METHOD FOR DETERMINISTIC SAFETY ANALYSIS IN NON-STATIONARY HIGH RISK SYSTEM, CONTROL METHOD AND CONTROL SYSTEM USING THEREOF

This invention relates to a method and systems of safety analysis of engineering processes and may be used for safety analysis of nuclear power stations. According to the invention, distribution of risk factors is analysed on different stages of the engineering process, and safety intervals are determined where safety conditions remain invariable. The method further includes analysis of failures transitions from one safety interval into another by means of cause-effect analysis. Based on the results of this analysis, deterministic safety models are created for possible scenarios of transition of failures from one safety interval into another. A method and system according to the invention provide quantitative safety analysis and evaluation for engineering processes in variable safety conditions and enable creating valid safety requirements to perform optimisation of an engineering processes control system.

The invention will be further illustrated with reference to an example of a system for safety analysis and evaluation of an engineering process of reloading a core region of a nuclear reactor WWER(Water/Water-Energy Reactor)-1000, designed by the Russian Kurchatov Institute, Moscow.

The safety analysis of an engineering process for refuelling a core region is implemented using a system for deterministic safety analysis of an engineering process, wherein the system comprises a central processor for performing safety analysis of an engineering process, a means for storing engineering process data, and a means for computation of probabilistic safety factors (indices) for each type of event and a cumulative safety index for the overall process.

A data storage means comprises both (i) information relating to industry standards and normative technical documentation, such as process-specific safety regulations, which is used as initial data for creating a list of safety criteria, and (ii) a list of actual overruns of acceptable safety parameters for the current nuclear power plant, engineering process or technological operation, to use in analysis of possible failures of the engineering process and for compilation of a list of failures that result in possible occurrence of OMSP.

Further, optionally, a system contains a means for creating a verbal model of an engineering process, including description of operating conditions and limits, a means for creating a deterministic-probabilistic safety model, a means for calculation of probabilistic safety indices, a means for creating a logic-probabilistic model and other calculation means.

The safety analysis and evaluation procedure according to the invention comprises the following sequence of operations.

At the first stage, initial data is collected, including normative-technical and exploitation documentation for a reloading machine, a control system, a product to be reloaded, engineering algorithms, a service area diagram, transporting-technological operations diagram and other required documents.

At the second stage, the input information is analysed to generate the following interim documents, including but not limited to:1. A Schematic Block Diagram of an Engineering Process

This diagram is typically represented as a multi-level structure illustrating a process of reloading a core region of a reactor, in combination with associated technological cycles and transporting-technological operations. The reloading process is represented as a sequence of technological cycles, wherein a list of cycles is defined on the basis of technical specification of a reloading machine, such as MPS-V-1000 U4.2 in the current example implementation.

According to the example, a process of reloading consists of 22 types of technological cycles with fuel assemblies, including the steps of: blowing up the assembly, inspection of installation level of the fuel assembly in the reactor, inspection of nests for installation of fuel assemblies in the reactor; 5 types of technological cycles involving elements affecting functionality (clusters), 4 types of technological cycles involving operations with plugs of a hermetical case.

Each technological cycle consists of a predetermined number of transporting-technological operations. For instance, according to the present example, the process includes 11 types of transporting-technological operations with fuel assemblies, 4 types of transporting-technological operations with clusters, and 2 types of transporting-technological operations with the plug of hermetical case.2. A List of Safety Criteria

The safety criteria throughout the current specification are defined as Maximum Acceptable Safety Parameters of normative impacts on a reloaded product (also, Maximum Safe Operation Parameter Pimax, see Definitions).

An overrun of the acceptable parameter is the failure consisting in that normative impact as defined by the safety regulations is exceeded. For different kinds of impacts to the reloaded product, different safety parameters could apply. Therefore, the safety criterion would be non-deviation from normative impacts to a given object, such as a reloaded product.

The safety criteria are determined upon analysis of Standard Norms and Rules, and exploitation documents of the nuclear fuel.

The approximate list of safety criteria at the reloading of the core region of the reactor (handling fuel assemblies) is shown in the Table 1.

TABLE 1Safety criteria, MaximumType ofSafe Operation Parameterimpact(MS Pismax)Safety RegulationsDownfallFuel assembly downfall isArticle 4.2.8 of the “Safetyof a fuelnot permittedregulations for storage andassemblytransportation of a nuclear fuelin a nuclear power engineeringapparatuses” PNAE G-14-029-91TorsionTorsion torque is notArticle 8.2.7 of the operatingtorquepermittedmanual “Complex of cassettesWWER-1000”0401.22.00.000RESideHitting a beam of aArticle 6.5.11 of the “Safetyblowreloading machine whenregulations for storage andtransporting fueltransportation of nuclear fuel inassemblies, by anuclear power engineeringconstruction elements of aapparatuses” PNAE G-14-029-reactor or a detention pool91is not permittedRemoval/Force of removal must notArticle 8.2.4 of the operatingMountingexceed 2205 Nmanual “A complex of cassettesForceMounting force must notWWER-1000”exceed 735 N0401.22.00.000REPinchPinch Force must notArticle 8.2.3 of the operatingforceexceed 9800 Nmanual “A complex of cassettesVVER-1000”0401.22.00.000REUpperA used fuel assemblyArticle 6.5.11 of “Safetyextremeshould not be elevatedrugulations for storage andpositionabove a marker showing atransportation of nuclear fuel inof a fuelwater layer sufficient tonuclear power engineeringassemblyprovide safety of personnelapparatuses” PNAE G-14-029-engaged in reloading of91nuclear fuelBendingBending force is notArticle 6.5.11 of “Safetyforcepermittedregulations for storage andtransportation of nuclear fuel innuclear power engineeringapparatuses” PNAE G-14-029-91TensileMaximum acceptableArticle 8.2.5 of the operatingloadtensile load applicable formanual “Complex of cassettesremoval of a fuelVVER-1000”assembly from a reactor0401.22.00.000REmust not exceed 39200 Nfor initial 40 mmFuelReloading of a fuelArticle 10.6 of the operatingassemblyassembly with mechanicalmanual “Complex of cassettesself-defects (breakage ofVVER-1000”destructiondetails or parts of units) is0401.22.00.000REnot permittedOverheatingReloading of a fuelArticle 4.2.11 of “Safetyofassembly at theregulations for storage anda fueldecreased water level intransportation of nuclear fuel inassemblythe detention pool is notnuclear power engineeringpermittedapparatuses” PNAE G-14-029-913. The next step is defining a list of failures in the engineering process and operation conditions that may result in OMSP (overrun of the maximum safety parameter), and hence, may constitute a Risk Factor, where risk factor is defined as such failure Fi=f(Pi) of a high risk technological process, which results in overrun of at least one process parameter Pi>.

Herein, failures in the engineering process in the step of core region reloading are defined as failures in regular exploitation, including, but not limited to the following:Unapproved movement of machineryUnapproved speed of movement of machineryUnapproved direction of movement of machineryError in positioning of machinery to prescribed coordinatesPositioning of machinery to non-prescribed locationPositioning of a reloaded product to/on aprescribed locationPresence of unauthorized objects in a reloaded products areaDeviation in dimensions of reloaded productsPower supply lossSeismic impact, etc.

In general, engineering process failures could be separated into two groups:Operation failures; for instance, unapproved movement of a shell;Status failures; for instance, the fuel assembly claw is positioned in the intermediate state.

The total number of failures of the engineering process that will be considered within the present process is 55, including 16 failures relating to status failures.4. Partitioning diagram showing how transporting-technological operations could be partitioned into intervals with invariable safety conditions

The next stage is creating a diagram of partitioning of transporting-technological operations into intervals with invariable safety conditions.

Further, a process of partitioning transport-technological operations into intervals with invariable safety conditions will be discussed in more detail with reference to the operation “Installation of a fuel assembly into a nuclear reactor”.

The first step is compiling a table containing data relating to OMSP, respective risk factors, and areas of influence of risk factors. The area of influence is defined as a part of a technological operation where a particular risk factor may result in unacceptable impacts. An example table may be presented as shown below (for some safety criteria)

TABLE 2OMSP,Overrunof Max-imum SafetyParameter,or Over-run ofSafetyCriterionRisk factor, Fi= f(Pi)Area of influence of a risk factor FiFuelUnauthorized fuelInitial position corresponds to—theassemblyassembly grippertransporting position with a fueldownfallopeningassembly. End position is defined as(OMSP1)a position when a shank of a fuelassembly is located within 100 mmfrom the installation positionTorqueUnauthorized pivot ofInitial position is defined as a position(OMSP2)a working beamwhen the shank of a fuel assembly islocated at a head level of theinstalled fuel assemblies. Endposition corresponds to positionwhen the fuel assembly is installedinto a reactor slotPinch forceA claw with a fuelInitial position corresponds to(OMSP5)assembly movesposition when a fuel assembly shankdownward at theis within 100 mm distance from theunapproved speedtarget location in a slot of a reactor.End position corresponds to positionwhen the fuel assembly is installedinto a slot of a reactor.

Further, a procedure is described for compiling a diagram of distribution of areas of influence of risk factors.

First, an engineering process is presented on a diagram in the following system of coordinates:on the horizontal axis, initial and endpoints of influence of risk factors are marked;on the vertical axis, points corresponding to possible types of damage are marked.

Then, for each risk factor, an influence area is marked by a horizontal line. Further, initial and end points of obtained influence areas (they are shown by dotted lines) are connected by vertical lines to separate the whole technological operation into intervals, where the safety conditions remain invariable, for instance, the number and types of possible damages of fuel assemblies is constant.

The obtained safety intervals represent stationary, in the context of safety conditions, objects, where standard methods of calculation of probabilistic safety analysis are applicable.

In this way, the whole engineering process can be represented as a set of sequentially connected safety intervals. In this representation, safety intervals are connected to each other not only by a sequence of technological operations, but also by cause-and-effect relations of engineering process failures, which could happen within these intervals.5. Table 3 “Propagation of Failures”

This table is compiled based on analysis of failure transitions from one safety interval to another.

A characteristic feature of multiple transporting-technological operations, in particular, nuclear fuel reloading operations, is that if a failure has occurred on some safety interval in the course of an engineering process, this may or may not result in the overrun of maximum safety impact on a reloaded product at this interval. For instance, if a failure has occurred on a safety interval when a fuel assembly was moved to a transit position, the result could be that a fuel assembly is not lifted to the required level, its lower part projecting outwards from the working beam. Within the given safety interval this failure may not result in a fuel assembly damage, however, later, when the fuel assembly will be moved through a transporting passage, it may be curved by collision with structures in the transporting passage.

To avoid the above described failures, propagation of failures shall be traced and analysed throughout the engineering process shall be made. To simplify analysis of failures transitions from one safety interval to another, according to the invention, the next step is compiling “A table of failures propagation throughout an engineering process” (further referenced as Failure Propagation Rules).

As a result of the analysis, a combined table of failures is compiled, where all possible failures in engineering process and all safety intervals for a given operation are listed. This table is compiled using Failure Propagation Rules developed earlier. An example table for the first three intervals of the operation “Installation of a fuel assembly” is presented below.

TABLE 3SafetySafetySafetyIntervalIntervalIntervalFailureR1.15R1.16R1.17designationDescription of failureInOutInOutInOut. . .FailureThe shell is out of+×++×++2−2.1.6.1required coordinates ofinstallation/removal ofa fuel assemblyFailureThe trolley is out of+×++×++2−2.2.6.1required coordinates ofinstallation/removal of afuel assemblyFailureThe trolley is out of−4−−4−−4−2.2.6.2required coordinates ofthe transporting passageentranceFailureThe claw with the fuel+1−−1−−1−2.4.7.1assembly is above thetransit positionFailureThe claw with the fuel+1−−1−−1−2.4.7.2assembly is below thetransit positionFailureThe claw with a picked−4−−4−−4−2.4.7.3up fuel assembly is “inthe transit position withthe product”FailureThe claw is not on the−4−−4−−−−2.4.7.4required coordinates ofinstallation/removal ofthe fuel assembly (bythe height)FailureDiscrepancy between−2−−2−−3−2.5.7.1the actual and requiredposition of the claw—itis openFailureDiscrepancy between−4−−4−−4−2.5.7.2actual and requiredposition of the claw—itis closedFailureThe claw latch is in the+×++×++×+2.5.7.3intermediate positionFailureThe working beam is not+×++×++×+2.7.7.1at zero degrees position(required position)FailureThe working beam is not−4−−4−−4−2.7.7.2at 45 degrees position(required position)Failure10The fuel assembly is−4−−4−−−−installed out of thereactor slotEtc.

In the above table, the symbols “+” and “−” denote, respectively, the presence and absence of potential failure at the beginning or at the end of a safety interval, while the numbers “1” . . . “6” correspond to the number of a failure propagation rule for a given engineering process. Example rules presented below.

Rule 1: The influence of a failure is terminated at the moment of a regular movement of machinery. For instance, the influence of the failure “Error of setting the shell to the required coordinates” is terminated as soon as the shell start moving regularly.

Rule 2: A potential failure in the engineering process is eliminated provided a safety interval is realized in accordance with the engineering process. For instance, installation of a fuel assembly into a reactor slot eliminates the influence of the following failures: “The working beam is not at 0 degrees position” and “The bridge or trolley are out of coordinates of installation/extraction of the reloaded product”, etc.

Rule 3: The influence of a failure in the engineering process is terminated upon unconditional conversion of failure into an overrun of a safety parameter. For instance, unapproved opening of a fuel assembly claw during transportation of a fuel assembly (this is a failure) unconditionally results in the fuel assembly drop (this is an overrun of a safety parameter).

Rule 4: A failure in the engineering process terminates its influence in a safety interval where this failure does not appear as a failure for a given safety interval. For instance, the influence of a failure “A claw is open” is terminated when the claw is back to a correct position.

Rule 5: The influence of a failure in the engineering process is not considered if it does not allow performing a regular technological operation, but does not result in overrun of an acceptable impact. For instance, if a claw moves downward in the position “The claw is closed”, thought landing of the claw onto a fuel assembly is impossible, this does not create a condition for the fuel assembly damage.

Rule 6: Engineering process failures relating to failures of the regular exploitation (unauthorized objects, deviation of geometrical sizes of a service area or reloaded products, etc.) are considered as acting if the start affecting the safety of an engineering process. For instance, an unauthorized object allocated in a reactor slot is not considered as a failure in the engineering process unless a fuel assembly is installed in a reactor slot where this object is allocated. The presence of an unauthorized object in a slot may result in failure in the installation of the fuel assembly in the correct position, and later this may result in the fall of the fuel assembly.

Further, on the basis of the documents described above a verbal model is created for future use in safety analysis of the engineering process.

On the third stage, the simulation of the engineering process is performed as follows.

Using the propagation table obtained earlier, a deterministic-probabilistic model of a technological operation is constructed, taking into consideration possible transitions of failures to subsequent safety intervals (FIG. 3A-3B). This model represents a combination of safety intervals. At this stage, failures are considered that occur in a given safety interval, and those failures in the engineering process (FEP) that were transferred from a previous interval and resulted in overruns of accepted impacts at this interval or may result in overruns at the subsequent intervals.

The above model takes into consideration all possible scenarios and paths of events development to provide a qualitative safety evaluation of a technological operation. The results of this analysis may be used either as such or for subsequent quantitative safety evaluation of the engineering process.

The next step is creating logical or logical-probabilistic models describing processes of initiation of OMSP for each safety interval (FIG. 4). At this stage, those failures in the engineering process (FEP) are considered that occur within the current safety interval or have propagated from a previous interval and resulted in OMSP (e.g. resulted in overrun of acceptable impact) in a given interval. Further, external impacts and protectors and locks available in the given safety interval are considered. To obtain quantitative indices, each failure in the engineering process (FEP) or failures of protectors and locks are taken into consideration with the respective probability of their occurrence.

The following events may be considered as an initiating impact: accidental stroke on the keyboard, faulty command produced by an operator, a control function failure in the remote control unit of a control system, a failure of a control function in a program-technical complex of a control system, a failure of a control function in electrical equipment.

The following events may be considered as an external impact: equipment failures (e.g. a reloading machine or its control system), exploitation personnel errors, deviation of geometric sizes of reloaded products of designed values, deviation of geometric sizes of designed values: reactor slots for fuel assemblies, rack cells in a detention pool, shells for fresh fuel and containers for used fuel; unauthorized objects located in a service area; water level decrease as a result of water flow through a coating of a detention pool; complete termination of power supply; seismic impact.

Protectors and locks may include, for instance, protectors and locks in a control system of a reloading machine. Protectors and locks can be separated into two groups: common protectors and locks, and protectors and locks of each device of a reloading machine.

Protectors and locks within the control system can be classified into the following groups in accordance with their mode of action:Remote control unit-protectors;Program-technical complex-protectors and locks;Power supply complex-protectors and locks.

The advantage of the above method of distribution of protectors and locks is that it providing echeloning of protection and also, certain protectors and locks can be combined independently to provide the required conditions of safe exploitation.

Depending on objectives and tasks of a safety analysis, various modifications and combinations of the above described models are possible within the scope of the appended claims, including deterministic models of operations and logical-probabilistic models of failures in engineering processes.

For example, a technological cycle can be modelled by combining deterministic-probabilistic models of sequential technological operations, with subsequent modelling a whole process of reloading of a core region of the reactor (FIG. 5).

A model of a reloading process provides the opportunity to determine a combined safety index along with quantitative safety indices for each safety criterion.

On the fourth step, probabilistic safety indices of a core region reloading are calculated using the certified calculation complex “Risk Spectrum Professional”.

Calculation of quantitative probabilistic safety indices (safety criteria) is implemented as the following steps:input of model data relating to a reloading process into a calculation complex;possible failures are assigned a respective probabilistic coefficients;protectors and locks are assigned their respective reliability coefficients;calculations and analysis is performed;results of calculations of probabilistic safety indices for the transport-technological operation “Installation of fuel assembly” are output;results of analysis of influence of protectors and locks on the probabilistic safety indices are output.

On the fifth stage, safety indices characterising contribution of individual transport-technological operations and individual protectors and locks to the aggregate safety index of the engineering process of the core region reloading are analysed.

On the sixth stage, the proposals and recommendations are developed to improve the construction and circuit solutions of a reloading machine and its control system.

On the seventh stage, recommendations are developed to increase the safety level of APP when performing transport-technological operations with nuclear fuel.

A method for deterministic quantitative safety analysis of a nuclear power generating system is described below in more detail by way of the following example embodiment.

In the following example embodiment, the method is run in a Windows NT environment or simply on a stand alone computer system having a CPU, memory, and user interfaces. The method can also form a part of a nuclear power plant control system.

The said non-limiting example implementation describes an engineering process of nuclear fuel re-loading in a so-called boiling water (BWR) type nuclear reactor, in particular, in WWER (Water/Water-Energy Reactor)-1000 designed by the Russian Kurchatov Institute, Moscow, and also a control system and control method using the same.