eDirect

Nu c l e a r E n g i n e e r i n g a n d T e c h n o l o g y 4 9 ( 2 0 1 7 ) 2 9 5e3 0 5

Available online at Scienc

Nuclear Engineering and Technology

journal homepage: www.elsevier .com/locate/net

Original Article

Current Status and Applications of IntegratedSafety Assessment and Simulation Code Systemfor ISA

J.M. Izquierdo a, J. Hortal a, M. Sanchez Perea a,*, E. Mel�endez a, C. Queral b,and J. Rivas-Lewicky b

a Modeling and Simulation Area (MOSI), Nuclear Safety Council (CSN), Justo Dorado, 11, 28040 Madrid, Spainb Energy and Fuels Department, Technical University of Madrid (UPM), Alenza, 4, 28003 Madrid, Spain

a r t i c l e i n f o

Article history:

Received 28 November 2016

Received in revised form

13 January 2017

Accepted 13 January 2017

Available online 9 February 2017

Keywords:

Dynamic Event Trees

IDPSA

ISA

PSA

* Corresponding author.E-mail address: msp@csn.es (M. Sanchez

http://dx.doi.org/10.1016/j.net.2017.01.0131738-5733/Copyright © 2017, Published by Elthe CC BY-NC-ND license (http://creativecom

a b s t r a c t

This paper reviews current status of the unified approach known as integrated safety

assessment (ISA), as well as the associated SCAIS (simulation codes system for ISA) com-

puter platform. These constitute a proposal, which is the result of collaborative action

among the Nuclear Safety Council (CSN), University of Madrid (UPM), and NFQ Solutions

S.L, aiming to allow independent regulatory verification of industry quantitative risk

assessments. The content elaborates on discussions of the classical treatment of time in

conventional probabilistic safety assessment (PSA) sequences and states important

conclusions that can be used to avoid systematic and unacceptable underestimation of the

failure exceedance frequencies. The unified ISA method meets this challenge by coupling

deterministic and probabilistic mutual influences. The feasibility of the approach is illus-

trated with some examples of its application to a real size plant.

Copyright © 2017, Published by Elsevier Korea LLC on behalf of Korean Nuclear Society. This

is an open access article under the CC BY-NC-ND license (http://creativecommons.org/

licenses/by-nc-nd/4.0/).

1. Introduction

The two traditional approaches to safety analysis in nuclear

power plants are the so-called deterministic safety assess-

ment (DSA) and the probabilistic safety assessment (PSA). DSA

continues to be the main support for licensing design issues.

At post-TMI times, PSA started to be used as well in several

licensing applications. The question of the consistency of

deterministic and probabilistic studies was already posed in

different licensing groups and reflected in the following is-

sues: (1) to what extent and at which stage of the PSA a

Perea).

sevier Korea LLC on behamons.org/licenses/by-nc

significant change in stand-by safety system initiation set-

points, with obvious impact on DSA, could be reflected in

PSA; and (2) to what extent DSA and PSA covered different

operator behaviors, including for instance time delays in

manual actions.

The Nuclear Safety Council (CSN) makes intensive use

of PSA models in key aspects of its licensing day-to-day

life, including inspections planning and categorization of

their findings, incident analysis, and operational aspects

(maintenance rule, human reliability, and safety culture).

However, the operation is constrained by the conclusions

lf of Korean Nuclear Society. This is an open access article under-nd/4.0/).

Nu c l e a r E n g i n e e r i n g a n d T e c h n o l o g y 4 9 ( 2 0 1 7 ) 2 9 5e3 0 5296

of the analysis of the (automatic) design basis transients

and accidents, (DSA), as reported in the safety assessments

(SAR), which also include day-to-day requirements like

those included in the operating technical specifications

(OTS). The overall process encompasses widely different

safety studies in nature, data, phenomena, and systems,

each being a piece interacting in several ways with many

others.

Ensuring consistency among implicit and explicit assump-

tions, interfaces, and conclusions is a major task of the regu-

latory review. The set of activities may be considered as a

licensing validation and verification (V&V) process. Most reg-

ulatory activities are qualitative in nature, but the widespread

use of computerized analysis also requires sophisticated,

quantitative V&V with independent checks complementing

the qualitative process. This paper summarizes some of the

tools [simulation codes system for ISA (SCAIS)], methods [in-

tegrated safety assessment (ISA)], and results that have been

(and are being) developed at CSN for this purpose, with special

emphasis on the most recent ones. The main focus is on PSA

related developments that may be classified according to the

three main stages of a typical PSA, namely: (1) delineate the

possible sequences of events (SOE), which amounts to finding

all possible sequences of dynamic transitions (SOTs) resulting

from the sequence of protective actions as well as possible

failures of safety systems. No protective action takes place

unless necessary conditions for it are fulfilled, most often

consisting of process variables entering certain regions, situa-

tions that we call stimuli activations, such as alarms, proced-

ure entry points, and/or crossing of deterministic setpoints.

The set of transients activating stimulus here is called the

stimulus domain; (2) determine system success criteria,

discriminating among successful sequences of configurations

of the safety systems (i.e., those in which the wrong trends of

damage indicators are successfully corrected) from failed ones.

The intersection of all stimuli domains of a sequence is the

damage domain; and (3) compute, for each SOE, the frequency

resulting from its safety systems configurations, by using, for

instance, Fault-Tree/Event-Tree (FT/ET) techniques.

Although detailed methods and abundant works in the

literature [1] provide guidance for Stage 3, such guidance be-

comes loosewhen describing Stages 1 and 2,mainly due to the

unique phenomena involved in each application domain,

their strong nonlinearities, and their dependence on the pro-

tection design methods, all of which are usually very sophis-

ticated and technology dependent, as described in safety

analyses reports (SAR) [2].

This paper addresses the feasibility of the ISA-SCAIS

approach and, in addition, presents new ideas to handle

important event timing and boundary condition uncertainty,

allowing a dividing/synthesizing of the main ingredients of

the accident progression.

2. Integrated deterministic-probabilisticsafety assessment methodologies

Integrated deterministic-probabilistic safety assessment

(IDPSA) is a family of methods that use a time-dependent

phenomenological model of system evolution along with an

analysis of system stochastic behavior to account for possible

dependencies between failure events and dynamic processes

[3]. The starting point of these frameworks is that safety

justification must be based on the coupling of deterministic

(consequences) and probabilistic (frequency) considerations

to address mutual interactions between stochastic distur-

bances (e.g., failures of the equipment, human actions, and

stochastic physical phenomena) and deterministic responses

of the plant (i.e., transients). Thus it can be considered com-

plementary to PSA and DSA approaches that intend to help in:

(1) resolving time dependent interactions among physical

phenomena, equipment failures, control logic, and operator

actions in analysis of complex scenarios; (2) identification and

characterization of a priori unknown vulnerable scenarios

(sleeping threats) of the overall system; (3) consistent treat-

ment of different sources of uncertainties; and (4) reduction of

reliance on expert judgment and assumptions regarding

complex time dependencies and scenarios.

The literature reports on a variety ofmethods, e.g., DYLAM,

ADS-IDAC, MCDET, ADAPT, and GA-IDPSA; see [3e5] for

further details.

As a drawback, these methods operate in the actual time/

state space and the computational effort is considerably larger

compared with that required in a conventional event tree

analysis. For this reason, application is still restricted to spe-

cific aspects of PSA or DSA. In order to considerably reduce the

computation time for the numerous dynamic calculations,

these methods generally treat continuous and discrete

random transitions in a probabilistic way, through repeated

branching of the sequence at systematically chosen points in

time according to user specified probability distributions. ISA

methodology lies within those methodologies.

3. ISA-theory of stimulated dynamicsmethodology

As indicated, ISAmethodology tries to verify compliance with

regulations and consistency in the design and safety assess-

ments made by the industry. Consistent with this intent, ISA

is an integrated method in which deterministic and probabi-

listic aspects of the safety problem are solved together, taking

into account mutual dependencies.

The concept of a sequence as an ordered set of events is

also extensively used in ISA. The ISA methodology strongly

relies on simulation to determine the consequences of acci-

dent sequences. However, a sequence cannot be fitted to a

particular time history. Treatment of sequence uncertainties

and identification of failure domains are essential parts of ISA.

If sequence success criteria are used, each simulated transient

is evaluated against those criteria in order to find the failure

domain. The concept of header success criteria is no longer

needed because compliance with the sequence success

criteria is a direct result of the simulation. This allows for the

use of ISA as a powerful tool to verify the header success

criteria used in Level 1 PSA.

The main basis of the ISA-TSD method (integrated safety

assessment based on the theory of stimulated dynamics,

Nu c l e a r E n g i n e e r i n g a n d T e c h n o l o g y 4 9 ( 2 0 1 7 ) 2 9 5e3 0 5 297

[6e8]) is to lower the assessment from the system configura-

tion sequence level, characteristic of Level 1 PSA, or from the

envelope level, characteristic of DSA, to the transient level

within each sequence by: (1) considering sequences as large

groups of transients accounting for all uncertainties compat-

ible with the probability space under check, e.g., parameter

uncertainty, initial conditions, variability in occurrence time

of events and uncertainty in boundary conditions; (2) simu-

lating a number of those sequence transients in order to find

the sequence failure domain, defined as the subset of

sequence transients in the probability space ending in a failed

state. The number of transients that need to be simulated

depends on the desired accuracy of the failure domain char-

acterization but, in general, this number is very high; and (3)

providing TSD algorithms to compute the contribution to the

exceedance frequency (of the safety limit used to define the

failed state) of any transient belonging to the failure domain,

and then aggregating these contributions for all the transients

there. Included as factors in those algorithms are the condi-

tional probabilities of the safety system configurations char-

acteristic of Level 1 PSA. Explicit consideration of stimuli

ensures consistency of the set of safety measures included in

every transient and allows for a proper classification of tran-

sients into dynamic sequences.

4. SCAIS

Leaving aside the theoretical aspects that inspired the detailed

computational methods (TSD, [6e8]), ISA analysis involves a

lot of transients, and its application thus requires a set of

simulation/computational tools. The computerized platform

called SCAIS has been developed for this main purpose. It is

composed of a set of interconnected modules which, never-

theless, are their own entity and can be used as standalone

tools or as modules of other methods as well.

Present day SCAIS (see [7,8] for its evolution) is the result of

a consolidation and modernization program of the prior sys-

tem. It is being developed in close collaboration with NFQ

Solutions (Madrid, Spain), a software development company

specializing in risk assessment. Also, the Technical University

of Madrid (UPM) actively participates at the testing and

application level.

As the focus of the ISA setup is in Discrete Dynamic Event

Tree (DDET) transient simulation, most of the components of

SCAIS are transient related, whereas a few others are proba-

bilistic in nature. Fig. 1 presents a simplified scheme of the

ISA-TSD methodology, whose blocks parallel the main com-

ponents of SCAIS.

The “Automatic Generation of Paths/Sequences” block in

Fig. 1 includes the following SCAIS elements [7,8]: (1) BABIECA

is the general simulation driver. It combines internal and

external simulation modules from which the user can

configure the plant model in the form of a topology of inter-

connected modules [9]. It takes care of the overall solution by

controlling the transmission of information among modules,

solving feedback loops if they exist and advancing the time

step. These features provide great flexibility to build powerful

plant simulation models; (2) DENDROS (Fig. 2) is the event

scheduler that drives the dynamic generation and manage-

ment of the different event sequences resulting from a given

initiating event. It directs the simulation to perform the sys-

tematic traversal of all the possible branches, leading to

different sequences. DENDROS then identifies and manages

the branching points and, in certain cases, asks BABIECA to

open new simulation processes, one for each possible

outcome of the event (SIM in Fig. 2). The result is a dynamic

event tree (DET); (3) PLANTMODEL is a particular user-defined

combination of BABIECA modules able to simulate accident

sequences. The variety of plant models that can be configured

ranges from those using well accepted and validated external

codes (MAAP, TRACE) to those composed only with internal

BABIECA modules; (4) SIMPROC is a simulator of operating

procedures that interacts with BABIECA to implement the

operator actions requested by the procedures [10]. It is a spe-

cial case of BABIECA external module because of the particu-

larities of the interaction between plant and procedures.

These four SCAIS components implement the main dy-

namic modules as required by DET, also including those

allowing for the verification of procedures via automatic pilot

simulations. Other SCAIS components are the following. (5)

The PROBABILITY CALCULATOR (ET/FT/APET block in Fig. 1) is

actually a collection of methods and algorithms that provide

probabilistic quantifications. It may be optionally called on to

make estimates of the respective probabilities of the output

branches of a branching point and to use them for elimination

of some of these branches on the basis of low probability

termination criteria. Its major role is the computation of ex-

ceedance frequencies in coordination with the RISK ASSESS-

MENT module. (6) The PATH ANALYSIS MODULE (Fig. 1)

performs detailed analysis of individual event tree sequences

through the simulation of specific transients (paths) of the

analyzed sequence. In coordination with DENDROS, the PATH

ANALYSIS MODULE defines multiple simulation cases, i.e.,

sequence paths, by varying values of uncertain parameters

and/or time delays (human actions or stochastic phenomena).

The aim is to identify the sequence failure domain, given the

applicable configuration sequence success criteria. (7) The

SCAIS DATABASE is an SQL relational database (POSTGRES

SQL) used as a repository for input and output information.

Represented in the left- and right-hand side columns in Fig. 1,

it stores all the input data and results, allowing their easy

postprocessing. The information stored in the database can be

accessed off-line, making it possible to perform new analyses

on the existing data without repeating the simulations unless

necessary. (8) The RISK ASSESSMENT module, also shown in

Fig. 1, calculates the design barrier safety limit exceedance

frequency, i.e., the frequency of the failed state, by integrating

the TSD equations over the failure domain obtained from the

PATH ANALYSIS MODULE, and considering the frequency

density function obtained from the probability distributions

evaluated in the PROBABILITY CALCULATOR.

All main components of SCAIS, including the simulator

driver BABIECA and the event scheduler DENDROS, are

designed with object oriented architecture and implemented

in Cþþ language. In an attempt to make it platform

Fig. 1 e Simplified scheme of the ISA-TSD methodology. FT, transmission function; ISA, integrated safety assessment; PSA,

probabilistic safety assessment, TSD, theory of stimulated dynamics.

Nu c l e a r E n g i n e e r i n g a n d T e c h n o l o g y 4 9 ( 2 0 1 7 ) 2 9 5e3 0 5298

independent, the whole SCAIS has been developed by CSN in

collaborationwithNFQ Solutions using open source standards

(Linux, XercesC, libpqþþ).

Automatic generation of DETs is only possible with an

adequate coordination between BABIECA and DENDROS, and

sometimes, also coordinated with the PROBABILITY CALCU-

LATOR. Fig. 2 illustrates the branching procedure imple-

mented in SCAIS. For the sake of simplicity, only binary

branching points are represented; these are points where the

two output branches correspond to occurrence or not of an

event. The upper part of Fig. 2 represents the opening of new

Fig. 2 e Overall BABIECA-DENDROS-pr

simulation processes, whereas the lower part represents the

corresponding dynamic event tree resulting from this

procedure.

Branching criteria are represented by Pi (P1, P2, etc.) in Fig. 2.

These criteria correspond to stimulus activations; the

branching consists of simulating both the occurrence and the

nonoccurrence of the event. When DENDROS detects that a

branchingcriterionhasbeen reached, it initiates thebranching

procedure, which can possibly be delayed by a time d if so

specified in the branching rules: (1) DENDROS asks BABIECA to

generate a restart filewith the current status of the simulation;

obability calculator coordination.

Nu c l e a r E n g i n e e r i n g a n d T e c h n o l o g y 4 9 ( 2 0 1 7 ) 2 9 5e3 0 5 299

the existing simulation process continues with the “nominal”

option (occurrence or nonoccurrence of the event, depending

on the defined branching rules); and (2) DENDROS spawns a

new simulation process, i.e., another instance of BABIECA,

initializing the simulation model with the stored restart file

and forcing the “alternative” option of the branching point.

This procedure is recursively continued until every simulation

process meets some predefined termination criterion.

5. Recent activities. Summary of activities onthe deterministic side

5.1. ISA methods used for sequence delineation andquality of the set of design basis transients used in SARs(envelope issue)

PSA-DSA in the nuclear context is but another example of

optimization of adequate protections and its verification. The

main problem is to find envelopes of the evolution of damage

indicators in piecewise sequences of successive changes in

dynamics, (i.e., SOT), associated with protection actions. In

general, the problem focuses on ensuring that the envelopes

consider all the possible SOTs that may be involved in the

accident progression and then cover, for each sequence, un-

certainty in initial conditions and key data, as well as, most

importantly, boundary conditions and protective action

timing. These uncertainties easily explode the number of

situations to consider, so that brute force techniques based on

reproducing transients with best estimate simulations usually

fail at reaching completeness of the situations considered to

demonstrate the (umbrella) enveloping character.

Fig. 3 deploys the strategy followed in the Spanish nuclear

industry, as well as at CSN/modeling and simulation area

(MOSI), to ensure that all relevant situations are covered,

including the division in subproblems that accounts for the

accident progression (APET, [8]).

The SAR underground philosophy is consistent with that

shown in Fig. 3, but this approach uses the concept of “design

basis transients/accidents” in order to cover all automatic

action design situations. This implies the use of artificial

events distorted both in assumptions and models, so that the

timing of these analyses is also artificial. It is not simple to

make an equivalence with the sequence delineation because

of the different purpose. Any PSA invoking SARs should be

Fig. 3 e Strategy to ensure that all safe

aware that they provide no clue to answering important issues

such as the available times embedded in the success criteria.

Neither do they guarantee the sequence delineation, Stage 1,

which requires extensive PSA additional analysis, based on

safety functions, taking into account that out-of-design situ-

ations should also be considered, including operator actions.

Instead, the ISA-SCAIS verification method considers se-

quences as piecewise objects (1 piece for each interval be-

tween consecutive transitions) consisting of well identified

groups of transients covering all uncertainties explicitly,

including times of actions and dynamic model boundary

conditions as functions of time. The design domain is clearly

distinguished from the general risk domain.

References [7,8] detail tools and methods and provide

several examples describing the ISA-SCAIS V&V approach for

internal consistency of the deterministic analysis and the

verification of the sequence delineation, that is, Stage 1. The

method proposes the use of surrogate models to analyze the

sequences, models fed from the deterministic analysis. When

considering the deterministiceprobabilistic consistency of

Stages 2 and 3, the approach ends up in the generation of a

SCAIS database with an adequate, best estimate set of repre-

sentative transients and the corresponding identification of

dynamic surrogate models. These surrogate models consis-

tently carry the deterministic connection while allowing for

fast simulation of a myriad of transients, each stimulus vari-

able having a different surrogate model that projects the in-

fluence of the rest of the system.

5.2. Verification of emergency operating procedures andsevere accident management guidelines

When verification of an emergency procedure (EOP) for sce-

narios without coremelt is the issue, simulations are runwith

an automatic pilot version of the procedures, as realistically as

possible, using the procedure simulator SIMPROC [10] coupled

to the automatic event tree SCAIS simulator. Timing to take

the actions is predetermined using information from best

practices and as operator crew task action studies indicate.

The objectives of the procedure should be met and success

relative to any of the safety limits should be assured. If this is

not the case, the procedure is questioned at specific points.

Examples are given in [11]. These examples are part of the

automatic sequence delineation verification of Stage 1.

Concerning severe accident management guidelines

(SAMGS), asapostFukushimastartingactivity,MOSIengaged in

ty relevant situations are covered.

Nu c l e a r E n g i n e e r i n g a n d T e c h n o l o g y 4 9 ( 2 0 1 7 ) 2 9 5e3 0 5300

methods to obtain useful insight into severe accident scenarios

typifiedbyblackouts (SBO).Asapreliminary exercise, theSCAIS

platform, using itsMAAP systemmodule,wasused to analyze a

sequence initiated by loss of both off-site and on-site AC power

[emergency diesel generators (EDG)] in a three loop Pressurized

WaterReactorWestinghousedesign (see [12]). Theset ofactions

is depicted in Fig. 4, which identifies the EOPs and SAMGs

involved. Five damage indicators have been considered in the

analysis:(1) core uncover; (2) core exit temperature

(CET > 648.86�C); (3) peak cladding temperature

(PCT > 1203.85�C); (4) fuel relocation into lower plenum; and (5)

reactor pressure vessel (RPV) failure.

Fig. 5 shows the damage domains for the same sequence

obtained when considering the uncertain times of failure of

the continuous, and of recovery of the alternate, current

electric supply. A total of 900 simulations were run, each

providing information on one of the (uncertain) time combi-

nation points in Fig. 5.

6. Recent activities. Summary ofdevelopments and applications in classicalprobabilistic issues

6.1. Incident analysis

CSN/MOSI has direct responsibility in executing CSN incident

analysis on a routine basis using a customized, classical FT/ET

method in order to rank incident severity and to classify in-

cidents as precursors of more severe situations.

Fig. 4 e Main operator actions taken into account in SBO seque

Station Black Out; AC, Alternate Current; CC, Direct Current; SA

Auxiliary Feed Water; LPSI, Low Pressure Safety Injection; HPS

Precursor analyses [13] are performed in the framework of

the Incident Revision Panel (IRP). The IRP is a cross-

disciplinary group that discusses, reviews, and classifies

every incident reported by the Spanish Nuclear Power Plants

(NPPs) to CSN. Within this group, precursor analyses are

requested to obtain a measure of the risk impact associated

with an incident and to obtain a probabilistic criterion as an

input to the classification. An incident with a risk measure

[conditional core damage probability (CCDP)] > 10�6 is a pre-

cursor; an incident with a CCDP > 10�5 is a significant pre-

cursor, and is then classified as a significant event. Insights

from precursor analyses are discussed within this group.

This area of precursor activity has evolved in scope over

the years (also covering significance determination of in-

spection findings), as has MOSI involvement as more PSA

models have become available. Some overall results are pre-

sented in Figs. 6 and 7.

6.2. Probabilistic consistency across different plants.Verifying classical FT quantifications

The accumulated MOSI experience in FT/ET quantification of

Spanish plants with industry PSA models includes use of, and

knowledge regarding, different computational platforms

(substantially Risk Spectrum and CAFTA), and different

modeling cultures at the different plants. As exemplified in

the cases of precursors and significance determination of in-

spection findings, intercomparison between results in

different contexts is essential to better understand the risk

profiles of plants. However, sometimes doubts appear

nces with seal LOCA. (CET, Core Exit Temperature; SBO,

G, Severe Accident Guideline; SG, Steam Generator; AFW,

I, High Pressure Safety Injection).

Fig. 5 e Comparison between damage domains with slow and fast cooling. SAMG, Severe Accident Management Guideline;

EOP, Emergency Operating Procedures.

Nu c l e a r E n g i n e e r i n g a n d T e c h n o l o g y 4 9 ( 2 0 1 7 ) 2 9 5e3 0 5 301

regarding whether or not the same problem will yield similar

results in different environments. In view of this, MOSI, in

cooperation with the CSN PSA licensing branch, initiated an

important harmonization activity. It was based on the use of

tools (where they existed, and on internal development where

they did not), to translate different modeling formats into a

unified XML language (open PSA initiative) [14]. Additionally,

tools were also used/developed to translate the unified XML

input files back into either computing environment. In addi-

tion, research projects were launched to verify the efficiency

of the computations by comparison with alternate ET/FT

1E-09

1E-08

1E-07

1E-06

1E-05

1E-04

1E-03

1E-02

1E-01

1E+00

1 4 7 10 13 16 19 22 25 28 31 34 3

Con

ditio

nal p

roba

bilit

y

Incide

Fig. 6 e Results of pre

approaches. Among these approaches, binary decision dia-

grams (BDD) constitute a popular alternative; one of the pro-

jects [15] used them for this purpose.

Furthermore, as regulators, CSN staff members need in-

dependent views of licensee models, which calls for in-house

made models. This harmonization activity also needs to ab-

stract different modeling techniques and diverse hypotheses

that are not intrinsic to and therefore not part of the risk

profile. In view of this and within the framework of these

harmonization activities, CSN has initiated also a standardi-

zation activity to bring together PSA hypotheses andmodeling

7 40 43 46 49 52 55 58 61 64 67 70 73 76 79nt no

cursor analysis.

0

5

10

15

20

25

30

CCDP<1E-6 1E-6<CCDP<1E-5 1E-5<CCDP<1E-4 1E-4<CCDP<1E-3 1E-3<CCDP<1E-2 1E-2<CCDP

No.

of i

ncid

ents

CCDP interval

Fig. 7 e Precursor distribution. CCDP, conditional core damage probability.

Nu c l e a r E n g i n e e r i n g a n d T e c h n o l o g y 4 9 ( 2 0 1 7 ) 2 9 5e3 0 5302

techniques from different Spanish NPP PSAmodels. The SPAR

(standardized plants analysis risk) concept, taken from the

approach followed by United States Nuclear Regulatory

Commission (USNRC) in its regulatory system, is being studied

and analyzed by CSN in collaboration with UPM, with the aim

of attaining a standard modeling framework and overcoming

the problems and drawbacks that have appeared in the

application of Integrated Nuclear Power Plant Supervision

System (SISC) during these past years. The strategy followed is

based on a comparison of current PSAs of similar Spanish

NPPs; it is implemented in order to collect, identify, and agree

on which characteristics, hypothesis, and modeling

Simulatepath

GeneratesequenceUser

Sequence Problem data

System configuration

Sequence data

Command

Systems configuration

Sequenc

Sequence d

Problem data

Path and param

Sequence data= paths, stimulus, parameters, and probabilityPath data= stimulus, parameters, and probability

Fig. 8 e Structural block diagram

approaches (both at the ET and the FT levels) are most

adequate and convenient for SISC purposes, and to propose a

standard for in-house modeling (see [16]).

7. Other current developments

7.1. ISA-TSD off-line prototype

The ISA-TSD framework has a deterministic aspect, i.e.,

finding the damage (failure) domains, and a probabilistic one,

i.e., finding its frequency. The SCAIS transient simulation

Calculateprobability

Analysepath

Generateparameters

Analysesequence

Analysepaths

e

Sequence

ata

Path

Path

Path

Parameters

Path data

eters

Probability

Stimulus andtransition rate

Path stimulus,transition rateand parameters

of the off-line TSD prototype.

sT1

S3S2 Sn

sT2 sT3 sTn-1 sTn

T2 T3 Tn-1 TnT1

S1

T1 T2 T3 Tnt

t=0

Interval 1 Interval 2 Interval 3

Output j

System

Input i

Time variables

Laplace variables

Fig. 9 e TFT þ TSD approach. TFT, transmission functions theory; TSD, theory of stimulated dynamics.

Nu c l e a r E n g i n e e r i n g a n d T e c h n o l o g y 4 9 ( 2 0 1 7 ) 2 9 5e3 0 5 303

techniques described above do not include any strategy to

optimize the branching approach of the DET to minimize the

number of runs needed to identify the so-called damage do-

mains, defined as the locus of failed transients and differing

only in terms of specified features characteristic of the un-

certainty problem. ISA-TSD extends the classical uncertainty

methods (which mostly refer to parameters) to uncertainty of

the timing of events, including envelopes of initial conditions,

and the boundary condition uncertainty.

Fig. 8 shows the structure of a first off-line TSD prototype

implementing the search of damage/failure domains and the

computation of the exceedance frequency. With this proto-

type, each research item can be tested off-line before its

integration into SCAIS, which is then used as a developmental

tool for testing ISA/SCAIS improvements. To show the unified

character of the tools, prototype performance has been used

under some challenging situations, such as the impact on the

containment of an inflow of hydrogen and steam as a PSA2

subproblem, resulting from a severe accident medium size

Loss of Coolant Accident (LOCA), and in a completely different

case consisting of a plant transient analysis (SAR type) in an

experimental facility.

It is easy to distinguish, in Fig. 8, circles dealing with single

transients (paths) from those related to the overall strategy,

i.e., selection of paths and identification of failure domains.

Several search methods have been proposed and tested.

Concerning transient treatment, the “simulate path” action

shown in Fig. 8 is performed with the help of models suitable

for finding reasonable envelopes (adequate models). These

models may be found in many ways (from Best Estimate (BE)

to simplified or parametric models).

7.2. Transmission functions theory and TSD approach

The ISA TSD method requires adequate dynamic models that

are able to find reasonable envelopes for any subproblem

describing accident progression phases in different areas of

the plant. However, best estimate codes are too large and

complex to be used directly, and finding adequate models for

each subproblem is hard, and the resulting models are diffi-

cult to validate, especially when considering the widely

different phenomena involved in the various subproblems.

CSN-MOSI is working on a new approach to tackle this

problem.

p�j!; T!

; t�≡ qj1 j0 ðT1; 0Þ$ qj1 j2 ðT2;T1Þ|fflfflfflfflfflfflfflffl{zfflfflfflfflfflfflfflffl}

A factor q for eachinterval betweenevents

…qjnjn�1ðTn;Tn�1Þ$ e

�Z t

Tn

dzXksj

pj/k zð Þ

|fflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflffl{zfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflffl}A term of finalsurvival

; where qjkðt;TÞ ¼ pk/j tð Þ|fflfflfflffl{zfflfflfflffl}Occurrenceof event at t

$ e

�Z t

T

Xlsj

pk/l zð Þdz

|fflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflffl{zfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflffl}Internal survival

(1)

Nu c l e a r E n g i n e e r i n g a n d T e c h n o l o g y 4 9 ( 2 0 1 7 ) 2 9 5e3 0 5304

As the safety variables of interest are not that numerous,

the idea is to use the BE multi-process-variable codes to

identify and feed envelope surrogate dynamic, models that

are adequate to project and envelope the BE result on any

preselected single process-variable. The single process vari-

able surrogate models are dynamic models based on piece-

wise linear approximations; these models have the same

mathematical structure in all cases. Very fast and efficient

algorithms allow the running of the very many transients

required to construct the timing and boundary condition en-

velopes. The basis for the dynamic surrogate models is

transmission functions theory (TFT) ([8,17]). Fig. 9 and Eq. (1)

depict the approach schematically.

7.3. ISA road map development

Some research objectives that are foreseen within ISA-TSD-

SCAIS development are the following: (1) future activities

will continue to consolidate, optimize, and gain more experi-

ence in the specific approach followed, including imple-

mentation of regular PSA quantification methods and tools

within SCAIS computer platform. The aim is to implement

current NPP Fault Trees models and generation of CSN stan-

dardized PSA models (such as the USNRC SPAR models) of

Spanish plants that may be quality graded; (2) different

research aspects devoted to improving and optimizing the use

of dynamic surrogate models based on TFT within ISA-TSD

methodology. Some examples are the following: explore the

definition of several useful figures of merit to synthesize re-

sults of PSA dynamic assessments; e.g., header-importance

indices that characterize header dynamic efficiency (i.e., the

actual protective or degrading function of the header); devel-

opment of transmission function (FT) identification tech-

niques based on database (BE code or experimental results);

application to estimates of source terms in PSA2, in a manner

similar to that in which the USNRC representative PSA2 study

[18] estimates the uncertainty bands for the release of the

most important families of radio-nuclides; (3) within themore

general integrated deterministic probabilistic safety assess-

ment (IDPSA) techniques being developed worldwide [3, 4],

some research activities have been foreseen: equip SCAISwith

adequate data mining and classification techniques [19],

which would help to establish lossless extraction and

condensation of useful information amenable to expert eval-

uation. Here again TFT could play a relevant role; and (4)

further applications of the method [12,20e23] are still

required. In particular, the ISA/SCAIS approach has inter-

esting and direct applicability to the verification of SAMGs and

EDMGs [12,24].

8. Conclusion

Quantitative V&V activities at regulatory bodies are comple-

mentary of their qualitative reviews, and are essential in view

of the ubiquity of computerized analysis included in the in-

dustry safety cases. Among the many issues involved, con-

sistency checks are of primary importance. They require

specific developments of independent tools and methods.

In particular, these checks should be performedwhen they

refer to issues of probabilistic versus deterministic aspects

that involve very difficult problems, so as to verify the success

criteria and to discriminate when those criteria should be

consistently modified in PSA applications. For instance,

relaxation of OTS (operating technical specifications), justified

on the basis of FT/ET computations, should not be accepted

without ensuring first that the FT/ET success criteria do not

require consistent modification.

Part of the efforts made at CSN to develop diagnostic tools

and methods for this purpose were briefly described, focusing

on the success criteria and internal consistency of the prob-

abilistic side. This helps a great deal in technically objective

regulatory decision-making because consistency of probabi-

listic and deterministic aspects can be better addressed.

This document has elaborated on: (1) the steps taken in the

development of the integrated safety assessment (ISA)

methodology and its associated software package (SCAIS); (2)

recent applications of methods and tools that illustrate its

potential to verify the consistency of deterministic and prob-

abilistic licensing safety cases; and (3) further areas of devel-

opment that are foreseen.

Conflicts of interest

The authors have no conflicts of interest to declare.

r e f e r e n c e s

[1] ASME, Standard for Probabilistic Risk Assessment forNuclear Power Plant Applications, ASME RA-S-2005, 2005.USA.

[2] USNRC, Regulatory Guide 1.70, Standard Format and Contentof Safety Analysis Reports for Nuclear Power Plants,November 1978. USA. AAN: ML011340072.

[3] T. Aldemir, A survey of dynamic methodologies forprobabilistic safety assessment of nuclear power plants,Ann. Nucl. Energy 52 (2013) 113e124.

[4] E. Zio, Integrated deterministic and probabilistic safetyassessment: concepts, challenges, research directions, Nucl.Eng. Des. 280 (2014) 413e419.

Nu c l e a r E n g i n e e r i n g a n d T e c h n o l o g y 4 9 ( 2 0 1 7 ) 2 9 5e3 0 5 305

[5] Tunc Aldemir (Ed.), Advanced Concepts in Nuclear EnergyRisk Assessment and Management, World ScientificPublishing Company Pte. Ltd, Singapore, 2017.

[6] J.M. Izquierdo, I. Ca~nam�on, TSD, a SCAIS Suitable Variant ofthe SDTPD. Presented at ESREL-2008 and 17th SRA EuropeAnnual Conference, Valencia (Spain), Sep 2008.

[7] J.M. Izquierdo, J. Hortal, M. S�anchez-Perea, E. Mel�endez, CSNExperience in the Development and Application of aComputer Platform to Verify Consistency of Deterministicand Probabilistic Licensing Safety Cases [Internet]. Vol I.General Approach and Deterministic Developments; CSNpublication, Colecci�on Otros Documentos, 40.2016 [citedMarch 2017]. Available from: https://www.csn.es/documents/10182/1012054/ODE-04.22þCSNþExperienceþinþtheþDevelopmentþandþApplicationþofþaþComputerþPlatformþtoþVerifyþConsistencyþofþDeterministicþandþProbabilisticþLicensingþSafetyþCasesþVolumeþI.þGeneralþApproachþandþDeterministicþDevelopments.

[8] J.M. Izquierdo, J. Hortal, M. S�anchez-Perea, E. Mel�endez, Whysequence dynamics matters in PSA: checking consistency ofprobabilistic and deterministic analyses, in: T. Aldemir (Ed.),Advanced Concepts in Nuclear Energy Risk Assessment andManagement, World Scientific Publishing Company Pte. Ltd,Singapore, 2017 (in press).

[9] R.H. Santos, A Standardized Methodology for the Linkage ofComputer Codes, Application to RELAP5/Mod3.2. NUREG/IA-0179, Office of Nuclear Regulatory Research, USNRC, USA,March 2000.

[10] J. Gil, I. Fern�andez, S. Murcia, J. Gomez, H. Marr~ao, C. Queral,A. Exp�osito, G. Rodrıguez, L. Iba~nez, J. Hortal, J.M. Izquierdo,M. S�anchez, E. Mel�endez, A code for simulation of humanfailure events in nuclear power plants: SIMPROC, Nucl. Eng.and Des. 241 (2011) 1097e1107.

[11] J.M. Izquierdo, J. Hortal, M. S�anchez-Perea, E. Mel�endez. AnIntegrated PSA Approach to Independent RegulatoryEvaluations of Nuclear Safety Assessments of SpanishNuclear Power Stations [Internet]. CSN publication,Colecci�on Otros Documentos, 28.2002 [cited March 2017].Available from: https://www.csn.es/images/stories/english/publications/ode-04_18_psa.pdf.

[12] C. Queral, L. Mena-Rosell, G. Jimenez, M. Sanchez-Perea,J. Gomez-Magan, J. Hortal, Verification of SAMGs in SBOsequences with Seal LOCA. Multiple damage domains, Ann.Nucl. Energy 98 (2016) 90e111.

[13] E. Mel�endez, R. Mu~noz-G�omez, CSN activities in precursoranalysis. NEA/CSNI/R(2003)11, in: Proceedings of the

Workshop on Precursor Analysis, 28e30 March, 2001 at theAssociation Vincotte Nuclear (AVN), 2001. Brussels, Belgium.

[14] E. Mel�endez, R. Herrero, Use of PSA model XML StandardFormats for V&V. Presented at the 2015 International TopicalMeeting on Probabilistic Safety Assessment and Analysis(PSA2015), Sun Valley (Idaho), Apr 26e30, 2015.

[15] C. Ib�a~nez-Llano, A. Rauzy, E. Mel�endez, F. Nieto, Hybridapproach for the assessment of PSA models by means ofbinary decision diagrams, Reliab. Eng. Syst. Safe 95 (2010)1076e1092, http://dx.doi.org/10.1016/j.ress.2010.04.016.

[16] E. Mel�endez, M. S�anchez-Perea, C. Queral, J. Mula, A.Hern�andez, C. Parıs. Standardized Probabilistic SafetyAssessment Models: First Results and Conclusions of aFeasibility Study. Presented at the 13th InternationalConference on Probabilistic Safety Assessment andManagement (PSAM 13), Seoul, Korea, 2e7 Oct, 2016.

[17] S.E. Galushin, J.M. Izquierdo, M. S�anchez-Perea,Transmission Functions and its application to the analysis oftime uncertainties in Protection Engineering, Process Saf.Environ. Protect. 92 (2014) 625e636, http://dx.doi.org/10.1016/j.psep.2013.07.004.

[18] United States Nuclear Regulatory Commission, SevereAccident Risks. An Assessment for Five US Nuclear PowerPlants, NUREG 1150, 1989.

[19] D. Mandelli, A. Yilmaz, T. Aldemir, K. Metzroth, R. Denning,Scenario clustering and dynamic probabilistic riskassessment, Reliab. Eng. Syst. Safe. 115 (2013) 146e160.

[20] L. Ib�a~nez, J. Hortal, C. Queral, J. G�omez-Mag�an, M. S�anchez-Perea, I. Fern�andez, E. Mel�endez, A. Exp�osito, J.M. Izquierdo,J. Gil, H. Marrao, E. Villalba-Jabonero, Application of theintegrated safety assessment methodology to safetymargins. Dynamic event trees, damage domains and riskassessment, Reliab. Eng. Syst. Safe. 147 (2016) 170e193.

[21] J. Montero-Mayorga, C. Queral, J. Rivas-Lewicky, J. Gonz�alez-Cadelo, Effects of RCP trip when recovering HPSI during LOCAin a Westinghouse PWR, Nucl. Eng. Des. 280 (2014) 389e403.

[22] M.J. Rebollo, C. Queral, G. Jimenez, J. Gomez-Magan,E. Mel�endez, M. Sanchez-Perea, Evaluation of the offsite dosecontribution to the global risk in a Steam Generator TubeRupture scenario, Reliab. Eng. Syst. Safe. 147 (2016) 32e48.

[23] A. Flores, J.M. Izquierdo, K. Tu�cek, E. Gallego, Assessment ofdamage domains of the High-Temperature Engineering TestReactor (HTTR), Ann. Nucl. Energy 72 (2014) 242e256.

[24] Nuclear Energy Agency, Informing Severe AccidentManagement Guidance and Actions through AnalyticalSimulations, Report of the Working Group on Analysis andManagement of Accidents, Paris, France, 2017 (in press).