \\o a I \\ 5 -2 8 y l J .. g a a I \\ { -g e s ll \\ ( -g c a y k -R OSS q 8 ( RES -2 no a aws s s ( E U l a\\ -- w n >a ( -2 gxd ,q ' i s \\ g -= 5 = gR, o a sbn I \\ ( .p s q \\ l o W E.. 2:gm g \\s ( -= C a 503 4--= m m m$ ( a\\. 2 2 ( s m ov {- s\\ .n 4- -. s i) s s (- -. a\\x m\\x 4- -- i (- -. N. .s. a (- -. a m N N k- -* i. m a N NN (--. mN m N., " K.4 'N. I:" g. 4 4 4 4 4 4 4 4 o pa z l -w m a W 3m W UE OX om m i ( l
0 1 2 3 4 5 6 7 8 9 9 9 9 9 g 9 9 9 9 9 0 0 O 0 o 0 0 0 0 C+. + + + D ^ li l 0 s2 C 3 s o, 2 ~ 8 2 ~ 7 2 g 8 U 2 5 - : 2 4 - : 2 3 2 2 - : 2 1 - : 2 FE - : 02 O C) x N0 ~ o U YE0 t n, TD1 e3: J 8 LE/ I 1 -.+ I E8 B C 7 [ 1 A X 0 w B E5 8 R O y A 1 RT/ E - :5 PE5 Y 1 p11i G +: 4 ER: VAS F 9 ITT 3 T 1 A E ._+2 E G L L 1 R U B A M U j 1 N U O (T 1 ~ C D
- o t
A
- e
_ ;e _ ;7 _-;a 5 =
- 4 6
= 3 p2 41 c 3 e. s. 7 s. 4 s. 2 1 1 e o 0 a o a s O E EYT C VTIE TLG N I E I ABR D LAAE U BT E MO FC UROX CP E l l
s ELEMENT 4: A 20 DEMAND SAMPLE IS TOO UtlCERTAIN At40 TOO COARSE A FILTER TO BE EFFECTIVE There are ample signs that indicate a 20 demand sample wculd pose problems. First it is coarse filter. One failure in 20 demands would suggest a 95% reliability. Only one additional failure, or 2 failures in 20 demands would drop the simple point average reliability all the way to 90%. But this is only a fraction of the difficulty that acccmpanies a 20 demand sample. Uncertainty at very small sample sizes, the sliding sample technique, and cumulative probability of target exceedence all act to exacerbate the problems of a 20 demand sample. The attached 3 figures show the cumulative probability of target exceedence for triggers of 2 or more failures in 20 demands, 3 in 20, and 4 in 20. For a 2 in 20 exceedence trigger there is a 43% probability that an EDG whose underlying reliability is 97%, will have a purely statistical exceedence in a given year, and an 80% probability it will have a purely statistical exceedence within 3 years. An EDG whose underlying reliability is 95% has a 66% chance of a statistical exceedence within one year and a 97% chance within 3 years. For plants who have 95% EDG reliable goals, these represent extremely high incorrect alarm rates. Such rates are unreasonable and should not be imposed. An exceedence trigger of 3 in 20 doesn't solve the problem. An EDG whose underlying reliability is 97% still has a 34% chance of having an exceedence within 3 years; an EDG whose underlying reliability is 95% chance has a 72% chance of an exceedence within 3 years. An EDG reliability goal of 97.5% puts the 20 demand sample at an even further disadvantage. No failure trigger values could be found that meet the desired criteria. A 20 demand sample either is a statistical reliability trap that an EDG cannot avoid or escape from, or if it is calibrated to avoid this, it is ineffective in detecting poor performers. HLW:3850NS8-4
0 2 3 4 5 6 7 8 9 1 9 9 9 9 9 9 9 9 9 9 ^ + + + 0 0 =~ l 3 9 l 2 8 l2 ~ 7 l2 ~ 8 l 2 5 l 2 4 l2 3 l 2 = ) 7 S 2 l 2 D = N 1 l 2 A F = M 0 O / l2 E D = f YE 8 l1 TIC0 = L N2 8 l I 1 BE m_ p ADN 7 l BEI 1 OES 8 R R CE l 1 A PX R j 3 E EU l Y 1 E L f VTI 4 l EA 1 I 'm, TGF 3 AR l 1 L AE </ U TR 2 l 1 M O / U M 1 l 1 C R / 0 l O 1 = 2 a 9 l / / ( m u 8 l f y m/, 7 l / y 6 l / _/ / 5 l / /, 4 o l / / /' f G 3 l m J 2 l / / 7 3 s 1 ~ i 8 J 7 4 3 2 1 O o o 8 c O EY E T C VT E IL N I TI G E A8R D L AA E U BT E MO FC UR 0X CP E
S O N M T O N m m 9 9 9 9 9 9 9 9 9 9 i f 4 4 4 I 4 4 4 i ,a s --g I \\ ia a i I \\ k -2 ia a 1 \\ ( -N ,a s I \\ i ,a a s I \\ i ia a g --N k ,a a i \\ ( n .,9 1 ( -N m , a m o i \\ i z - 33 a a s 4 6 \\ \\ ( 3 -2 a m o o I ( gw 4, a 00 \\ ( o 3zN s --mw \\ ( -t <oz i, s mw-i g { o m n a = m N \\ { Q. e q \\ \\ m sa w a pod i \\ \\ \\ l< a a $m k -E 3 a 2 O ) \\ \\ m 2 a h ( h \\ '4 N s\\ ( m o O N s\\ ( -= a ,o i a a --o A -h N e\\ '(- -- a a N N (- -a a\\o s\\ (- -* a N N (- a a -e N N a's. \\- a N, m p. _.,. -. n; o n n s n n d o a o o a o o o -a z E o
== e E8bW 0 0. y
a 2 3 4 5 6 7 8 9 0 j 9 g 9 9 9 9 9 9 9 9 + o 4 + g 0 C 3 J 8 o = 2 5 U' m_ 2 7 J ~ 2 5 2 5 D 2 4 2 a 3 J 2 ) 2 S x. o_ 2 D N 1 g 2 m A 'o F M 0 +/ 2 O y E D 8 YE D ge 1 T C0 I 8 LN2 g 1 IBE 7 7 ADN 1 BEI o R O E S D, E RCE A t PX R 0 5 Y E 1 U E L 4 V TI e 1 EA ITGF 3 A R 0 5 1 L AE 2 U TR J i 1 m-M O 1 U M 1 j b C o R b t O 4 c o b9 'o ( b8 / 87 / O U S /. f S / O< g 4 3 / 7.e 2 / T I 1 ~ s. s. 7 s. 4 3 2 o c o o o o o a E EYT C VTIE N ITLG E I ABR D L AAE U BTE WO FC UROX CP E
ELEMENT 4: A 20 DEMAND SAMPLE IS TOO UNCERTAIN AND TOO COARSE A FILTER TO BE EFFECTIVE There are ample signs that indicate a 20 demand sample would pose problems. First it is coarse filter. One failure in 20 demands would suggest a 95% i ] reliability. Only one additional failure, or 2 failures in 20 demands would drop the simple point average reliability all the way to 90%. But this is only a fraction of the difficulty that accompanies a 20 demand sample. Uncertainty at very small sample sizes, the sliding sample technique, and cumulative probability of target exceedence all act to exacerbate the problems of a 20 demand sample. The attached 3 figures show the cumulative probability of target exceedence for triggers of 2 or more f ailures in 20 demands, 3 in 20, and 4 in 20. For a 2 in 20 exceedence trigger there is a 43% probability that an EDG whose underlying reliability is 97%, will have a purely statistical exceedence in a given year, and an 80% probability it will have a purely statistical exceedence within 3 years. An EDG whose underlying reliability is 95% has a 66% chance of a statistical exceedence within one year and a 97% chance within 3 years. For plants who have 95% EDG reliable goals, these represent extremely high incorrect alarm rates. Such rates are unreasonable and should not be imposed. An exceedence trigger of 3 in 20 doesn't solve the problem. An EDG whose underlying reliability is 97% still has a 34% chance of having an exceedence l within 3 years; an EDG whose underlying reliability is 95% chance has a 72% chance of an exceedence within 3 years. I An EDG reliability goal of 97.5% puts the 20 demand sample at an even further disadvantage. No failure trigger values could be found that meet the desired i criteria. l 1 A 20 demand sample either is a statistical reliability trap that an EDG cannot i avoid or escape frem, or if it is calibrated to avoid this, it is ineffective l in detecting poor performers. I HLW: 3850NS8 4 l-
o a m m o s e m 9 m m m a m 9 m m m i + 4 4 4 I + o a s 3 --g 4 ( ( ( -= ( -= il \\ -N o 5 d \\ Ei 3 \\ -a s gu S \\ oo ll \\ azm a mW ll \\ --t: <oE is m" 11 o m 3s \\
== m w W ( Q. .m., w.e r .s 1\\ u2:b a -1s \\ -3 a saw \\ 5b f's \\ s o sm .3 a \\ 2 o l \\ N o 2 a U m I \\ s f 'g \\ ~~ O 11 s\\ n a \\ v N -= \\ a\\ io \\ ma \\ a\\ a\\ N N a\\a\\ --= \\ \\ N. --i a\\ i \\ a N i e\\m N i a s ,\\. m 5%,'N. , 5' ~s ~~ ~ 1 4 4 4 4 4 4 4 4 4 O O O O O O O O O W W bu P205 $mm a m24 2 Ogu t i mNoX l 0 0. w l l t
e o m n w c e n a m 9 9 9 9 9 9 9 9 9 9 i t 4 4 4 I + o 4 1 au a 5 --E I \\ k no a -2 I \\ ( -g >a s i \\ ( -n ia s i \\ i -g 'a s s I \\ t -N ,a a 3 I \\ t ,a a s --s 1 \\ ( -N >a a m \\ \\ ( y -N a a a z a a -a 4 s w \\ \\ ( 3 -a o li a u tw 4 ( o 4, m oo \\ \\ ( =f z N a s mw \\ \\ { <az i, a e -g mW-1 \\ \\ { o in i a = 2 2 wg l' \\ ( - = ]>. = Ebd l 1 \\ o -am s s ( Sm o a s oyw s \\ ( m a s 2 o j x \\ ( b e o 2 \\\\ s\\ k
- o N
u\\ ( m \\ a\\ u\\ ( -o N s\\ (- -- (- a\\ m\\. (- a -.i N N. (- a a N N (- a a N N N,'d.._I". m: o o a o o e o o o o m2o5 5=25 =a a 0 EPxbW U Q. y
o ~ m 4 o e s e m 9 9 9 9 9 9 9 9 9 9 i f 4 4 4 1 + a ( ,--R 1 ~ i q t a \\ .\\ <--n t a \\ \\ <--A I } 8 a \\ .I q 'c j q a a 5 k 5 a L \\ \\ .\\ <--a 3 6 a o o \\. \\ <--= asa L)!: tu a i A ow .i <--2 g8E a ey0 h 4--8 4 b i. 4--e W 'wg h A 4--: sbd x' jo' q 1 4 -= 23e 3 .i (.-:: m o o 2 u \\ (. = O b .I 3 \\ 4 a b 1< -- \\ \\..! a N\\ .t< a -a .d -* + \\ \\.1 c N' N. Nm h._\\l(' %\\ 4 i i i i i i i sk d t pa z 9 "o o s %o EabW UA y
s 7/28/88 Meeting Diesel Generator Reliability Calculations TECHNICAL BASES FOR EDG RELIABILITY PROGRAM TRIGGER VALUES Final Report, July 1988 Prepared by ERIN ENGINEERING AND RESEARCH, INC. 1850 Mt. Diablo Blvd... Suite 600 Walnut Creek, California 94596 Principal Investigators 0.E. True T.G. Hook Prepared for Electric Power Research Institute 3412 Hillview Avenue Palo Alto, California 94304 EPRI Project Manager J.P. Gaertner
4 ABSTRACT P In support of utility objectives to ensure high emergency diesel generator (EDG) reliability, EPRI has developed an EDG reliability program which is structured to provide a measured, graded response to potential unreliability problems. In this program, actions to improve EDG reliability are initiated through the use of triggers, based on the number of failures observed in a given number of EDG demands. This study develops the methodology and technical basis for defining the triggers to be used in the EPRI EDG reliability program. In defining these triggers, a balance between inadvertent identificalion of acceptable parformers and timely identification of poor performers is sought. I t h I a i J t I l-e
ACKf10WLEDGEMEtiT The authors wish to acknowledge the support and assistance of Mr. D. P. Gaver in the performance of these statistical analyses.
...=.. i L i l CONTENTS L Section g 1 INTRODUCTION 1-1
1.1 Background
11 1.2 Investigation Objectives 1-1 l 4 r 2 ANALYSIS OF POTENTIAL TRIGGER VALUES 2-1 i 2.1 Methodology 21 2.2 Results of Simulations 23 i 3 CONCLUSIONS 3-1 4 REFERENCES 4-1 4 1 I i i I i h ( -h i r r I
Section 1 INTRODUCTION
1.1 BACKGROUND
The proposed resolution of USI A-44 (122) refers to emergency diesel generator (EDG) reliability programs for utilities to ensure continued high reliability of on site AC power sources in the event of a loss of off site power. The Electric Power Research Institute (EPRI) is developing such guidelines. The NRC has also recently completed a study of potential EDG reliability program guidelines (1). One element common to both of these programs is the use of trigger reliability levels based on the observed EDG failure and demand history. These trigger levels are then used to initiate actions to address the observed, degraded EDG performance. The purpose of this investigation is to perform statistical analyses that can be used to identify technically defensible trigger levels which not only identify poor EDG performance, but also ensure that, to the greatest extent possible, good performers are not incorrectly identified as poor performers. The selection of specific trigger levels depends very much on the actions that are called for by the particular reliability program under study. In this report trigger levels are evaluated with respect to the EPRI guidelines referenced above. 1.2 INVESTIGATION OBJECTIVES The overall objective of this investigation is to develop technically based EDG reliability trigger values which can be used in conjunction with the EPRI proposed EDG Reliability Program or a similar program to initiate actions aimed at correcting the source of observed EDG unreliability. In support of this overall objective, several sub-objectives were developed to ensure that the result is technically sound and should be acceptable from both the industry and regulatory perspective. These sub-objectives are as follows: 1-1
o o Determine the statistical nature of EDG failures (i.e. define the statistical distribution which best reflects the inherent randomness of EDG failures). o Determine the optimal combination of reliability trigger values for 50 and 100 demand sample sizes to: minimize "false alarms" (i.e. the identification of plants whose actual EDG reliabilities are above an acceptable level, but due to statistical variations would be identified as "poor" performers by the targets). provide assurance that "bad" performers would be caught in a reasonable length of time. maximize early warning at the 50 demand level to provide time for response prior to exceeding the 100 demand target. provide an acceptably low industry average false alarm rate based on the actual population of plants. The methodology and results of this investigation are described in Section 2. Conclusions regarding acceptable trigger values and perspectives on trigger value selection are provided in Section 3. 1-2
Section 2 ANALYSIS OF POTENTIAL TRIGGER VALVES 2.1 METHODOLOGY The variability in calculated instantaneous EDG reliability is caused by the random variability in time between EDG failures. It is generally assumed that, if the failures are independent, the time between failures can be approximated by an exponential function. In order to provide some additional basis for the use of the exponential distribution (or geometric for a discrete distribution), analyses were performed on plant-specific failure data to determine whether or not the time between failure data conformed to an exponential distribution. The plant that was analyzed has four EDGs and an operating history of over 12 years. During that operating period, a total of 28 failures were observed out of a total of 3768 demands. The sequence of failures and the number of EDG demands since the last failure for each of the EDGs is given in Table 2-1. The primary characteristic of the exponential and geometric distributions is that the mean is approximately equal to the standard deviation. Upon analysis of this data, the mean number of demands between failures can be seen to closely approximate the standard deviation of the number of demands between failures for each EDG and on a plant average basis. A suneary is as follows: Table 2-2 Mean # of Demands EDG # Between Failures Standard Deviation 1 127.3 123.1 2 108.5 126.6 3 117.4 100.0 4 109.0 119.9 Avg. 113.6 111.3 21
TABLE 2-1 EMERGENCY DIESEL GENERATOR FAILURE HISTORY
- of Demands EDGf Failure #
Since Last Failure 1 1 2 153 3 6 4 288 5 62 2 1 2 50 3 195 4 94 5 25 6 383 7 96 8 6 9 19 3 1 2 102 3 24 4 232 5 209 6 20 4 1 3 65 4 126 5 10 6 294 7 1 8 250 1 22
I i l The close correlation between the mean ons m r. w d deviation supports the use [ j of an exponential or geometric distri J. . a scribe the variability in I j calculated EDG reliability (1). i t Having defined the parameters important to the variability in the sample size, ) i a Monte Carlo computer program was written to simulate the performance of an average plant with two diesel generators. Each of the EDGs is assumed to be 1 tested 25 times per year for a total of 50 demands per plant year. A Monte l Carlo routine is used to generate a simulated 30 year plant life I (approximately 1500 demands) for various constant underlying EDG reliabilities and a geometric distribution to describe the variability in demands between j failures. These simulated EDG failure histories are compared to a user. L defined set of target values for 50 and 100 demand samples. This process is repeated for the number of plant life simulations desired. The simulation begins 10 years before the first sample is taken to eliminate any artificial i program "startup" effects. The output of the computer simulation program includes the following data: For Each Plant life Simulation: l the year in which the 50 demand target was first exceeo64 the year in which the 100 demand target was first exceeded l the year in which both targets were first exceeded simultaneously 1 l the number of years in which the plant exceeds one or both i targets the total number of times both targets were exceeded simultaneously the number of times an exceedence of both targets was not preceded by [ a single target exceedence Overall Summary of All Simulated Plant Lives: the probability of initial target exceedence per year for each year of ] the simulated plant life the fraction of years spent in exceedence of one or both targets t I the percentage of 100 demand exceedences not preceded by a 50 demand l exceedence j 2-3 i i t
These parameters are then calculated for a variety of potential failure targets and combinations of targets over a range of simulated EDG reliabilities. The total number of EDG demands simulated for any single EDG reliability and any unique combination of 50 and 100 demand targets is approximately the number of plant life simulations performed (generally 500-1000) times 1500 demands per simulation (750,000 to 1,500,000). The two primary outputs of the simulation program are the data regarding the probability per year of target exceedence and the fraction of years spent in exceedence of targets. The probability of target exceedence per year is of interest because it provide a measure of not only the likelihood of false alarm for a plant with "good" EDGs, but also a measure of the likelihood of detecting a plant with "poor" EDGs. Further, by knowing the probability of target exceedence for each year, an assessment can be made of the likelihood of target exceedence over the life of the plant. The fraction of years while in exceedence is calculated by determining whether or not a target was exceeded in each year of simulated plant operation and calculating an average fraction of years in which some time was spent in exceedence of the targets. This parameter is of interest because it can be used to indicate how many plants might be expected to be in exceedence of the targets during any one year. The percentage of 100 demand target exceedences not preceded by a 50 demand exceedence was also tracked as a measure of the early warning effectiveness of the 50 demand target. Since a program such as the EPRI approach requires a more limited action when only one of the two targets is exceeded, it is desirable for the 50 demand target to provide some warning to the plant before more costly actions are required. 2.2 RESULTS OF SIMULATIONS A range of potential targets was evaluated for each sample size (50 and 100 demands) and each NUMARC 87-00 overall plant reliability target (0.95 and 0.975). A number of combinations of triggers and sensitivity cases were simulated. A list of the potential trigger values evaluated for each combination of sample size and reliability is given in the following table: l 2-4 i
Table 2-3 Potential Potential NUMARC 87 00 50 Demand 100 Demand Reliability Target Triggers Triggers 0.95 4 6 5 7 6 8 9 10 0.975 2 3 3 4 4 5 The simulation results of these sensitivity cases for EDG reliabilities from 0.90 to 0.99 in intervals of 0.01 in terms of the likelihood of target exceedence per plant year are presented in the following sections. The selection of an effective trigger value requires the consideration of not c".iy the false alarm rate for "good" performers, but also the likelihood that a "poor" performing plant will be effectively identified by the trigger. The criteria for ' selecting optimal targets from the options in Figure 2 are as follows. The likelihood of false alarms for good plants should be less than 10% per year. At the same time the likelihood of target exceedence for poor performing plants should be greater than 50% per year. Targets were selected to satisfy these criteria as nearly as possible. The likelihood of target exceedence within 3 years is also looked at as a measure of the appropriateness of the trigger. In 3 years, the false alarm rate for good performance should be less than 25%, and the likelihood of target exceedence for poor performers should be greater than 65%. In the case of the 0.95 target, "good" performers were considered to be those plants with EDG reliability of 0.97 or higher; "poor" performers were considered to be those plants with EDG reliabilities of 0.93 or lower; and plants with reliabilities between 0.94 and 0.96 were considered to be "intermediate" performers. The plots shown on Figure 2-1 indicate that a trigger value of 5 failures out of 50 demands provides an appropriate balance between false alarm rate and poor performance indication. For plants with EDG reliabilities of 0.97 and above, the likelihood of false alarm is less than 7% per year. For plants with EDG 2-5
~ reliabilities of 0.93 or less, the likelihood of target exceedence is greater than 55% per year. For "intermediate" plants represented by the 0.95 reliability level, the likelihood of exceedir.g the target value is 28% per year. The plots in Figure 2 2 show a much tighter grouping of the trigger exceedence probability curves for the 100 demand triggers. From this figure, a trigger value of 8 failures out of 100 demands can be seen to have similar characteristics as the 5 out of 50 trigger. For the 8 out of 100 trigger, "good" reliability plants have a probability of trigger exceedence of less the 3% per year, "poor" reliability plants have greater than 60% chance per year of trigger exceedence and "intermediate" plants have a 26% chance per year. In the case of the 0.975 target "good" performers were considered to be those plants with EDG reliability of 0.985 or higher; "poor" performers were considered to be those plants with EDG reliabilities of 0.965 or lower; and plants in between and represented by 0.975 reliability were considered to be "intermediate" performers. Figure 2-3 indicates that a trigger value of 3 failures out of 50 demands provides the best balance between the necessary considerations. For plants with EDG reliabilities of 0.985 and above, the likelihood of false alarm is itss than 10% per year, with a sharp decrease to less than 5% for plants with greater than 0.99 reliability. For plants with EDG reliabilities.of 0.965 or less, the likelihood of trigger exceedence is greater that 45% per year. For "intermediate" plants at 0.975 reliability, the likelihood of exceeding the trigger is 27% per year. From Figure 2 4, a trigger value of 5 failures out of 100 demands can be seen to have similar characteristics as the 3 out of 50 trigger for the 0.975 target. For the 5 out of 100 trigger, "good" reliability plants have a probability of trigger exceedence of less the 8% per year, "poor" reliability plants have grea+ir than 40% chance per year of trigger exceedence and "intermediate" plants range have a 20% chance per year. The cumulative probability of trigger exceedence by year is plotted in Figures 2 5 and 2 6 for the 0.95 reliability trigger values of interest (5 or more failures out of 50 demands and 8 or more failures out of 100 demands). These figures show that poor performers are highly likely to be identified within a short period r,f time (specifically, < 3 years). Additionally, these charts show that high 26
reliability plants (0.97 or higher) are unlikely to exceed the triggers for many yeers. These same charts for the 0.975 trigger values of interest (3 or mora failures out of 50 demknds and 5 or more failures out of 100 demands) are thewn in Figures 2 7 and 2 8. Here again, the low reliability plants are very likely to be identified and high reliability plants are likely to operate many years before a false alarm is likely. An additional feature of these charts is that they allow the calculation of probability of trigger exceedence per year for plants which test their EDGs more or less frequently than 50 times per year. Since the simulations were based on a constant test frequency (50 demands per year) the number of years shown on the abscissa of these plots can be interchanged with demands by multiplying by 50. For example, or a plant which averages 100 EDG demands per year, the probability of trigger exceedence is given as the probability of exceedence in 2 years. Similar plots of the probability of trigger exceedence per year are given for the case of both triggers being exceeded simultaneously. For the 0.95 target values of 5 failures or more in 50 demands and 8 failures or more in 100 demands, the plot is shown in Figure 2 9. For the 0.975 target values of 3 failures or more in 50 demands and 5 failures or more in 100 demands, the plot is shewn in Figure 2-
- 10. As would be expected, the calculated probability of exceeding both triggers is somewhat less than the probability of exceeding either trigger individually.
I Another measure of the appropriateness of reliability triggers is the effectiveness in providing an eariy warning of potential problems. In this case, the early warning is provided by the 50 demand trigger. Therefore, the effectiveness of the early warning can be measured by evtluating the fraction of 100 demands trigger exceedences which were not preceded by a 50 demand trigger exceedence. This factor is plotted in Figures 2 11 through 2-12 for various ] combinations of 50 and 100 demand targets. Figure 2 11 shows that for the 0.95 ) trigger values identified above (5 out of 50 and 8 out of 100), less than 20% of all 100 demand trigger exceedences are not preceded by a 50 demand trigger exceedence. The results for the 0.975 trigger combination of 3 out of 50 and 5 out of 100 are shown in Figure 2 12. This figure indicates an even lower likelihood of failure to provide early warning by the 50 demand trigger (< 15%). 2-7
r As an additional sensitivity, several simulations were performed to evaluate potential triggers based on the number of failures in the past 20 demands. The results of these simulations are presented in Figure 2-13. This plot is similar to Figures 2-1 through 2-4 for the 50 and 100 demand trigger values showing the probability of exceeding u.e trigger pe) year for a ranga of EDG reliabilities. The 'asults of these simulations demonstrate the ineffectiveness of the 20 demand sample ir providing a reliable trigger for action. The variability in EDG failures causes any potential triggers to be either too restrictive for the high reli bility plants or too loose to detect poor performers in a cimely manner. The trigger value that came closest to meeting the criteria was 3 or more failure out of 20 demands for use with 0.95 reliab lity target plants. However, this trigger value was not consistent with the other chosen 0.95 trigger values in that the false alarm rates were higher, particularly on a three year basis (33% versus less than 15% for the other triggers). Additionally, no 20 demand trigger v21ue could be found which met the crite 'a for plants with a 0.975 reliability target. The fraction of years in which various trigger values are expected to be exceeded are presented in Figures 2-14 through 2-17. These plots show the average fraction of years in which the plant spent some time ir exceedence for a range of EDG reliabilities and trigger values. This data is useful in that is provides a measure of the fraction of plants of each EDG reliability category which would be expected to be in exceedence in any one year. As shown in the figures, the shape of the curves are quite similar to Figures 1 through 4 for probability of trigger exceedence per year. However, the quantitative values given in Figures 2-14 through 2-17 are slightly higher than those in Figures 2-1 through 2-4. The difference is due to the fact that some exceedences extend over more than one year. In order to determine the impact of these proposed triggers on the industry as a whole, a determination was made of the overall industry average false alarm rate. The first step in this determination was the development of an industry EDG reliability profile. The EPRI report,"The Reliability of Emergency Diesel Generators at U.S. Nuclear Power Plants", NSAC-108, was used as a source of data for this determination. Figure 2-18 shows a histogram of the number of plants having reliabilities between 90 and 100% on the basis of unit averags EDG 2-8 w
performance. All but 2 of the 65 plants in the f1 SAC-108 survey data exceeded 95% reliability on a unit average basis. Figure 2-19 shows the same tiSAC-108 EDG data presented on an individual EDG basis. From the unit average EDG reliability data, a calculation of the industry average false alarm rate for the 0.95 reliability triggers was made based on the percentage of plants in each reliability range above 0.95 and the trigger exceed-e probability shown in Figures 2-1 through 2-4. The basis for this caicuh tion is the following formula: 99 Overall Industry Average False [ X(R)
- AR (R)
= j Alarm Rate R - 95 Where X(R) is the frution of plants with unit average EDG reliability between R and R+1 (i.e. between 95% and 96%) and ARj(R) is the alarm rate calculated for the given trigger value, i. All plants which had a reliability of 100% were classified as 99% plants. Plants with reliabilities below 95% were excluded because their exceedence of the trigger wculd not constitute a false alarm. For the 0.95 reliability triggers discussed, 5 failures out of 50 demands and 8 failures out or 100 demands, the industry average probability of trigger exceedence is less than 4.7% per plant year for a single trigger exceedence and less than 2% for exceedence of both triggers. In three years, the probability of exceeding a single trigger is less than 9.5% per plant. For the 0.975 reliability triggers discussed, 3 failures out of 50 demands and 5 failures out of 100 demands, the industry average probability of trigger exceedence is less than 7% per plant year. For single trigger exceedence and less than 2.3% l for exceedence of both triggers. In three years, the probability of exceeding a single target is less than 15% per plant. i l l l I l l 2-9 l l
es ' o. as 0 0 0 ' a. 5 5 5 / / / 4 5 6 ~ + 7 ' o. S) ES UD E LN C AA s N V M e E N o. Y E D R T E E D I E G IL 0 B C G 5 A I X R L I E RT T S s E 1 RO e R c. 2 E F YA TP G G I RL D E G N R I AIBI E RE A U TYI S E G L E G IF FRE R 4 A s OER U ' o. R P L E Y 5IA V T
- 9. F A
IL 0 I B N T I L A O N B A s ' e. U I O TD a R NE P ES TA OB P( 2s o. se ' ' o. ~ s. ~ o 3 a 7 s. 4 s. 2 1 o i 0 0 o o o o o c YR E TE CR ILG NA 8 G EE I DY I ARE BTER O CE R F XP PO E 2
0 0 0 0 0 0 1 0 0 0 0 1 / 1 1 1 1 / / / / 0 6 7 8 9 1 + 4 9:.. S )S E D U E L N C AA N VM + n:. Y E E .T D RD IL E E I E G0 B C G0 A I I 1 X R L , E E RTT i:. R S RO Y A G 2 E F T P D G I RL 2 G AIB N I E RE A E I E TYI R L S G U FREE A A e G OERR R F P U E I Y 5L VA I T
- 9. F A
IL 0 T I I B LN N A B AO i:. U + I O T D R N E P ETS O A P (B i i ~ r ~ 4 J 2 1 1 a 0 O 0 YRE TE CR LG NA I EE I B GI DY ARE BTER O CE RF XP PO E 5.~
e s.o l s e. + o 7 s. I o S E )S U D E L C AN s V A
- e. Y N
M o T l E RE I D ED L E G B I E GO A C S I I X R L E TT s E R
- e. R S
l 3 ROY A o EFT G P I 2 G L D RI E G ABN E REA E I I R I TYLS G U EE 4 A G FR RR oR e. l IF OE U E P5L Y Y 7IA A T
- 9. F IL T
O I I B N N A LO s
- s. U B
A l o O D I T E R N S P E A TO B P( z n. l o N s. l o s. o 7 s. 4 s. 2 t. 8 1 o o o o o o YRE TE CR ILG NA B G EE I DY I ARE BTER O CE RF XP PO E ?g
9 t 3 9 0 0 0 0 0 0 0 0 0 1 1 1 1 / / / / 3 4 5 6 8 ^ + m-4 + l 9 0 7 9 l 0 S) ES UD E LN C AA 8 V M N 9 Y l ~ E 0 T E R D D E I IL E G 0 B E G C I 0 A I X R1 L E T E R T .9 R ROYS l 0 4 E FTA G I G LP RI D 2 G ABN E IREAI E E I R TYLS G EE 4 A U FR R R R B 9 l G OE 0 U E IF P5 L V Y 7IA A T L
- 9. F I
BI 0 T I N N A L 3 O 9 U B A l 0 O TD I R NE P ES TA OB P( 29 l 0 1 9 l 1 0 ~ ~ 9 v ~ ~ 0 1 7 s. 4 J 2 1 o 0 0 O 0 O 0 O YRE TECR ILG NA BG EE I DY I ARE BTER O CE RF X P POE 5"
0 1 2 3 4 5 6 7 8 9 9 9 9 9 9 9 9 9 9 9 0 0 0 0 0' 0 0 0 0 0 + + + 0 =. 0 a' C = Ia3 P 7i2 9 W 7 8 J a2 7 7 D a2 7 8 g 2 i 'm 7 5 O i2 P 4 D i2 P 3 O a2 - A~ ) 2 S O T 2 i D J 'm_ N 1 Ti2 A F 0 M i O D a7 2 E YED 9 D n ?i 1 TC 8 0 ILN g ti 5 1 5 E I = 7 B A D N O ?i 1 EI 2 B 'a +i1 E 8 R E O C S = A R R X E / +5 E PER U U Y 1 U / 4 G ERL g ?:1 IF V E A /- + I ITGF 3 AG g i 1 LI E / + 2 UR R w o i 1 T M O / s., + U M g i 1 C + 0 R 0, i 1 O ~ i9 g/ 'm m 5 ( a8 g/ -i7 a, 0 1iS - 5 /
- i4 v/
3 / g i2 f- - a [ E i1 s. s. 7 5 4 3 2 1 8 1 o o o o o o o EYRE VT E C TLG N I I AB G E I D L I ARE U BTE MO C URF X CPO E ~L*
FIGURE 2-6 CUMULATIVE PROBABILITY OF TRIGGER EXCEEDENCE (8 OR MORE FAILURES IN 100 DEMANDS) t-- ^ X"x- .~ _.,_,_,_, o.s-- c.3-- ^ 0.90 o.7-- + 0.91
- 0.92
/ a.s a- + 0.93 CUMULATIVE m
- 0.94 1
PROBABILITY *'- OF TRIGGER EXCEEDENCE J'a-.I - 0.95 D ,,4-~ A 'a,0 0 + 0.9 6 O'O 0- 0.97 / J'O'O'0 03- =- 0.98 O'D ~ 0.99 c.2-- ag,0 / o.1 *- ,0 3,0,0 = = =,_,_ _m m m a a 0-f-7"N~h_i-{ l--i -l-N - [ [- [ t-i 1 2 3 4 3 4 7 4 S 1O 11 12 83 14 13 18 17 18 19 20 21 22 23 24 23 24 27 24 29 30 YEAR
0 1 2 3 4 5 6 7 8 9 9 9 9 9 9 9 9 9 9 9 0 0 0 0 0 0 0 0 0 0 ^ + 4 + D 0 3 = 7 9 2 8 2 7 g 2 8 2 5 2 4 =- 2 3 2 ) o-e 2 S 2 D
- 2 N
1 =. _ A F 0 M O a. 2 E YE D
- 1 9
a = TC 0 I e 8 LN 5 a
- 1 E
IB 7 D N
- 1 7
A EI a B E 6 R 7 2 O C S m
- 1 A
R X E = 5 E E PE R
- 1 Y
R m = U U E RL = p 4
- 1 G
V E A F TGF = e I I I 3
- 1
/ AG ej LIE 2 U R
- 1
/ R T M O s 1
- 1 U
M _o C ./ F o R _o
- t
./ O eo-p
- 9
=/ 3 "7 (
- 8
's
- 7
./ . - a 'o/
- S f
x
- S
/ =[ 3 /
- 4 G
= e = +3 /,
- 2 e
B ./ / I r /l L 3 .1 7-1 5 7 s. 4 3 2 1 0 O O 0 o 0 c 0 EYRE VTE C TLG N I I AB G E I 0 L I ARE U BTE MO C URF X CPO E I- ?*
1 O w N to 4 in to N a3 m 9 9 9 9 9 9 9 9 9 9 O O O O O O O O O O i Y k i k h N i s --R u a l \\ ( --n o a ( --n i a \\ i ) a s --N l \\ g D a s --n k --N D E k --E D E R \\ f --R D a nm 11 \\ 4 --N o a a z ll \\ ( a m w 2 11 \\ i --R o W o a g Q ll \\ k i* d o q s k h- 'O E k --D f bZ io 5 \\ \\ od] Exw j i \\ { --! "d N ,a s w q s, ,. p = Wm i, W g =d -> a E \\ \\ i 3 >w OC PO4 l \\ \\ i n t (cw p 5 aW \\ k 3 % i a\\ ~ H$ 1 2 5 o 5 '\\ o 2 U l \\ t .a g e\\ m o a l I \\ { o In a a n i N N a s (- -a v a\\ N,\\ i N (- -n (- -- a\\ a\\ (- -a a m N.a N\\ (- -* {- -n a a N,N. 1 N \\ -- a i F a,, N, T 9 o e 9 n 9 9 M n N o o a o o o o o o W MN W U PUO Z Y=mn i e 58wW a a. o w 2-17
e O e N to + 4 e 5 cc Cn Cn m Cn m Cn Cn m m Cn Cn 0 d d d d d i f 4 4 4 I f 4 4 1 f 1a s -N 4 \\ l -g a n - \\ l -S E ' ] -g t a i I a a..-n \\ l a u--s I \\ \\ a si-N \\ \\ a m..-N \\ I \\ a u<-;; g '-R a 5 ' OSo \\ l o a ma fwew \\ l l -wN l-! -d w cc a n' \\ \\ mo a m.-C cn 4 >< o p: l-3 "4 \\ l I mWm I 5' cq O gN b: I nW ~ g W LWO q 5< - y. g O . L ) m W O.. q i O as ,{ k a g...Q ~ W \\ i 5W O i a a..-U o J 52 5 g i m e s u.. Dw q \\ f O O l a s 1-e a \\ il a Ba-* \\ l i -= q p a,-> a \\ l i \\ %7 aD-* i ie s> a i ,i i 1 m-1 4 4 4 4 4 4 4 o o o d o o o a o o W >= g W >HwC i:U O Z $Ps0 =m-e 58'M 010w l 2-18
2 3 4 5 6 7 8 9 0 1 9 9 9 9 9 9 9 9 9 9 ~ 0 0 0 0 O' 0 0 0 0 O + + + 0 0 a 83 ~ 9 52
== 8 s 2 m, 3 p 7 62 = ~ 6 = 5 2 = 5 52 = ~ 4 62 = / 3 42 = 2 o I2 1 o I2 E F 0 C) O N0 2 2 E0 s Y I T D1 6 m 1 E/ I 5 L 4 IES a 1 0 BC 7 1 AX 0 a 4 1 BE 5 5 R 2 O / a 4 A 1 RR E PE3 'm 5 E Y 4 a, 1 R G e j 'n/ U EG: 4 5 G VI S 1 R R I I 3 F TT E 5 LEG D 1 A P 2 U LG 4 m/ G 1 m[j BI M R = 1 U I1 U O (T g = /. p C o D 5 G t / 45 "7 O g/ =' 55 7 =/ 0 = m. J 4a / p p 45 G / / 44 = G /. 3 G 2 r/ g/. g ~ a 1 -[ b ~ ~ s. s. 7 4, 3 2 1 i o o o 8 a o o o EYR E C VTE TLG N I I E I AB GI D L ARE U BTE MO C UR F X CPO E m ;, =
9 9 l t-0 8 . 9 0 E 79 C l 0 NA D D E E DE EC E X 8 C E 9 l 0 Y X ER T I E L S G B I R G A EI I GR L wl 1 GT 5 E 9 R ? I 1 RD 0 TN G 2 A D D M E E N E R A E D U M G G E0 4 A 9 R F D5 I l 0 x E 0G V 0N A. 1I D T FE I N OE W 3 U C 9 NE l 0 ORP IT C A ART FU 2 O 9 l / 0 W 0 6 7 8 9 1 / / / / / 5 5 5 5 5 1 5 l 0 ~ + + gu 9 V 0 a 9 5 7 9 s. 4 3 2 3 o 0 0 a o 0 0 o o N O I TCAR F ";o
99 i.0 6 ! / 3 99 1 0 E 7 C 9 l N 0 A DD EE DE EC E X C E 49 Y A. I X l 0 ER T I E L S G B RG A EI GR U 2 GT 5 E I 1 l RD 9 R 0 TN 2 G A D D M E N E E R A D E U M G G E0 4 A I 9 R F D5 l 0 7 E 0G V 0N A 1I D T FE I OE N C 5 U 9 NE l 0 ORP IT C A ART F0 2 0 9 l / 0 W 1 9 l y. 0 0 9 5 4 S 5 5 2 5 3 a 4 0 J o 2 o 1 o o. O O 0 a o N O I T C A RF y
ee ' o. 0 0 0 2 2 2 / / / 2 3 4 e + s ' a. 7 T e ' o. S E E C U s N L e E A i' o. Y T D V u E l E R B C E A X G U 0 E G RI s E ROR ,' e. R 1 o E FT G 2 G RD D G E I AN E R REA N E U TYM G G E 4s A FRD + ' o. R I F OE E P0 Y V 2 T A u L T l A B I N I A T s B N e U O E 'c R T P O P
- s
' o. i ' s. o ~ - ~ e. ~ o e. J 7 s. 4 s. 2 s. o O a o o u o o YR E T ECR uG NA l GEE B DY I ARE BTER O CE RF XP PO E l m4"
99 0 0 0 0 5 5 5 / / / 5 4 5 6 9 0 + 7 9 f 0 SE ULA 8 + 9 Y G V 0 N T R u ID E ERG)S lB E OG A R C FI U 4 X RE ERTG 5 E 9 R 1 a G A YI 0 SETR G 2 TYuT D N E E l ARBD R LEAN E U PP G UA G 4 A FREM 9 IF R OERE 0 G D E 5 V NG 0 A 95 OIR ITT 0( T C I L N A A 3 U R 9 I e F T 0 N ETO P 29 e 0 1 .9 a 0 m - e 9 e 0 e 9 4 7 5 3 4 2 1 0 1 0 0 0 0 0 0 0 0 SG R N TNR A ONIEE TA D I G Y E CL G A P EI R CR R E FXT F P OE ?O d
e i s.o 0 0 0 0 0 0 e 0 0 0 0 1 s. r / o 1 1 1 1 / / / / 0 6 7 8 9 1 + + + 7 i s.o SE UL e A G V + i s.oY N T I R L ID E) I ERGS BA E OGR I CFI X RE L 5 ERT G s E 1 G , e. R ~ o A YI SE R G T 2 TYIT D L N I E E ARBD R LEA N E U PPI A G L 4 G M A FRE . e. r F OERE oR I D E G V 5 N G 0 A OI9. 0 IR TT 01 i i C L( N A s U R A F TI e. e.o N ETO P z
- i. s.
o i i s. e c s. o s. s. 7 s. 5 4 s. 2 1 3 o o o a o o o o o SG R NTNR A ONI E E TA D I G Y E CL G PEI R A CR E RFXT F P 0E m4*
0 0 5 5/ 3 4 + l .a 1 l SE ULAV G l Y N R T I I D E L ER G) I GS B EOI A C FR R I X T E L 6 ER G s E 1 A TG R l SE TI R G I 2 TYL T D N I E AR B E R LE A D N U PPL E I A G E G uR 1 FRRM A I l F OE E G5D E NG7 V 0 A OIR9. 5 I TT0( T C I A L N U R A l F ITN ET O P l ( l I s. 7 s. s. 4 2 1 .o o a o o o o o o SG R NTNR A ONIE E TA D I G Y E CL G A P EI R CR R E FXT F P 0E 73
9 il 9o 0 0 0 0 0 0 0 0 1 1 1 1 / / / / 3 4 5 6 99 l a + + 79 l o SE U LAV 5 G 9 Y l N R a T ID E IL ERG )S I G B E OI R A CFRE I X TG L 7 ER G 5 E AYI 9 R 1 l SE TR a I TYL T G 2 N D I E ARBD E R LE AN I PPLA E U EM G R FRRE A 43 F OE l R D o G5 E NG70 V OI 9. 0 A R I TT0(1 T C I A L N R A 3 U 9 F l l T 9 N ETO P 2 9 l o 19 l o TE ~ 9 o 9 s. s. s. 4 s. 2 t. o o a o o o e o o SG R NTNR A ONIEE TA D I GY CL E G A PEI CR R R FXT E F P OE 7%
.= \\ I FIGURE 2-18 i INDIVIDUAL EDG RELIABILITY (1983-1985) l BASED ON NSAC-108 DATA l ,I ss- - S0-- 45-- I .o__ 35__ i I NUMBER OF 30-- ~ h EMERGENCY DIESEL GENERATORS 23-- ] 20-- ~ 15-i t 10-- S-~ o i 1 i L I I I I i"1"1"1
- =
- =
- =
- =
- =
- =
- =
- =
- =
- =
EDG REUA8luTY I
FIGURE 2-19 OVERALL UNIT AVERAGE EDG RELIABILITY (1983-1985) l BASED ON NSAC-108 DATA i 20 - - l ta-- i 19-- 14-- 12-- NUMBER OF ' ~~ PLANTS 8-- g__ 4-- 2-- 0 1 1 1 I i i i l 1 I 100X 99.0-99.92 98.0-98.9X 97.0-97.9X 96.0-96.9X 95.0-95.9X 94.0-94.9X 93.0-93.9X 92.0-92.9X 91.0-91.9X 90.0-90.9X OVERALL UNIT AVERAGE RELIABILITY I
't.: Section 3 CONCLUSIONS Based on the statistical simulations performed, technically sound reliability triggers based on the number of observed failures in past demands can be developed. The optimization of trigger values to minimize false alarms and maximize detection of poor performers has lead to the recommendation to utilize the following targets in conjunction with a diesel generator reliability program similar in character to the one EPRI is proposing: Table 3-1 NUMARC 87-00 Overall Plant Failures Out Failures Out of Reliability Target Of 50 Demands 100 Demands 0.95 5 8 0.975 3 5 The results quoted in this report, as well as the trigger values that are recommended based on the analyses described herein, must be viewed in the context of something similar to the EPRI proposal program. In particular, the authors provide the following cautions: 1) The trigger values that are recommended provide an effective balance of the factors necessary to ensure the effectiveness of an approach such as EPRI is proposing. 2) The false alarm rates reported in this document are based on the likelihood of trigger exceedence per year. This definition of false alarm rate differs from the definition utilized by the NRC in Reference 3. Due to this difference, comparisons between the false alarm rates quoted here and those quoted in Reference 4 should be avoided. 3-1 1
w The basis for these cautions is that the EPRI proposed reliability approach calls for a graded response; that is, when only one of the triggers is exceeded, certair actions are called for and when both triggers are exceeded, more extensive actions are called for. The criteria for selecting the triggers in Table 3-1 were considered appropriate for the levels of response EPRI is proposing. Stronger actions might justify a more lenient trigger, milder action might justify a more strict trigger. This report provides additional details in the tables and figures to evaluate triggers for other programs with different elements. Further, the methods used in this study are appropriate for generating more detailed information for other combinations of triggers. 3-2
l o t Section 4 REFERENCES 1. Draft Reg. Guide 1.155, "Station Blackout", USl:RC, September 25, 1987. 2. "Guidelines and Technical Bases For NUMARC Initiatives Addressing Station Blackout at Light Water Reactors", NUMARC 87-00, October 19, 1987. 3. "A Reliability Program for Emergency Diesel Generators at Nuclear Power Plants", NUREG/CR-5078, April 1988. 4. Reliability and Risk Analysis, N. J. McCormick, Academic Press, 1981. 4 'i l l i 4-1 l
I 2 t ng n Diesel Generator EP IP s t o em AGENDA NUMARC/NRC MEETING ON EDG RELIABILITY JULY 27, 1988 OVERVIEW H. WYCKOFF ELEMENT 1 H. WYCKOFF USING THE IAST 50 AND LAST 100 DEMANDS TO JUDGE EDG RELIABILITY HOWTOCOMBINESTARTANDLOAD-RUNFAliURE DATA TO DERIVE A COMPOSITE FAILURE FIGURE ELEMENT 2 INDUSTRY RECOMMENDS A GRADED RESPONSE J. GAERTNER THAT IS BASED ON EDG RELIABILITY PERFORMANCE ELEMENT 3 DETERMINING THE 50 DEMAND AND THE 100 DEMAND FAILURE TRIGGERS CHARACTERISTICS OF A SLIDING SAMPLE H. WYCKOFF THE MONTE CARLO SIMULATION D. T. RUE SELECTING THE FAILURE TRIGGERS J. GAERTNER ELEMENT 4 PROPERTIES OF A 20 DEMAND SAMPLE J. GAERTNER
OVERVIEW THE PROGRAM ELEMENTS THAT WE ARE PUTTING FGRWARD TAKE UP WHERE NSAC-108 LEAVES OFF. THEY LINK THE OUTPUT OF NSAC-108 TO A GRADED RESPONSE RELIABILITY APPROACH. THESEELEMENTS.BUILDONTHECONCEPTTHATWASINTR0dbCED IN NUREG/CR-5078 0F USING FAILURE RATE TRIGGERS TO ASSESS COMPLIANCE WITH EDG RELIABILITY GOALS. THESE ELEMENTS ARE DESIGNED TO COORDINATE WITH A GRADED RESPONSE RELIABILITY APPROACH. BOTH THE STATISTICAL UNCERTAINTY OF EDG RELIABILITY DATA, AND THE GRADUAL CHANGE IN PLANT RISK WITH CHANGING EDG RELIABILITY SAY THAT A TRIP-WIRE APPROACH TO JUDGING EDG RELIABILITY IS INAPPROPRIATE.- THE ELEMENTS WE ARE CONSIDERING TODAY FOCUS ON THE METHODOLOGY AND CRITERIA FOR JUDGING EDG RELIABILITY PERFORMANCE. THE PLAN IS TO REACH GENERAL UNDERSTANDING ON THIS ASPECT BEFORE TAKING UP RESPONSE APPROACHES 1 ,--,w
ELEMENT 1 USE LAST 50 AND LAST 100 DEMANDS 2 TO JUDGE EDGE RELIABILITY AGREE WITH NUREG/CR-5078 THAT 50 DEMANDS AND 100 DEMANDS ARE APPROPRIATE SAMPLE SIZES THEYHAVELIMITATIONS,BUTOVERALLAPPEARTOBESS GOOD AS CAN BE HAD THE ACCEPTABLE RANGE FOR SAMPLE SIZE IS LIMITED THE MAXIMUM SAMPLE SIZE IS LIMITED BY HOW OLD AND RELEVANT THE EARLIEST DATA IS THE MINIMUM SAMPLE SIZE IS GOVERNED ilY STATISTICAL CONFIDENCE CONSIDERATIONS l l t I ~. 2
ELEMENT 1 (CONTINUED) A 100 DEMAND SAMPLE IS STATISTICALLY RELIABLE, BUT IN SOME CASES COULD INCLUDE DATA THAT IS UP TO 8 YEARS OLD AND PROBABLY NOT RELEVANT A 20 DEMAND STMPLE IS T00 STATISTICALLY UNRELIABLE TO BE USABLE (ELEMENT 4) A 50 DEMAND SAMPLE IS IN THE MIDDLE. THE REACH-BACK IS UP TO 4 YEARS. THIS 15 LONG, BUT USABLE IF THERE HAS NOT BEEN A MAJOR CHANGE. FIFTY IS LARGE EN0 UGH FOR THE STATISTICAL CONFIDENCE LEVEL TO BE ACCEPTABLE. m 3
~- ELEfiENT 1 (CONTINUED) COMBINING START AND LOAD-RUN FAILURE DATA TO GIVE A COMPOSI-TE FAILURE FIGURE FROM NSAC-108 1) EDG RELIABILITY = (START RELIABILITY) X (LOAD-RUN RELIABILITY) WHERE: 2) START RELIABILIT( = 707,t[,$ $ 7tM $3@77373y 0F 3) LOAD-RUNRELIABILITY=707,t%[ggF L T AD-RUN CONTINUING (4) EDG RELIABILITY =(1-START UNREL) X (1-LOAD-RUN UNREL) =1-(START UNREL + [0AD-RUN UNREL) + (START UNREL X LDAD-RUN UNREL) 5) EDG UNRELIABILITY = START UNREL + LOAD-RUN UNREL w .\\
ELEMENT 1 (CONTINUED) I HENCE 4 FOR A 100 DEMAND SAMPLE: 6) EDG UNRELIABILITY = (START FAILURES) + (LOAD-RUN FAILURES) 100 ) FOR A 50 DEMAND SAMPLE: 7) EDG UNRELIABILITY = (START FAILURES) + (LOAO-RUN FAILURES) 50 i 4 1 5
o ELEMENT 1 (CONTINUED) 2 GUIDANCE FOR A RELIABILITY PERFORMANCE ASSESSMENT USING DATA FOR INDIVIDUAL EDGs TYPICAL NUMBER OF DEMANDS PER YEAR START 25 TO 100 LOAD-RUN 12 TO 50 FOR 100 DEMAND SAMPLE. INCLUDE FAILURES FROM: DATA REACHES BACK LAST 100 START DEMANDS (1.0 TO 4.0 YEARS) LAST 50 LOAD-RUN DEMANDS AND MULTIPLY BY 2* (1.0 TO 4.0 YEARS)
- lT IS PREFERABLE TO USE A SAMPLE OF MORE THAN 50 LOAD-RUN DEMANDS (WITH APPROPRIATE SCALING TO 100) IF THE REACH-BACK IS NOT EXCESSIVE.
FOR 50 DEMAND SAMPLE. INCLUDE FAILURES FROM: LAST 50 START DEMANDS (0.5 TO 2.0 YEARS) LAST 50 LOAD-RUN DEMANDS (1.0 TO 4.0 YEARS) I 6
ELEMENT 1 (CONTINUED) GUIDANCE FOR A RELIABILITY PERFORMANCE ASSESSMENT USING COMBINED EDG DATA TYPICAL NUMBER OF DEMANDS PER YEAR START 50 TO 200 LOAD-RUN 25 T0 100 FOR 100 DEMAND SAMPLE, INCLUDE FAILURES FROM: DATA REACHES BACK LAST 100 START DEMANDS (0.5 TO 2.0 YEARS) LAST 100 LOAD-RUN DEMANDS (1.0 TO 4.0 YEARS) FOR 50 DEMAND SAMPLE. INCLUDE FAILURES FROM: LAST 50 START DEMANDS (0.25 TO 1.0 YEARS) LAST 50 LOAD-RUN DEMANDS (0.50 TO 2.0 YEARS) l i l 7 L
ELEMENT 2: GRADED RESPONSE EDG RELIABILITY PROGRAM Desirable Features of Regulatory Reauired Program Consistent with many features of NUREG 5078 Simple to implement; clear requirements Expected to maintain good EDG performance and to improve poor performance No punitive or counterproductive requirements Graded response dependent on EDG performance
o PROCESS FOR MAINTAINING EDG RELIABILITY PERIODIC m A TESTING 1r r 3 EVALUATE PERFORMANCE IMPROVE-MARGINAL ACCEPTAh MENTNEEDED \\ PERFORMANCE PERFORMANCE \\_ v 'P IDENTIFY RELIABILITY IDENTIFY IMPROVEMENTS RELIABILITY BASED ON IMPROVEMENTS M NTOR EXTENSIVE BASED ON PAST FAILURES EVAL UATION FAILURES t V k
CHARACTERISTICS OF A SLIDING SAMPLE HISTORICALLY EDG RELIABILITY HAS BEEN DETERMINED BY MONITORING A SLIDING SAMPLE OF DEMANDS - TYPICALLY THE LAST 100 EACH SAMPLE HAS BEEN FORMED FROM THE PREVIOUS SAMPLE BY REPLACING THE OLDEST DEMAND WITH THE LATEST DEMAND WITH EACH NEW DEMAND WE HAVE SOUGHT AN INDICATION OF RELIABILITY BY COUNTING THE NUMBER OF FAILURES IN THE PREVIOUS 100 DEMANDS IN DOING THIS, EACH NEW DERAND HAS BEEN TREATED AS GIVING RISE TO l A NEW SAMPLE OF 100 DEMANDS 1 i I L
CHARACTERISTICS OF A SLIDING SAMPLE (CONT'D) FOR EXAMPLE, IT CAN BE SHOWN THAT FOR AN UNDERLYING 95% REllABILITY, EACH OF THE 100 DEMAND SAMPLES STEMMING FROM EACH NEW DEMAND HAS A 38% CHANCE OF HAVING MORE THAN 5 FAILURES NOTE THIS PROBABillTY OF HAVING MORE THAN 5 FAILURES IN THE LAST 100 DEMANDS, ACCOMPANIES EACH NEW SINGLE DEMAND - ALL 100 0F THEM THE ARITHMETIC TO DETERMINE THE PROBABILITY OF EXCEEDING 5 FAILURES IN 100 DEMANDS ACTUALLY HAS BEEN DETERMINED IN A WAY THAT YlELDS THE PROBABILITY OF EXCEEDING 5 FAILURES IN A TOTAL OF 100 SAMPLES (NOT ONE) EACH HAVING 100 DEMANDS l IN THIS EXAMPLE, (0.38 X 100 =) 38 0F THE 100 SAMPLES (EACH HAVING 100 DEMANDS) COULD BE EXPECTED TO INCLUDE MORE THAN 5 FAILURES. THIS AVERAGES TO BE AN EXCEEDEijCE EVERY 2 TO 3 NEW DEMANDS I 2
CHARACTERISTICS OF A SLIDING SAMPLE (CONT'D) BUT IN PRACTICE, MOST OF THESE EXCEEDENCES HAVE HAD LITTLE MEANING FOR A VERY COMMON SENSE REASON THEY HAVE BEEN EXCEEDENCES CAUSED BY AN OLD GROUP OF FAILURE STILL ARE INCHING BACKWARD IN THE LAST 100 DEMANDS, WHILE THE CURRENT NEW DEMANDS ARE SUCCESSFUL THE PECULIARITIES OF THE SLIDING SAMPLE BECOME EVER MORE PE THE SAMPLE SIZE GETS SMALLER THE BOTTOM LINE IS THAT THE FAILURE CRITERIA THAT DETERMINE EXCEEDENCES MUST BE SPECIFIC TO THE SLIDING SAMPLE METHODOLO 4 THAT IS BEING USED TO INDICATE EDG RELIABILITY 3 t
ELEMENT 3: DETERMINING TRIGGER LEVELS i i Definitions Per Reg Guide 1.155 and NUMARC 87-00, utilities will commit to comply with reliability targets (i.e.,0.95 or 0.975). Compliance with targets can be determined by comparing EDG performance with triggers (i.e., number of failures in a standard size sarnple). l l l l I { i
~ ELEMENT 3: DETERMINING TRIGGER LEVELS
Background
The use of failure rate triggers to track compliance with EDG reliability goals recommended in NUREG/CR 5078 part of EPRI EDG reliability program studies practical, straight-forward performance indicator for management and regulators. Insufficient data or analyses existed to evaluate failure trigger values as they would be used. Triggers must be optimized with respect to false exceedences and missed exceedences.
ELEMENT 3: DETERMINING TRIGGER LEVELS Objectives Develop failure targets for the following tables that are optimized with respect to false exceedences and missed exceedences. EDG Trigger Values Reliability Failures out Failures out Target of 50 of 100 0.95 0.975 Test the viability of a 20 demand trigger level. l Set triggers so that 50 demand trigger is an early warning to the 100 demand trigger. Evaluate the probability of false exceedence for the current population of nuclear units. t
\\ ELEMENT 3: DETERMINING TRIGGER LEVELS Method A Monte Carlo simulation of diesel demands was performed. Exponentially distributed mean times to failure were verified and simulated. Accounting for complications: overlapping samples instantaneous values of failure rates combinations of triggers cumulative probabilities of exceedence Range of conditions simulated: 0.95 and 0.975 reliability targets running 20,50, and 100 sample sizes failure triggers from 2 to 10 actual reliabilities from 0.90 to 0.99
ll 1lllll l 1l l 1lll 1 l' I! .l lil1 1Il1ll '1' c. i.. 0 0 0 5 5 5 / / / 4 S 6 + s E S C T N E + E G ... Y D R . T E A u T )S B E l C YT A X TE U ERI G L . E OI R T FB A - + .. R E AT G G R U D R A E D A E RN E T Y A E R 5M G F E O E 9. D . A ... R Y P0 E T L0 V u A5 A l I( B T T A N IN B E O T . U R O P P ~ ~ 1 4 s. i. 8 o Y E TT CR E uG NA EE lBR DY AA E BT ER O FCE R OXP P E \\
e e a 9 9 9 9 9 9 9 9 9 9 o o o o o o o o o o i k k k l k U N i s--R ( 7 3 (--2 a n \\ \\ (--2 i o a \\ l s 5--;; q .ii i u< a \\ \\ {--N q g a 5 1 4-8 l q g a {- a a 5 1 \\ \\ 6-;; q le F-a ba!< g 1 4 o a >w a "uo n g g E z w) 4 a a f mw s \\ f-2 g83 r 6 a k 4-= o m i EN h .I 4.. b i 3 -r h-I [ l E go' b {.-= 23e 4-= + 2 o \\ \\ m 2 b a 4--:: k k ( = O \\ \\ J b a -= 8 N s. l-- N 1 1 L. N 1 ..l. N ..I., !..L., \\ \\ \\ l h,, '.\\ Y.. " N, a = n n n n n n o a o e e o e e o
- a z
55 8 2g w$ !a=O U Q. g
EDG Trigger Values Reliability Failures out Failures out Target of 50 of 100 0.95 5 8 0.975 3 5 Consider the 5/50 failure trigger: For units 2 0.97 reliability False exceedence rate < 7% per year False exceedence rate < 16% in 3 years For units s 0.93 reliability y7[$ Exceedence rate > 55% per year Exceedence rate > 8No in 3 years Trigger is early warning for the 8/100 trigger > 80% of time For current U.S. population, false exceedence < 5% / year
EDG Trigger Values Reliability Failures out Failures out Target of 50 of 100 0.95 5 8 't 0.975 3 5 Consider the 8/100 failure trigger: For units 2 0.97 reliability False exceedence rate < 3% per year False exceedence rate < 6% in 3 years For units s 0.93 reliability @['/f Lo per year Exceedence rate > 6) Fin 3 years Exceedence rate > 85 o For current U.S. population, false exceedence < 2% / year
EDG Trigger Values Reliability Failures out Fallures out Target of 50 of 100 0.95 5 8 0.975 3 5 Consider the 3/50 failure trigger: For units 2 0.985 reliability False exceedence rate < 12% per year False exceedence rate < 25% in 3 years For units s 0.965 reliability Exceedence rate > 45% per year Exceedence rate > 80% in 3 years Trigger is early warning for the 5/100 trigger > 85% of times For current U.S. population, false exceedence < 7% / plant year i I
EDG Trigger Values Reliability Failures out Failures out Target of 50 of 100 O.95 5 8 O.975 3 5 Consider the 5/100 failure trigger: For units 2 0.985 reliability False exceedence rate < 5% per year False exceedence rate < 12% in 3 years For units s 0.965 reliability Exceedence rate > 41% per year Exceedence rate > 65% in 3 years For current U.S. population, false exceedence < 3% / plant year L
O C Example of Sensitivity to Changes in Failure Trigger Values Unit Results (%) for failure target of reliability 5/50 6/50 2 0.97 units 7 / yr 3 / yr 16 / 3 yrs 7 / 3 yrs l s 0.93 units 55 / yr 38 / yr 87 / 3 yrs 70 / 3 yrs
A 20 demand failure trigger level is not viable because of the high false exceedence rate. Unit Results (%) for failure target of Reliability 2/20 0.97 units 43 / yr 0.93 units 89 / yr i l l l l l l
i .4 OVERALL UNIT AVERAGE EDG RELIABILITY (1983-1985) BASED ON NSAC-108 DATA 207 18-- i.-- 14-It-- NUMBER OF,,__ PLANTS + g.- 4-- 2 --- =>......>......>.E.....>.S 1 OVERALL UNir AVERAGE RELIABILITY}}