The Best Estimate Plus Uncertainty (BEPU) method is applied to analysis of the “intentional depressurization of steam generator secondary side” which is an accident management procedure in a small break loss-of-coolant accident with high pressure injection system failure. In the present study, scaling calculations from the LSTF small break LOCA tests were carried out for a conventional Westinghouse type four-loop PWR. The two test cases were selected with different break size and different depressurization conditions to ensure the reliability for the analyses for the accident scenario. The uncertainty propagation analyses were performed for the PWR. The dominating input uncertainty parameters, i.e. those few with the highest influence on the output uncertainty were identified. The analysis results were compared with those for the LSTF to address the scaling up capability and the similarity evaluation between the LSTF model and the PWR plant model. It was found that the PWR plant model results had overall agreements with the LSTF model, and the uncertainty of the predicted PCT included the measured PCT. Furthermore, the correlation coefficients between the input uncertainty parameters and the PCT for the PWR plant model had similarities with those for the LSTF model.

PSA is found to be a valuable tool for improving the safety and reliability of nuclear reactors due to intense involvement of human interactions in an experimental facility. It may also be advantageously applied to research reactors under design and construction. This paper demonstrates the study and result of a Level 1 internal initiating event PSA under the power operation mode to the High Flux Engineering Test Reactor (HFETR) which is under design and construction. The occurrence frequency of core damage which may potentially arise in HFETR is evaluated by using RiskSpectrum software, and event trees have been used to study the response of the installation to various initiating events whereas fault trees have been used in the modeling of safety system failures. Calculation results show that core damage frequency for HFETR research reactor is 5.28E−07 per year, and initiating events which have a significant contribution to CDF are loss of coolant water and loss of offsite power.

Instrumentation and Control (I&C) systems for Nuclear Power Plants (NPP) are exceedingly complicated electronic solutions that include thousands of different components such as microcontrollers, Field-Programmable Gate Arrays (FPGAs), integrated circuits etc. Deployment of such safety-critical systems cannot be performed without complex safety and reliability assessment, verification and validation (V&V) activities that are addressed to exposing of overlooked faults. The examples of such activities are Fault Tree Analysis (FTA), Failure Modes and Effects Analysis (FMEA), Fault Injection Testing (FIT). Due to complexity of NPP I&C systems in most cases the process of assessment is very time consuming and the results mostly depend on experts’ qualification. Traditional safety and reliability assessment methods are being constantly modified and enhanced so as to comply with increasing demands of national and international standards and guidance, as well as to be applied for I&C systems that contain number of complex components like FPGA. Although much work related to analysis of FPGA-based systems has been performed, there is a lack of detailed technique for FPGA-based I&C systems failure identification that considers probability of several faults at the same time (multi-faults), development of preventive strategies for controlling or reducing of the risk related to such failures, as well as automation of this technique so as to make it utilizable for real NPP industry tasks. FIT as verification for Failure Modes, Effects and Diagnostics Analysis (FMEDA) was used during Safety Integrity Level 3 (SIL3) certification process of RadICS NPP I&C platform, while the parts of proposed technique were used as internal verification and validation activities applied on several modules of the platform.

Nowadays cyber security assurance is one of the key challenges of safety critical software based NPP I&C (Nuclear Power Plants Instrumentation and Control) systems requirements profiling, development and operation. Any I&C system consists of a set of standard software (SW), hardware (HW) and FPGA components. These components can be selected and combined in different ways to address the particular control and safety assurance related tasks. Some of them are proprietary software (PS) and commercial off-the-shelf (COTS) components developed previously. Application of such components reduces the level of safety and cyber security, because they can contain vulnerabilities that were created intentionally. In this case, targeted attacks can lead to a system failure. National Vulnerability Database (NVD) and other open databases contain information about vulnerabilities which can be attacked by insiders or other intruders and decrease cyber security of NPP I&C systems. In this paper, we propose a safety assessment technique of NPP I&C systems, which consists of the following procedures: 1. Analysis of I&C architecture to assess influence of OTS component failures on dependability (reliability and safety) of the system. For that purpose, FMEDA or similar techniques can be applied. As a result, three-dimension criticality matrixes (CM) (with metrics of detection, probability and severity) are developed for different components (SWFCM and HW/FPGAFCM). 2. The IMECA-based assessment of OTS components and their configuration. In this case, CMs (SWICM and HW/FPGAICM) describe the degree of failure component influence on cyber security. 3. Joining of criticality matrixes (SWFCM and HW/FPGAFCM, SWICM and HW/FPGAICM), impact analysis of components depending on degree of influence on cyber security and safety as a whole. 4. Developing of Security Assurance Case and selecting of countermeasures according to safety (cyber security)/costs criteria. The developed tool supports creation of criticality matrixes for each analyzed component of the system and I&C as a whole. Joining of criticality matrixes allows creating common matrix for system cyber security and functional safety. The tool supports decision making to optimize choice of countermeasures according to criterion of safety and security/cost criterion.

Passive containment cooling system (PCCS) is an important safety-related system in AP1000 nuclear power plant, by which heat produced in reactor is transferred to the heat sink – atmosphere – based on natural circulation, independent of human response or the operation of outside equipments, so the reactor capacity of resisting external hazards (earthquake, flood, etc.) is improved. However since the system operation based on natural circulation, many uncertainty factors such as temperatures of cold and heat sources will affect the system reliability, and physical process failure becomes one of the important contributors to system failure, which is not considered in the active system reliability analysis. That is, the system will lose its function since the natural circulation cannot be established or kept even when the equipments in the system can work well. The function of PCCS in AP1000 is to transfer the heat produced in the containment to the environment and to keep the pressure in the containment below its threshold. After accidents the steam is injected to the containment and can be cooled and condensed when it arrives at the containment wall, then the heat is transferred to the atmosphere through the steel vessel. So the peak value of the pressure is influenced by the steam situation which is injected into the containment and the heat transfer and condensate processes under the accidents. In this paper the dynamic thermal-hydraulic (T-H) model simulating the fluid performance in the containment is established, based on which the system reliability model is built. Here the total pressure in the containment is used as the success criteria. Apparently the system physical process failure may be related to the system working state, the outside conditions, the system structure parameters and so on, and it’s a heavy work to analyze the influences of all the factors, so only the effects of important ones are included in the model. Monte Carlo (MC) simulation is used to evaluate the system reliability, in which the input parameters such as air temperature are sampled based on their probabilistic density distributions. The pressure curves along with the accident development are gained and the system reliabilities under different accidents are gotten as well as the main contributors. The results illustrate that the system physical process failure probabilities are varied under different climate conditions, which result in the system reliability and the main contributors to system failure changing, so the different methods can be taken to improve the system reliability according to the local condition of the nuclear power plant.

The Best Estimate Plus Uncertainty (BEPU) method is applied to analysis of the “intentional depressurization of steam generator secondary side” which is an accident management procedure in a small break loss-of-coolant accident with high pressure injection system failure. In the present study, experimental analyses using the RELAP5/MOD3.2 code were carried out for the ROSA/Large Scale Test Facility (LSTF) secondary-side depressurization tests. The two test cases were selected with different break sizes and different depressurization conditions to ensure the reliability for the accident scenario analyses. The input parameter uncertainty propagation analyses were performed to get 95%/95% tolerance limit values of the output parameters. It was confirmed that the code predicted well the major event progressions of the accident for both test cases and the 95%/95% uncertainty bounds of the peak cladding temperatures included the measured values. On the other hand, the same ranges of some input uncertainty parameters could lead to different influences on the output uncertainties between the test cases. The dominating input uncertainty parameters could be different depending on the break sizes and depressurization conditions of the accident scenario.

After Fukushima accident, decay heat removal in station blackout (SBO) accident is concerned for different NPP design. Advanced passive PWR relies on passive systems to cool reactor core and containment, such as the passive residual heat removal system (PRHR), passive injection system and passive containment cooling system (PCCS). Passive safety systems are considered more reliable than traditional active safety system under accident condition. However, in long-term SBO situation, possible failure of passive safety systems is noticed as active valves are needed in system actuation. Moreover, probability safety analysis results of advanced passive PWR show that system failure is possible without external event. Given different passive safety system failure assumptions, response of reactor coolant system and containment of advanced passive PWR is calculated in SBO accident, the integrity of core, reactor pressure vessel and containment is assessed, and decay heat removal approach is studied. The results show that containment failure is predicted with the failure of PCCS and PRHR, reactor vessel failure together with containment failure is predicted with the failure of PCCS, passive injection system and PRHR. Advices to deal with the risk of advanced passive PWR in SBO are given based on the study.

The application of the Best Estimate Plus Uncertainty (BEPU) method is made to analysis of the “Intentional depressurization of steam generator secondary side” which is an accident management procedure in a small-break loss-of-coolant accident (SBLOCA) with high pressure injection (HPI) system failure. RELAP5/MOD3.2 is used as the analysis code. By applying the BEPU method, the uncertainties of the analysis results can be estimated quantitatively. However, the accuracy of the analysis results depends primarily on the base case result predicted by the best estimate code. In this study, in order to investigate the appropriate base case model, simulation analyses using the RELAP5/MOD3.2 were carried out for the ROSA Large Scale Test Facility (ROSA/LSTF) secondary-side depressurization tests. It was found that the code predicted well the major event progressions such as pressure responses, core liquid level responses, and rod surface temperatures, as well as important phenomena such as formation and clearing of loop seals, accumulation of water from condensation, and countercurrent flow limitation (CCFL) at the inlet of the U-tubes, which are characteristic features of this accident scenario.

Layer of Protection Analysis (LOPA) is extensively used for safety analysis of non-nuclear facilities e.g., chemical processes. It is simpler and less expensive methodology comparing full probabilistic risk assessment methods. It evaluates the probability of failure per demand for the safety system failures and the resulting consequences. LOPA is widely used in chemical process safety analysis however it is introduced as a practical technique for risk assessing in many other industries. This research examines utilization of LOPA method for nuclear systems as a quick evaluation of the safety level. The changes are proposed to classic LOPA method by using event tree method for event scenario identification and development. The so-called modified layer of protection analysis (Modified-LOPA) methodology utilizes Bayesian updating for more precise quantification of the failure probabilities and updating data. A simple example of a fire protection system shows application of this method.

In typical pressurized water reactor (PWR), to cope with beyond design basis events such as station black out (SBO) or small break loss of coolant accident with safety injection system failure, injection from accumulator sustains core cooling by compensating for loss of coolant. Core cooling is sustained by single- or two-phase natural circulation or reflux condensation depending on primary coolant mass inventory. Behavior of the natural circulation in PWR has been investigated in the facilities such as Large Scale Test Facility (LSTF) which is a full-height and full-pressure and thermal-hydraulic simulator of typical four-loop PWR. Two steady-state natural circulation tests were conducted in LSTF at both high and low pressure. These two tests were conducted changing the primary mass inventory as a test parameter, while keeping the other parameters such as core power, steam generator (SG) pressure, and steam generator water level as they are. Mitsubishi Heavy Industries (MHI) plans new natural circulation tests to cover wider range of core power and pressure as test-matrix (including the previous LSTF tests) to validate applicability of the model in wider range of core power and pressure conditions including the SBO conditions. In this paper, the previous LSTF natural circulation tests are reviewed and the new test plan will be described. Additionally, MHI also started a feasibility study to improve the steam generator tube and inlet/outlet plenum model using the M-RELAP5 code [4]. Newly developed model gives reasonable agreement with the previous LSTF tests and applies to the new test conditions. The feasibility findings will also be described in this paper.

Output from a high-order simulation model with random inputs may be difficult to fully evaluate absent an understanding of sensitivity to the inputs. We describe, and apply, a sensitivity analysis procedure to a large-scale computer simulation model of the processes associated with Nuclear Regulatory Commission (NRC) Generic Safety Issue (GSI) 191. Our GSI-191 simulation model has a number of distinguishing features: (i) The model is large in scale in that it has a high-dimensional vector of inputs; (ii) some model inputs are governed by probability distributions; (iii) a key model output is the probability of system failure — a rare event; (iv) the model’s outputs require estimation by Monte Carlo sampling, including the use of variance reduction techniques; (v) it is computationally expensive to obtain precise estimates of the failure probability; (vi) we seek to propagate key uncertainties on model inputs to obtain distributional characteristics of the model’s outputs; and, (vii) the overall model involves a loose coupling between a physics-based stochastic simulation sub-model and a logic-based Probabilistic Risk Assessment (PRA) sub-model via multiple initiating events. Our proposal is guided by the need to have a practical approach to sensitivity analysis for a computer simulation model with these characteristics. We use common random numbers to reduce variability and smooth output analysis; we assess differences between two model configurations; and, we properly characterize both sampling error and the effect of uncertainties on input parameters. We show selected results of studies for sensitivities to parameters used in the South Texas Project Electric Generating Station (STP) GSI-191 risk-informed resolution project.

As components in an actual nuclear system have multi states and are dependent on each other, a method for system reliability analyse based on Markov theory and Bayes network is presented in this paper. The method resolves the problems of multi-state and dependence simultaneously, by utilizing Markov theory and Bayes network synthetically. Applying the method to analysing reliability of power-supply system in nuclear power plant, the system failure probability, RAW and posterior probability of each component are obtained, which are useful for system reliability evaluation, improvement of weakness and fault diagnosis. Synchronously, the method is proved feasible and effective for solving system reliability that contains dependent and multi-state components.

The project of nuclear station LNPP-2 with a reactor power plant VVER type by electrical power 1200 MVt involves a number of new design solutions to increase of parameters of safety. The passive containment heat removal system and heat removal system via steam generators is including of number of such solutions. Passive heat removal system via steam generators (PHRS/SG) is assigned for remove of residual heat of reactors core to final heat absorber (atmosphere) through a secondary circuit at DEC accident. The system PHRS/SG duplicates cooling-down system via SG to final heat absorber in case of impossibility of realization of its design functions. Containment heat removal system (PHRS/C) is assigned for remove of residual heat from containment in accidents with heat-transfer emissions from primary circuit. PHRS/C duplicates functions of a spray system to reduce of pressure under containment in case of spray system failure. In the substantiation of passive security systems the complex in SPbAEP of computational and experimental analysis was executed, the main results of which are shown in the present report.

The computation of initiating event frequencies has received much attention in recent years. This attention reflects the importance of support system failures in the computation of core damage frequencies from internal events for nuclear power plants. Multi-train support system failures, such as a total loss of service water or a total loss of component cooling water, potentially represent significant impacts for many nuclear plant designs. The contribution to basic event importance from such initiator models has also been recognized, especially as part of the Mitigating Systems Performance Index (MSPI) program; Reference 1.

Lead-bismuth coolant is preferable for the medium size reactors, since, in contrast to the sodium coolant, it does not interact with water and air, it is radiation resistant, insignificantly activated and it is not combustible [1]. Combination of natural properties of lead-based coolants, mono-nitride fuel, fast reactor neutronics and design approaches used for the reactor core and heat removal system brings SVBR 75/100 NPP [2] to achieve a new safety level and assures its stability without operation of active safety systems even under severe accident conditions. Analysis of possible sequences of the events even under conditions of such severe accidents as addition of total excess reactivity or all pumps trip accompanied by safety system failure leads to the conclusion on that power unit with SVBR 75/100 reactor plant (RP) has high safety level.

The Electric Power Research Institute (EPRI) is conducting research in cooperation with the Nuclear Energy Institute (NEI) regarding Operating Experience of digital Instrumentation and Control (I&C) systems in US nuclear power plants. The primary objective of this work is to extract insights from US nuclear power plant Operating Experience (OE) reports that can be applied to improve Diversity and Defense in Depth (D3) evaluations and methods for protecting nuclear plants against I&C related Common Cause Failures (CCF) that could disable safety functions and thereby degrade plant safety. Between 1987 and 2007, over 500 OE events involving digital equipment in US nuclear power plants were reported through various channels. OE reports for 324 of these events were found in databases maintained by the Nuclear Regulatory Commission (NRC) and the Institute of Nuclear Power Operations (INPO). A database was prepared for capturing the characteristics of each of the 324 events in terms of when, where, how, and why the event occurred, what steps were taken to correct the deficiency that caused the event, and what defensive measures could have been employed to prevent recurrence of these events. The database also captures the plant system type, its safety classification, and whether or not the event involved a common cause failure. This work has revealed the following results and insights: - 82 of the 324 “digital” events did not actually involve a digital failure. Of these 82 non-digital events, 34 might have been prevented by making full use of digital system fault tolerance features. - 242 of the 324 events did involve failures in digital systems. The leading contributors to the 242 digital failures were hardware failure modes. Software change appears as a corrective action twice as often as it appears as an event root cause. This suggests that software features are being added to avoid recurrence of hardware failures, and that adequately designed software is a strong defensive measure against hardware failure modes, preventing them from propagating into system failures and ultimately plant events. 54 of the 242 digital failures involved a Common Cause Failure (CCF). - 13 of the 54 CCF events affected safety (1E) systems, and only 2 of those were due to Inadequate Software Design. This finding suggests that software related CCFs on 1E systems are no more prevalent than other CCF mechanisms for which adherence to various regulations and standards is considered to provide adequate protection against CCF. This research provides an extensive data set that is being used to investigate many different questions related to failure modes, causes, corrective actions, and other event attributes that can be compared and contrasted to reveal useful insights. Specific considerations in this study included comparison of 1E vs. non-1E systems, active vs. potential CCFs, and possible defensive measures to prevent these events. This paper documents the dominant attributes of the evaluated events and the associated insights that can be used to improve methods for protecting against digital I&C related CCFs, applying a test of reasonable assurance.

Generally, there are two methods to estimate reliability of system or component failure in engineering, or survival function of patient death in medicine: 1) parametric and 2) non-parametric methods. The parametric method has been used widely since there is few data on severe accidents in nuclear power plants. However, if we have a lot of data on system failure or patient death, the non-parametric method could be used to estimate reliability or survival function. In this paper we focus on the latter case in which one problem arises in treating the data. The problem is how to reflects efficiently the censoring information into reliability or survival function. In this study, two works have been done: 1) develop the model to reflect censoring information and 2) show how efficient the model is using the Monte-Carlo Simulation. In the WASH-1400 (NUREG-75/014), Failure to Operate of Motor Operated Valves from Nuclear Experience is suggested 1×10 −3 / d . The new developed method can estimate closer to the failure rate 1×10 −3 / d than the other existing methods. Also the failure rate using the new method satisfies the conservative limit.

Embedded within modern technological systems, human error is the largest, and indeed dominant contributor to accident cause. The consequences dominate the risk profiles for nuclear power and for many other technologies. We need to quantify the probability of human error for the system as an integral contribution within the overall system failure, as it is generally not separable or predictable for actual events. We also need to provide a means to manage and effectively reduce the failure (error) rate. The fact that humans learn from their mistakes allows a new determination of the dynamic probability and human failure (error) rate in technological systems. The result is consistent with and derived from the available world data for modern technological systems. Comparisons are made to actual data from large technological systems and recent catastrophes. Best estimate values and relationships can be derived for both the human error rate, and for the probability. We describe the potential for new approaches to the management of human error and safety indicators, based on the principles of error state exclusion and of the systematic effect of learning.