(47a) New Insights Into Computing PFDavg for Pressure Relief Valves Based On Proof Test Data

Previously we analyzed several CCPS PERD Pressure Relief Valve (PRV) proof test data sets using Quantal Response Analysis (QRA) and obtained estimates for λ_D, the constant failure rate for the "stuck-shut" failure mode, in the range of [10^-8, 10^-7] failures/hour. We also found that in that range of values, λ_D alone explained only a small fraction of the observed failures; the remaining failures were modeled by probability of initial failure (PIF) in the range of 1% - 1.6%.

Using Statistical Signature Analysis (SSA), we now re-analyze two of the data sets, this time considering more complex models of λ_D(t) to explain the observed failures and to compute average probability of failure on demand (PFDavg). Our findings are:

? Any analysis of proof test data, based solely on operating times until proof test and results of proof test (pass/fail), must necessarily admit multiple explanations for the failure mechanisms underlying the test results, i.e., one data set will be statistically consistent with more than one λ_D(t).

? Since PFDavg serves to measure risk reduction, it should include all dangerous failures regardless of underlying cause. By using more complex models for λ_D(t) than are currently considered, e.g., models which can include constant λ_D, both zero or non-zero PIF, and models for infant mortality and/or failure rate growth, it is possible for λ_D(t) to account for all observed failures regardless of underlying cause.

? Each different explanation of failures observed, i.e., each different λ_D(t) model produced from a single data set, potentially produces a different value for PFDavg for any given proof test interval, T_P. Thus, one data set can support multiple values of PFDavg for any fixed T_P. However, for the data analyzed to date and for a fixed value of λ_D, these difference are small for T_P > 4.5 years. Generally, in these cases, PFDavg > 0.01. Hence, once T_P reaches about 4.5 years, the data analyzed support Safety Integrity Level (SIL) 1 behavior for all of the complex models of λ_D(t) explored thus far. For values of T_P < 2 years, some complex models for λ_D(t) support SIL 2 behavior. But we can not tell by currently available analysis methods which models best represent the actual failure mechanisms responsible for the proof test data observed. Thus, in general, current data supports SIL 1 behavior for PRV.