Keywords

1 Introduction

The application of the concept of defense in depth is the primary means of preventing accidents in a nuclear power plant and mitigating the consequences of accidents if they do occur [1]. If an accident occurs at a nuclear power plant, to restore safety, two types of accident management guidance documents are typically used: EOP for preventing fuel rod degradation, and SAMG for mitigating significant fuel rod degradation when a severe accident is imminent [2]. And the relationship between different components of an Accident Management Programme (AMP) is illustrated in Fig. 1. Preventive accident management EOPs integrate actions and measures needed to prevent or delay severe damage to the reactor core. Mitigatory accident management SAMGs refers to those actions or measures which become necessary if the preventive measures fail and severe core damage occurs or is likely to occur [3].

Fig. 1.
figure 1

Relationship between EOPs and SAMGs

Full size image

Severe accident management guidelines should be comprehensively Verified and Validated [4] (V&V). Implementing and enhancing the existing SAMG program in NPPs is an important post-Fukushima activity [5]. Expert judgment, simulators, field training, tabletop exercises, emergency drill, and exercise and analysis are current practices related to SAMG V&V. Moreover, informing SAMG and actions through analytical simulation is a practical and commendable practice [5].

While numerical simulation is scenario/event based from initiating event to core damage, and even to fission product release to the off-site environment. There is a great challenge that SAMGs take an integrated, symptom-and-knowledge-based approach [5], and that means, SAMGs contain actions to be taken that are based on the values of directly measurable plant parameters [6].

SAMEX, a decision support system, is developed for use in severe accident management following an incident at a nuclear power plant [6]. Risk-informed severe accident risk database management module (RI-SARD), which is a risk-informed accident diagnosis and prognosis module of SAMEX [7], examines (a) a symptom-based diagnosis of a plant damage state (PDS) sequence in a risk-informing way and (b) a PDS sequence-based prognosis of key plant parameter behavior, through a prepared database, SARDB, which stores the data of integrated severe accident analysis code results like MAAP and MELCOR for hundreds of high-frequency scenarios from the plant damage state event tree of a Level 2 PSA. RI-SARD predicts a series of potential severe accident sequences that match the user-specified symptom criteria, and then prioritizes and adds more symptoms to screen down scenarios for prognosis analysis.

The accident process diagnosis and prognosis method, with fast-running severe accident codes and scenario selection, used in SAMEX, fills the gap between symptom-based analysis and event-based analysis. But with the given symptom of key parameters of NPPs, a small set of initiating events and sequences may lead to a similar plant damage state, and this method is not precisely focused on one scenario, which means multiple parallel sub-section simulations should be conducted to provide information for users to select.

Numerically reproducing symptom-based scenarios and selecting a small set of accident sequences to be simulated is practical in accident process diagnosis for SAMG implementation and assessment. Ideally, the selection of scenarios to be simulated should be made from the results of both Level 1 and Level 2 PSA [5], whereas only Level 2 PSA result is used in SAMEX.

The main purpose of this paper is to: 1) a concept of risk-and-knowledge informed diagnosis and prognosis of plant damage state during the entrance of SAMG, tracing back process progression from initiating event to core damage; 2) a feasible way to select only one scenario from the result of Level 1 PSA, especially ET, for numerically decision support for SAMG implementation and assessment, with an application of advanced algorithms, deep learning, in Artificial Intelligence (AI).

2 AI Application in Accident Diagnosis of NPPs

Since the 1980s, with the field of artificial intelligence evolved, kinds of artificial intelligence methodologies are implemented for accident diagnosis in NPPs.

Jaques Reifman [8] provides a comprehensive survey of computer-based diagnostic systems using artificial intelligence techniques that have been proposed for the nuclear industry up to 1997. Two computing tools: expert systems or Artificial Neural Networks (ANNs), are used for artificial intelligence-based systems for process diagnostics. Hybrids of them and a combination of these technologies with numerical quantitative simulation programs have also been proposed.

The early diagnostic approaches were based on expert systems, and then ANNs before the 21st century, which follows chronologically the popularity of these artificial intelligence technologies.

Kinds of diagnosis systems were developed based on an expert system. REACTOR, an expert system for diagnosis and treatment of nuclear reactor accidents, was developed at the beginning of the 1980s in the U.S.A [9]. DISKET, which is based on knowledge engineering in the field of expert systems, has been developed to identify the cause and the type of abnormal transient of a nuclear power plant in the middle of the 1980s in Japan [10]. ADAM, an accident diagnostic, analysis, and management system application for severe accident simulation and management in the 2000s in the U.S.A [11]. Even in the past few years, a decision support system called SEVERA was developed in Europe [12], aimed at supporting the decision-making team during an accident or a training exercise, using decision modeling software DEXi, which is based on if-then rules.

The ANNs method application for diagnosis in NPPs is data-driven with model training and is mainly trained with simulation data of NPPs. Diagnosis result is highly dependent on the quality of simulation results. At the early stage, numerical simulation is not quite competent for accident progression. No systemic application was built based on ANNs, only in some specific domains, ANNs were applied as a methodology basis.

But nowadays, integrated simulation code, MAAP or MELCOR, is advanced involved in the past few decades. And several diagnosis systems were developed. ADAS, using neural networks, was developed in the 2000s in Korea for accident diagnosis and support operator decision-making [13]. A severe accident diagnosis and response support system was developed in China, which uses three diagnostic methods including BP neural network method, SDG expert diagnosis, and artificial diagnosis [14].

Moreover, some other machine learning methods emerged and are applied for accident diagnosis in NPPS. A cascaded support vector regression (CSVR) model is used to predict accident scenarios, accident locations, and accident information [15]. An approach for diagnosis of multiple failures based on dynamic Bayesian networks (DBNs) is proposed to support emergency response in case of an incident [16].

Nowadays, the most popular AI technology is Deep Learning, which is a subset of machine learning and essentially a neural network with three or more layers. Related algorithms in this domain include Convolutional Neural Networks (CNN), Recurrent Neural Networks (RNN), Auto Encoder (AE), Generative Adversarial Network (GAN), etc. These algorisms greatly improve the ability to solve practical issues, such as image recognition, speech recognition, auto driving, language translation, etc. And inspires new prosperity of AI applications.

Although numerical simulation is applied to generate accident data, those AI methods mentioned above do require not a very large dataset to train the model, hundreds or even thousands of simulations may be enough. As a drawback, the diagnosis capability may be limited.

3 Traceback Accident Progression Methodology During Transition from EOP to SAMG

Following the occurrence of initiating event, EOPs are step-by-step procedures for operators in the main control room to put the NPPs into a safe state. Prevention efforts, including safety system function and human performance, with success or failure execution, direct to different branches of the progression path, which are static sets of ETs of L1 PSA. Key procedures in EOPs are simplified as header events of ETs, for example, depressurizing the primary system. This path with the uncertainty of time may produce tens of thousands of scenarios.

According to different SAMG entrance conditions, for example, core exit temperature exceeds 650 ℃, TSC is formed to mitigate accident progression from large nuclide release. Plant damage state assessments are required when operation transitions from EOPs to SAMG.

With fast-running simulation code, qualitatively PDS and SAMG action assessment is conducive for accident management. But the obstacle gap between symptom-based SAMG and event-based numerical analysis needs to be filled first.

This paper promotes a traceback method for TSC, which can automatically generate an input deck of simulation code, based on chronological parameter data from initiating event occurrence time to time when SAMG entrance condition is realized. And this method is data-driven, using the good performance of deep learning algorithms to diagnose header events and their time to define a relatively reasonable scenario that confines symptoms on assessment time. It’s their advantage to diagnose from big datasets for DL algorithms, while with a little number of datasets, they may diagnose with poor capability.

3.1 Traceback Methodology

The main steps are described as follows:

1) Analysis of event trees and header events selection

First, a review of event trees from publicly available Level 1 PSA is performed to select the main header events for every sequence path which causes core damage.

2) Sequences simulation and database generation

With the previously identified header events delineated for each sequence, using a simulation tool, and with the occurring time uncertainty branch, a database is produced with a large amount of CPU calculation work. The branching method will be explained in the following section. Selection of key parameters as the figure of merits is performed for simulation output.

3) Traceback model training for scenario confinement

Using DL algorithms, classification and regression models are trained with formerly generated scenarios database. This may last for weeks. Different kinds of DL algorithms are tried to be used, and hyperparameters are tuned with effort.

4) PDS diagnose with simulation and real-time instruments indicator

Put chronological real-time instrument data into DL-trained models to diagnose confined scenarios, and then generate an input deck of the simulation tool, ranging from initiating event occurrence time to the time when core exit temperature exceeds 650 ℃. This defined scenario is a base scenario for the following accident simulation.

5) Prognosis and SAMG action assessment

Put SAMG action into input deck of base scenario, and following simulation code execution, which runs fast ahead of real-time, will prognosis the following accident progression with/without SAMG action.

3.2 Header Event Branches

According to step 2, header event branching is conducted in dealing with scenario uncertainties.

The third issue described in the report of OECD/NEA [5] is the treatment of simulation uncertainty for assessing SAM actions using an analytical tool. The best-estimate approach is recommended for analytical simulation because a conservative approach may not be of much help and sometimes could even lead to a wrong decision.

Despite code uncertainties, representation uncertainties, numerical inadequacies, user effects, computer/compiler effects, and plant data uncertainties for the analysis of an individual event, branching time is one important uncertainty for sequence definition. Lots of evaluation effort has been done for computer code uncertainty.

While some safety systems function automatically, there is still uncertainty between simulation and real-time accident progression. In addition, automatic safety systems may fail and manual work with delayed time may still be needed to define accident scenarios.

Besides, manual actions following up EOPs may delay branching time for diagnosis time, preparation time, and execution time.

Fig. 2.
figure 2

Event tree branches

Full size image

Kinds of breaching time for both safety systems and manual actions are simulated for scenarios, as shown in Fig. 2. For one sequence of ETs, header event 1 action should be done at time t1 as action condition is fulfilled in simulation, three branches deviated t1 time, which are 10 min after t1, 20 min after t1 and 30 min after t1. The safety system or manual actions at header event 2 is similar to header event 1, and three branches are formed with different delay times. And another three branches for t2 action are formed for a scenario with t1–2 action in 20 min. So, the permutation of delayed action time for header events makes a very large number of scenarios for one sequence of ETs.

4 Case Study – Medium Break LOCA (MBLOCA) in a Pressurized Water Reactor (PWR)

This section presents an example application of the above-referred traceback methodology to define a suitable input deck of accident progression scenario from initiating event to core exit temperature exceeding 650 ℃ in no more than one day, which is the basic scenario for SAMG actions implementation assessment.

The initiating event of this case study is the middle break loss of coolant accident in a pressurized water reactor. According to L1 PSA, two ETs are analyzed which differ in the position of break, one break is on one hot leg, and the other one is on one cold leg. Only hog leg ETs is analyzed in this case study.

4.1 Event Tree Analysis and Header Events Selection

The event tree of MBLOCA with a break on the hot leg is depicted in Fig. 3. There are a total of 21 sequences in this ET, 4 sequences result in bringing back to safety status (OK), and the remaining 17 sequences lead to core damage (CD), which cause different plant damage state.

Among these 17 sequences, some of them may not need to be distinguished due to their header events. For example, sequences 7, 8, and 9 are like sequences 11, 12, and 13 respectively. The difference between them is human error in safety actions or the mechanical inherent failure of these safety systems. So, 13 sequences causing CD are screened for the next steps.

Not all of the header events in Fig. 3 are used for each sequence. For example, only E01, H01, and E02 are used for scenario 2. And head events needed for each sequence are analyzed for each sequence.

Fig. 3.
figure 3

MBLOCA Event Trees

Full size image

4.2 Event Tree Scenarios Simulation with Branches

Modular Accident Analysis Program (MAAP) is used as a numerical analysis tool for scenario simulation.

For every one of the screened 13 sequences, 10 different initiating event occurrence times, 10 break sizes, 2 break locations (near/not pressurizer), and 10 branching times for each header event are analyzed and simulated. The branching point is managed in the above-referred method. All these simulation results generate a database of knowledge on accident progression. Some parameters chosen as figure-of-merits (FOMs) are listed in Table 1.

Table 1. FOMs of simulation
Full size table

4.3 DL Models Training

1D-CNN (one-dimension convolutional neural network) algorithm is used for this modeling task. The knowledge database formally generated is used as training and testing data for classification and regression models.

The classification models include the sequence number of ETs, and break location near or not near the pressurizer.

And regression models include initiating event occurrence time, break size, and branching time for every header event in every sequence.

The result of the training models is listed in Table 2.

Due to the large scale of scenarios, weeks of training time may be needed for this task.

Table 2. Result for sequence 2 of ETs in MBLOCA
Full size table

4.4 Trace Back Accident Progression

Accident data from the simulator or MAAP is generated for testing 1D-CNN trained models. In the case of real implementation, parameters of instrument indicators are used for gathering chronological data of accident progression.

The task in this section is to automatically generate a defined input deck of MAAP, which relatively accurately depicts the chronological progression from initiating event to core exit temperature exceeding 650 ℃. And the methodology is to input chronological data to 1D-CNN trained models and get classification and regression data for each model. These tracked back model data are written to an input deck of MAAP.

Based on this section, a basic scenario for testing accident data is confined to an input deck of MAAP.

4.5 Application of Basic Scenario for SAMG Assessment

With the above-referred tasks, TSC can diagnose plant damage state using an input deck of basic scenarios. For the prognosis of an accident, TSC personnel put related action commands for SAMG actions into this basic input deck, with the calculation result of MAAP, the negative or positive effect of these actions can be foreseeable with fast running code. And the simulation result is used for decision support of TSC.

5 Conclusions

Numerical analysis is a practical tool for SAMG assessment. But the gap between symposium-based SAMG actions and event/scenario-based numerical simulation is the first obstacle to on-time decision support. Although methods of using L2 PSA are provided, the drawback of several screened scenarios are not focused and may generate controversial calculation results.

Event trees of L1 PSA are used for scenarios database generation, and header events selection is performed to generate the skeleton of scenarios.

Uncertainty of scenarios is considered in this traceback method, with different time branching points for each header event of scenarios, and confidence is gained for the following decision-making support.

The method described in this paper is good at automatically generating an input deck for a basic scenario ranging from initiating event to core exit temperature exceeding 650 ℃. And the track back result fills the gap between symposium-based SAMG actions and event-based simulations. The prognosis for SAMG assessment can be realized based on this methodology.