RISK INFORMED UNAVAILABILITY MANAGEMENT (INTRODUCING BALANCE TIME INSTEAD OF AOT) Tibor Kiss 1, Zoltán Karsa 2

Transcription

1 RISK INFORMED UNAVAILABILIY MANAGEMEN (INRODUCING BALANCE IME INSEAD OF AO) bor Kss 1, Zoltán Karsa 2 1 MVM Paks NPP Ltd.:H-7031 Paks, P.O.B.71, Hungary, ksst@npp.hu 2 NUBIKI Nuclear Saety Research Insttute: Konkoly-hege Mklos str , Budapest, Hungary, 1121, nubk@nubk.hu hanks to several year systematc PSA development nowadays Paks NPP has a comprehensve pcture o derent potental rsks related to the operaton o the nuclear aclty. Besde the normal ull power and shut down operaton modes, these rsk assessment studes cover the rsks assocated wth the unplanned, orced shut down modes, as well. Extensve knowledge o probablstc aspects o the plant rsks gves a good bass or changng the clearly determnstc based regulaton nto a rsk-normed one. As a move orward wth ths process the new verson o the Hungaran Nuclear Saety Regulaton requests justcaton o Allowed Outage mes (AO) or the saety related systems and components. Based on the rsknormed decson makng prncples a new method or the management o component unavalabltes has been ntroduced. Instead o the tradtonal rectangle method whch has obvous decences n determnng AOs a new rsk-normed approach has been developed. he basc concept o the method s based on the comparson o rsks assocated wth the possble ways o managng the stuaton caused by unavalabltes o saety related components. Bascally, management o an unavalablty s possble ether by contnuous operaton o the unt wth the parallel repar o the aled component, or by shutdown o the unt untl the component restoraton. he new method compares the rsks assocated wth these possble solutons. Based on the rsk mportance o the aled component n ull power and derent orced shutdown plant operatonal states (POSs), and also normaton on the possble restoraton tme, the optmal rsk-normed soluton on unavalablty management can be made. he method was used or evaluaton o components havng lmtng condtons o operaton. A set o so called balance tmes were determned or these components. It can generally be stated that the results show the possblty o sgncant extenson o lmtng tme condton or the components wth no rsk ncrease or relaxaton. he method ullls the requrement o the Hungaran Nuclear Saety Regulaton on consderaton o rsks caused by shutdown and startup maneuvers o the unt n connecton wth the unavalablty. he new approach wll be appled n the revson o exstng echncal Speccatons and submtted or regulatory approval. he new approach to managng rsk assocated wth component unavalabltes ully ts the rsk-normed decson makng mplementaton concept or Paks NPP. he method supports the selecton o the way wth optmal rsk to handle stuatons when saety components become unavalable. he advantage o the new approach n comparson wth tradtonal ones s that there s no need or a predened allowed rsk ncrease value (e.g. CCDP<1E-6), nstead, the optmal cumulatve rsk can be reached. hus t can be appled n countres (lke Hungary) where a predened rsk ncrease value does not exst n the regulatory requrements. I. INRODUCION he lmtng tme condtons o unavalablty o components are prescrbed n the echncal Speccaton (S) or Paks NPP Hungary. hese lmtatons are prmarly based on ether some past engneerng judgment or mantenance capacty o the repar sta. Accordng to the recently ssued verson o the Nuclear Saety Regulaton, the lmtng tme condtons o the S must be revsed and establshed wth the assstance o modern assessment tools. he determnaton method o the lmtng condton tmes must consder the rsks caused by the potental shutdown and startup o the unt. hs s a dcult task due to the act that the Hungaran Regulaton nether denes nor allows the predened rsk ncrease value. 1

2 II. MEHODS FOR DEERMINAION OF LIMIING CONDIION IMES II.A. Conventonal Methods he bass o the conventonal unavalablty management reles on the predened rsk ncreased value (e.g. CCDP<1E-6). he rsk assocated wth the unavalablty o the gven saety component can be determned by a multplcaton o the core damage requency (ΔCDF) ncrement and the tme elapsed. he tradtonal rectangle method (see Fg. 1) represents the Allowed Outage me (AO) as a rato o the allowed rsk ncrease aganst the CDF ncrement. CDF 1 ΔCDF CCDP AO= 0 AO Fg. 1. Conventonal determnaton o allowed outage tme t Based on the sgncance o the components, the AOs der rom component to component. he most mportant advantage o ths method s the smplcty and relatve easness o mplementaton. hese very acts explan ts wdespread applcaton all over the word. Besdes the advantages o ths method, some decences could be lsted: - he method requests the predened allowed rsk ncrease value. Nuclear regulaton o some countres dsowns such a value. her reason or ths s that the lcensee must strve to mnmze the operatonal rsk all the tme. - It does not consder the shutdown and the startup rsks o the unt. - he decson made by means o probablstc consderatons n the past may change gradually over tme, because the probablstc values turn nto realty, so the ormer probablty assumpton may become true or alse. hs means that the estmaton and decson made at the begnnng o the unavalablty o the component may not match condtons at the tme pont when the AO expres. (E.g. let us suppose the restoraton o the component avalablty by the end o AO s unsuccessul. Accordng to the orgnal decson the unt must be shutdown, however, looked nto the uture the stuaton would be the same as t was when the alure was dscovered. From rsk pont o vew, n ths case the shutdown o the unt cannot be vered.) - Handlng o multple unavalabltes s a real challenge. II.B. Introducng the Balance me Method he method to be ntroduced now s based on the approach whch ams at reachng a mnmal level o cumulatve rsk caused by component unavalablty. In case o random alure o the component, the rsk o the possble nterventons should be consdered (e.g. transent rsk due to change o Plant Operatng State (POS)). Accordng to the current S, n case o expraton o the AO the unt must be drven nto the saer shutdown state. At the end o the component repar the unt wll be restarted and wll be drven back to the normal power operaton. Fg. 2 shows the possble change o rsk n general. he cumulatve rsk caused by the unavalablty o the component could be understood as the terrtory below the rsk curve between the tme ponts t 1 and t 5. he cumulatve rsk.e. the cumulatve Core Damage Probablty (CDP Unav) due to the unavalablty can be calculated accordng to the ormula (1). As t can be seen rom the ormula, or determnaton o the cumulatve rsk n general we need the ollowng data: 2

3 - CDF at the begnnng (power operaton) and nal (target) shutdown POSs wth the unavalable component. - CDF at the shutdown transent POSs wth unavalable component. - CDF at the startup transent POSs wth recovered component. - me duratons n the transent POSs. CDF 1 0 CDF 2 t 1 t 2 t 3 t 4 t 5 t Fg. 2. CDF change due to the saety component unavalablty Notatons o the Fg. 2: t 1 - t 2 - t 3 - t 4 - t 5 - Nomnal CDF (power operatonal mode); CDF n case o component alure (power operatonal mode); CDF n shut down mode wth the unavalable component; Begnnng tme o the component unavalablty; he end o the allowed outage tme, begnnng o the shutdown (t 2-t 1=AO); Gettng the target shut down mode (rom t 2 to t 3 s the duraton o the shutdown transent); he end o the component repar, begnnng the startup o the unt (t 4-t 1= repar, repar tme); Gettng back to the power operaton (rom t 4 to t 5 s the duraton o the startup transent). CDP Unav NSD NSD N SU 1 AO SD, SD, 2 repar AO SD, SU, j SU, (1) 1 1 j1 N SD he number o shutdown transent POSs; SD, he CDF o the shutdown transent wth the unavalablty o the component n the POS named. hese POSs are represented between the tme ponts t 2 and t 3; N SD SD, Duraton o the shutdown transent POS named, SD 3 2 1, t t N SU he number o startup transent POSs; SU,j he CDF o the startup transent wth the recovered component n the POS named j. hese POSs are represented between the tme ponts t 4 and t 5; N SU SU,j Duraton o the startup transent POS named j, SU 5 4 1, t t 3

4 Fg. 2 and ormula (1) are only vald or the case, when the repar tme o the component exceeds the AO ( repar>ao). I the repar tme s less than the AO the shutdown o the unt s not consdered. In ths case cumulatve core damage probablty depends on the begnnng POS and can be calculated by ormula (2): CDP 1 (2) Unav repar In general the begnnng and the target (sae shutdown) plant operatng states should be consdered as a varable and they determne the transent POSs. Furthermore, durng the evaluaton, the AO and the repar tme ( repar) are also consdered as varables. When the unavalablty o the component or system occurs, there are two potental alternatve actons that could be consdered: 1. Further power operaton wth the parallel repar o the aled component or system 2. Shuttng down the unt and drvng to a saer plant operatonal mode. Followng the component repar startup o the unt, t wll be drven back to the power operaton mode. In case o the rst opton (power operaton) ater the component repar the rsk level wll be reduced to the nomnal level 0. In case o the shutdown opton the shutdown and startup rsks should be consdered. Accordng to the rsk based decson prncple the case wth the smaller rsk should be selected (R Power vs. (R SD+ R SU)). Decson made between these two optons (urther operaton vs. shutdown) hghly nluence the component repar tme. I the aled component can be repared relatvely ast, there s no reason to select the shutdown startup opton, because at the power operaton mode - due to the short tme - the accumulated rsk s also small. In ths case the rsk s obvously less than n case o unt shutdown. he shutdown and startup processes always mean some extra rsk due to the transent stuaton that have to be consdered. Generally, wth ncreasng repar tme the shutdown - startup opton tends to be seen more reasonable. It s obvous that there exsts a certan repar tme duraton, when the rsk o the two alternatves becomes equal. hs tme s named as rsk balance tme ( balance). he determnaton o the balance wll be ntroduced by ormula (3) by modyng the general ormula (1). he let sde o the equaton represents the rsk n case o power operaton. On the rght sde o the ormula we set the AO=0 and nstead o reapr t s substtuted wth balance, because n case o AO>0, the calculaton o the balance gves the overestmated value by AO. hs means the cumulatve balance rsk wll not be mnmal. NSD NSD N SU 1 balance SD, SD, 2 balance SD, SU, j SU, (3) 1 1 j1 From the Eq. (3) the balance: balance NSD NSD N SU SD, SD, SD, 2 j1 SU, j SU, (4) For all components (ncluded n the PSA) ths rsk balance tme can be calculated. I the estmated actual repar tme exceeds the calculated rsk balance tme value, the shutdown opton wll be preerable, because the cumulatve rsk o the shutdown - startup process s less than that o the power operaton. Practcally the rsk balance tme or all components could be calculated usng PSA n advance. he balance tme or the component can be calculated by the equaton Eq. (4). For the calculaton o the rsk balance tme the PSA model s needed or the power, admnstratve shutdown and startup operatonal modes. he admnstratve shutdown and startup operatonal modes can be derent rom the outage shutdown and outage startup. Durng the outage shutdown, there can be derent tasks (e.g. decontamnaton), whch are not perormed n case o admnstratve shutdown. Also the duratons o the smlar actons can be derent. hese rsk balance tmes or the saety related components could be ntroduced n the echncal Speccaton. he actual restoraton tme or the component s determned by the alure mode. For the best approxmaton o the repar tme n the actual stuaton the nvolvement o the mantenance personal s preerable. I the approxmated repar tme s less than the predened rsk balance tme, the restoraton o the component s preerable by urther operatng the unt, otherwse the shutdown opton would cause smaller rsk ncrease. hs approach s entrely derent rom the conventonal determnaton o allowed outage tme methods. Accordng to the conventonal approach the repar works start at the power operaton, and n case o success t nshes n the tme rame o AO. 4

5 In case o extenson o the repar works beyond the AO the admnstratve shutdown o the unt s ntated. Accordng to the balance tme approach both the decson and the acton are made mmedately, ether or the repar o the component wth urther power operaton or or repar wth mmedate shutdown o the unt. he new method has the ollowng benets: - he predenton o the allowed rsk ncrease s not needed, so the method can be used n countres where the regulator does not support the dea o allowed rsk ncrease. - he method consders the possble shutdown and startup rsks. - Based on the rsk sgncance o the components, derent rsk balance tmes could be determned. hese balance tmes are ndependent rom the derent subjectve crtera, t depends purely on the component rsk mportance n derent plant operatonal states. - Derent end states and alternatve shutdown states can be examned (hot or cold shutdown states). - he multple unavalabltes can be handled. - It can be used even n the shutdown state to select the saest plant operatonal mode n case a random alure occurs. Crtque o the balance tme approach: - Accordng to the Paks NPP nvestgaton the method causes AO relaxaton or all S regulated saety components; the relaxaton o AO may consequently cause the relaxaton o repar works ntensty as well. So n order to keep the orgnal repar ntensty at the recent level some new measures should be consdered. - he method consders mmedate acton. In practce, some tme s necessary or the dagnoss to evaluate the possble repar tme. II.C. Integraton o the Balance me Method nto the Rsk Montor Rsk montor s a very ecent tool to control the actual rsk and support the rsk normed decson makng n case o unavalablty o the component. Most rsk montor sotwares support the conventonal determnaton o the AO. For rsk montorng purpose the Paks NPP apples the RskWatcher (RW) sotware tool (Lloyds Regster Consultng product). It has been examned how ths tool can support the above descrbed rsk normed decson makng and what knd o addtonal eature o the sotware could support such an actvty. In the so called plannng mode the sotware s capable o evaluatng the predened event sequences n the uture tme ponts. he program also supports the evaluaton o derent alternatve event sequences. For the determnaton o balance we need the produce the cumulatve rsk curves o two alternatves (power operaton vs. shutdown). At rst, n order to produce those cumulatve rsk curves we have to prepare the CDF curves (see Fg.3). Producng the power operaton rsk curve s relatvely easy. Only the alure o the component should be set and the unavalablty as a uncton o tme should be kept. Modellng o the shutdown case s more complex. It conssts o 3 phases. he 1 st phase s the shutdown transent. For the calculaton o ths phase the predened transent shutdown POSs and ther duratons have to be called. POS tmes come rom plant statstcs o the admnstratve shutdowns. he rsk o the 3 rd phase startup ater repar can be evaluated as to be smlar to the 1 st phase, the only derence s the unavalablty/avalablty o the component consdered. he 2 nd phase s the sae end state (target POS), when the repar actvtes are nalzed. he CDF o ths POS s a uncton o repar tme. he cumulatve rsk o the 1 st and 3 rd phases are constant, they do not depend on the tme varable. For the nterpretaton o the cumulatve rsk uncton o the shutdown case t s reasonable to reorder these 3 phases and put the 2 nd phase to the end. By ths maneuver the result s not changed, t s smply the tme dependent phase that wll be the last one n the order, whch helps n the nterpretaton o balance. Fg. 3 shows the reordered nterpretaton. Havng the CDF curves o the alternatve solutons the cumulatve rsk curves can be generated. hs uncton s provded by the RW sotware. he ntersecton o the curves shows the balance o the rsks and consequently the balance tme can be read (see Fg. 4). hs example below shows the alure o the emergency desel generator. Accordng to the calculatons the balance tme n ths partcular case expected as balance 5 days. hs means that the estmated repar tme s less than 5 days the repar works should be perormed durng power operaton o the unt, otherwse ( repar > balance) the shutdown o the unt would cause smaller rsk ncrease. hs plot case showed that the rsk montor can potentally support the determnaton o the rsk balance tme or the actual, onlne stuaton. o make the evaluaton more convenent we requested the RW sotware developers to extend the sotware wth some new eatures. 5

6 balance Cumulatve Rsk Balance PHASE-1 PHASE-3 PHASE-2 Power operaton Shut down Fg. 3. CDF o the alternatve actons Falure o the DG balance Fg. 4. Determnaton o the balance as an ntersecton o cumulatve rsk curves 6

7 III. CONCLUSIONS 13 th Internatonal Conerence on Probablstc Saety Assessment and Management (PSAM 13) he above ntroduced method was developed to ulll the Hungaran Nuclear Saety Regulaton that requres justcaton o Allowed Outage mes (AO) or the saety related systems and components. he man benet o ths approach s that t consders the rsk o the potental shutdown and startup over urther operaton maneuvers, whle t does not requre any predened allowed rsk ncrease value. he method ts the ongong mplementaton o the rsk normed decson makng program n Hungary. Wth some mnor eature extensons o the rsk montor sotware ths balance tme concept could be a powerul tool n the rsk normed decson makng process. REFERENCES 1. Z. Karsa, A. Bareth,. Javor, Allowed Outage me and Survellance est Interval Revson, Report No , NUBIKI (2014) (n Hungaran) 7