RIS 1999-03, Resolution of Generic Issue 145, Actions to Reduce Common-Cause Failures
- t ' '~ A-/-/7 UNITED STATES NUCLEAR REGULATORY
COMMISSION
OFFICE OF NUCLEAR REACTOR REGULATION
WASHINGTON, DC 20555-0001 October 13, 1999 NRC REGULATORY
ISSUE SUMMARY 99-03 RESOLUTION
OF GENERIC ISSUE 145, ACTIONS TO REDUCE COMMON-CAUSE
FAILURES
ADDRESSEES
All holders of operating licenses for nuclear power reactors, except for those licensees who have permanently ceased operations and have certified that fuel has been permanently removed from the reactor vessel.
INTENT
The U.S. Nuclear Regulatory Commission (NRC) is issuing this regulatory issue summary (RIS)to notify nuclear power reactor licensees about the staff's resolution of Generic Issue (GI) 145,'Actions to Reduce Common-Cause Failures," and to communicate the broad insights that have been developed from the staff's review of the common-cause failure (CCF) events identified in licensee event reports during the 15-year period between 1980 and 1995. This RIS does not transmit any new requirements or staff positions.
No specific action or written response is required.
BACKGROUND
INFORMATION
Prevention of CCFs is very important to ensuring nuclear power reactor safety. For highly redundant systems, CCFs can be a major cause of system failure. The accident at Three Mile Island in 1979 and the loss of main and auxiliary feedwater incident at Davis-Besse in 1985 were examples of occurrences involving CCFs. NRC studies have shown the importance of CCFs, and probabilistic risk assessments (PRAs) routinely identify CCFs as important contributors to potential core damage sequences and risk. Licensee event reports and operating experience studies have identified actual and potentially significant CCFs. GI-145 was established to determine whether additional cost-effective actions to reduce the potential for significant common-cause failures were appropriate.
To resolve GI-145 and to address deficiencies related to the availability and analysis of CCF data, the staff developed a CCF database and CCF analysis software package for addressing the CCF aspect of system reliability analyses and related risk-informed applications.
The CCF database contains (1) guidance on the screening and interpretation of data and (2) relevant event data to provide a more uniform and cost-effective way of performing CCF analyses.
In July 1998, the NRC issued Administrative Letter 98-04, 'Availability of Common-Cause Failure (C06Q0a I PD lDoCX 65000005 u qlb13 J/I nhc X, R Z -S-<
Database." This administrative letter notified nuclear power reactor licensees of the availability of the CCF database, CCF analysis software, and associated technical reports that had been developed by the NRC. As noted in the administrative letter, the quantitative results of the CCF data collection effort is described in NUREG/CR-6268, "Common-Cause Failure Database and Analysis System." Additionally, by letter dated July 30, 1998, the NRC sent nuclear power reactor licensees a CD-ROM containing the CCF database together with supporting technical documentation, including an analysis software package, to aid in system reliability analyses and risk-informed applications.
Some quantitative insights about the data were also published in NUREG/CR-5497, 'Common-Cause Failure Parameter Estimations," for use in PRA studies.
SUMMARY OF ISSUE
With the dissemination of NUREG/CR-6268 information in Administrative Letter 98-04 and the distribution of the CD-ROM on the CCF database and its use, the staff concluded that the objectives of GI-145 had been substantially achieved without the need for developing new or revised requirements.
This conclusion was based in large measure on the recognition that the existing infrastructure of regulations, operating experience review processes, probabilistic risk assessments programs, licensee safety review processes, and NRC regulatory oversight
'programs provide a robust framework for identifying and correcting potentially significant CCFs.The existing NRC infrastructure has been further strengthened, for example, by providing CCF insights for NRC inspections and the dissemination of NUREG/CR-6268 information in support of consistent and correct treatment of CCFs in PRAs. An additional basis for closure of GI-145 is the recognition that the trend in yearly occurrence rate for complete'
CCF events has steadily declined over the last two decades, as is shown in Figure 1. Note, however, that caution should be used in extrapolating the fitted trend lines.Although the general insights from the analysis of the CCF data are documented in Volume 1 of NUREG/CR-6268, the staff determined that it would be beneficial to augment Administrative Letter 98-04 with a summary that specifically highlights for nuclear reactor licensees the CCF event insights in NUREG/CR-6268.
Accordingly, the general observations from the analysis of the CCF event data are summarized in the paragraphs that follow.General Insights From CCF Events Basic information about the nature of CCF events is shown in Figures 2 and 3. These figures illustrate the distribution of the proximate causes and coupling factors, 2 respectively, for CCF' A complete CCF event is one in which all of the components are completely failed (not degraded), and the failures occur within a short time period of each other.2 A coupling factor is a characteristic of a group of components that identifies them as susceptible to the same cause of failure. Such characteristics include similarity in hardware, maintenance, environment, or operation.
Examples of coupling factors are (1) the same defective design in multiple identical components (hardware), (2) an incorrect set point specified in the calibration procedure for multiple relief valves (operational), and (3) emergency diesel generator (EDG) fuel oil contamination that disables all EDGs (environmental).
events during 1980-1995.
This information presents a general picture of the types of events that may be expected to occur, and which design features might be most susceptible to CCF events.0.35 i 0.3 0.° 0.25 8 0.2 S 0.E01 001 0 t0.1 9 0.05.!
- 1' I-I- ! 1- I I I I I i I I lT l 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 Year F Estimated
-Fitted --- -5% Bound -95% Bound Figure 1. Yearly occurrence rate for complete CCF events These figures also illustrate the different characteristics of partial CCF events 3 and complete CCF events.A general review of the actual events and the distributions presented in Figures 2 and 3 reveals the following insights regarding CCF events: A major programmatic contributor to CCF events is maintenance practices.
The frequency of scheduled maintenance has been a factor in wear out-caused and aging-caused events. Additionally, the quality of the maintenance, in terms of both the maintenance procedures and the performance of the maintenance activities, is a key factor. Similar events have occurred at different plants-lubrication of circuit breakers (too much, too little, or too long between lubrications)
and improperly set torque switches and limit switches on motor-operated valves that are reported as misadjustment and not as set point drift. This indicates the importance of the review of maintenance practices in minimizing CCF potential.
- Another significant contributor to CCFs is design problems.
Many of the design-related CCF events resulted from a design modification, indicating that the modification review processes were not sufficiently rigorous and resulted in conditions that introduced susceptibility to CCF.* Human errors related to procedural problems caused a small percentage of the total events. However, the impact of the individual events was usually greater, since the human errors often defeated the programmatic controls (e.g., procedures, vendor maintenance guidance).
This is illustrated by comparing Figures 2b and 2a, which show that human errors cause a larger portion of complete CCF events than partial CCF events. Examples of events caused by human error are (1) simultaneously draining all emergency diesel generator day tanks for a chemistry surveillance and (2) having redundant pump motor breakers racked out as the plant changed mode from shutdown to power.* A vast majority of the CCF events are not due to multiple failures associated with an operational demand, but result from a "condition of equipment." The most common is an inspection or surveillance test of one component revealing a deficiency that prompts the licensee to inspect/test the redundant component, resulting in the discovery that the same defective condition is common to both components.
This illustrates that detection of failures during the testing and surveillance program can prevent CCFs from occurring during demand situations.
3 Any CCF event which is not a complete CCF event. At least one component in the group is not completely, but partially, failed or one of the failures does not occur within a short time interval of the original failure, or there is uncertainty about the shared cause.
Cantl/C'm'onent V 09w;" FR~1 2a. Distribution of causes of complete and partial CCF events 2b. Distribution of causes of only the complete CCF events Figure 2. Distribution of CCF events by cause
3a. Distribution of coupling factors for both complete and partial CCF events 3b. Distribution of coupling factors for only complete CCF events Figure 3. Distribution of CCF events by coupling factors The CCF database contains several examples of both CCF and independent failure events recurring at selected plants. This indicates varied effectiveness of root cause analyses and corrective actions from plant to plant. Examples of repeated events are water in compressed air systems, pump seal wear out, and turbine governor misadjustment.
However, not all plants experience the same type of recurring event.This indicates that plant-to-plant variability exists in the CCF parameters that might cause the CCF parameter estimates used in PRAs for some plants to be higher than the industry average for certain component and system combinations.
Table 1 lists the systems, component types, and failure modes for which CCF events have been collected and entered into the database.
It also contains the number of CCF events for each system and component combination and the number of independent failure events.Table 1 shows only the event counts for failure modes that are relevant to PRA studies. Other failure modes, such as failure to close for reactor trip breakers, were found in the source data;these events were coded and entered into the CCF database, even though they are not likely to be used in PRA studies.SPECIFIC INSIGHTS FROM CCF EVENTS The NRC plans to update the CCF events database and document more specific observations and insights on the characteristics of CCF events for classes of risk-significant component groups such as emergency diesel-generators, pumps, motor-operated valves, air-operated valves, check valves, batteries/chargers, circuit breakers, heat exchangers and strainers.
It is anticipated that CCF insights reports will be periodically published over the next few years for each group and will include operational and engineering insights for CCF events including aspects such as causes, coupling factors, and frequency of occurrence.
Accordingly, as these studies are completed, the NRC plans to periodically supplement this RIS with more specific and detailed component-level CCF insights.With the transmittal of the general insights from NUREG/CR-6268, Vol. 1 in this RIS the actions required for final resolution of GI-145 have been completed.
The staff determined that a notice of opportunity for public comment prior to issuance of this RIS was unnecessary because it is informational and merely augments the NUREGICR documents and administrative letter noted in the background discussion, and the information presented herein was discussed in a public forum with the Advisory Committee on Reactor Safeguards.
Table 1. Component types and systems analyzed for CCF events (1980-1995)
Component PRA-Relevant Systems Analyzed for the Number of Number of Total Number Total Type Failure Modes Component Type CCF Independent of CCF Number of EventsT for Failures for EventS4 for Independent System and System & Component Failures for Component Component Type Component T ype T Type Type Air- Fail to Open Auxiliary Feedwater (PWR) 42 197 191 505 Operated Fail to Close Hinh PrpqtI,,irp t~inn RWR R Valves Fail to Stay Closed Isolation Condenser (BWR) 1 9 Main Steam Isolation (BWRIPWR)
146 271 Batteriesl No Output, High DC Power (BWR & PWR) 60 1,260 60 1,260 Chargers Output Check Fail to Open Auxiliary Feedwater (PWR) 59 201 147 556 Valves Fail to Close High Pressure Injection (BWRIPWR)
23121 841145 l Fail to Stay Closed Low Pressure Injection (BWRIPWR)
23/21 88/38 Circuit Fail to Open DC Power (BWRIPWR)
8 112 116 989 Breakers Fail to Close AC Power (BWRIPWR)
82 746 Fail to Stay Closed Reactor Trip Breakers (fail to open) 26 131 _Emergency Fail to Start, Run Emergency Power (BWRIPWR)
131 1,346 131 1,346 Diesel Generators Heat Fail to Transfer Containment Spray (PWR) 10 14 18 29 Exchangers Residual Heat Removal (BWRIPWR)
8 15 Motor- Fail to Open Auxiliary Feedwater (PWR) 27 422 192 2.568 Operated Fail to Close Containment Spray (PWR) 15 250 Valves Fail to Stay Closed High Pressure Injection (BWRIPWR)
11/40 3691292 Isolation Condenser (BWR) 2 44 Low Pressure Injection (BWRIPWR)
61/23 492/470 Pressurizer (PWR) 7 155 Refueling Water Storage Tank (PWR) 6 74 l Pumps Fail to Start Auxiliary Feedwater (PWR) 51 919 280 3,507 Emergency Service Water (BWRIPWR)
141 1,184 High Pressure Injection (BWRIPWR)
2142 343/481 Low Pressure Injection (BWRIPWR)
9/25 1481362 S Standby Liquid Control (BWR) 10 70 l Relief Fail to Open BWR Primary System 37 237 115 976 Valves Fail to Close Pressurizer (PWR) 22 334 Fail to Stay Closed Steam Generator (PWR) 56 405 Safety Fail to Open Pressurizer (PWR) 6 119 38 280 Valves Fail to Close Steam Generator (PWR) 32 161 Fail to Stay Closed Strainers Fail to Allow Flow Containment Spray (PWR) 1 0 39 162 Emergency Service Water 36 162 (BWRIPWR)_ _iu:es Pool (BWR) 2 0'includes partial (degradations)
and complete failure CCF events This RIS requires no specific action or written response.
If you have any questions about the information in this RIS, please contact one of the technical contacts listed below.David ws, Director Division of Regulatory Improvement Programs Office of Nuclear Reactor Regulation Attachment:
Recent List of NRC Regulatory Issue Summaries Technical Contacts: Dale Rasmuson, RES 301-415-7571 E-mail: dmr@nrc.gov A uaw 4s Ronald Emrit, RES 301-41 5-6447 E-mail: rce@nrc.gov Attachment
1 LIST OF RECENTLY ISSUED NRC REGULATORY
ISSUE SUMMARY Regulatory Issue Date of Summary No. Subject Issuance Issued to 99-02 Relaxation of TS Requirements
10/13/99 All holders of Ols for nuclear for PORC Review of Fire Protection Program Changes power reactors, except those who have permanently ceased operations and have certified that fuel has been permanently removed from the reactor vessel 99-01 Revision To The Generic Communications Program 10/4/99 All NRC licensees OL = Operating License CP = Construction Permit This RIS requires no specific action or written response.
If you have any questions about the information in this RIS, please contact one of the technical contacts listed below.Original signed by David B. Matthews, Director Division of Regulatory Improvement Programs Office of Nuclear Reactor Regulation Attachment:
Recent List of NRC Regulatory Issue Summaries Technical Contacts: Dale Rasmuson, RES 301-415-7571 E-mail: dmrinrc.gov Ronald Emrit, RES 301-415-6447 E-mail: rce~nrc.gov Tech Editor review and concurred on September
13, 1999 DOCUMENT NAME:S:\DRPMSEC\ris99-03.wpd
- See Previous Concurrence To receive a copy of this document, indicate in the box C=Copy w/o attachment/enclosure E=Copy with attachmentlenclosure N = No copy OFFICE RES* I RES* I RES i I X RESI Il l REXB:DRIP*
I NAME DRasmuson PBaranowsky l SRubin ERossi JShapaker DATE 9/24/99 9 /27/99 l /°99 J 9/24 /99 9 /27 /99 OFFICE SPSB* I C:REXB:DRIP*
I D:DRIP NAME RBarret LMarsh DATE 9/30 /99 l 10/4/99 0/A499 l1 OFFICIAL RECORD COPY
RIS 99-XX October XX, 1999 This RIS requires no specific action or written response.
If you have any questions about the information in this RIS, please contact one of the technical contacts listed below.David B. Matthews, Director Division of Regulatory Improvement Programs Office of Nuclear Reactor Regulation Attachment:
Recent List of NRC Regulatory Issue Summaries Technical Contacts:
Dale Rasmuson, RES 301-415-7571 E-mail: dmrenrc.gov Ronald Emrit, RES 301-415-6447 E-mail: rie @nrc.gov Tech Editor review and concurred on September
13, 1999 DOCUMENT NAME:,E5:\REXBjel\ris-cif.wpd
- See Previous Concurrence To receive a copy of this document, ipdicate in the box C=Copy w/o attachmentlenclosure E=Copy with attachmenVenclosure N = No copy OFFICE RES* / RES* RES RES* REXB:DRIP*l NAME DRasmus 4 n PBaranowsky SRubin* ERossi JShapaker DATE 9/24/9 j9 /27/99 1j01.599 9/24 /99 9 /27 /99 OFFICE SPSB* C:REXB:D lP l lD:DRIPIl NAME RBarrett LMarsh DMatthews DATE 9 /30 /99 to/ 4/99 1 /99 OFFICIAL RECORD COPY
RIS 99-YY September XX, 1999 regulatory issues summary requires no specific action or written response.
If you have any,-'questions about the information in this summary, please contact one of the technical coptacts listed below or the appropriate Office of Nuclear Reactor Regulation (NRR) project aager.David B. Matthews, Director 7 Division of Regulatory Improvement Programs Office of Nuclear Reactoriegulation Attachment:
Most recent list of NRC Regulatory Issues Summaries Technical contacts Dale Rasmuson, RES 301- 415-7571 E-mail: dmrenrc.gov/r Ronald Emrit, RES 301- 415-6447, E-mail: rcefrc.gov James ,$fapaker, NRR 301-/45-1
151 E-W'ail: jwsinrc.gov Tech Editor review and concurred on September
13, 1999 DOCUMENT NAI(AE: G:\REXB\jel\ris-cif.wpd To receive a cop of this docurfent, indicate in the box C=Copy w/o attachment/enclosure E=Copy with attachment/enclosure N = No copy E OFFICE RES RES C RES RES REXB:DRIPl_NAME D, 9f9 PBarano Aky 9 D SRubin l l ERos j l JShapaker DT /99 9/27/99 >t6:99Ayq
?7110ln 9099 1 99l OFFICE SPSB ,pAC:REXB:DRIP
I D:DRIP l NAME RBarrett r LMarsh DMatthews DATE V!299 q -2 5 I /1199 I /99 OFFICIAL RECORD COPY