IAEA Training in level 1 PSA and PSA applications
Basic Level 1. PSA course for analysts
Accident Sequence modelling
Accident Sequence modelling
Content
z Event tree modelling
z Special aspects of scenario development
z Operator actions in the accident sequence
z Treatment of dependencies in the accident
sequence
z Experience from reviews
Slide 2.
Accident Sequence modelling
Event Trees
z
z
DISPLAY SEQUENCE PROGRESSION
z
z
DISPLAY SEQUENCE END STATES
z
z
DISPLAY
-SPECIFIC DEPENDENCIES
DISPLAY SEQUENCE
SEQUENCE-SPECIFIC
DEPENDENCIES
„
„ PHYSICAL (SYSTEMS)
„
„ FUNCTIONAL (SUCCESS CRITERIA)
„
„ HUMAN
z
z
IMPROVED UNDERSTANDING OF MODELS
„
„ ANALYSTS / USERS
„
„ PLANT PERSONNEL
„
„ REVIEWERS
Slide 3.
Accident Sequence modelling
TRANSIENT-INDUCED IMPACTS
z
z
LOCAs
„
„ PRIMARY OVERPRESSURE
„
„ REACTOR COOLANT PUMP SEAL FAILURE
„
„ MAKEUP / LETDOWN
z
z
OVERCOOLING
„
„ SECONDARY OVERPRESSURE
„
-OPEN RELIEF / SAFETY VALVES
„ STUCK
STUCK-OPEN
z
z
ATWS
z
z
OPERATOR ACTIONS
Slide 4.
Accident Sequence modelling
TRANSIENT-INDUCED LOCAs
z
z
ADD TO LOCA INITIATING EVENT FREQUENCY
„
„ LOSE ACTUAL INITIATING EVENT INFORMATION
„
„ LOSE DEPENDENCIES
„
„ SIMPLIFIED EVENT TREES
„
„ SIMPLIFIED SYSTEM MODELS
z
z
ADD SEPARATE EVENT TREE TOP EVENT
„
„ RETAIN DEPENDENCIES
„
„ EVENT TREES MORE COMPLEX
„
„ INTERFACE WITH SYSTEMS MORE COMPLEX
„
„ BETTER UNDERSTANDING OF MODELS / RESULTS
Slide 5.
Accident Sequence modelling
OVERCOOLING SCENARIOS
z
z
PRESSURIZED THERMAL SHOCK (PTS)
„
-SPECIFIC PROBLEM
„ MAY BE SIGNIFICANT PLANT
PLANT-SPECIFIC
„
„ WELD MATERIAL
„
„ DOCUMENTATION
„
„ INSPECTIONS
z
z
AUTOMATIC SIGNALS
„
„ SECONDARY ISOLATION (STEAM AND/OR FEED)
„
„ SAFEGUARDS ACTUATION
„
„ AFFECT SEQUENCE PROGRESSION
„
„ AFFECT AVAILABLE SYSTEMS
Slide 6.
Accident Sequence modelling
ATWS SCENARIOS
z
z
REACTOR SHUTDOWN SUCCESS CRITERIA
z
z
SIGNAL FAILURES (REACTOR PROTECTION SYSTEM)
z
z
MECHANICAL FAILURES (CONTROL RODS)
z
z
ALTERNATE SHUTDOWN OPTIONS
„
„ TIME WINDOW
„
„ SUCCESS CRITERIA
„
„ AVAILABLE SYSTEMS
„
„ OPERATOR ACTIONS
Slide 7.
Accident Sequence modelling
ATWS MODELS
z
z
CORE NUCLEAR POWER
z
z
PRIMARY / SECONDARY ENERGY BALANCE
z
z
FEEDWATER SUCCESS CRITERIA
z
z
PRIMARY PRESSURE RESPONSE
z
z
ENERGY RELEASE INTO CONTAINMENT
Slide 8.
Accident Sequence modelling
OPERATOR ACTIONS AFTER INITIATING EVENT
z
z
ACTIONS REQUIRED BY EMERGENCY OPERATING PROCEDURES
z
z
USE OF ALTERNATE EQUIPMENT
z
z
REALIGNMENT OF SYSTEMS
z
z
MANUAL BACKUP TO AUTOMATIC SIGNALS
z
z
REPAIR / RECOVERY OF FAILED EQUIPMENT
z
z
NO FUNDAMENTAL DIFFERENCE BETWEEN
PROCEDUREBETWEEN ““PROCEDUREDIRECTED
RECOVERY” ACTIONS
DIRECTED”” ACTIONS AND ““RECOVERY”
Slide 9.
Accident Sequence modelling
MODELLING PROCESS
z
z
DEFINE THE ACTION
z
z
ADD THE ACTION TO THE PSA LOGIC MODELS
z
z
EVALUATE THE LIKELIHOOD OF HUMAN ERROR
Slide 10.
Accident Sequence modelling
DEFINE THE ACTION
z
z
SUCCESS CRITERIA
z
z
BOUNDARY CONDITIONS
z
z
TIMING
Slide 11.
Accident Sequence modelling
SUCCESS CRITERIA
z
z
WHAT IS THE OPERATOR REQUIRED TO DO?
z
z
HOW MANY OPERATORS ARE REQUIRED?
z
z
WHAT LEVEL OF OPERATOR SKILL OR TRAINING IS
REQUIRED?
z
z
WHERE MUST THE ACTION BE PERFORMED?
Slide 12.
Accident Sequence modelling
BOUNDARY CONDITIONS
z
z
WHAT IS THE INITIATING EVENT?
z
z
WHAT PRECEDING SYSTEM FAILURES (OR
SUCCESSES) HAVE OCCURRED?
z
z
WHAT PRECEDING OPERATOR ACTIONS HAVE
OCCURRED?
Slide 13.
Accident Sequence modelling
TIMING
z
z
WHEN IS THE ACTION REQUIRED?
z
z
HOW MUCH TIME IS AVAILABLE TO COMPLETE THE
ACTION?
z
z
HOW LONG DOES IT TAKE TO COMPLETE THE ACTION?
Slide 14.
Accident Sequence modelling
GENERAL RECOMMENDATIONS
z
z
EVALUATE EACH ACTION IN CONTEXT OF FUNCTIONALLY SIMILAR
SCENARIOS
„
„ INITIATING EVENT
„
„ TIME WINDOW FOR OPERATOR RESPONSE
„
„ PRECEDING SYSTEM SUCCESSES AND FAILURES
„
„ PRECEDING OPERATOR SUCCESSES AND FAILURES
„
„ PROCEDURAL GUIDANCE AND TRAINING
z
z
BEWARE OF INDEPENDENT COMBINATIONS OF OPERATOR
ACTIONS IN EVENT TREES AND/OR FAULT TREES
Slide 15.
Accident Sequence modelling
PROBLEM DEFINITION
z
z
DEFINE SCOPE AND CONTEXT OF OPERATOR ACTIONS
DURING EARLY DEVELOPMENT OF PSA MODELS
z
z
INITIATING EVENT GROUPS
z
z
FUNCTION AND SYSTEM SUCCESS CRITERIA
z
z
IDENTIFY WHERE OPERATORS MUST CONTROL
FUNCTIONS AND SYSTEMS
z
z
BE AWARE OF PSA SCOPE (LEVEL 1 / LEVEL 2)
Slide 16.
Accident Sequence modelling
PROBLEM DEFINITION
z
z
SPECIFY OPERATOR ACTIONS IN TERMS OF HIGH
HIGH-LEVEL FUNCTIONAL DESCRIPTIONS
„
„ START BLEED AND FEED COOLING (PWR)
„
„ DEPRESSURIZE REACTOR (BWR)
„
„ ALIGN HIGH PRESSURE RECIRCULATION (PWR/BWR)
„
„ OPEN CONTAINMENT VENT (LEVEL 2)
z
z
DETAILED ACTIONS DETERMINED BY CONTEXT OF PSA
MODELS
Slide 17.
Accident Sequence modelling
BREAKDOWN AND IMPACT ASSESSMENT
z
z
DETERMINE HOW PROCEDURES DIRECT OPERATOR
RESPONSE
„
-BASED VS. EVENT
-BASED PROCEDURES
„ SYMPTOM
SYMPTOM-BASED
EVENT-BASED
„
„ OPTIONS DEPEND ON PLANT STATUS
z
z
DETERMINE HOW OPERATOR RESPONSE AFFECTS
EVENT PROGRESSION
„
„ SUCCESSFUL PERFORMANCE OF PROCEDURAL
GUIDANCE
„
„ FAILURE TO PERFORM PROCEDURAL GUIDANCE
„
„ POSSIBLE ALTERNATE ACTIONS
Slide 18.
Accident Sequence modelling
BREAKDOWN AND IMPACT ASSESSMENT
z
z
IDENTIFY SPECIFIC ACTIONS THAT MAY HAVE A
SIGNIFICANT IMPACT ON PLANT STATUS AND EVENT
PROGRESSION
z
z
UNDERSTAND HOW MONITORED PARAMETERS AND
ALARMS CHANGE WITH PLANT STATUS AND TIME
z
z
IDENTIFY CONDITIONS THAT ARE NOT CONSISTENT
WITH NORMAL PROCEDURAL ASSUMPTIONS
„
„ INITIATING EVENT
„
„ EQUIPMENT FAILURES
„
„ PRECEDING ERRORS
Slide 19.
Accident Sequence modelling
PSA MODEL INTEGRATION
z
z
OPERATOR ACTIONS MUST ACCOUNT FOR SCENARIO
SCENARIO-SPECIFIC DEPENDENCIES
„
„ TIME WINDOW FOR RESPONSE
„
„ HARDWARE AVAILABILITY
„
„ PRIOR OPERATOR ACTIONS
z
z
IDENTIFY POTENTIAL COGNITIVE DEPENDENCIES
BETWEEN MULTIPLE ACTIONS WITHIN A SCENARIO
Slide 20.
Accident Sequence modelling
DEFINITION OF OPERATOR ACTION FOR PSA
QUANTIFICATION
z
z
IDENTIFY SPECIFIC APPLICABLE SCENARIOS
„
„ INITIATING EVENTS
„
„ FUNCTIONAL SCENARIO PROGRESSION
„
„ HARDWARE AVAILABILITY
z
z
TIME WINDOW FOR RESPONSE
z
z
CUE
-RESPONSE STRUCTURE
CUE-RESPONSE
z
z
PROCEDURE DIRECTIONS
z
z
DEPENDENCIES WITH OTHER ACTIONS
Slide 21.
Accident Sequence modelling
HUMAN ACTION DEPENDENCIES
z
z
COGNITIVE DEPENDENCIES
„
„ COMMON AREAS - MULTIPLE ACTIONS INITIATED BY
A SINGLE CUE
„
„ COMMON GOALS - MULTIPLE POSSIBLE ACTIONS TO
ACHIEVE THE SAME FUNCTION
„
„ COMMON TRAINING AND EXPERIENCE
z
z
TIME AVAILABILITY
„
„ SEQUENTIAL OR COORDINATED ACTIONS LIMITED
BY TIME
„
„ PARALLEL ACTIONS LIMITED BY MANPOWER
Slide 22.
Accident Sequence modelling
EXAMPLE:
TWO MANUALLY-INITIATED FUNCTIONS
z
z
CORE DAMAGE OCCURS ONLY IF BOTH FUNCTIONS FAIL
z
z
FUNCTION A: HARDWARE A (HDWA) + OPERATOR ACTION A (OPA)
z
z
FUNCTION B: HARDWARE B (HDWB) + OPERATOR ACTION B (OPB)
z
z
FUNCTION
PREFERRED”, FUNCTION B ““ALTERNATE”
ALTERNATE”
FUNCTION A
A ““PREFERRED”,
z
z
NOMINAL VALUES:
HDWA
HDWB
OPA
OPB
=
=
=
=
5.0E
-04
5.0E-04
2.0E
-03
2.0E-03
1.0E
-03
1.0E-03
1.0E
-02
1.0E-02
Slide 23.
Accident Sequence modelling
EXAMPLE:
ASSUMED COMPLETE INDEPENDENCE (GENERALLY
INCORRECT)
z
z
FOUR INDEPENDENT CUTSETS:
HDWA * HDWB
HDWA * OPB
OPA * HDWB
OPA * OPB
z
z
=
=
=
=
1.0E
-06
1.0E-06
5.0E
-06
5.0E-06
2.0E
-06
2.0E-06
1.0E
-05
1.0E-05
CORE DAMAGE FREQUENCY:
1.8E
-05
1.8E-05
Slide 24.
Accident Sequence modelling
EXAMPLE:
COMPLETE DEPENDENCE (POSSIBLE FOR SOME SCENARIOS)
z
z
IF OPERATORS FAIL TO PERFORM ““PREFERRED”
PREFERRED”
ACTION OPA, THEY WILL ALWAYS FAIL TO PERFORM
““ALTERNATE”
ALTERNATE” ACTION OPB
z
z
ONE FUNCTIONAL ACTION: OPA = OPB = OP
z
z
TWO CUTSETS:
HDWA * HDWB
OP
z
z
=
=
1.0E
-06
1.0E-06
1.0E
-03
1.0E-03
CORE DAMAGE FREQUENCY:
1.0E
-03
1.0E-03
Slide 25.
Accident Sequence modelling
EXAMPLE:
PARTIAL DEPENDENCE (MOST TYPICAL CASE)
z
z
IF OPERATORS FAIL TO PERFORM ““PREFERRED”
PREFERRED”
ACTION OPA, IT IS MORE LIKELY THAT THEY WILL ALSO
FAIL TO PERFORM ““ALTERNATE”
ALTERNATE” ACTION OPB
z
z
THREE FUNCTIONAL ACTIONS:
OPA (NOMINAL ACTION)
OPB1 (AFTER SUCCESS OF OPA)
OPB2 (AFTER FAILURE OF OPA)
1.0E
-03
1.0E-03
5.0E
-03
5.0E-03
1.0E
-01
1.0E-01
Slide 26.
Accident Sequence modelling
EXAMPLE:
PARTIAL DEPENDENCE (MOST TYPICAL CASE)
z
z
FOUR CORRELATED CUTSETS:
HDWA * HDWB
HDWA * OPB1
OPA * HDWB
OPA * OPB2
z
z
=
=
=
=
CORE DAMAGE FREQUENCY:
1.0E
-06
1.0E-06
2.5E
-05
2.5E-05
2.0E
-06
2.0E-06
1.0E
-04
1.0E-04
1.1E
-04
1.1E-04
Slide 27.
Accident Sequence modelling
ADD THE ACTION TO THE PSA LOGIC MODELS
z
z
REVIEW EVENT TREES AND FAULT TREES TO IDENTIFY
DIFFERENT RESPONSE SCENARIOS
z
z
GROUP SCENARIOS ACCORDING TO SIMILAR EFFECTS
ON OPERATOR RESPONSE
z
z
DEFINE SEPARATE OPERATOR ACTIONS (TOP EVENTS,
SPLIT FRACTIONS, BASIC EVENTS) FOR EACH GROUP
OF SCENARIOS
z
z
AVOID DIRECT COMBINATION OF OPERATOR ACTIONS
WITH SYSTEM HARDWARE FAILURES
z
z
MODELS MUST ACCOUNT FOR DEPENDENCIES IN
SCENARIOS THAT INCLUDE MULTIPLE ACTIONS
Slide 28.
Accident Sequence modelling
ACTIONS IN FAULT TREES: EVENT TREE LOGIC
A
B
__________________________
|
|________
|_________________
|________
1
2
3
4
A = OPA + (1-OPA) * (HDWA)
B = OPB + (1-OPB) * (HDWB)
Slide 29.
Accident Sequence modelling
ACTIONS IN FAULT TREES: SEQUENCE RESULTS
SEQUENCE
1
CUTSET FORM
1 - (OPA + HDWA + OPB + HDWB)
2
OPB + HDWB
3
OPA + HDWA
4
(OPA)*(OPB) + (HDWA)*(OPB) +
(OPA)*(HDWB) + (HDWA)*(HDWB)
EXPANDED FORM
1 - OPA - (1-OPA)*(HDWA) - OPB - (1-OPB)*(HDWB) +
(OPA)*(OPB) + (OPA)*(1-OPB)*(HDWB) +
(1-OPA)*(HDWA)*(OPB) +
(1-OPA)*(HDWA)*(1-OPB)*(HDWB)
OPB + (1-OPB)*(HDWB) - (OPA)*(OPB) (1-OPA)*(HDWA)*(OPB) - (OPA)*(1-OPB)*(HDWB) (1-OPA)*(HDWA)*(1-OPB)*(HDWB)
OPA + (1-OPA)*(HDWA) - (OPA)*(OPB) (1-OPA)*(HDWA)*(OPB) - (OPA)*(1-OPB)*(HDWB) (1-OPA)*(HDWA)*(1-OPB)*(HDWB)
(OPA)*(OPB) + (1-OPA)*(HDWA)*(OPB) +
(OPA)*(1-OPB)*(HDWB) +
(1-OPA)*(HDWA)*(1-OPB)*(HDWB)
Slide 30.
Accident Sequence modelling
ACTIONS IN FAULT TREES
z
z
ADVANTAGES
„
„ SIMPLER EVENT TREES
z
z
DISADVANTAGES
„
„ MORE COMPLEX FAULT TREES
„
„ MORE DIFFICULT FOR ANALYSTS TO IDENTIFY SCENARIO
SCENARIO-SPECIFIC DEPENDENCIES
„
„ HOUSE EVENTS OR SPECIAL LOGIC TO DEFINE CONDITIONS
FOR CORRECT ACTIONS
z
z
GENERAL EXPERIENCE FROM REVIEWS
„
„ POOR TREATMENT OF OPERATOR ACTIONS
„
„ OPTIMISTIC QUANTIFICATION OF COMBINED ERRORS
Slide 31.
Accident Sequence modelling
ACTIONS IN EVENT TREES: EVENT TREE LOGIC
OPA
HDW A
OPB
HDW B
____________________________1_________________
|
|
|
| _______
|
|
| ________GF_______
|
| ________2_________________
|
|
| _______
|
| ________GF_______
| ________GF________3_________________
|
| _______
| ________GF_______
"GF"
1
2
3
4
5
6
7
8
9
DENOTES SYSTEM FAILURE IF OPERATOR ACTION
FAILS
Slide 32.
Accident Sequence modelling
ACTIONS IN EVENT TREES: SEQUENCE RESULTS
SEQUENCE
1
2
3
4
5
6
7
8
9
CUTSET FORM
1 - (OPA + HDWA + OPB1 + HDWB)
HDWB
OPB1
HDWA
HDWA * HDWB
HDWA * OPB2
OPA
OPA * HDWB
OPA * OPB3
EXPANDED FORM
(1 - OPA)*(1 - HDWA)*(1 - OPB1)*(1 - HDWB)
(1 - OPA)*(1 - HDWA)*(1 - OPB1)*(HDWB)
(1 - OPA)*(1 - HDWA)*(OPB1)
(1 - OPA)*(HDWA)*(1 - OPB2)*(1 - HDWB)
(1 - OPA)*(HDWA)*(1 - OPB2)*(HDWB)
(1 - OPA)*(HDWA)*(OPB2)
(OPA)*(1 - OPB3)*(1 - HDWB)
(OPA)*(1 - OPB3)*(HDWB)
(OPA)*(OPB3)
Slide 33.
Accident Sequence modelling
ACTIONS IN EVENT TREES
z
z
ADVANTAGES
„
„ SIMPLER FAULT TREES
„
„ EASIER FOR ANALYSTS TO IDENTIFY SCENARIO
SCENARIO-SPECIFIC DEPENDENCIES
z
z
DISADVANTAGES
„
„ MORE COMPLEX EVENT TREES
„
„ BRANCH POINT CONDITIONS TO DEFINE CORRECT
ACTIONS
z
z
GENERAL EXPERIENCE FROM REVIEWS
„
„ IMPROVED TREATMENT OF OPERATOR ACTIONS
„
„ REALISTIC QUANTIFICATION OF COMBINED ERRORS
Slide 34.
Accident Sequence modelling
EXPERIENCE FROM REVIEWS
z
z
POOR TREATMENT OF OPERATOR ACTION
DEPENDENCIES IS THE MOST IMPORTANT SOURCE OF
PROBLEMS IN HRA RESULTS
z
z
““CONSERVATIVE
CONSERVATIVE SCREENING ERROR RATES
RATES”” DO NOT
NECESSARILY SOLVE THE PROBLEM
z
z
CUTSET EDITING AND POST
-QUANTIFICATION ““FIXES”
FIXES”
POST-QUANTIFICATION
ARE OFTEN INCOMPLETE
z
z
CANNOT EXAMINE CUTSETS THAT ARE
OPTIMISTICALLY ELIMINATED BY NUMERICAL CUTOFF
VALUES
Slide 35.
Accident Sequence modelling
EXPERIENCE FROM REVIEWS
z
z
EXTREMELY DIFFICULT TO IDENTIFY DEPENDENCIES BY
EXAMINATION OF FAULT TREES
„
„ ACTIONS DISTRIBUTED AMONG SEVERAL TREES
„
„ NO INFORMATION ABOUT SEQUENCE PROGRESSION
z
z
DIFFICULT TO IDENTIFY DEPENDENCIES BY EXAMINATION OF
CUTSETS
„
„ FUNCTIONAL IMPACTS FROM SEQUENCE
„
„ TIME LIMITATIONS FROM SEQUENCE PROGRESSION
„
„ HUMAN COGNITIVE DEPENDENCIES
z
z
ANALYSTS RECOGNIZE AND CORRECTLY ACCOUNT FOR
DEPENDENCIES IF THEY ARE CLEARLY DISPLAYED
Slide 36.