A cause-defense approach to the understanding and analysis of common cause failures

For improved reliability and safety, nuclear power plants are designed with redundant safety systems, many of which also have redundant trains of equipment within the system. However, the very high reliability theoretically achievable through the use of redundancy is often compromised by single events that can individually render redundant components unavailable (common cause failure [CCF] events). As evidenced by the results of probabilistic risk assessments (PRAs) and by historical experience with nuclear power plant operations, CCF events are usually major contributors to the risk posed by nuclear power plant operation. Thus, it is important that PRAs recognize the potential for CCF events and realistically account for CCF contributions to system unavailability and plant risk. Much progress has been made over the years in the area of CCF analysis, including the development of both qualitative and quantitative analysis methods. Until now, however, CCF methodologies have not explicitly and systematically accounted for the impact of plant-specific defenses, such as design features and operational and maintenance policies, in place to reduce the likelihood of failure occurrences at nuclear power plants. Recognizing the importance of this issue, the NRC has funded a research effort that has focused on developing the cause-defense methodology for CCF analysis and prevention. This report presents the results of this research. Specifically, this report discusses the development of (1) procedures for identifying the potential for CCF events at individual nuclear power plants and (2) cause-defense matrices for analysis of CCF events. Also, new concepts and more precise definitions are introduced to enhance CCF terminology and interpretation of historical event data. (author)