Due to special production, nuclear power stations have very strict requirements for safety and economy during production.In particular, third generation nuclear power units with million kilowatt capacities, which are highly developed, are now required to reach the advanced technical level of the thirdgeneration nuclear power on the basis of meeting relevant reliability requirements of the Utility Requirement Document (URD) and the European Utility Requirement (EUR).Forced unavailability not only influences economic indicators of nuclear power units, but also seriously threatens the safe operation of units.There are many factors that cause forced shutdowns, such as availability loss mainly due to systems being unable to work normally based on operation experience and system design.In this paper, the average number of forced shutdown days per year for EPR units is evaluated through the PAA method.

The EPR Nuclear Power Unit is the third generation nuclear power technology of the European PWR, which has the largest single unit capacity in the world.

It is defined in the second sector of the second volume of the EUR that forced unavailable related parameters must be met in order to ensure the availability for the third generation of the nuclear power unit.The duration of forced shutdown of units≤5days/year(1.4%).Forced unavailability parameters are shown in Table 1.

The forced shutdown time of initial distribution for EPR units is less than 5days/year, while the initial forced shutdown time of NSSS and BNI is less than 3days [1-3].

PAA (probabilistic availability assessment) is a method to evaluate the availability of plants.Take the system that causes unavailability during normal operation as a unit.By calculating the probability of occurrence and the unavailable time of the critical failure mode, make the unavailable target of the initial allocation become satisfied.Through feedback and optimization design, continuously upgrade the unit reliability level.The process of the PAA method is shown in Figure 1.

According to FMEA, the PAA method is based on a system to select all the single and key failure modes that cause the shutdown of the unit under the normal power mode and calculates the unavailable time of the power unit that each key failure mode causes through the failure rate of the key failure mode and the mean down time (MDT).

PAA is mainly used to evaluate the unavailability time of main system failures on the forced unavailability of power plants.

Taking the main steam and main feed-water system of EPR as an example, the main steps of PAA analysis are summarized as follows:

1) Function analysis of the system;

2) Fault mode and effect analysis;

3) Estimation of forced unavailability of power plants caused by system failures.

The main steam (nuclear island) and main feed-water system of EPR refer to the whole process from the main feed-water isolating valve to the main steam isolating valve through the secondary side of the steam generator.

It is the pivot of one and two circuits of the nuclear power plant.The main function is to transfer the heat from the primary coolant to the feed-water of the two circuits, generate steam in the steam generator to drive the turbine to generate power, and realize primary circuit and two-loop separation by the steam generator to ensure that the two-loop steam is free of radioactivity.

4.1.1.Operation Function

The operation functions (OF) of main steam VVP system:

$\cdot\$ OF1: Supply steam generated by SG to turbine and other steam users;

$\cdot\$ OF2: In the tests, thermal shutdown or low power operating conditions, the system transfers the thermal power of SG to the condenser (if available);

$\cdot\$ OF3: Exhaust steam through the VDA system during unit start-up and before hot shutdown conditions are reached;

$\cdot\$ OF4: Ensure the pressure and temperature rise rate of the steam line downstream of MSIVs are met during the heat shutdown of the unit during the heating pipe;

$\cdot\$ OF5: Condensate water from steam lines during unit start-up.

The operation functions (OF)of main feed-water system:

$\cdot\$ OF1: Feed water from high pressure feed-water heater system to SG;

$\cdot\$ OF2: Low pressure load regulating valve (LLCV) and full load regulating valve (FLCV) are used to control the flow of feed-water and maintain the level of SG in normal operation range;

$\cdot\$ OF3: Isolate SG in case of feed-water system failure to avoid overflowing of SG;

$\cdot\$ OF4: Above 20% of power rating, LLCV to keep open, FLCV to regulate the water flow;

$\cdot\$ OF5: At start-up and shutdown stages and below 20% power rating, only LLCV opens and adjusts feed-water flow.

4.1.2.Safety Function

The safety functions of the main steam VVP and main feed-water system are defined in the system design report, and three main safety functions are performed:

$\cdot\$ SF1: Reactivity control.

$\cdot\$ SF2: Residual heat discharge.

$\cdot\$ SF3: Radioactive material containment [4].

The periodic test of main steam and main feed-water systems that will affect the forced unavailability of the unit:

$\cdot\$ PT1: Operational test of main steam isolation valve (partial closure test)

The test is conducted once a month and can be carried out after the main steam tube is heated or in reactor power operation mode. Each time a different master tube is selected, the valve is partially closed (10%) to verify the operation of the main steam isolation valve.

$\cdot\$ PT2: Partial closure test of feed-water isolation valve

The test is carried out every two months and can be carried out in reactor power operation mode and in addition to the state of feed-water flow regulated by the main feed-water small flow regulating valve. This test is used to check the operation of the main feed-water isolation valve when the feed-water isolation signal appears [5-6].

The initial forced unavailability distribution provides some guidance data of systems thatcontribute to plant unavailability and is used for comparison after assessment.It is defined as: forced shutdown time of initial distribution for EPR units≤5days/year; initial forced shutdown time of NSSS and BNI≤3days.

Among them, according to the previous unit operation experience feedback, the unusable time of the main steam system and main feed-water system is 0.99 hours and 2 hours, respectively. Detailed system distribution valuesare shown in Table 2.

5.2.1.Presuppositions

FMEA identifies failure modes of critical components for plant availability. The following presuppositions should be made:

$\cdot\$ Only analyze failures pertinent to unit power operation modes. As for conditions that are not pertinent to unit power operation, like unit condition under the condition of starting or shutdown, failures will not influence the forced unavailability of plants.

$\cdot\$ Only consider single failures of equipment including subsequent secondary failures.

$\cdot\$ Without considering unit shutdown caused by external factors: false operation and flooding.

$\cdot\$ Excluding hand-operated valves with diameter of pipeline≤25mm.

$\cdot\$ Without analyzing position sensors, which provide a limit switch of valve stem in the valve.

$\cdot\$ In-situ measurements will not influence plant availability and do not need to be considered.

5.2.2.FMEA Analysis of Main Steam Pipeline

1) An external leak.The external leakage of the main steam pipeline can be detected by the leakage detection system, and the leakage valve can be repaired without affecting the availability of the power plant. Therefore, the failure mode of external leakage may not be considered.

2)The main isolation valve (MSIV) refuses to close. The failure will result in partial loss of safety function of the main steam system. According to CPR1000 operating experience, if an MSIV control line is unavailable or one or more valves of the same function group refuse to close, the unit begins to withdraw to the NS / RIS-RHR mode within three days.

3)The main isolation valve MSIV was mistakenly closed. The failure will lead to the loss of part of the operation function of the system and the high steam pressure on the secondary side of SG. When the SG pressure is higher than the set value, the reactor shutdown signal will be triggered to ensure the fuel integrity and the coolant system integrity at the power level.

From the above analysis, failure modes of the main steam system that result in forced unavailability of plants are selected as shown in Table 3.

5.2.3. FMEA Analysis of Main Feed-Water Pipeline

1)Main feed-water regulating valves fail to regulate, which is the failure of the main feed-water control flow system that results in failing to regulate the water level of the steam generator SG’s secondary side.If the feed-water flow is high, the water level of SG will be too high, which may result in the overflow of steam generators and the automated shutdown of units.

2) Main feed-water isolation valve refuses to close, which will result in partial safety function loss of systems.There are two redundancy designs for this isolation valve, and one can conduct main feed-water isolation while another one cannot close failures.Based on the operation experience of CPR1000, when one feed-water isolation valve with full load has not been closed and cannot be closed in one column or a few columns, if the power is 20% over rated power, the power level of station units should be lowered to below 20% of the rated power within three days and the isolation valves with full load in each effected column should be closed.If this does not work, the power should remain 20% below rated power and one isolation valve with full load in each effected column should be closed at the same time and be repaired within three days.

3) Main feed-water isolation valve is closed by mistake, which will result in partial operation functions loss of systems and main feed-water isolation and lead to feed-water loss of SG and SG’s secondary side being unable to take out the heat;then, the temperature and pressure of SG’s primary side increase, and the scram signal is triggered.

From the above analysis, the failure modes of the main feed-water system that result in forced unavailability of plants are selected as shown in Table 4.

The failure rate of the critical failure mode determines the input condition for calculating the forced shutdown time. The failure rate of the component failure mode in PAA comes from different sources, and the detailed data sources mainly are:

$\cdot\$ Reliability data pertinent to PSA;

$\cdot\$ Operation experience of fourth circuit pressurized water reactors in France and Germany;

$\cdot\$ Expert judgement.

From operation experience, the hourly failure rate of component k’s failure mode jis calculated as below:

$\cdot\$ n_jk—During given time period T, times of component k’s failure j.

$\cdot\$ T—One reactor operation in one year within operation experience feedback.

$\cdot\$ N_Fk—Amount of component k in each French nuclear power plant.

$\cdot\$ N_Gk—Amount of component k in each German nuclear power plant.

$\cdot\$ H_FP—Duration of operating with full power in each nuclear power plant per year.

The failure rate that is estimated and used during forced unavailability calculation of main feed-water system components is shown inTable 5.

Each system (operation or safety) might influence the availability of plants, and the unavailability types can be divided into direct shutdown, power reduction, and indirect shutdown (OTS) based on failure consequences. The way of calculating the plant unavailability time (UU_i) caused by system“i” is shown below:

$\cdot\$ UU_i=total amount of unavailability time caused by component k’s failure=∑(X_jk)

$\cdot\$ X_jk= (failure rate of component k) × (unavailability time caused by component k’s failure) =λ_jk×TU_jk

The calculation methods of TU_jk are described in detail inTable 6 based on unavailability types.

5.5.1. Unavailability Time of Main Steam Isolation Valve MSIV Refuse to Close in PT Test[8-9]

The failure mode of the main steam isolation valve that cannot be closed can be verified by the main steam isolation valve partial closure test (PT VVP-002). The test was carried out after the main steam pipe was heated or under the RP operation mode. The MSIV valve was partially closed (10% closed) to verify the operability of the main steam isolation valve. Referring to OTS (Operation Technical Specification), the requirement was to restore the plant to operational state within 3 days.

The forced unavailability type is 3a, and the shutdown overhaul time is calculated as follows:

${{X}_{jk}}=\text{ }{{\gamma }_{jk}}\times \text{ }T{{U}_{jk}}\times {{N}_{test}}$

TU_jk=t_{100→0%PN hand-shutdown}+t_condition+t_preparation+MTTR+t_{re-identificaiton}+t_reach100%PN

$\cdot\$ Time required for the unit to descend and return to rated power statusT_up&down:

${{T}_{\text{up }\!\!\And\!\!\text{ down}}}=2.5+5.5+1.5+16+18=43.5\text{h}$

$\cdot\$ Mean time to restoration(MTTR)

The time to remove and repair the valve, based on the operating experience, is conservatively estimated by experts as:

$MTTR=18\text{h}$

In summary, the time for forced shutdown and overhaul caused by the main steam isolation valve (MSIV)is estimated as follows:

$T{{U}_{\text{FC/MSIV}}}=43.5+18\approx 62\text{h}$

The main steam isolation valve partial closure test (PTVVP002) is carried out once a month and 12 times a year. Therefore, the failure mode causes the annual forced shutdown overhaul time per line to be:

${{X}_{\text{FC/MSIV}}}=\text{ }{{\gamma }_{\text{FC/MSIV}}}\times \text{ }T{{U}_{\text{FC/MSIV}}}\times \text{ }{{N}_{\text{test}}}=0.00031\text{ }\times 62\times 12=0.2306\text{h}$

5.5.2. Unavailability Time of Main Steam Isolation Valve (MSIV)Close by Mistake [10-11]

The drive device of the valve shall be inspected, and corrective maintenance shall be used for daily management. If a repair is required, it can be carried out without removing the valve.

The failure of the main steam isolation valve will cause reactor shutdown automatically, so the forced unavailability type is 1a, and the method for calculating the shutdown maintenance time is as follows:

${{X}_{jk}}={{\lambda }_{jk}}\times T{{U}_{jk}}$

TU_jk=t_{100→0%PN shutdown}+t_condition+t_preparation+MTTR+t_{re-identificaiton}+t_reach100%PN

The failureneeds to be repaired in NS/SG mode. Thus, the time is calculated as follows:

$\cdot\$ Time required for the unit to descend and return to rated power T_up&down:

Because the fault mode is a dominant fault, that is, the main steam isolating valve failure causes the unit trip to NS/SG mode immediately, T_up&down is:

$T_{\text{up }\!\!\And\!\!\text{ down}}^{{}}=1.5+5.5+2=9\text{h}$

$\cdot\$ Mean time to restoration (MTTR):

The drive device is isolated from the pipeline. The overhaul time is estimated by experts based on the operation experience.

$MTTR=5\text{h}$

The forced shutdown and overhaul time due to "close by mistake" of the main steam isolation valve is estimated to be:

$T{{U}_{\text{SC/MSIV}}}=9+5=14\text{h}$

Therefore, the failure mode results in an annual forced shutdown overhaul of each line, as follows:

${{X}_{\text{SC/MSIV}}}=\text{ }{{\lambda }_{\text{SC/MSIV}}}\times \text{ }T{{U}_{\text{SC/MSIV}}}\times \left( 365\times 24\times 0.9 \right)=0.0000019\times 14\times 7884=0.2097\text{h}$

5.5.3. Unavailability Time of Regulating Failure of Main Feed Water Regulating Valve

Since the failure of the main feed regulating valve will eventually cause the automatic shutdown of the reactor, that is, the forced unavailability type is 1a, the method for calculating the outage maintenance time is as follows:

${{X}_{jk}}=\text{ }{{\lambda }_{jk}}\times \text{ }T{{U}_{jk}}$

TU_jk=t_{100→0%PN normal}+t_condition+t_preparation+MTTR+t_{re-identificaiton}+t_reach100%PN

$\cdot\$ Time required for the unit to descend and return to rated power status T_up&down:

${{T}_{\text{up }\!\!\And\!\!\text{ down}}}=1.5+5.5+2=9\text{h}$

$\cdot\$ Mean time to restoration (MTTR):

$MTTR=8\text{h}$

In addition, considering the valve hydrophobicity, preparation, and re-qualification, the time estimate for the forced shutdown overhaulis:

$T{{U}_{\text{EL/}}}_{\text{FW}}=9+8=\text{17 h}$

As a result, the failure mode results in an annual forced shutdown overhaul of each line, as follows:

${{X}_{FC/}}_{MFRV}=\text{ }{{\lambda }_{FC/}}_{MFRV}\times \text{ }T{{U}_{FC/}}_{MFRV}\times \left( 365\times 24\times 0.9 \right)=0.0000028\times 17\times 7884=0.3753\text{ h}$

5.5.4. The Unavailability Time of MFIV Cannot Close in PT

The failure of the main feed-water isolation valve can be detected by the A line by-pass feed water isolation signal test (PTRPA042). The test is carried out in RP mode.

First, the bypass feed isolation valve is fully opened, and then the main feed isolation valve (10%) is partially closed to verify the operation of the main feed isolation valve.

That is, the forced unavailability type is 3a, and the maintenance time of shutdown is calculated as follows:

${{X}_{jk}}=\text{ }{{\gamma }_{jk}}\times \text{ }T{{U}_{jk}}\times {{N}_{test}}$

TU_jk=t_{100→0%PN hand-shutdown}+t_condition+t_preparation+MTTR+t_{re-identificaiton}+t_reach100%PN

$\cdot\$ Time required for the unit to descend and return to rated power status T_up&down:

${{T}_{\text{up }\!\!\And\!\!\text{ down}}}=2.5+5.5+1.5+16+18=43.5\text{ h}$

$\cdot\$ Mean time to restoration (MTTR):

$MTTR=18\text{ h}$

In addition, considering the drain, preparation, and re-qualification, the time for forced shutdown and maintenance is estimated as:

$T{{U}_{FC/MFIV}}=43.5+18\approx 62\text{ h}$

The main feed-water isolation valve partial closing test (PTRPA042) is carried out once every two months, N_test=6 times/year. Therefore, the failure result in the annual forced shutdown time for each line is:

${{X}_{\text{FC/MFIV}}}=\text{ }{{\gamma }_{\text{FC/MFIV}}}\times \text{ }T{{U}_{\text{FC/MFIV}}}\times \text{ }{{N}_{\text{test}}}=0.0003\text{ }\times 62\times 6=0.1116\text{ h}$

5.5.5. Unavailability Time of False Closing of the Main Feed Water Isolation Valve(MFIV)

The drive device of the valve should be inspected, and corrective maintenance should be carried out in daily management. If a repair is needed, it can be completed without removing the valve.

The forced unavailability type is 1a, and the shutdown overhaul time is calculated as follows:

${{X}_{jk}}=\text{ }{{\lambda }_{jk}}\times \text{ }T{{U}_{jk}}$

TU_jk=t_{100→0%PN hand-shutdown}+t_condition+t_preparation+MTTR+t_{re-identificaiton}+t_reach100%PN

$\cdot\$ Time required for the unit to descend and return to rated power status T_up&down:

${{T}_{\text{up }\!\!\And\!\!\text{ down}}}=1.5+5.5+2=9\text{ h}$

$\cdot\$ Mean time to restoration (MTTR):

$MTTR=8\text{ h}$

The forced shutdown and overhaul time due to “false closing” of the main steam isolation valve is estimated to be:

$T{{U}_{\text{SC/MFIV}}}=9+8=17\text{ h}$

As a result, the failure results in an annual forced shutdown overhaul of each line, as follows:

${{X}_{\text{SC/MFIV}}}=\text{ }{{\lambda }_{\text{SC/MFIV}}}\times \text{ }T{{U}_{\text{SC/MFIV}}}\times \left( 365\times 24\times 0.9 \right)=0.000000308\times 17\times 7884=0.0402\text{ h}$

From the above calculation, the plant forced shutdown time and shutdown frequency caused by failure, disorder, or degradation can be calculated as detailed in Figure 2 and Table 7.

The plant forced shutdown time is estimated to be 2.902 hours/year caused by failures.The disorder or degradation of the main feed-water system is less than 2 hours of initial forced unavailability distribution and meets the reliability requirements.However, the unavailability time of the main steam pipeline is more than 0.99 hoursand slightly exceeds the initial allocation requirement.It needs to be optimized.

Other critical systems of nuclear island NI are finally analyzed, including contributions these systems made to forced shutdown time of nuclear power plants to make sure that forced shutdown time caused by critical systems of nuclear island NI is less than the target value: 3 days.

As for systems where the calculation results do not meet the initial forced unavailability distribution, feedback should be given to the design department for circular optimization. It can be optimized mainly through the following three aspects:

1)Equipment with long mean time between failures MTBF and high reliability should be used in design to improve equipment (especially CCM equipment) reliability of units, lower failure rate, extend mean time between failures MTBF of equipment, and reduce times of forced shutdown.

2)After equipment failure, new overhaul technology is used to reduce mean time to repair MTTR; therefore, forced shutdown timeis shortened.

3) As for critical components with high failure rate and long maintenance time, they should be optimized in the system process (like increasing redundancy designs) and forced shutdowns caused by a single failure can be changed to double or multiple failures to reduce the critical failure modes of systems and lower the forced unavailability of systems[12-13].

4) The initial forced unavailability allocation can be adjusted according to the optimization results, so that the calculation results are close to or meet the initial reliability requirements.

Based on the above calculation results, the failure of adjustment failure of the main feed-water regulating valve is the main factor that causes the forced unavailability, that is, a weak link that accounts for 38.8% of all the failure modes.According to Table 5, the high failure rate of the main isolation valve and the longer repair time are the main factors that account for the high proportion of the main isolating valve [14-15].

The forced unavailability of units not only influences economic indicators of nuclear power units like availability, but also seriously threatens the safe operation of units.It is significantly important for the safety and economy of nuclear power units to reduce forced shutdown times and shorten forced shutdown times of nuclear power units.

In this paper, based on the third generation EPR unit, the unplanned shutdown time that affects availability is calculated, critical weaknessesare found, optimization methods are put forward, and feedback is given at the design stage to continuously optimize equipment reliability of nuclear power systems and improve the unit economy under the premise of meeting safety requirements through the PAA method.This will provide not only a good reference in design, system configuration, and equipment selection of new nuclear power plants, but also reference suggestions to improve the reliability of nuclear power units.