ML20153H475
| ML20153H475 | |
| Person / Time | |
|---|---|
| Issue date: | 04/15/1988 |
| From: | Stello V NRC OFFICE OF THE EXECUTIVE DIRECTOR FOR OPERATIONS (EDO) |
| To: | |
| Shared Package | |
| ML20153H298 | List: |
| References | |
| FOIA-88-332, TASK-PINV, TASK-SE SECY-88-103, NUDOCS 8805130022 | |
| Download: ML20153H475 (31) | |
Text
i * " %,
il S I
s...../
April 15, 1988 POLICY ISSUE (Notation Vote) stev-88-ios For:
o The Comissioners From: Victor Stello, Jr.
Executive Director for Operations
Subject:
STATUS OF THE PERFORMANCE INDICATOR PROGRAM Purpese:
To inform the Commission of the status of the Perfonnance Indicator (PI) Program and obtain approval of the staff's plan to include new P!s in the program.
Sumary:
The PI program as approved by the Comission is now .*dlly implemented under the direction of AE00. The interoffice task group established to develop the initial set of P!s has been retained to assist in the continuing development and improvement. The quarterly PI reports have been providing valuable input to senior management cecision-making with regaro to the need to adjust plant-specific regulatory programs. Over the past year, the staff has developed an in-house report production system that is fully operational. The quality and contents of the reports have irrproved through the use of this system and enhanced data presentation methods. The PI data are extracted from the licensee event reppts and other operational data which are submitted to the NRC in accordance with current regulations. '
Since the Comission approval of six Pis, the staff has added collective radiation exposure as the seventh PI in the program. The exposure data are being provideo on an annual basis. The practicality of obtaining the quarterly data for radiation exposure and other comon PIs is being discussed with the Institute of Nuclear Power Operations (INPO).
The staff plans to use causes of events (cause codes 1 that include licensed operator error, other personnel error, maintenance problem, design / installation / fabrication problem, administrative control problem and random equipment failure as Pts in the program. In conjunction with cause ~
codes the licensee corrective actions that include training, procedure, discipline, tranagement change, design modification, and equipment replacement / adjustment are also planned to be monitored.
CONTACT: R. Singh, AEjD 9$$Wl3 COD]X,qhPP-
.= -
o Thd Co missioners The staff believes that the addition of cause codes to {
the current set of PIs significantly enhances the ability i to recognize overall performance trends of. individual !
plants. The cause codes provide insight into licensee ;
programs, and thus, they add to the predictive capability !
of the PI program. In conjunction witt. the current P!s, I they enable better identification of potential areas of
.aknesses in licensee programs, such as maintenance. For example, two of the current PIs, safety system failures and equipment forced outages per 1000 critical hours, serve as ,
direct measures of maintenance effectiveness since equip- i ment failures are largely due to inadequate or improper l maintenance. In addition, autcmatic scrams while critical l and significant events provide some measures of maintenance effectiveness as many of them involve equipment failures due to maintenance deficiency. Therefore, the use of a mainte-nance cause code, along with these four PIs, enhances the staff's ability to monitof maintenance effectiveness.
Similarly, licensed operator error and other personnel error cause codes, along with training as a part of the corrective actions provide insights into the training area.
The PI developmental effort, primarily undertaken by RES in conjunction with AE00, NRR and the regions, has identified ,
an indicator of safety system unavailability, a risk-based PI, that can be included in the program as soon as the necessary data are available to the NRC. This indicator is directly related to plant operational safety and provides a 4
measure of the effectiveness of maintenance. Also, the data for this pl will provide supplemental infonnation, the mean time between failures of safety systems, that provides additional insights into the reliability of safety systems and the effectiveness of preventive maintenance. The staff is currently reviewing a similar indicator, safety system performance indicator, developed by INP0 as an alternative to the previously described safety system unavailability I indicator. Discussions with INPO will continue in this I rega rd. The safety system failures P! will be deleted when the new indicator is routinely implemented and included in j
- the program.
4 The staff remains comitted to continue exploring additional Pls and the means for obtaining the data neces- !
sary for their development and implementation.
l
Background:
The Secretary's memorandum of December 30, 1986 on !
i SECY-86-317, Performance Indicators, directed that: the ,
staff should continue exploring the development of Pls l
beyond those included in the program; the optimum set of I
PIs should not b2 expanded to more than about ten P!s without consulting with the Conynission; and the staff 1
j l
1 i
_-c_- . . _ . _ , , - _ . _ - - - . _ _ _ , . . . - , . __
', b s l
i The tcmnissioners should keep the Comission apprised of the status of th(
continuing development and implementation of Pls. On June 9,1987, the staff briefed the Comission on the status of the PI program. The subsequent staff requirements memoran-dum of Ju9e 16,1987 encouraged the staff to consider certain specific perfonnance elements when developing new '
PIs. In the staff requirements memorandum of February 25, 1988 on SECY-87-314, Interim Policy Statement on Maintenance gf Nuclear Power Plants, the Comission advised the staff of their concerns with respect to the utilization of cause codes. The results of the staff's effort, including recom-mendations, are sumarized below. The causes of events and corrective actions are discussed in detail in Enclosure 1, and the risk-based P!s in Enclosure 2.
Discussion: Program implementation The Cornission initially approved six P!s for monitoring in the program. They were automatic scrams while critical, safety system actuations, significant events, safety system failures, forced outage rate, and equipnt forced outages per 1000 critical hours. Subsequently, the staff has added collective radiation exposure as the seventh P! in the program. The definition of this PI is identical to the one used by IMPO. It is the total dose at the site divided by the number of units at the site contributing to the exposure.
The PI data are extracted from licensee event reports. These reports are submitted in accordance with 10 CFR 50.73, issediate rotifications to the NRC Operations Center in acconbnce with 10 CFR 50.72, monthly operating reports in accordance with plant Technical Specifications, and annual radiation exposure reports in accordance with 10 CFR 20.407.
The possibility of obtaining radiation exposure data on a
, quarterly basis free INPO is currently being explored. As directed by the Comission in the staff requirements memo-randum of July 9,1987 on SECY-87-117, Coordination Plan for NRC/INPO Use of Performance Indicators, a memorandum of agreement is being developed that would provide a framework for: obtaining quarterly data for comen indicators from INP0; coordinating developmental activities; and thus, reducing the duplication of ef forts.
Since February 1987, the P1 reports have been provided to the sanfor r.anagement and Comission on a quarterly basis.
Also, they are being placed in the NRC Public Docuent Ro:n. So far five such reports have been issued. The senior management has been reviewing these reports in conjunction with other information on a semi-annual basis to recognize changes in the safety perfomance of operating plants and to identify those plants that ray warrant i ir. creased NRC attention.
,Tb Connissioners The staff has made several enhancements in the report production and data presentation methods since the approval of the program. The reports are now being produced in-house and their quality has been improved through the use of a micro-computer based system and in-house developed software.
In calculating a plant's PI trends for the top sunnary (finger) charts, the averages of the latest two quarter values instead of the latest quarter value are used to help provide increased stability in the trends. On the bottom sunnary (finger) charts, older plants are compared against older plant means and newer plants against both the older and newer plant means. The older plants are those that have had a full-power license for at least one calendar year.
The detailed analysis charts for a plant show!ng the quar-terly data for PIs now face the sunnary charts in the reports to enhance the review process. Also, beginning with the February 1988 report, the four quarter moving averages are being displayed on the analysis charts. '
Typical analysis and sunnary charts are provided in Figures 1 and 2 respectively. Part II of the report now contains supplemental infonnation such as the dates and susmary descriptions of events to assist in the evaluation of the charts, i
To ensure that the industry and NRC stcff are aware of the limitations of the Pls and to provide guidance in the !
interpretation of the data, several steps have been taken.
The staff has held workshops on the PI program for the j
industry in each of the five regions, and for the regional and headouarters personnel. Also, fonnal guidance on the use of performance indicators was issued to all NRC employees on February 5,1988 consistent with the staff requirements memorandum of December 2,1987 on SECY-87-207, Policy for Use of Performance Indicators.
The PI program is now a single and coordinated NRC program under the overall direction of AE00. Separate performance indicator programs in regions and headquarters have been discontinued. The interoffice task group that was j established to develop the initial set of PIs has been i
retained to assist in the continuing development and
) improvement activities. The regional and headquarters j program offices continue to provide active support to thw
- program.
! Developmental Effort ,
The focus of the developmental effort in the past year was q
on causcs of events, risk-based Pls. maintenance, training, i
a .
4 l
l
. .T e Contnissioners overtime, generic issues backlog, and other perfonnance elements recomended by the Comission for consideration.
The effort was primarily undertaken bv RES, in conjunction with AE00, and with assistance from NRR and the regions.
The results of the effort and plans for further development are provided below.
A. Causes of Events: The causes of events (or cause codes) are useful indicators of operational safety performance that cover a broad range of licensee programs and the results of those programs. Specifically, they are useful in: (i) identifying the potential areas of weaknesses in licensee programs, (ii) monitoring the effectiveness of licenste corrective actions to identi-fled problems, and (iii) predicting (and thereby ,
helping reduce) the likelihcod of serious events by evaluating the trends of causes associated with less serious, but more numerous ones.
Based on the results of the developmental effort and experience in this area, the staff has selected licensed operator error, other personnel error, main- '
tenance problem, design / installation / fabrication problem, administrative control problem, and random equipment failure as the cause codes for monitoring in the PI program. These cause codes are intended to raise questions about programatic performance through systematic identification of potential trends and thereby establish a basis and focus for further investi-gation. In view pf this, cause codes along with licensee corrective actions will be identified through expert review and evaluation of licensee event reports. Other available information, such as inspection reports will be reviewed to the extent practicable for improving the cause coding. The major corrective actions to be monitored are training, procedure, discipline, manage-ment change, design modification and equipment replacement /adjus tment. Together with cause codes, the corrective actions help in understanding the underlying causes of an event or deficiency.
The cause codes are related to all three key elements of plant safety, i.e., the frequency of transients, unavailability of safety systems and potential for comon-cause failures. For example, maintenance problems can result in transients as well as unavail- -
ability of safety systems and can contribute to the potential for cocmon-cause failures. Also operator error or other personnel error may, be a a licensed 9
,__,.-_-..____,_y ,
. . TNe Costnissioners cognitive error which is an important aspect of plant safety. Most importantly, since the cause codes identify the areas of weaknesses in licensee programs, they are considered to be leading indicators and thus, predictive of future performance.
The detailed descriptions for the cause codes and corrective actions including data presentation methods ;
are provided in Enclosure 1.
B. Risk-based PIs: The PIs are intended to monitor :
plant operational safety perfonnance. As such, they I should reflect trends i.1 the three key elements of operational safety mentioned earlier. From the efforts in refining the existing Pls for these elements and developing new ones, an indicator of safety system unavailability has been selected for inclusion in the !
program as soon as the required data become available, i This indicator is defined below.
Indicator of Safety System Unavailability: This indicator is the aggregate of the estimated unavaila- i bilities of seven important safety systems in a plant.
The seven systems are: auxiliar core isolation cooling for BWRs)y feedwater
, high pressure (reactor injection (high pressure coole t injection or core .
spray for BWR$), service wate' (or standby service water for BWRs), emergency ac Nwer, emergency de power, reactor protection, and cintainment spray (containment cooling for plants without spray). The operational data needed to constri.ct this P! are the total durations that the individual trains of those system 3 are cut of service and the total number of train failures (i.e., loss of train function) in a period. Using straight forward reliability methods based on independent events, the data are converted into the estimates of system unavailabilities. The individual estimates are then aggregated to arrive at the plant level indicator of safety system
- unavailability.
The indicator of safety system unavailability is directly related to plant operational safety and thus, to the overall risk to the public.. In addition, it reflects maintenance effectiveness. Since the indi- ,
cator is based on the number of trains in individual -
systems, it factors in plant-specific inherent design features which are important for evaluating operational safety. The systems selected for monitoring represent most of the sensitivity of risk to the outage of a i
4
)
, T5e Consnissioners ;
safety system train. Also, it is an Norovement over the safety system failures currently : the program as ,
the data density at the train level significantly '
i improves the ability to trend potential system problems.
The safety system failures will be removed from the set of PIs after the new indicator is included in the program. !
Also, using the data collected for this indicator, the ;
mean time between failures of selected safety systems '
will be calculated. This will be maintained as ,
supplermntal information for obtaining additional insights into the reliability of safety systems and
! the effectiveness of preventive maintenance. :
I f Additional details on the risk-based Pls are provided i in Enclosure 2. The staff is assessing rulemaking :
for obtaining the data necessary for this new PI i since the data are currently not required to be reported. Future plans for developmental work on the risk-based P!s include the treatment of cortnon-cause J
events and balance of plant transients. I 4
i C. Maintenance: The interoffice task group had initially
- recomendel maintenance backlog as a Pl. The defini- l 3 tion of this PI was the same as the one used by INPO, l i.e., the ratio of outstandino corrective maintenance '
i{ work requests, not recuiring a unit outage, that are
' greater than 3 months old to total corrective mainte-nance work requests at the end of a reporting period.
' However, this PI was deleted from the set reconinended to the Conunissien due to industry concerns as stated in SECY-86-317. The concern was that using the backlog as a PI could provide a negative incentive, such as minimizing the number of maintenance work 1
requests rather than minimizing the amount or impor-tance of backlogged work. The staff continues to explore other backlog measures for potential use as i Pls.
{
r Several of the current Pis, including safety system failures (SSFs) and e l critical hours (EFOs)quipment forced
, are measures of outages per 1000 maintenance .
i effectiveness. The failure trends of safety systems monitored in SSFs are measures of effectiveness in 3
maintaining the availability of safety systems. The -
i EF0 is a measure of the mean time between forced outages 4
caused by equipment failures, which can be largely l
attributed to deficiencies in the maintenance of equip-ment, particularly balance of plant toutpment. Also, I
- 4 i
i i
l
Tb Corivnissioners automatic scrams while critical and significant events provide some measures of mainterance effectiveness as many of them involve equipcent failure due to maintenaice deficiency.
In addition to the indicators of safety system unavailability and maintenance problem as a cause ; ode, the staff has explored several potential Pts in the area of maintenance over the past year. The status of these potential PIs is provided below.
Maintenance Rework: Maintenance rework has high face val;dity as a miintenance indicator. However, an automated data scarch presided only 65 LERs with iden-tified maintenance rework in 1986 out of approximately 1 3000 LERs. Fifty-eight operatino units had no reported rework and 19 had just one. As a part of the continuing developmental effort, the LER data base will be further evaluated, and the validity of and other possible data sources for this potential PI will be further explored, Reseat Equipment Failuros in an Individual System: l Lite the maintenance rework, repeat failur~es of the same equipment or similar equipment ir a system is a strong candidate for a potential maintenance Pl. Based i I
on an initial LER data search th'e developmental effort is being continued.
Items Out of Service: The number and duration of items out of service were~ evaluated using the infonnation in the Nuclear Plant Reliability Data System (NpADS).
The results of the effort to-date have been inconclu-sive. The plans are to continue exploring the use of NpRDS as a data source and in parallel evaluate plant-specific data far items out of service.
During the past year the development of maintenance Pls was focused on the data currently reported to the l NRC. The staff remains committed to continue exploring data sources for the development and imp 12 mentation of i
additional Pls. In addition to the maintenance rework and items out of service, other indicators currently being explored it,clude the mesh time to repair, mean time between main:enance of critical safety and blance of plant equipment, and nonnalized maintenance backlog. ,
D. Trainint: The training P!s studied over the last year includec licensed operator error and other personnel error as measures of fcedback fron on-the job experi-ence, and the NRC licensing examination results for
i
, he Comissioners I direct measures of training effectiveness. The cause codes - *aining as a part of the corrective actions have been .iscussed earlier.
The licensing examination results maintained by NRR and and the regions were evaluated to explo e the following five potential training PIs: Reactor Operator Initial --
Pass Rate, Senior Reactnr Operator Initial Pass Rate, Ave ~ age Reactor Operator Score, Average Seninr Reactor Operator Scorn, and Requalification Pass Rate. Based on
(
the available data, evaluation of the requalification pass rate was judged to be inconclusive. The evaluation >
will continue as more data become available. The remainin; potential PIs were found to have no recog- -
nizable relationship with licersed operator error.
The staff plans to continue exploring the development of training as well as maintenance PIs through plant-specific studies and review of similar efforts at other government organizations, such as NASA, FAA and 000.
E. Overtime: The work to develop a PI from this measure included a review of prior studies performed on the overtime practices in the transportation industr artned forces, the relationship of hours worked (y40and vs.
60 hours6.944444e-4 days <br />0.0167 hours <br />9.920635e-5 weeks <br />2.283e-5 months <br /> per wee 2) with productivity in the construc-tion industry, and the results of a survey of nuclear power plant personnel with respect to overtime. Suffi-cient overtine data from the nuclear industry were not available for evaluating their impact on safety.
The results of the review indicate that moderate levels of overtime within the NRC estab11rhed guideli nes are a comon practice at nuclear power plants and are not a concern. The staff will continue to explore ways for obtaining additional data for further development work.
F. Generic Issues Backlog: One pessible measure of management effectiveness is the responsiveness in resolving safety issues for a plant. Utilizing the data in the Safety Issues Management System (SIMS),
three measures of backlcig were evaluatad as a poten-tial Pl. They were the total number of months that issues had been in the backlog, the number of issues in the backlog, and the average number of months thtt the issues had been in the backlog at the end of a -
quarter.
The findings of this evaluation were that the number of issues and months in buklog have meaningful corre-lations with some of the current Pls. Although it was
, The Corsnissioners found that there is a wide variation in how quickly plants resolve the issues, nevertheless very few plants take longer than the schedule negotiated with the NRC. Additional analysis is planned before the staff makes a final recomendation on the generic issues backlog as a Pl.
G. _ Expanded PI Program: The staff is currently developing an expanded PI program to monitor the effectiveness of selected licensee improvement programs. AE00 has been working with the regions and NRR in developing plant-specific Pls to supplement the generic PIs for this program. The Dresden, Palisades, Rancho Seco and Sequoyah plants are initial participants.
Monthly data will be obtained from the plants on a voluntary basis. AEOD will evaluate the data and provide periodic reports to the senior management. The data collected for this program will be also used for the P! developmental activities. Examples of plant-specific Pts being considered include number and duration of safety and balance of plant equipment out of service, overtime, planned vs. actual preventive and corrective maintenance on equipment types (e.g., motor-operated valves), requalification pass rates, simulator training hours, maintenance training hours, turnover, vacancies, and repeat maintenance work requests.
H.
Direction of the Future Developmental Work: As a part of the developmental work, the staff will ~ctmtinue to review the existing P!s and improve them as necessary for enhancing the overall PI program. This may include the replacement of an existing PI with an improved one.
The major effort will be to develop and validate new Pts that are more directly related to safety and more pre-dictive of future safety perfonnance. Reliability and risk models will be used as the framework for aggregating
' component level data into potential plant level indicators.
Both the safety and balance of plant components and systems will be included in the development of such indicators.
The development of risk-based Pts is technically l
complex, but achievable because of the existence of models that relate operational data to safety perfor-
' mance. The development of progransnatic indicators. -
which we believe are more leading indicators than the event-based indicators, is much more difficult because quantitative models do not exist. Therefore, the selection of potential programatic Pts is more intuitive l
r
I The Comnissioners -
' and the validation of the predictive capability involves substantial effort. Nevertheless, the staff continues to explore such indicators through plant-specific studies, further evaluation of the data available to the NRC, ;
and participation in similar efforts at other organi-2ations in the U.S. and abroad. The developmental work
, will consider the reconnendations of the National Academy of Sciences.
The staff will continue to review the Pts in use and add new ones to the program. The growth of the PI program has been gradual in order to wintain it as i
1 a useful tool for senior r.anagement. The Coenission I will be kept apprised of the results of the develop-i mental activities.
4 Reconsnendations:
That the Connission.
1 Approve the staff's plans to include the cause codes and !
corrective actions in the program, proceed with the actions j for implementing the indicator of s fety system unavail-ability, and continue the developmental effort as described in this paper.
l Scheduling: I have directed the staff to preceed in accordance with these approaches pending Conr.ission review and subsequent guidance.
'j (s,ce. ,& '
1
. l ctor Stello, Jr Executive Direct for Operations
Enclosures:
- 1. Causes of Events and Corrective Actions
- 2. Risk-based Performance Indicators 1
\
\
l 1
Commissioners' comments or consent should be provided directly
, to the Of fice of the Secretary by c.o.b. Wednesday, May 4, 1988.
Commission Staf f Of fice comments, if any, should be submitted to the Commissior. rs NLT Wednesday, April 27, 1988, with an information copy to the Office of the Secretary. If the paper is of such a nature that it requires additional time for analytical review and comment, the Commissioners and the Secretariat should be apprised of when conunents may be expected.
DISTRIBUTION:
Connaissioners OGC OI OIA I GPA REGIONAL OFFICES EDO ACRS '
ASLBP I
ASLAP SECY
- e.g i
t l
l e
r cpt 1 u N , ester DL ANT X Leaend: ~
o+, ~i A-, 9 Critic'JI H0J S 56--1 to 87-4 "" ' 0 " '" * * "9 " "' 9'
.._ i AJomot< Sacrns ww Critcel ax e 2 Sc'ety System Actetent nao S. . W . I2SO 4: _ k.^ ,, #, P' h d h3. t y's ~
p 3.
81 ;
,xt y # .
3 xt ut a .
% 'E
@> >,8 ', .
cw f 1
- 2. M k 1 .
ew f l $ '
h: - eDC % $. k
- CCO '8 8
,, y ,
$ %i
'I ti f . -
S$ z ,
{ $ 2 ; \ il k- S$
- k hi '
h *
,k'! ;w j k ' '
e t s a SN. '
= r -
s t -- ~~ . no 0 0 0 I 0
96 1 St W3 94-4 85-187-2 4).) 85-4 06-1 M-! W 3 06-4 67 9 C-8 87-3 41-4 v ow - Cus ter v ow - O.cr t e 3 Spfcorit Cett 4. SCff ty SyS'tm FOktes
. 3. g 3. L kb f5 ?
={ ml 3:
4 's . , - 1*>-
- {I 1
- e .f; z ih\ ?
x
{5 1 i'$ i
, 4 .i , i . i j "
i 0 ?. , 1 4
- +
\
3 . _M . !
06 106-3 W3 86-4 87.1 t?.2 8'.) I?.e v ow - cus t er es t 36 2 W3 06-4 89 107 8 0'.3 07.e I tw - Curtw ;
l 6 C:p Fyce:s Cuoys/
to S Ferceo Cuene Rue (t) Critics *o,is I
- t
. E
= c-5 1 fI I ht o. 3 -
- b.i t
3E
- eo .
- 'll A
of*"
18 1s4 T
., k
, e f ,$
- 3. A; 20 . , g ['l _ 14 m:
f
'; i s r , w 'f Lh--
r:0 f"1 17 ,,,,sd. O tC we v:3: ao .
e >
' ,, h1 -
,A tekt 46-3 0453 R$4 t'-t BY.I S .3 i 31'-4 ed.t teki t$-3 06L4 8?'-t si.3 gi.) g/.4 ves - Gunter t w - Cur t y
, 'J q rouet a PLANT Y: Trends Performance Indicators Dec N incroved
- 2 htr Avg 'b E) - 083
- 2. Sofety System Actuotons (2 Otr. Avg ere 87-4; . ose
- 3. Spf. cord Events (2 Otr. Avg end 87-4) . one
- 4. Sofety System Foues (2 Otr. Avg end 87-4) . c at
. S. Forces Outoge Rote (2 Ctr. Avg end 87-4) . o ee 6 CovoneN forced gg/M ,Critg 877j) , n 3, 1
-2.5-20-i -iO 5 c: 0'S t'0 t'S 2'0 2.5 .
Devictions rom ev o.s 4 Otr. Mont M i (M*csved in St:-ord Devotions) eons l
PLANT Y: Deviations from Older Fet Means Performance Indicotors Bebr Avg Pe f Above Avg Perf, 1 Automatic Scroms wn.ie criticot (4 Otr. Avg ere 87-4) - -o t2 2 Safety $> stem Actuotons (4 Ctr. Avg end 87-4) . ,a 1
) 3 Sv$ficont Events (4 Ctr. Avg end 87-4) . .o p ,
a i
- 4. Saf ety System Foues (4 09. Avg end 87-4) . -o 47 S Fercee Outoge Rote (4 Otr. Avg ene 87-4) . -tu h '
6 EevemeN Forces s/1000 Crit Mrs Ayg end 87-4) - 09 evotions 0-i)-iof cm 'S0: C
'S t'0 t'S 2'O 2.5 Plont Meons '
1 i
(Meosured in St:re:rd Devota) l 4
4 .
I i
n 1
Enclosure 1 CAUSES OF EVENTS AND CORRECTIVE ACTIONS The causes of events (or cause codes) are useful indicators of plant safety performance that cover a broad range of licensee programs and the results of these programs. Their relationship to plant safety is illustrated in Figure 1 of Enclosure 2. The cause codes are specially useful in: (1) identifying the potential areas of weaknesses in licensee programs affecting operational safety, (2) monitoring the effectiveness of licensee corrective actions te identified problems, and (3) predictino (and thereby helping reduce) the likelihood of' serious events by evaluating the trends and patterns of causes associated with less serious, but more numerous res. In the perfomance indicator IPI) program, events generally ir..sude operating reactor events, deficiencies, or problems reported in the LERs.
The cause codes are intended to raise questions about programatic performance through systematic identification of potent'tal trends and thereby establish a basis and focus for further investigation and review. In view of this, cause codes along with licensee corrective actions are identified through expert review and evaluation of infomation contained in the LERs. Other types of infonnatinn,
, such as inspection reports are reviewed as necessary to improve the coding.
Together with cause codes, the corrective actions help in understanding the underlying causes of an event or deficiency. Furthennore, they provide a measure of the licensee's understanding of an event or deficiency and whether the actions taken are, in fact, responsive to the underlying causes.
The cause codes monitored in the program are licensed operatcr error, other l
personnel error, maintenance problem, design / installation /febrication problem, 4 administrative control problem, and randum equipment failure. The corrective ;
I actions monitored are training, procedure, discipline, management change, design '
- modification, equipment replacement / adjustment, and other. If multiple causes ,
j or corrective actions are associated with one event, they are so identified.
The cause code categories and their application have evolved over the last several years. As a part of the developmental eff ort, the causes of events reported in LERs were evaluated in detail. It was deternined that the reported s
causes could not be used as P!s, since they did not relate to licensee programs !
in a systematic manner. For example, weakness in the maintenance program was i seldom reported by licenseets as the cause of an event. Cause codes similar to the ones for the P1 program have been successfully used in the past for identi-fying potential areas of weaknesses at several facilities. Recently, using the 1987 LERs the usefulness of PI cause codes has been reaffirmed. Also, this type of cause code information has been provided to the senior management in the past as an input to the decisionmaking with regard to the need to adjust
) plant-specific regulatory programs, j The cause codes are presented in charts in Part I of the quarterly PI reports as -
4 well as in text fors in Part !! of the same reports. The.cor.ective actions are l 1
presented only in text f cru in Part II. Examples of the presentations are
{
provided in Figures 1 aW 2. Also, other types of presentation wtheds, such as 1 pie charts, are available for displaying the plant-specific and ine.Nstry-wide i distribution of cause codes. The cause codes and c:rrective actions are further '
described below, l
l
2 Ca.se Codes
- 1. Licensed Operator Error. This cause code captures errors comitted by licensed reactor operators during plant activities. These errors could be those that result in events or that are comitted during the course of events.
It includes both the errors of omission and commission. Multiple errors associated with one event are identified separately whether comitted by the same person or different persons. Examples include instances when error was due to carelessness, lack of experience or training, fatigue, stress, attitude or poor work habits. Not included are instances when administrative control problems, such as supervision, procedure or activity planning problems, caused the operator to take inappropriate actions.
- 2. Other Personnel Error. It is similar to the previous cause code except that the errors are committed by plant staff other than licensed operators.
Contractors involved in plant activities are considered part of the plant j staff.
- 3. Maintenance Problem. The intent is to capture full ran deficiencies in the areas of maintenance, surveillance,ge of programatic testing and calibration under this cause code. The deficiencies generally lead to inadequate or improper upkeep and repair of plant equipment and systems. .
Some examples of these deficiencies are as follows:
A. MG set trip on high vibration due to worn out flywheel bearing.
B. Pump suction filter leak due to failed gasket.
C. TG speed would not increase due to controller being out of calibration.
D. Loose battery connections found during surveillance. Post-eaintenance testing after previous repair may not have been adequate.
E. Valve packing leak.
F. Pump seal leakage.
t l G. 7 of 11 SRVs lifted prematurely during test.
1 H. Pump bearing failure due to low lube oil level.
l Errors comitted by maintenance staff are norinally captured under maintenance problee/other personnel error.
4 Desion/ Installation / Fabrication Problem. It covers full range of programatic deficiencies in the areas of design, installation and i'
3 fabrication. Like in other cases, this cause code is used in combination with other cause codes when ntcessary. Examples are:
A. Testable check valve being backwards resulted in RHR overpressurization when isolation valve opened.
B. Transmitter sensing lines reversed.
C. Loss of control power due to underrated fuse.
D. Use of wrong seal material resulted in solenoid malfunction.
E. Equipment not qualified for the environment.
- 5. Administrative Control Problem. The intent is to capture all management and supervisory deficiencies that affect plant activities. Examples are poor planning, breakdown or lack of adequate management or supervisory control, inadequate interdepartmental coordination, poor comunication between supervisors and staff or among departments, procedure, deficiencies resulting in weak or incorrect operating, surveillance or testing procedures, and departures from program requirements. Like in other cases, this cause code is used in conjunction with other cause codes when necessary. Specific examples are:
A. No corrective action initiated after a design problem discovered.
- 8. QA/QC problems.
C. Radioactive shipments without labeling.
D. Unauthorized work activity.
E. Unqualified personnel performing plant tasks.
F. 10 CFR 50.59 review not performed.
G. Personnel contamination due to lack of warning signs.
H. Tech. Spec, surveillance not scheduled.
I. Containment access doors opened without the knowledge of control room.
J. Procedure error resulted in inadvertent safety injection, t
- 6. Random Eculpment Failure, The intent is to capture only random equipment -
failures under this cause code. It excludes failures that can be clearly I I
attributed to other problems, such as design / installation / fabrication l
problems or maintenance problems, in the judgement of the technical expert '
performing the review. Generally, it includes spurious or onetime failures l
l l
4 that can not be clearly attributed to other causes. For the PI program, failures resulting from environmental causes (e.g., lightning) and offsite problems (e.g., loss-of-offsite grid), and aging are included under the random equipment failure cause code.
Corre:tive Actions l
- 1. 1 raining. It includes all formal or informal training given to the licensee and contractor personnel for preventing the same or similar occurrence. Exam:les are classroom or simulator training, required reading and review of design, procedures and manuals, hands-on training in the plant or shop, and plant walkdowns.
- 2. Procedure. All changes to written procedures or creating new ones as a part of the corrective action are identified. Procedures for all plant activities (operation, maintenance, surveillance, testing, design, 00, etc.) are considered.
- 3. Discipline. All actions taken to improve the attitude, and work habits of i licensee and contractor personnel are identified under this category.
Examples of this corrective action include counselling, probation. leave i without pay and termination.
4 Management Change. All actions taken in response to isientified administra-tive control problems except procedure problems are captured under this category. Supervisory changes, organizatienal changes, and realignment or strengthening of responsibilities and accountability are included as a part of this correction action.
- 5. Desien Modification. This includes changes in the design of components, systems or structures. Also included are changes made to the operating characteristics of components or systems as a result of design review or analysis, such as set point changes or changes in materials, lubricants, etc.
! 6. E q u i pme n t Rep l a c eme n t /A d,i u s t me n t . Examples of this corrective action are replacement of equipment with a similar type as in the case of an equip- i rent degraded from aging. . Actions including instrument calibration, set ;
point ad,iustment, valve repacking, and overhaul of an equipment would al?o be included in this category. !
7
_0ther. Corrective actions other then the above six are captured under this category.
4 l
l l
5-For initial use, input data are being obtained through discussions with individual plants. However, obtaining taese data from all operating plants 0111 involve regulatory action. Options include arranging with each operating plant to provide the data (possibly through INPO), or rulemaking. The staff is developing the supporting basis to initiate rulemaking.
Continuing Wnrk RES is continuing to refine methods for risk-based performance indicators in the three areas listed below. For each of these technical issues, approaches are being explored in 1988. Where practical approaches are identi-fied, RES will develop and validate the method in 1988-89.
(1) Aggregating of Unavailability Data: In 1988, refine method to' aggregate unavailability data across the selected systems. The approach is to weight the selected systems to reflect their risk importance. This will be particularly useful for integrating initiating events, described below.
(2) Initiating Events: In 1988, explore the relative merits of alternative approaches to integrate initiating events into risk-based performance 1
indicators and then select the best approach. In 1988-89, develop the
- selected method, identify the input data on initiating events, identify the information on plant configuration needed to evaluate the data, and provide pilot software for trial use. .
I (3) Comon-Cause Events: In 1988-89, improve the treatment of coernon-cause '
events.
- l When implemented, these developments will strengthen the objectivity and response l time of the indicator. !
i
) i 1
1 l
l
PL,. ANT D MS Came Code Legend: c'w wi m 4 Me % Average 1 85-3 to 87-2 CAUSE C00CS
. 1 W Ctwatcr Ener ano a 2. Othe Pw m Ente anno
. ame
. ame w
e,- %,- N. .
g ,
%.x .
.se I w
s j
2 . .se I I,.
., . ej ;
.] I..
3 g '-
.]
s, (g.= >. .
e e,a.9y,e,p.,e,.,
- i. k -
e ((-
e, a sj-, w s.. .,.
3 -,
t., ,
1 wome neo.m
- 4. Wmocrperieuw renom F e. 8 a.
L i t s,
,. r- iy
. e g; xs i i h: Ns
,h -
h Y k k
$l
, a p 4
1 ' 1
$ :li t i n
e K ,
$i p i $ $j ')
an.) aw ajgt gew 6.. ei.: ~ sa m' age'y geA poi.'.t~-
t 1 Arrratisw cortia !
,_ he
, 4 W Castret Fakse
- s. i 3 e.
.I.
4 3. 8 4 s. -
. . , .,, ,.. _._ e h:
i ,_ ....
1 I
5 l
l I
t Enclosure 2 RISX-BASED PERFORMANCE INDICATORS '
As illustrated in the plant safety logic model of Figure 1, operational safety ree. ires a low frequency of transients and a hi which also includes a low potential for comon cause gh availability failures.ofTherefore, safety systems, the .
t Pls are intended to include measures of at least the frequency of transients, unavailability of safety systems, and potential for ccmon-cause failures.
Although the inherent design features and potential for cognitive error were recognized as important aspects of operational safety during the development of i initial Pls, their consideration was left for the future developmental work. '
i The staff has been working on the refinement of existing P!s and development of new ones for providing improved measures in the key elements of plant safety and factoring in the contributions from other aspects.
The currently used surrogate indicator of safety system unavailability is
) determined from the number of safety system failures reported. However, i i counting safety system failures does not directly measure system mailability.
Also the frequency of these failures is typically less than once pr quarter, so it is difficult at best to establish a trend. In conjunction with AEOD, RES developed a method for an improved indicator of the unavailability of safety
' systems of safety as well as supplemental infonnation on the mean time between failures systems.
l This enclosure describes the indicator and its significance, l further improvements. input data collected, and plans for implementation and traceoffs regarding the Indicator of Safety System Unavailability A
The improved indicator of safety system unavailability is: the aggregate of i the total hours per year that selected safety systems are estinated to be unavailable while the reactor is critical, As illustrated in Figure 2, this indicator use: two kinds of operational data free seven selected safety systems: l
! (1) 1 i
the reactor the total number of hours that each train is taken out of service while is critical ,
(2) the number of failures of each train (i.e., loss of train function) k In addition to these monthly or quarterly performance data, this indicator
, also safety needs the following one time input of design data for the seven selected systems:
The number of trains in each system i
- Success criterf at f.e., the number of trains that must function to accomplish the system's safety function, .
j The surveillance test intervals The in Figuretrain-level
- 3. data are agcregated to a plant-level indicator as illustrated First the train unavailabilities are estimated using both 4 discovered down tine and undiscovered down time. Discovered down-time is
. o 2
the number of hours that each train in the selected systems is taken out of service while the reactor is critical. In the event a train fails on actual demand or during a surveillance test, undiscovered down-time is an estimate of how long before the test or demand the train was unavailable. For this indicator, undiscovered down time for each train is approximated as the number of train failures times half of the surveillance-test interval.
These train unavailabilities are converted to estimates of system unavailabilities by using simple reliability methods based on independent events. For example, the unavailability of a two-train system is estimated as the product of the unavailability of train A times the unavailability of train B. These unavailabilities are sumed and multiplied by 8760 hours0.101 days <br />2.433 hours <br />0.0145 weeks <br />0.00333 months <br /> in a year to approximate the aggregate number of hours that the selected systems are expected to be out of service per year. The indicator is thus the aggregate
' of the total hours per year that any of the selected safety systems are expected to be unavailable.
Seven important safety systems are selected for monitoring PWRs (or SWRs):
Auxiliary Feedwater (or Reactor Core Isolation Cooling for BWs)
High Pressure Injection (or High Pressure Coolant in,iection for BWRs)
Service water (or Standby Service Water for BWRs)
, Emergency Power AC Emergency Power-DC l Reactor Protection System Containment Spray (or Containment Cooling for plants without Containment Spray)
The first six of these systems account for roughly 90t of the impact of all I single train outages on the expected frequency of core-melt. In addition, i containment spray or cooling systems are particularly important to prevent '
- release in the event of core melt.
i l t
Mean Time between Failures of Safety Systems I i
l By analyzing these same data in a different way, we can produce supplemental i A
i information related to the reliability of these safety systems. This infoma- !
tien is an estimate of the number of years between loss of function for any of !
, the selected safety systems, i.e., the mean time between failures.
This supplemental information is calculated from the same train level data, but in the following way. The observed train failure rate (i.e., loss of train function) is used to estimate the system failure rate (i.e., loss of system
' function) sising simple reliability methods. For example in a two-train system, l
' the system failure rate equals the failure rate of train A times the prcbability that train B will be unavailable plus the failure rate of train B times the '
probability train A will be unavailable. Then these estimates of system failure rate are added to give the aggregate $ rate of failure of the selected safety systems. This aggregated failure rate is inverted to estimate the time between failure of any of the selected safety systems.
, 3 Interpretation The improved indicator for the unavailability of selected safety systems is directly related to operational safety. Six of the systems selected for rent toring represent about 90f. of the sensitivity of core melt frequency to
, outage of a safety-system train, The containment system selected for monitoring is particularly important for preventing release. Thus trends in this indicator of unavailability are one indicator of trends in safety pe rformance.
In addition, trends in this unavailability indicator also indicate maintenance effectiveness. NRC defines maintenance as the aggregate of those functions recuired to preserve or restore refety, reliability, and availability of plant structures, systems, and components. Thus one measure of maintenance effectiveness is the availability of these important safety systems.
The snean time between failure, on the other hand, reflects the effect
- ness of the preventive portion of the maintenance program. The objective of , t tveltive maintenance is to prevent failures. Thus trends in this estimate of years ,
i
' between loss of function of any of these important safety systems reflect trends in the effectiveness of preventive maintenance.
Also, the infomation on mean time between failures will help understand trends j ,
in the indicator of safety system unavailability. For exar.ple, if both unavail-ability and mean time between failures are degrading simultaneously, then the
! ' trend involves increasing failures or errors. On the other hand, if unavaila-bility degrades while the mean time between failures is stable or improves, ,
] then the trend involves an increase in trains taken out of service while criti-i 1 cal. Other ways of analyzing these same data will produce additional informa- ;
1 tior, that will help in understanding the sources of degrading perfomance and l ictatifying areas for further followup, An example of such infomation is the performance trends at system and train level with or without consideration of ,
inherent design features, i.e., the degree of redundancy. l 1
I Three of safetysimplifications systems shouldused in cciculating this indicator of the unavailability be noted.
- One simplification is that in the event of ;
i a train failure, the undiscovered down time is approximated as one-half of the 1 routine surveillarce interval. This is a conventional assumption in PRAs.
The second simplification is that events are analyzed as independent events,
{'
not as potential comoon-cause events. This is an acceptable approximation for trending. Meanwhile, further research is exploring ways to improve this treat-ment of the data with respect to common-cause events. A third simplification .
)
i is that estimatas of system unavailabilities are sunned to aggregate the data' to ebtain a plant-level indicator. It is then multiplied by the number of hours l
1 I per year so that the result is in tangible units; i.e., the aggregate of the l
total hours per year that selected safety systems are expected to be unavailable. -
Thus, the indicator for ursvallability is not unavailability itself. This is a l
j simplified indicator to monitor trends in the unavailability of ieportant safety systems, i
- _ - . . .. . . . - . - - = . _
- o 4
1 This unavailability indicator will respond about ten tirres faster to changes ir, clant performance than the current method of counting reported safety system fa G ures. This is because reported failures involve either loss of svstem func-ticr. or loss of multiple trains and, therefore, occur infrequently, the incroved indicator is based on individual trains out of servi:e; 1.e., events !
that occur more frequently than multiple train outages. Furthermore, this
' indicator factors in some plant specific inherent design features, i.e., the deg-ee of redundancy, which is an important consideration for evaluating operational safety.
In sunnary, this indicator of safety unavailability will improve tracking of plant safety performance. In addition, trends in this unavailability indicator and information on mean time between failures can help to track trends in the l effectiveness of the plant's maintenance program.
Traceoffs in Detail of Input Data i
! The scope and detail of the input data reconsnended for this indicator of ,
unavailability of important safety systems are intended to strike a balance between improving the indicators' objectivity and predictive capability vs.
increasing the burden of collecting and analyzing the data.
I The data recomended to be collectcd are simple; e.g.: (1) The total number of !
1 hours1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> that each train in the selected systems is taken out of service, and (?)
4 i
the number of failures of each train. Sample dcta sheets for the quarterly data and the one time design data are shown in Figure 4. Utilities keep 1
track of trains out of service in order to assure meeting Technical Specifica- l 3
tion requireeents regarding Limiting Conditions for Operation (LC01 Collecting ,
these data is not considtred to be a burdensoce recuirement. '
3 Additional event based data could further enhance the indicator's predictive capabilities, but would increase the reporting burden. Such data include the 4
' dates and times when a train of the selected safety systems is taken out of service and when it is returned to service, the corponent involved and a brief
, narrative sumarizing the cause. The additional data for each failure would i
assist in mo < accurately assessing the undiscovered down-time and more rapidly i identifying the unavailability trends. Also, factoring in the causes of failures 4
would make the trends more predictive of future performance. However, the recom-i mended indicator for safety system unavailability does not require these adcitional data. RES is continuing to evaluate the burden and potential value of r.aking future indicators more predictive.
Planned Application i
in the longer tern, as reans of obtaining the data are developed, this indicator of unavailability of selected safety systems will be included in NRC's set of ~
l per'ormance indicators for all operating plants. When this indicator is fully implemented, the currently used indicator of safety system failures will be l dropped. Figures 5 and 6111ustrate the format of this improved indicator of l unavailability,
! i i
I
_ -_ ,. ~ ~ . - . _ - _ _ , - . - . - . . - _
6
.Iigure 1 PLANT SAFETY LOGIC MODEL PLANT SAFETY e _
i INHERENT DESIGN 1 LOW FREQUENCY HIGH AVAILABILITY FEATURES AND LOW OF TRANSIENTS OF SAFETY SYSTEMS POTENTIAL FOR COGNUNE ERRORS I
I I
. I !
l HIGH TRAIN LOW POTENTIAL l AVAILABILITY I CAUS IURES l
I I
i Pk Pls Pls Pts
_NEW Pts .
OCAUSE CODES e CAUSE CODES e CAUSE CODES e CAUSE CODES e INDICATOR OF eINDICATOR OF SAFETY SYSTEM SAFf.TY SYSTEM UNAVAILABILITY UNAVAILABILITY l
l 1
EXISTING Pls o SCRAMS e SAFETY SYSTEM e EQUIPMENT l
FAILURES FORCED l
' SAFETY SYSTEM OUTAGES ACTUAT)ONS l
e COLLECTIVE . i RADIATION !
k e SIGNIFICANT EVENTS EXPOSURE 1
e FORCED OUTAGE RATE
PL&MT A i PI RYINTS PCR 87-4 pr1 TAM tust/sr tres: Et47sla M. ras: 1110e Pote: m c114 Actics: I elstPL/t Peat /fula/t Msim CAUSEI 3QU17/2 DESGM/PERAN as Penfwise sista esses a uml. ulets cAuslu Imsla talP stAcfm saan SSF 18/14/97 Lead: M isPell M.faf 1576 paan: la CAUSE SEMIN 4
emIWC1TW ACTim ! Pect/7talsatste {
1 3T3731: PtimMtf CUffAlmerfAAttTERIES M7m l ttsti luettunft permum Wlustt armare Is As Insecpta mLW List W POR RhlWTDestE B ODrTAlgerf I watE3. Tuls toelfle NBAfD 18 TW Mpfgrfl4L Less 8P Pt1444Y torfalWErf Imellff I 1 WOW PI IVENTS FOR 87-4 M1 14/98/97 Lit #: M147%8 M.F3f: Peans a CAUSE ADMIE j etmartCtrW ACTiest: 2 Pect 379TWh PLA51 P601tCTIW 87ffWe I 4 i M 9C !
PAJLLES 1010Ltew fits. Mt. Itallt0Euf t PCR CnAAIEL CutCE Of RPS MMLL BI .
i Mk 14/24/8F Ltti M147983 N.? Ifs j
eDasectIW actics: faA!E/PECC POKE: evt CAUSI PNEAR j
{
pfstat: Walsturf CENTAllSEB1/tBr1Al5Eff 190LATICE 87815 i
seses outIas 71sT, issIsuErf cumet tas IscreaAMt tCDGEI TA45 ftCs. $PtCt. AtLOSB.
' Mk 12/ tots? tta# Mis 7ml M.72t: 10933 Paaa: ect t t.;AUSE Str**C1lW AcTlous P90t/ftAll ' OPIR/PERSN l t
1 F atACTCit CCRf 190LAfla CDDLIN ST3tta A
stEL.Aflou 0F DCit $ttA8 t!E iflit itIUtilbG situ Olffitteil AL PittS.at.
- Mk 12/17/87 Lief
- MtL7554 M.729: 109P5 Post: T2s
! traasCTlw ACTicma M5Cm/ftAIS CAUSBl DESGB/PERAN l vftigi: PtinAAT tratalstal/tDITAIBGf 190LAflCu tTttu j pf173t: STA.SST &&8 f ttATErl fitf3 j fftTSI: MATIst AaB Alt etaelfiels 57875 i stet:
i WILs ptattam!M CAL!snA11a. urstAtt Me sua sicmAL ins ascitwa reos aucTon Acnafles eP sett Am IWufle er wat , vite MLates Erf tan i
j TTPt Obt 8&R 33 46 4 SFa 87 8 EF 3 SF 4
..........................................t ....... ..........
genAss of11 pmER/1000 ttiftet amas 0.00 0.00 0.5 1.32 1.49 8NIE *1958883 4 4 1.71 1.56 4.90 1 4 4 4 fett stung e e 1 e t t t 3 uftri vfssur Amsfles 3 1 e t t 3 e
) elenica ram i . .
1 e e t i i wm MfaeAm= e i e i i i e
{ i 4 4 i 808t B Sft M Mit (13 M 91 95 i
IEJIP. PorCID G/f AGil/teos alfical gaat 91 36 M 75 it 3.65 4.44
} elfictL Imat 4 1.49 3.57 1.M 9.00 0 $80 823 1MS i
1968 M9 1986 l
1 1
l 6
i l
Fig CONCEPT OF INDICATOR FOR UNAVAILABILITY ,
i
- ADD TOTAL DURATION OF TRAIN DOWNTIME DUE TO SURVEILLANCE AND MAINTENANCE l 1
? ?p A A '
I, s s i
t 3
!/ b
/
1 s
\ $
a : ; s s
i 1
- ?
s s
i C
O
. d %'
d -
L TIME (MONTHS) t 2 3 4 5 i
i
- WHEN TRAW FAILS, ADD UNDtSCOVERED DOWNTIME oc1/2 (SURVEILLANCE INTERVAL)
)
4 9
j 8 ,
Figui , *f l
TRAIN-LEVEL DATA ARE AGGREGATED TO INDICATE ,
I UNAVAILABILITY OF IMPORTANT SAFETY SYSTEMS -
4
} BNOGCATOR OF UNAVAILA38tfTY - Pt 4
AGGREGATE OF HOURS / YEAR THAT 7 SAFETY l SYSTEMS ARE ESTIMATED TO BE UNAVAILABLE f MEAW TIME BETWEEN FAILURES - SUPPLEMENTAL INFORMATION
- 4 ESTIMATE OF YEARS BETWEEN FAILURE OF ANY OF 7 SAFETY SYSTEMS .
2 I
.YSTEMS: OR OR OR EDGE SATTERIES RPS CS RCIC HPC1/HPCS ESWS I I I I I I l-= 5o5 0 5 6 5 O b 6 6 6 6 6 6 i
}
, MONTHLY OR QUARTERLY DATA
)
- HOURS EACH TRAIN IS OUT OF SERVICE
]
- NUMBER OF TRAIN FAILURES iLOSS OF TRAIN FUNCTION)
L 1
,\ .
O W em O
OU
- l
. * . ?, 1 W
- E :
1 :
i 9.s i
)
l l 9
)
5
. 2 3 i J . + l J y .
i 'l lj = . , I J E -k W : '
c
- aC gc 5
k2 t
- !e n
W 3 y r j t a .
< 5 5 I j,$ I i J .
If
'1 Ib i
i w l n-
=l na '
o $
{3 3
l i
i , -if l l 9 ie 22
~ ~
1 9
ly- .
f
- 11!
52 2 5 1 1 3 3 .
! -~a -~" -~- -~, -~., .~ .. -~, ! l 1
b R$ 3 g g -
e E RW-
[:I: =5= 6 3
- a } 'r I -
I t
I ) _
O FIGL0E 5. SAFETY SYSTEM UNAVA'LABUTY i
f
^ ,
$1 00 ...
Nm u
j80 y
Y 60. J m , i at S 40 j fy "
v i e Br$
M t 4 MM I o em 4@p- d$s 9
u MEc !
S u:ss hm e q#g.:
g jfp l
.[ 20 . gg
- e -
llj jgjg
%a 5 OI t- ,4 o!o 86-1 86-2 86-3 86-4 87-1 87-2 ;
Year - Quarter '
e f
i t
I i
+ l I
e i i
j r:GLRE 6. PLANT B TRENDS 2 CUARTER AVERAGE ENDING 87-2 i
u I
i Dec :ned Improved I
I i ,
I
". automctic Scroms g WN4 Critical i i i
- t i
Sofety S, stem Actuotions 0.80 i ;
I Significont Events i
l Forced Outege Rete
!, i 2 _-
t".
! g'ej b. CQv pment Ic'ce" f l
J r g Outoges/1000 Crit. Hrs.
L r t l
I b Eb[ty h:/y')
i i
( l l
<- -2.5-2.01.5-1.0-0.500 .
0.5 1.0 1.5 2.0 2.5 i
i Deviations from Previous 4. Otr. Meens !
J . l i (Measured in Standord Deviations I t i i l i !
1 l l
1