The Dependence of Repair Times of Safety-significant Devices on Repair Class in the Loviisa Nuclear Power Plant

Transcription

1 HELSINKI UNIVERSITY OF TECHNOLOGY Systems Analysis Laboratory Mat Individual Research Projects in Applied Mathematics The Dependence of Repair Times of Safety-significant Devices on Repair Class in the Loviisa Nuclear Power Plant Juho Helander 63646T Espoo, February 2, 2009

2 Contents 1 Introduction 2 2 Factors Affecting the Repair Time Repair Class, RC Allowed Outage Time, AOT The Influence of Failure on Device, B Current Operating Conditions Work Class Other Factors Statistical Testing Comparing Variances, the F-distribution Comparing Means Variances Equal Variances Unequal Analysis of Variance Two-way ANOVA for balanced data The analysis of unbalanced data The reliability of the statistical tests Description of the Data The Processing of Data Defining the Repair Time Results Estimation of Average Repair Times Graphical reviews Statistical Testing The reliability of the results Conclusions and Considerations 19 References 21 A Graphical presentations of mean repair times 22 B Abbreviations 25

3 1 INTRODUCTION 2 1 Introduction The construction and operation of a nuclear power plant are dominated by strict safety demands. The ultimate objective is to prevent the contamination of surrounding communities and environment. This target is fulfilled with the help of multiple redundant backups, active and passive safety systems as well as strict safety culture among the plant personnel. The International Atomic Energy Agency (IAEA) introduced the International Nuclear Event Scale (INES) in 1990 in order to illustrate the radiation and nuclear safety significance of events. INES consists of 7 levels, from which levels 1 to 3 are called incident-levels and levels 4 to 7 accident-levels. In the Finnish nuclear power plants only anomalies (INES Level 1) and incidents (INES Level 2) have occurred. "Below-scale events" are very common because in a complex technical facility it is not possible to avoid minor failures (e.g. small leaks, electrical faults). Instead, the safety design is based on being prepared for different kinds of faults. [14] The Probabilistic Risk Assessment (PRA or PSA) is a complex and comprehensive methodology which has been used to evaluate risks within aviation and nuclear industry, for example [8]. In PRA risks are characterized by the severity and probability of the event. The most crucial chains of accidents, systems, devices and operations are recognized. Thus the right procedures during accidents and the most important needs for change can be identified. The PRA of the Loviisa NPP is extended and applied by Fortum Nuclear Services Ltd. The core damage frequency has decreased significantly since the risk study was initiated in the middle of the 1980 s. In the Loviisa NPP all failure events are carefully recorded. The failure data can be used to examine different kinds of dependencies in order to further enhance the safety of the plant. In this research project the dependency between repair time and repair class is examined. The repair class decribes the safety-significance of a certain device and it was introduced in the Loviisa NPP in It has been discovered that repair times can be modelled with the help of allowed outage time (AOT) [13]. However, if also the repair class has a significant effect on the repair time, the modelling based on merely AOT should be questioned. For instance, it might be that a device with long AOT is repaired faster than expected because the device is considered critical in terms of the repair class (or vice versa). In this research project, the different factors affecting the repair time are recognized in the second section. In the third section the principles of statistical testing are illustrated and the failure data is described in the fourth section. The dependencies are thoroughly studied in the fifth section with the help of different statistical tests and graphical reviews. Conclusions and considerations are presented in the final chapter. The appendices involve graphical presentations and the abbreviations used.

4 2 FACTORS AFFECTING THE REPAIR TIME 3 2 Factors Affecting the Repair Time The influence of certain factors on repair times in the Loviisa Nuclear Power Plant are studied. In this chapter all the significant factors are recognized and described. Only few factors are essential as regards this research project. Some factors have been examined earlier [13], some have only a negligible impact and some are simply difficult to measure. In addition, the scarcity of data prevents us from considering too many factors simultaneously. 2.1 Repair Class, RC The most important categorization in this research project is the repair class (RC). The following classes are in use: RC=1: The device is critical to production and safety RC=2: The device is important to production and safety RC=3: The device is significant to production and safety RC=4: The device has no safety requirements and failure of the device does not cause loss of production The aim of this research project is to investigate the influence of the repair class on the repair time. The intrinsic conclusion would be that critical devices are repaired more rapidly than insignificant ones. 2.2 Allowed Outage Time, AOT When it comes to operating a nuclear power plant, certain requirements as defined by technical specifications (TTKE) must be met. One of the requirements is called the allowed outage time (AOT). When a certain safety-significant device fails, it must be repaired within the AOT. Otherwise, power reduction or immediate shutdown must be introduced. Sometimes a failure of a certain valve might require the closure of some other valves in order to assure safe operation. The closure of valves might result in power reduction. These kinds of power reductions occur quite rarely but each one results in an expensive loss of production. Sometimes it is possible to avoid the power restrictions by introducing some compensatory actions. For example, radiation measurements can temporarily be replaced by regular laboratory analyses.

5 2 FACTORS AFFECTING THE REPAIR TIME 4 The AOT has been defined for each significant device. The amount of different levels is limited; the most common values include 0h (immediate power reduction or shutdown), 2h, 3h, 4h, 8h, 12h, 24h, 3 days, 3 weeks and 6 weeks. Obviously, the AOT has a significant influence on the repair time. It is very important to repair the device within AOT or introduce some compensatory actions if possible. 2.3 The Influence of Failure on Device, B A failure might have different kinds of impacts on the device at issue. A pump might become totally unavailable due to an electrical fault and it can not be started before the failure has been repaired. On the other hand, a small oil leak certainly does not prevent the use of the device (at least in the short-run). It might be that the pump must be turned down while the leak is being repaired. In some cases the leak can perhaps be fixed while the pump is running. The possible levels of influence are presented in the following list. The first two types are considered in this research project. B=1: Failure prevents the use of device B=2: Repairing prevents the use of device B=3: No influence on the use of device B=4: The operation of the device is insufficient 2.4 Current Operating Conditions The different operating conditions of a nuclear power plant include: power operation, start-up, hot standby, hot shutdown, cold shutdown, shutdown (refuelling). During normal power operation a certain device might be critical to the safety of the plant and it will be repaired as soon as possible. On the other hand, during shutdown the same device and the subsystem where it belongs to might be completely out of use and the repair work can be delayed. The allowed outage times are not valid in such situations. Thus, the current operating condition of the plant has a significant influence on the repair time. In this research project only failures that are detected and repaired during power operation are considered. 2.5 Work Class Events are categorized in different work classes. The following categories are in use: Failure repair, Restoration, Investment, Condition monitoring, Laboratory

6 3 STATISTICAL TESTING 5 work, Regular maintenance, Periodic test, Periodic inspection, Alteration work, Small alteration work, Inspection/shift round. Only failure repairs are of interest because the others can not be regarded as unexpected failures. 2.6 Other Factors There are also other factors that might have influence on the repair times. These factors include: The starting point of restriction on use The type of the defected device (e.g. pump, valve, measurement) The system that the device belongs to (e.g. main steam piping) Component accessibility and other circumstances The availability of spare parts and repairmen The possibility of common cause failures Some of these factors are difficult to measure (e.g. accessibility) and some are considered uninteresting or insignificant. On the other hand, the scarcity of data prevents us from categorizing the data in terms of too many factors. 3 Statistical Testing The principal target of this research project is to determine whether the repair class of the device has an influence on the repair time. The effect of the factor "influence on device" will be studied as well. Also the AOT must be taken into account in order to get correct results. When studying the different effects, the events are groupped in terms of the relevant factors and the mean repair times are calculated. Strong dependencies can be spotted with the help of simple graphical presentations but eventual conclusions should be based on statistical testing. In this section, the relevant statistical tests are represented. At first, the pairwise tests for equal variances and equal means are illustrated [1, 9]. Then the principles of Analysis of Variance (ANOVA) are described. The basic two-way ANOVA for balanced data as well as a more complex procedure for strongly unbalanced data are presented [4, 11].

7 3 STATISTICAL TESTING Comparing Variances, the F-distribution Before comparing means pairwise, it is crucial to know if the variances of the different samples can be considered equal. The F-test for variances of two independent samples can be used. Let us assume that the two samples are normally distributed (N(µ 1, σ 2 1), N(µ 2, σ 2 2)). The null hypothesis (H 0 ) and the two-sided alternative hypothesis (H 1 ) are: H 0 : σ 2 1 = σ 2 2 = σ 2, H 1 : σ 2 1 σ 2 2 (1) The sample variance (s k ) can be calculated in the following way (here X k denotes the sample mean and n k the amount of observations in the sample): s 2 k = 1 n k 1 n k i=1 (X ik X k ) 2, Xk = 1 n k X ik, k = 1, 2 (2) n k The following test statistic can be used to estimate the equality of variances. If the null hypothesis can not be rejected, the test statistic follows the Fisher F-distribution with n 1 1 and n 2 1 degrees of freedom. F = s2 1, F F (n s 2 1 1, n 2 1) (3) 2 If F 1, the variances seem to be equal and the null hypothesis is valid. Because a two-sided alternative hypothesis was chosen, both two small and two large values of F lead to the rejection of null hypothesis (the variances are unequal). The critical points depend on the choice of the significance level. If a significance level α is chosen, the rejection region is defined by the critical points F 1 α/2 and F α/2 : P r(f F 1 α/2 ) = α/2, P r(f F α/2 ) = α/2 (4) The most common values of α are 0.05, 0.01 and The higher the confidence level, the easier the null hypothesis will be rejected. In this research project we choose the confidence level α = However, we could also choose otherwise and thus sensitivity analysis is necessary: would the results change if a different confidence level was chosen? i=1 3.2 Comparing Means Variances Equal Now we assume that the observations are normally distributed with the same variance. Furthermore, let us assume that the observations can be divided into k different groups (i=1,2,...,k) according to a certain factor A. We denote the j:th observation in the group i by y ji. We could consider simultaneously as many groups

8 3 STATISTICAL TESTING 7 as needed but considering two groups pairwise will be enough for the purposes of this project. Thus, we assume two groups of observations that are independent and normally distributed (N(µ 1, σ 2 ), N(µ 2, σ 2 )). We wish to test the null hypothesis, that the expected values of the different groups are equal. H 0 : µ 1 = µ 2, H 1 : µ 1 µ 2 (5) The appropriate test statistic is t 0 which follows the Student s t-distribution with n 1 + n 2 2 degrees of freedom. Here s p is an estimate of the common variance and s 1 and s 2 are sample variances. t 0 = ȳ 1 ȳ 2, s 2 p = (n 1 1)s (n 2 1)s 2 2, t 0 t(n 1 + n 2 2) (6) s p 1/n1 + 1/n 2 n 1 + n 2 2 If t 0 0, the means are somewhat equal and the null hypothesis is valid. A twosided alternative hypothesis was chosen and thus, both large negative and positive values will lead to the rejection of null hypothesis. The critical points t α/2 and +t α/2 can be determined in the following way: P r(t t α/2 ) = α/2, P r(t +t α/2 ) = α/2 (7) Variances Unequal Let us now assume that the variances of the two groups are not equal (N(µ 1, σ1), 2 N(µ 2, σ2)). 2 The pooled, independent or uncorrelated T-test can be used to test the equality of means. The test statistic t 0 approximately follows the t-distribution and the degrees of freedom must be estimated (Smith-Satterthwaite procedure): t 0 = ȳ 1 ȳ 2 s 2 1 /n 1 + s 2 2/n 2, t 0 t 3.3 Analysis of Variance ( ) (s 2 1/n 1 + s 2 2/n 2 ) 2 (s 2 1 /n 1) 2 n 1 + (s2 2 /n 2) 2 1 n 2 1 Let us assume that we have observations which are affected by two different factors: A and B. Suppose that factor A has I levels and factor B has J levels. The observations can be divided into IxJ groups. Let us assume a complete layout, i.e. there is at least one observation for each group. The ideal situation would be that each group would contain exactly K observations (balanced data): n ij = K, i = 1, 2,..., I, j = 1, 2,..., J, n ij 1 i, j (9) (8)

9 3 STATISTICAL TESTING 8 However, when real failure data is utilized, the numbers of observations are obviously different between different groups (unbalanced data). In order to study the influence of the factors, unbalanced data could be converted into balanced data using approximate procedures. If most of the groups contain the same amount of observations, the missing values can be estimated. On the other hand, if some groups contain more data than others, the excess observations can be set aside. Anyway, if n ij differ greatly from each other, these procedures are unpractical or ineffective. Furthermore, the elimination or estimation of data reduces the precision of estimates and the power of hypothesis tests. Thus, more sophisticated methods are necessary. Nowadays, several computer programs (e.g. SAS, NCSS) provide versatile features for analysis of variance of balanced or unbalanced data. Statistical packages utilize such procedures as GLM (Generalized Linear Models) [3], method of fitting constants [4], methods of Overall and Spiegel [4], method of weighted squares of means [4, 11] and method of unweighted means [4, 9, 15]. In the next section, the two-way ANOVA procedure for balanced data is presented. After that, more complex models for unbalanced data are illustrated. In both cases, the initial assumptions are the same. The observations must be normally distributed: y kij N(µ ij, σ 2 ). In other words, if we formulate the statistical model of the twoway ANOVA, the residuals must be independent and normally distributed (here µ ij denotes the group mean): y kij = µ ij + ɛ kij ɛ kij N(0, σ 2 ), k = 1,..., n ij, i = 1,..., I, j = 1,..., J (10) Two-way ANOVA for balanced data The null hypothesis states that the means of the different groups are equal. The hypothesis can be divided into three different hypotheses: no interaction (H AB ), no difference among levels of factor A (H A ), no difference among levels of factor B (H B ). At first, we define the total mean and group means (y.ij = µ ij ) of observations. In the case of balanced data the numbers of observations per group are equal (n ij = K i, j). Here N denotes the total number of observations. y... = 1 N I i=1 n J ij j=1 k=1 y kij, y.ij = 1 n ij n ij y kij, i = 1,..., I, j = 1,..., J (11) Also the sample means of different levels of factor A and B must be calculated: k=1 y.i. = J nij j=1 k=1 y I nij kij i=1 J j=1 n, i = 1,..., I, y..j = I ij i=1 n ij k=1 y kij, j = 1,..., J (12)

10 3 STATISTICAL TESTING 9 The total variability can be partitioned into components. This can be expressed in terms of sum of squares (SS): SST = SSA + SSB + SSAB + SSE, (13) I J K SST = (y kij y... ) 2, i=1 SSA = JK SSAB = K j=1 k=1 I (y.i. y... ) 2, SSB = IK i=1 I i=1 J (y..j y... ) 2, j=1 J (y.ij y.i. y..j + y... ) 2, SSE = j=1 I i=1 J j=1 k=1 K (y kij y.ij ) 2 Here SST is the total sum of squares, SSA the sum of squares due to factor A, SSB the sum of squares due to factor B, SSAB the sum of squares due to interaction and SSE the sum of squares due to error. Now we can calculate the so called mean squares (MS): MSAB = SSAB (I 1)(J 1) SSA SSB, MSA =, MSB = I 1 J 1, MSE = The appropriate test statistic to test the null hypothesis of interaction H AB is: SSE IJ(K 1) (14) F AB = MSAB MSE, F AB F ((I 1)(J 1), IJ(K 1)) (15) Here we compare the variablity due to interaction to the variability due to error. Since sum of squares are nonnegative, F AB 0. If F AB is close to zero, the interaction is insignificant and the null hypothesis is valid. Large values of F AB lead to the rejection of null hypothesis (interaction is significant). The critical point F α can be determined in the following way: P r(f F α ) = α (16) The other hypotheses (H A, H B ) can be tested in the same manner: F A = MSA MSE, F A F ((I 1), IJ(K 1)) (17) F B = MSB MSE, F B F ((J 1), IJ(K 1)) (18) It is convenient to present the results in the form of ANOVA table (table 1).

11 3 STATISTICAL TESTING 10 Table 1: ANOVA table. Source of SS df MS F deviation A SSA I-1 MSA=SSA/df F A = MSA/MSE B SSB J-1 MSB=SSB/df F B = MSB/MSE AB SSAB (I-1)(J-1) MSAB=SSAB/df F AB = MSAB/MSE Residual SSE IJ(K-1) MSE=SSE/df Total SST IJK The analysis of unbalanced data The analysis of variance is utilized also when the data is unbalanced. However, the square sums must be calculated in a different manner to compensate the fact that the numbers of observations (n ij ) vary between groups. The method of unweighted means is a computationally simple method which should work quite well if the n ij are not very different. Nonetheless, the method is only an approximate procedure because the sums of squares for factors and interactions are not distributed as χ 2 random variables. The method of weighted squares of means is more reliable and yet simple enough to carry out without statistical programs. Thus, it will be utilized in this research project when the influences of different factors on repair time are examined. The procedure is described here shortly. At first, the hypothesis of no interaction (H AB ) will be tested. Let us define the row and the column sums of the observations. g i = n J ij y kij, i = 1,..., I, h j = j=1 k=1 n I ij y kij, j = 1,..., J (19) i=1 k=1 To test the interaction, we define the variable Υ in the following way: Υ = I i=1 n J ij ykij 2 j=1 k=1 I i=1 n J ij y kij y... j=1 k=1 I g i (y.i. y... ) i=1 J h j (y..j y... ) The total mean y... and the groups means y.i. and y..j are defined in equations 11 and 12. Let us also recall the sum of squares due to error, SSE, which now has n-ij degrees of freedom (n denotes the total number of observations): j=1 (20) SSE = n I J ij (y kij y.ij ) 2 (21) i=1 j=1 k=1

12 3 STATISTICAL TESTING 11 The sum of squares due to interaction, SSAB, (p-i-j+1 degrees of freedom) can now be calculated: SSAB = Υ SSE (22) Now the test statistic of equation 15 with (I-1)(J-1) and n-ij degrees of freedom can be utilized. The square sum due to factor A (I-1 degrees of freedom) should be calculated in the following way: SSA = I W i y.i. 2 i=1 ( I ) 2 i=1 W iy.i. I i=1 W, W i = i J 2 J j=1 n 1 ij, i = 1,..., I (23) The test statistic of equation 17 with I-1 and n-ij degrees of freedom can now be utilized to test H A. Obviously, the procedure concerning factor B is analogous. 3.4 The reliability of the statistical tests When statistical tests are conducted, some assumptions must be made concerning the test arrangement. Further tests and conclusions are thus always conditional to the initial assumptions. If these assumptions prove out to be false, the reliability of the conclusions deteriorates as well. When testing the equality of variances, the samples were assumed to be normally distributed. When the means were tested, it was also assumed that the observations are independent within and between the two samples. The initial assumption of the ANOVA procedure stated that the residuals of the statistical model must be normally distributed. The normality of the samples can be tested with the help of Bowman and Shenton test which is described here briefly [6]. Let us define the skewness and kurtosis of a sample: γ 1 = µ 3 σ 3, γ 2 = µ 4 σ 4 3, µ k = E((X E[X]) k ) (24) Here µ k is the k th moment about the mean, σ is the standard deviation and E is the expectation operator. Let us define the null hypothesis "H 0 : the sample is normally distributed". The hypothesis can be tested with the following test statistic which approximately follows the χ 2 -distribution: χ 2 = n 6 γ2 1 + n 24 γ2 2, χ 2 a χ 2 (2) (25) It is quite probable that real repair times can not be considered normally distributed. Obviously, the violation of the normality assumption deteriorates the reliability of

13 4 DESCRIPTION OF THE DATA 12 the conclusions. Nonetheless, when it comes to comparing means or conducting ANOVA, the effect of violation is only slight, especially if the number of observations is large. For instance, the results of a one sample t-test can be considered quite reliable even for strongly skewed samples if the number of observations is more than 40 [6]. The tests for variances, instead, are not reliable if the normality assumptions fail. The effects of departures from the underlying assumptions are discussed more thoroughly by Scheffe [11]. 4 Description of the Data The data of this research project includes failure histories of the Loviisa NPP from years 2003 to Earlier data can not be exploited because the repair class was introduced only recently. The data consists of tens of thousands of events annually from which only a small minority is useful for this study. 4.1 The Processing of Data The data will be filtered according to the principles presented in Chapter 2. Only events that occur and are repaired during power operation are considered (during shutdowns repair times are usually longer). If the failure has no impact on the use of the device, the case is neglected (influence of the failure must be B=1 or B=2). The work class of the failure must be "Failure repair". Additionally, multiple events and events that lack some essential information are eliminated. Sometimes it is possible to avoid the restrictions (power reduction or shutdown) by introducing some compensatory actions. For example, radiation measurements can be temporary replaced by regular laboratory analyses. Some valve failures, on the other hand, might require the closure of another valve. This kind of events will be eliminated. Obviously, the repair times are longer if there is no threat of restrictions taking effect. After the processing, 337 events remain. The number of cases might prove out to be too small if several factors are considered at the same time. The remaining failure events are presented in table 2. The number of "B=2" events is quite small. And quite obviously, no reliable conclusions based on statistical analysis can be done regarding repair class 1 due to the small number of events. Nevertheless, a qualitative analysis can be conducted. All in all, only few devices ( 0.5% of all devices) are considered critical (RC=1), including turbines, generators, containment building, steam generators, reactor vessel, control rods, reactor coolant pumps and some critical safety valves. Failures of

14 5 RESULTS 13 Table 2: The data categorized in terms of repair class and influence on device. Repair Class N, B=1 N, B=2 N, Total ALL these critical devices occur quite rarely and apart from only few exceptions, the AOT is 0h (immediate shutdown or power reduction). Thus, further analysis is unnecessary because these components belong to the most critical groups in terms of both factors. So the AOT-based modelling of the repair times should not be distracted by the repair class categorization. In the following statistical analyses only repair classes 2, 3 and 4 will be included Defining the Repair Time The repair time is not given explicitly in the data and thus it must be calculated according to some strict principles. The concept of repair time is not always unambiguous. For example, different kinds of delays could be included or not. Thus, it is necessary to give an exact definition. There are certain factors that affect the way that the repair time is calculated. First of all, if the failure prevents the use of the device (B=1), the repair time begins when the failure is detected. If only repairing prevents the use of device (B=2), the repair time begins when the work permission is given and the safety measures are taken, i.e. the device is extracted from the process. In both cases the repair time ends when the extraction of the device ends. 5 Results 5.1 Estimation of Average Repair Times At first, only one factor, i.e. the repair class, is considered and all 337 cases are employed. The numbers of observations (N), sample mean repair times (µ R ), sample standard deviations (s R ) and average AOTs within each repair class are shown in table 3. If only the average repair times are considered, it seems that more critical devices are repaired faster. However, we should not yet jump into conclusions because there is a significant nuisance factor that has not been taken into account. The average

15 5 RESULTS 14 Table 3: Mean repair times within each repair class. Repair Class N µ R (h) s R (h) µ AOT (h) ALL AOTs of classes 3 and 4 are significantly longer than the average AOT of class 2. Thus, the AOTs might actually alone explain the deviation of repair times. In order to get reliable results, the effect of the AOT on repair times must be eliminated. The data is categorized in terms of AOT in table 4. Table 4: The data categorized in terms of AOT. AOT (h) N µ R (h) s R (h) As already anticipated, the amount of data is insufficient within the most AOT classes. Somewhat reliable estimations might be possible by considering classes: 8h, 24h, 72h, 504h. Let us now examine these classes further. In table 5 the data is categorized in terms of AOT and repair class. The repair class 1 is neglected because it includes only 2 events. The mean repair times are somewhat different for different repair classes but, all in all, it is difficult to spot any distinct dependency between the repair class and repair times. There is one factor that has not yet been taken into account: the influence of failure on device (B). The data involves 337 events, 298 of which are of the type B=1 and the rest (39) of the type B=2. When it comes to "B=2" events, only AOT class 72h includes events from all three repair classes. Let us now categorize further the "AOT=72h" events in table 5 in terms of factor B (table 6). The figures of the table might indicate that critical devices are repaired faster when it comes to "B=2" events.

16 5 RESULTS 15 Table 5: Part of the data categorized in terms of AOT and repair class. AOT (h) Repair Class N µ R (h) s R (h) ALL ALL ALL ALL Table 6: Events categorized in terms of B and repair class. AOT (h) B Repair Class N µ R (h) s R (h) ALL ALL

17 5 RESULTS Graphical reviews Before performing any statistical tests, the graphical presentations of mean repair times should be examined. Some conclusions are quite obvious on the basis of mere graphical considerations. The figure 1 of appendix A represents the mean repair times for different repair classes. Quite obviously, the repair times of repair classes 1 and 2 are significantly smaller than the repair times of repair classes 3 and 4. The figure 2 of appendix A presents the mean repair times of different repair classes when B=1 and B=2 failures are considered. Some interaction can be detected: when we vary the level of RC, the group mean changes in a slightly different way if a different level of factor B is selected. The repair class does not seem to have a significant effect on the repair times. When it comes to factor B, the repair times of B=1 failures might be a bit longer on the whole. The figures 3 and 4 of appendix A illustrate the mean repair times of different repair classes when AOT classes 8h, 24h, 72h and 504h are considered. No significant interaction of the factors is indicated: when we vary the level of RC, the group mean changes in a similar way if a different AOT level is selected. However, it would be quite difficult to say, which repair class is related to the longest or shortest repair times. The AOT, on the other hand, does have a major impact on the repair times. 5.3 Statistical Testing At first, we take a look at table 3 and test whether the mean repair times are equal between different repair classes. The choice of test statistic depends on the equality of variances which can be tested with the F-test for variances. The test statistic (equation 3) and the respective p-values are shown in table 7. Table 7: Paired comparison of the variances in table RC F p H 0 F p H 0 F p H accept accept accept reject reject accept The null hypothesis can be rejected if the p-value is smaller than α/2 or larger than 1 α/2 (two-sided alternative hypothesis). If the confidence level α is set to 0.05, the rejection area is thus (0, 0.025) (0.975, 1). The variances seem to be unequal

18 5 RESULTS 17 between repair classes 2 and 3 as well as between classes 2 and 4. When it comes to group 1 the null hypothesis can not be rejected. This is mainly because of the small amount of observations. All conclusions concerning group 1 include great amount of uncertainty. The choice of confidence level has no influence on the results. Now the paired comparison of means can be conducted. The test statistics are presented in equations 6 (variances equal) and 8 (variances unequal). The results are shown in table 8. Table 8: Paired comparison of the means in table RC t 0 p H 0 t 0 p H 0 t 0 p H accept accept accept reject reject accept The mean repair time of repair class 2 differs significantly from the repair times of classes 3 and 4 at a 5% confidence level. If a 0.1% confidence level was chosen, the means of repair classes 2 and 4 could be considered equal. However, the results above can not be considered reliable because the influence of AOT has not been taken into account. Let us now take a look at table 5. Here the mean repair times are presented in terms of two factors: the RC (3 levels, I=3) and the AOT (4 levels, J=4). Obviously, the data is very unbalanced: the numbers of observations vary from 2 to 94 observations per group. Thus, the method of weighted squares of means (section 3.3.2) is utilized. The ANOVA procedure is summarized in table 9. Table 9: ANOVA for the unbalanced data in table 5. Source of Variation SS df MS F p-value Interaction RC AOT Error The interaction is insignificant and repair class does not have a significant influence on the repair time. The effect of AOT, on the other hand, proves out to be significant. Let us now have a look at table 6 to study the factor B. Once again, we encounter unbalanced data with two factors: RC (3 levels, I=3) and B (2 levels, J=2). The ANOVA procedure is summarized in table 10.

19 5 RESULTS 18 Table 10: ANOVA for the unbalanced data in table 6. Source of Variation SS df MS F p-value Interaction RC B Error No significant interaction was detected. Neither of the factors has a significant influence on the repair time, although factor B does have a bit stronger effect than repair class. 5.4 The reliability of the results The reliability of the statistical tests depends on the validity of the assumptions, the most important of which was the normality assumption. Thus, the normality of the samples should be tested. The conclusions of the paired comparisons (tables 7 and 8) were already considered useless because the effect of AOT was not taken into account. Thus, it is not necessary to examine the normality of the data. Instead, the normality assumptions of the ANOVA procedures (tables 9 and 10) will be examined. As usual, a graphical presentation might be enlightening. The residuals of the statistical model (equation 10) should be normally distributed. Let us plot the histograms of the residuals and compare them to properly scaled normal distributions (with the same variance). Obviously, no firm conclusions can be made in this manner but strong violations can, nevertheless, be spotted. Figure 5 of appendix A illustrates the residuals related to the data in table 5 and figure 6 illustrates the residuals related to the data in table 6. In figure 5 the peak is very high and the right tail is quite long. Nor does the histogram of figure 6 follow the normal distribution too well. Let us now perform the Bowman and Shenton normality tests (equation 25). Table 11 includes some descriptive statistics of the residuals of the two data sets as well as the results of the normality tests. Set I refers to the data presented in table 5 and set II to the data presented in table 6. Table 11: Descriptive statistics and normality tests for the residuals. µ σ min max γ 1 γ 2 n χ 2 p I II

20 6 CONCLUSIONS AND CONSIDERATIONS 19 Not surprisingly, neither of the residual sets can be considered normally distributed at 5% or 1% confidence levels. However, the sample II could be considered normal at a 0.1% confidence level. In the first sample the residuals are positively skewed (the right tail is longer) and the distribution is strongly leptokurtic (acute peak). In the second sample the residuals are mildly positively skewed and the distribution is platykurtic (wide peak). Despite of the violations of the normality assumptions, the earlier conclusions can be considered quite reliable. The sample sizes are quite large (apart from some individual groups) and the ANOVA procedure should provide results accurate enough. In addition, the conclusions of the graphical reviews and the statistical tests were consistent. Furthermore, the ANOVA procedures illustrated in tables 5 and 6 were confirmed with the help of a statistical program (NCSS 2001). The program utilizes the GLM procedure [3] and some other methods. The results obtained were very consistent with the results presented above. 6 Conclusions and Considerations In the Loviisa NPP each event involving repairs, maintenance, inspections or tests are carefully documented. These events are described and categorized in terms of several factors, including repair time, repair class, allowed outage time (AOT) and the influence of failure on device (B). In this research project the influence of repair class on repair time was examined. Additionally, the effect of factor B was studied. The AOT of the device, obviously, has a strong influence on the repair time and thus it had to be taken into account while the effects of other factors were studied. When real data is processed, the limited number of events often causes problems. The scarcity of data deteriorates the reliablity of the conclusions. When it comes to rare events (such as common cause failures, CCF), the failure data of multiple plants from several years is utilized and the total operating experience might span several thousands of years. The data of this project included 337 failure events which occurred in the Loviisa NPP during 5 years. Older data could not be exploited because the repair class was introduced only recently. All in all, the amount of data was somewhat sufficient. When studying the dependence between repair class and repair time, two-way ANOVA procedure for unbalanced data was used. It could be perceived that the AOT, indeed, does have a significant influence on the repair time. The effect of the repair class, instead, could not be considered statistically significant at any confidence level. The factor "influence on device" (B) has a bit more influence but the effect is also insignificant. Consequently, the conclusion of this research project is that the AOT-based modelling can be considered adequate also in the future. This

21 6 CONCLUSIONS AND CONSIDERATIONS 20 applies also to the repair class 1 which was analyzed qualitatively due to the scarcity of data. In this study the weighted squares of means method for a complete two-way layout with unbalanced data was utilized. Obviously, numerous other methods for solving the same problem coexist. Many procedures are based on ANOVA but the sums of squares are calculated in different ways. Also a regression model could be formulated and the significance of the predictors could be tested. Failure or repair times are usually modelled with distributions that can take the long tails into account (e.g. Exponential, Weibull or Gamma distributions). In this research project the repair times were assumed to follow the normal distribution in order to be able to perform the necessary statistical tests. Not surprisingly, the normality assumptions failed. However, it has been found out that ANOVA procedures can be conducted quite reliably even if the samples do not follow the normal distribution, in particular if the number of observations is large. In this study the total number of observations was sufficient but when it comes to certain individual groups, only few observations were involved. This slightly undermines the reliability of the conclusions and further analysis could be recommended when more data is available. Furthermore, more factors affecting the repair time could be taken into account (for example the type of the device).

22 References 21 References [1] J.S. Milton; Jesse C. Arnold. Introduction to Probability and Statistics: Principles and Applications for Engineering and the Computing Sciences. McGraw-Hill, Inc., 3rd edition, [2] W.J. Conover. Practical Nonparametric Statistics. John Wiley & Sons, 2nd edition, [3] Jeff Gill. Generalized Linear Models: A Unified Approach. SAGE, [4] F. M. Speed; R. R. Hocking; O. P. Hackney. Methods of analysis of linear models with unbalanced data. Journal of the American Statistical Association, 73(361): , [5] H. B. Mann. Analysis & design of experiments: analysis of variance and analysis of variance designs. Dover Publications, Inc., [6] Ilkka Mellin. Koesuunnittelu ja tilastolliset mallit. noppa.tkk.fi/noppa/kurssi/ mat /luennot (referred Jan ), [7] Ruth G. Shaw; Thomas Mitchell-Olds. Anova for unbalanced data: An overview. Ecology, 74(6): , [8] Mohammad Modarres. Risk Analysis in Engineering: Techniques, Tools and Trends. CRC Press, [9] Douglas C. Montgomery. Design and Analysis of Experiments. Wiley, 6th edition, [10] Wayne Nelson. Applied Life Data Analysis. John Wiley & Sons, [11] Henry Scheffe. The Analysis of Variance. John Wiley & Sons, Inc., [12] Martin L. Shooman. Probabilistic Reliability: An Engineering Approach. McGraw-Hill, [13] Sami Siren. Ydinvoimalaitoksen turvatärkeiden laitteiden korjausajan mallinnus. Technical report, Fortum Nuclear Services Ltd, [14] STUK. Yvl 1.12 ines classification of events at nuclear facilities, [15] F. Yates. The analysis of multiple classifications with unequal numbers in the different classes. Journal of the American Statistical Association, 29(185):51 66,

23 Appendix A. Graphical presentations of mean repair times Figure 1: Mean repair times within different repair classes. Figure 2: Mean repair times for B=1 and B=2 events (AOT=72h).

24 Figure 3: Mean repair times for AOT levels 8h, 24h and 72h. Figure 4: Mean repair times for AOT level 504h.

25 Figure 5: Histogram of residuals for data in table 5. Figure 6: Histogram of residuals for data in table 6.

26 Appendix B. Abbreviations ANOVA AOT B CCF IAEA INES MS NPP PRA PSA RC SS Analysis of Variance Allowed Outage Time The Influence of Failure on Device Common Cause Failure International Atomic Energy Agency International Nuclear Event Scale Mean Square Nuclear Power Plant Probabilistic Risk Assessment Probabilistic Safety Assessment Repair Class Sum of Squares