# Probabilistic safety assessment for internal and external events/ European projects H2020-NARSIS and FP7-ASAMPSA_E

Evelyne Foerster, Emmanuel Raimond, Yves Guigueno

► To cite this version:

Evelyne Foerster, Emmanuel Raimond, Yves Guigueno. Probabilistic safety assessment for internal and external events/ European projects H2020-NARSIS and FP7-ASAMPSA_E. EPJ N - Nuclear Sciences & Technologies, 2020, 6, pp.38. 10.1051/epjn/2019012. cea-02641363

HAL Id: cea-02641363

https://cea.hal.science/cea-02641363

Submitted on 28 May 2020

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
REVIEW ARTICLE

OPEN ACCESS

# Probabilistic safety assessment for internal and external events/
European projects H2020-NARSIS and FP7-ASAMPSA_E

Evelyne Foerster<fnref n="1" />,*, Emmanuel Raimond<fnref n="2" />, and Yves Guigueno<fnref n="2" />

Received: 12 March 2019 / Accepted: 4 June 2019

**Abstract.** The 7th EU Framework programme project *Advanced Safety Assessment Methodologies: "Extended PSA"* (ASAMPSA_E, 2013-2016) was aimed at promoting good practices to extend the scope of existing Probabilistic Safety Assessments (PSAs) and the application of such "extended PSA" in decision-making in the European context. This project led to a collection of guidance reports that describe existing practices and identify their limits. Moreover, it allowed identifying some idea for further research in the framework of collaborative activities. The H2020 project "New Approach to Reactor Safety ImprovementS" (NARSIS, 2017-2021) aims at proposing some improvements to be integrated in existing PSA procedures for NPPs, considering single, cascade and combined external natural hazards (earthquakes, flooding, extreme weather, tsunamis). The project will lead to the release of various tools together with recommendations and guidelines for use in nuclear safety assessment, including a Bayesian-based multi-risk framework able to account for causes and consequences of technical, social/organizational and human aspects and a supporting Severe Accident Management decision-making tool for demonstration purposes, as well.

## 1 Introduction

The methodology for Probabilistic Safety Assessment (PSA) of Nuclear Power Plants (NPPs) has been used for decades by practitioners to better understand the most probable initiators of nuclear accidents by identifying potential accident scenarios, their consequences, and their probabilities. However, despite the remarkable reliability of the methodology, the Fukushima Dai-ichi nuclear accident in Japan, which occurred in March 2011, highlighted a number of challenging issues (e.g. cascading event – cliff edge – scenarios) with respect to the application of PSA questioning the relevance of PSA practice, for such low-probability but high-consequences external events.

Following the Fukushima Dai-ichi accident, several initiatives at the international level, have been launched in order to review current practices and identify shortcomings in scientific and technical approaches for the characterization of external natural extreme events and the evaluation of their consequences on the safety of nuclear facilities.

The collaborative ASAMPSA_E project has hence been supported by the European Commission, aiming at identifying good practices for PSA and at accelerating the development of "extended PSA" in Europe with the objective to help European stakeholders to verify that all the major contributions to the risk are identified and managed. Due to the Fukushima Dai-ichi accident, the ASAMPSA_E project had to focus also on risks induced by the possible natural extreme external events and their combinations. Despite this limitation, the ambition of this project (number of technical issues to be addressed) was considerable and required assembling the skills of many experts and organizations located in different countries.

Based on the ASAMPSA_E lessons and also on the theoretical progresses and outcomes from other recent European projects (e.g. FP7-SYNER-G, FP7-MATRIX, FP7-INFRARISK), the NARSIS project has then been initiated in 2017, in order to propose a number of improvements on the probabilistic assessment and the uncertainty treatment, notably in case of cascading and/or conjunct external natural events, which would enable also extended use of PSA in the field of accident management. Profiting from the presence of practitioners and operators within its consortium, NARSIS will test the proposed improvements of the safety assessment procedures on virtual and actual PWR plants, postulating some

<footnote n="1">¹ CEA Paris-Saclay, Nuclear Energy Division, 91191 Gif-sur-Yvette, France</footnote>

<footnote n="2">² IRSN, Nuclear Safety Division, BP 17, 92262 Fontenay-aux-Roses, France</footnote>

<footnote>* e-mail: evelyne.foerster@cea.fr</footnote>
<figure><img src="image_2.png" /><figcaption>Fig. 1. The FP-7 ASAMPSA_E project.</figcaption></figure>

hazard-induced damage states representing the variety of their initial conditions in terms of relevant parameters and availability of relevant systems, functions and equipment. For the existing plants, the focus will be mainly put on Beyond Design Basis (BDB) sequences.

# 2 The FP-7 ASAMPSA_E project (Fig. 1)

## 2.1 Presentation of the project and its results

The ASAMPSA_E (Advanced Safety Assessment Methodologies: extended PSA) project was aimed at investigating in details how far the PSA methodology application enables identifying any major risk induced by the interaction between NPPs and their environment, and deriving technical recommendations for PSA developers and users. The project was open to European (and non-European) organizations having responsibility in the development and application of PSAs in response to the Regulators' current and hardened requirements.

The following definition has been adopted for the project: "An extended PSA (probabilistic safety assessment) applies to a site of one or several Nuclear Power Plant(s) (NPP(s)) and its environment. It intends to calculate the risk induced by the main sources of radioactivity (reactor core and spent fuel storages) on the site, taking into account all operating states for each main source and all possible accident initiating events affecting one NPP or the whole site". An "extended PSA" should consider, for all reactors and spent fuel storages on a nuclear site, the contributions to the risk originating:

- from internal (operation) initiating events in each reactor;

- from internal hazards (internal flooding, internal fire, etc.);

- from single and correlated external hazards (earthquake, external flooding, external fire, extreme weather conditions or phenomena, oil spills, industrial accident, explosion, etc.);

- from the possible combinations of the here-above mentioned events;

- from the interdependencies between the reactors and spent fuel storages on a same site.

An "extended PSA" shall include a minima a Level 1 PSA (L1 PSA), which calculates scenarios of fuel damage (and their frequencies), a Level 2 PSA (L2 PSA) which calculates scenarios of radioactive releases (frequencies, kinetics and amplitude of such releases) and could include a Level 3 PSA (L3 PSA) which calculates the risk for the population, the environment and/or the economy.

The PSA methodology is, in principle, able to combine and account for all components of risks (frequencies, consequences) but, in actual practice, the reliability of results and conclusions has always to be proven, because the relevance of a PSA depends on the quality of data, the assumptions and hypothesis adopted as well, which must account for:

- the plant or site operating states definition;

- the definition, characterization and frequency of accident initiating events (internal events, internal and external hazards and their combinations);

- the human and equipment failure modelling (fault trees);

- the accident sequences modelling (event tree approach);

- the accident consequences assessment;

- the supporting studies to assess the event trees adopted to address all previous topics;

- the results presentation and their interpretation to serve as an input for the decision-making process.

European countries agreed that harmonization of practices and technical exchanges could contribute to the above-mentioned steps. Specific care was recommended for external hazards as well as high impact events.

The stress-tests, organized by ENSREG, based on a deterministic approach (postulated conditions), examined the European NPPs resilience against events like earthquake or flooding, and the response in case of partial or total loss of the ultimate heat sink and/or loss of electrical power supply.

The review concluded that the level of robustness of the NPPs under investigation was sufficient but, for many plants, safety reinforcements have been defined or recommended to face the likelihood of beyond design basis (BDB) events. These reinforcements include:

- protective measures (against flooding, earthquake);
- additional equipment (mobile equipment, hardened stationary equipment) able to control the NPP in case of BDB events;

- protective structures (reinforced local crisis centres, secondary control room, protective building for mobile equipment, etc.);

- severe accident management provisions, in particular for hydrogen management and containment venting;

- new organizational arrangements (procedures for multi-units accidents, external interventions teams able to secure a damaged site, etc.).

It was claimed that there is an interest to confirm through “extended PSA” results, the high level of robustness of NPPs after the implementation of the safety reinforcements described above. But, building a meaningful risk assessment model for NPPs and their environment is a difficult task which is resource and time consuming, even if some guidance already exists on many topics.

The ASAMPSA_E project has been initiated after the Fukushima Dai-ichi accident and the above mentioned “stress-tests” organized in Europe with the objective to assess the NPPs robustness against extreme events and to identify whether some reinforcements where needed (see http://ensreg.org/EU-Stress-Tests).

The ASAMPSA_E project was intended to help the acceleration of the development of such “extended PSA” in the European countries with the objective to help European stakeholders to verify that all dominant risks are identified and managed. Due to the Fukushima Dai-ichi accident, the ASAMPSA_E project had to give importance to the risks induced by the possible natural extreme external events and their combinations.

The project, which provided an opportunity to examine which PSA methodologies have already been implemented and how efficient they are (optimization of resources, potential for identification of NPP weakness, etc.), has gathered 31 organizations (utilities, vendors, service providers, research companies, universities, technical support of safety authorities ... from Europe (21 countries), USA, Japan and Canada) represented by more than 100 experts who shared their experience on probabilistic risk assessment for NPPs.

27 technical reports [1-27] have been developed by the project partners and cover:

- bibliography;

- general issues for PSA: lessons learned from the Fukushima Dai-ichi accident for PSA, list of external hazards to be considered, methodology for selecting initiating events and hazards in PSA, risk metrics, the link between PSA and the defence-in-depth concept and the applications of extended PSA in decision making;

- methods for the development of earthquake, flooding, extreme weather, lightning, biological infestation, aircraft crash and man-made hazards PSA;

- severe accident management and PSA: optimization of accident management strategies, study of spent fuel pool accident and recent results from research programs.

These reports have been obtained after the three phases developed from 2013 to 2016: (1) the identification of the

PSA End-Users needs for “extended PSA”, (2) the development of guidance reports and (3) a peer review of the reports issued in the project. All these reports are available on the project web site (http://asampsa.eu).

## 2.2 Some of the lessons learned

The technical reports developed by the project partner's present number of considerations that should help the PSA developers and users to increase the quality and relevance of the risks quantifications.

At the end of the project, the few general lessons summarized here below were released.

During the project, achieving an “extended PSA” as defined here above was still considered a pending objective for most (all ?) the teams. That has been obviously identified as an area for progress, because no NPP site (among those considered) had got (in 2016) a PSA that allowed covering:

- all reactors initial states;

- all possible sources of radioactivity;

- all possible types of initiating events (internal and external);

and accounted for a multi-unit accident management.

In complement to the development of the “extended PSAs” the willingness was claimed to define and evaluate a “global risk metrics”. Such metrics could turn out extremely advantageous for PSA application but should be highly questionable if the precisions of the different components of the PSAs were not homogeneous. Typically, huge uncertainties affect the annual frequency of rare natural events (high magnitude earthquake frequency, correlated extreme weather conditions, etc.) and can challenge such “global risk metrics”. In practice, it may be more effective clearly separating the different components of the PSA (internal events PSA, earthquake PSA, flooding PSA, fire PSA, extreme weather PSA, etc.).

For natural hazards, the geosciences may not yet provide convenient solutions to calculate the frequency and the features of rare natural events for PSA. For example, today, earthquake predictions are mainly based on seismic historical data and on the available outcomes of investigations on the possible active faults displacement; for extreme weather conditions, even if they are identified as possible significant contributors to the risk of severe accidents, only a few methodologies are available to assess the frequencies of the worst cases (combined/ correlated events). That is a societal concern, not only for nuclear industry. Progress in geosciences for rare extreme natural events modelling is highly desirable for day-to-day applications in PSAs. Some new tendencies in seismology – such as physical modelling of fault rupture, improved validation of simulation tools on real seismic events – could open alternatives to the application of statistical/historical data.

As far as external hazards are concerned, the PSA analyst shall not limit its modelling to a single reactor but widely address its boundary conditions such as: (1) the neighbouring sources of threats around the site (e.g. sources of flooding – sea, river, dam failure, rain impacts –
and their combinations, presence of other industrial
facilities, transports, etc.), (2) the site features (including
the case of multi-unit sites). It is recommended to develop
firstly simplified approach but considering a quite large
area around the reactors.

Concerning multi-units PSA, it was concluded that the
single unit risk measures (core (or fuel) damage frequency,
large (early) release frequency, etc.) can be applied and
that the external hazards screening performed for single
unit PSA can be used (no additional work needed). But
there is a need for methodological developments on event
trees structure and content: how to limit the size of event
trees, how to introduce site human risk assessment, how to
define multi-unit common cause failures, how to consider
the interface between level 1 and level 2 PSA. A multi-unit
PSA should conduct to difficulties for risk aggregation like
single unit PSA (due to highly uncertain data, as explained
above). In addition, it appeared that quantitative safety
targets are defined and applied (in some countries) for
single unit PSA but for multi-unit PSA, it is not clearly
established whether the same quantitative safety targets
can be applied.

## 2.3 Dissemination activities, potential impacts

Communications (papers, presentations) were done to
promote the project results in the nuclear PSA community
or generally speaking in the risk assessment international
community. For example, communications were done at an
ARCADIA project workshop (2014), the EGU (European
geoscience Union) conference in 2015 (EGU 2015), the
ESREL 2015 and 2017 conference, the NENE 2016
conference, the NUCLEAR 2016 conference, the annual
OCDE/NEA CSNI-WG-Risk meetings (2013,2014,2015,
2016,2017), the PSAM13 conference (2017), in the Disaster
Risk Management Knowledge Centre (DRMKC) report
2017 or at an IAEA, workshop on multi-units PSA (2016).

A public web site ([http://asampsa.eu](http://asampsa.eu)) is available since
the beginning of the project.

The PSA End-Users from all countries have been
associated at the beginning of the project to discuss the
needs of guidance for extended PSA and at the end of the
project to discuss the reports prepared by the project
partners. Each time, an international survey and then an
international workshop have been organized.

The ASAMPSA_E was intended to promote and help
the development of high quality complete PSA for NPPs in
Europe. This task is now on-going in many countries and a
clear tendency is to extend the scope of existing PSA. The
ASAMPSA_E guidance reports can be applied as starting
point for many issues. The project results can also be used
for the development of national of international standards
(by IAEA for example).

## 2.4 Interest for follow-up research/collaborative activities

In the framework of the ASAMPSA_E project and the
relationship established with PSA End-Users international
community, some interests for further research or

collaborative activities have been discussed. Among the
highlighted topics the following ones can be mentioned:

- the exchanges of information at international level on
risk-informed decision making and "extended PSA",
including comparison of risk metrics applications;

- the sharing of available methodologies to demonstrate
that the defence-in-depth is appropriately implemented;

- the development of methods enabling modelling the
hazards combinations (especially extreme weather
correlated events);

- the study of the importance of non-safety systems and
their secondary impacts in external hazards assessment;

- for seismic PSA, the aftershocks modelling, the applica-
tion of faults rupture modelling for PSA or the
calculation of the fire probability in case of earthquake;

- for flooding PSA: the multi-unit flooding PSA, the
methods to introduce combination of hazards, the
uncertainties on flooding event frequency for the different
causes, the system, structure and component fragilities
for flooding (including water propagation modelling);

- for extreme weather PSA: the research on combined
extreme weather events frequency and (due to slow
progress in this area), the alternative approaches for risk
identification and management;

- the comparison of existing PSA with regard to loss of
ultimate heat sink (risk quantification, ultimate heat sink
design comparison (with back fitting examples));

- in tight connection with PSA activities (or risk informed
decision making), the calibration of lightning protections
and comparison of protection solutions in different area
(data server; e.g. google, military applications, commu-
nication devices, airplane traffic, etc.);

- the comparison of level 2 PSA for external hazards (only
few are available);

- the implementation of the crisis team modelling (teams
that rescue a NPP with mobile equipment defined after
the Fukushima accident) in level 1 and 2 PSA;

- the dry spent fuel storages risk assessment;

- the conditions that allow spent fuel pool stabilization in
case of accident.

## 2.5 Conclusion for ASAMPSA_E project

The ASAMPSA_E project has been successful and remarkable from any viewpoint, also considering the number of PSA experts involved, their high and effective commitment, as well as the quality and extent of exchanges among the partners. That claims, in the European framework, – even difficult and ambitious – projects can be profitable and must be supported and sustained.

The 27 technical reports mentioned here-above on one
hand enable an accurate and comprehensive view of the
status of current PSAs, on the other provide the users with
numerous recommendations to develop meaningful, perti-
nent and efficient "extended PSA" and to identify some
pending difficulties, to be overcome through shared
research, development and innovation, as well.

Now, PSA teams have a lot to do to develop extended
PSAs. In this context, a framework oriented towards
realization of extended PSAs could be an interesting
perspective, providing a place to share knowledge, tools
and methodologies and contribute to disseminate know
how on extended PSAs.

For the future, ASAMPSA_E identifies some key-
issues to define new perspectives for collaborative projects
on PSAs in, at least, 4 main fields of endeavour:

- the improvement of methodologies that support PSAs (the NARSIS project is a good example of such projects);

- the extension of the range of PSA (including initial operating states, initiating events, internal and external hazards, multi-units issues and site environments issues);

- the sharing of NPPs risk dominant contributions: PSAs are not theoretical tools but representations of the reality of risks. They should help safety analysts to identify, rank and address the dominant risks with the highest priority at the design level and in operation;

- the improvement and harmonization of uses of extended PSAs and decision making processes.

That way, the likelihood of having to face another
major accident in nuclear industry in the medium-short
term should be significantly reduced.

3 The NARSIS project (Fig. 2)

3.1 NARSIS general overview

The NARSIS project is a project initiated relying upon the
ASAMPSA_E lessons to address more specifically the
following challenges:

- a better characterization of external hazards, focusing on those identified as first-level priorities by the PSA End-Users community in ASAMPSA_E (earthquakes, flooding, extreme weather), as well as the development of a framework enabling the modelling of hazards combinations (e.g. extreme weather correlated events) and related secondary effects, useful for PSA;

- a better risk integration combined with a suitable uncertainty treatment (also for expert-based information), to support the risk-informed decision making and a risk metrics comparison within extended PSA;

- the possibility to better assess the fragilities of NPP Systems, Structures & Components (SSCs), by including functional losses, cumulative effects (aftershocks modeling in case of seismic PSA), ageing mechanisms, human factors;

- an improvement of the processing and integration of expert-based information within PSA: methodologies for quantification and propagation of uncertainty sources underwent significant improvements in some other fields (e.g. related to human-environmental interactions), but is still pending the demonstration of their applicability to PSA of NPPs and the benefits of using modern uncertainty theories both to represent in flexible manner experts' judgments and to aggregate them.

To address the aforementioned challenges, the NARSIS
project proposed to review, analyse and improve aspects
related to:

- external hazards including events arising from combina-
  tion of hazards, frequency estimation of high intensity-
  low probability events with potentially very large-
  consequences and re-evaluation of screening criteria;

<figure><img src="image_3.png" /></figure>

<figure><img src="image_4.png" /><figcaption>Fig. 2. The NARSIS project.</figcaption></figure>

- modelling of the SSCs response to external events and development of new concepts of multi-hazard fragility functions, correlation effects and consequent damage scenarios;

- theoretical development for: (i) constraining Expert Judgment, (ii) treatment of parameters, (iii) models and completeness uncertainties and finally, (iv) development of methods based on Bayesian approach and Human Reliability Analysis;

- L2 PSA aspects of external hazards analysis including evaluation of accident management measures.

NARSIS does not aim at performing a complete review
of the PSA procedures.

In order to propose some improvements to be integrated
in PSA, the project puts together three interconnected
components, organized in 5 main scientific work-packages
(cf. Fig. 3):

- theoretical improvement in scientific approach of multiple natural hazards assessment and their impacts, including advance in evaluation of uncertainties and reduction of subjectivity related to expert judgments;

- verification of the applicability and effectiveness of the findings in the frame of the safety assessment and iii) application of the outcomes at demonstration level by providing improved supporting tools for operational and severe accident management purposes.

Thanks to the diversity of the 18 participants constituting the NARSIS consortium (Fig. 4), from academic to operators and TSOs, the foreseen theoretical developments and the effectiveness of the proposed improvements will be tested on simplified and real NPP case studies.

About 60 deliverables are planned in NARSIS,
including technical reports, recommendations, education
and training materials, as well as software tools.

Hereafter, are reported some of the main achievements
expected from NARSIS:

- reviewing the state of the art in hazard/multi-hazard characterization and combinations and in risk integration methods for high risk industries;

- improving methodologies for single probabilistic hazard assessment (flooding, extreme weather, extreme earthquakes and tsunamis);

- developing an integrated multi-hazard framework for combined hazard scenarios relevant for safety assessment as well as recommendations for use of this framework;
<figure><img src="image_5.png" /><figcaption>Fig. 3. Global workflow of the NARSIS project.</figcaption></figure>

- providing methods to:

* analyse extreme hazards using multi-varied statistics;

* account for secondary hazards of each NPP component separately adopting physical approaches;

* develop scenarios through a stochastic approach, allowing characterization of the input hazard curve to integrate all possible uncertainty, temporal and spatial combinations for Design Basis Events;

* account for cumulative effects, soil-structure interactions, ageing mechanisms in the fragility assessment of SSCs in case of seismic events;

* derive hazard-harmonised fragility functions, which can be updated by integrating the whole amount of available information (numerical results, qualification and other experimental testing data, in situ measurements, expert judgment), through the combined use of statistical extreme value analysis and Bayesian updating;

* incorporate human factors into multi-hazard fragility functions, as they are considered the originating cause of major disasters, and yet are difficult to predict under extreme conditions (one of the major source for epistemic uncertainty);

* adapt advanced assessment approaches to identify and prioritise the most influential sources of uncertainty in the parameters (external threats, etc.) and NPP elements modelling, so that uncertainty on results can be constrained before integration in the multi-risk framework;

- developing a Bayesian Network (BN) framework for multi-risk integration and nuclear safety assessment;

- developing a model reduction strategies at the components and NPP scales, to be used for probabilistic analyses in case of external hazards (earthquakes, flooding): the focus in NARSIS is put on meta-modelling techniques (e.g. surrogate models), as well as on Proper Generalized Decomposition (PGD) with LATIN method, which will be further developed to address complex, nonlinear, dynamic systems [28];

- providing with the safety analysis of a simplified generic PWR model representative of the European fleet, comparing purely deterministic (conventional), purely

<figure><img src="image_6.png" /><figcaption>Fig. 4. The NARSIS consortium at a glance.</figcaption></figure>

probabilistic (BN) or combined deterministic-probabilistic (BEPU/E-BEPU) approaches;

- developing a decision-making (DM) tool to support SAM Guidelines, which will be fed by projected accident progression sequences and associated SAM strategies: the primary purpose of this tool is to provide support in preventing the BDB condition from developing into severe accident condition (i.e. condition involving severe fuel damage) or mitigating it at earliest stage before it produces significant radioactive releases. The goal is here to strengthen the earliest in-plant/Technical Support Centre (TSC) response and thus avoid significant source
terms, as compared to strengthening and supporting
the emergency preparedness, response and exercises
which are investigated by projects such as H2020
FASTNET.

## 3.2 The NARSIS NPP “multi-risk model”

Beside the need to better characterize natural hazards and their possible combinations, as well as to provide robust methods to assess response and fragility of SSCs, consequences (e.g. large early release frequencies, core damage and plant damage states), including sensitivity analyses, have also to be addressed in a dedicated integrated multi-risk framework.

In order to encompass the many aspects related to the complexity of a NNP “risk model” (e.g. multiple hazards and vulnerabilities, cascading effects, complex dynamic systems, human and organisational factors, uncertainty ...), different risk integration methods have been proposed and used in high risk industries (other than nuclear ones). It was concluded that the combination of probabilistic and deterministic approaches generally yields better results for multi-risk integration.

Moreover, Bayesian Networks (BNs) have been used to model multi-risk aspects of real systems, instead of Fault Trees (FTs) or Event Trees (ETs), as the latter ones are rather static methods, based on reductionism and linear causal chains. An ET is a graph representation of events – in which individual branches are alternative steps from a general prior event, state or condition through increasingly specific subsequent events (intermediate outcomes) to final outcomes. Accordingly simplifying assumptions made for its quantification as well as for inclusion of common cause failures (CCF) are often affected by high uncertainties. Furthermore generally adopted conventional distribution functions may misestimate high standard deviation (leptokurtosis).

The extension to the Bayesian setting allows describing the state of each node of the network through richer information (e.g. full probability distribution), instead of a single value. Any information can then be used to update the probabilistic information, as the entire BN represents the probability of every possible event as defined by the combination of the values of all the random variables (i.e. Joint Probability Distribution). That way, both aleatory (due to the random nature of the external threats) and epistemic uncertainties (due to incomplete knowledge of the system) may be accommodated and assessed in the system failure. Unlike conventional FT formulations, BNs can account for correlations both at the hazard and the component damage levels: that ensures that the most critical failure modes, which may result from the joint or cascading adverse events, will be properly identified and quantified, with respect to the occurrence of the top event. Moreover, such an approach allows for efficient risk comparisons.

In NARSIS, a dynamic BN has been adopted and is being developed, as a multi-risk integration framework able to account for time evolution. This approach has been successfully demonstrated in other critical infrastructures.

Figure 5 shows a very simplified picture of what such a BN can look like in case of combined external hazards leading to a Station Black-Out (SBO) event.

The key challenges when deriving such a BN framework for safety analysis are to be able to:

- define the accident scenario progression with the events of interests and their dependencies;

- select the random variables, which will populate the BN nodes and deriving the conditional probability distributions and causality relations (edges of the BN);

- model quite detailed risk-subnetworks to cover many aspects (technical, social, organisational) and integrating them in the larger BN model;

- assess the impact of the different assumptions and BN inputs on the final joint probability related to a given top event (e.g. SBO).

Hence, a clear description based on existing PSA FTs/ETs should be used at first, in order to develop into a probabilistic description compatible with the BN approach. To build the technical sub-networks (e.g. flood defence failure, piping system failure, etc.), some physics-based numerical simulations can be used to account for realistic off- and on-site conditions and may be complementary to available data to define critical scenarios. Regarding the human and organisational sub-networks, they should include aspects related to human performance shaping factors, maintenance activities, etc.; a focus has to be made as well, on group processes and decision making at times of high pressure, i.e. in the case of accidental conditions.

## 3.3 Some key results expected from the NARSIS project

From a methodological point of view, the two main expected achievements of the project will provide the stakeholders with a useful basis to address a number of topics identified as relevant by the PSA community such as (see Sect. 2.3):

- the integrated multi-hazard framework enabling probabilistic modelling of the hazards combinations, and

- the dynamic BN multi-risk modelling approach derived for the safety assessment purposes of NPPs, integrating plant complexity (technical, social & organisational aspects) and multi-hazards scenarios. If applicable, the BN approach will also allow risk comparison considering different risk metrics.

In addition, the study of the importance of various plant systems in a multi-hazard context and the derivation of hazard-harmonized fragility models accounting for functional consequences and/or human factors, will enable to address the estimation of the secondary impacts in the assessment of external hazards.

Regarding single hazard PSAs and fragility assessment:

- the SSCs fragilities for flooding (including water propagation modelling) will be addressed;

- the cumulative effects of the solicitations (e.g. earthquake mainshock and aftershocks) and the ageing mechanisms (e.g. damaging phenomena, corrosion) of structural elements, will be integrated.
<figure><img src="image_7.png" /><figcaption>Fig. 5. Illustration of a very simplified BN construction considering combined hazard events (e.g. flooding & earthquake): each node corresponds to a full probability distribution.</figcaption></figure>

Moreover, as the experts' judgment is mandatory in the PSA of nuclear facilities, NARSIS intends to provide flexible approaches based on recent advances of the theory of uncertainty:

- to represent and aggregate the experts' judgments, managing possible controversial views and

- to propagate uncertainties in order to assess their impact on PSA results and hence, to better constrain the uncertainty engendered by the knowledge incompleteness.

The applicability, validity and robustness of the proposed advanced procedures in the safety assessment practice will be tested in situations where empirical data are scarce, incomplete, imprecise and vague (e.g. by using an expert-based knowledge modelling tool).

## 3.4 Dissemination and training activities in NARSIS

Different goals are sought within NARSIS regarding dissemination and training activities:

- raising awareness about the challenges of nuclear safety and shearing potential improvements provided by the project;

- informing and educating different target audiences as appropriate;

- engaging target audience groups and notably regulators and decision-makers to get input /feedback on their expectations;

- promoting the use of the project outputs and their implementation through practical knowledge transfer;

- raising public confidence in nuclear energy.

Regarding education and training activities, apart from master trainings and postdocs proposed in the project, 5 PhD theses have been launched in cooperation with universities, in order to cover a number of research topics useful for NARSIS:

- extreme weather characterisation;

- seismic fragility of ageing structures;

- vector-valued fragility functions for multi-hazards assessment;

- LATIN-PGD model reduction strategy for seismic response of structures;

- Bayesian networks integration framework for probabilistic risk assessment.

The project has also an on-going collaboration with the European Nuclear Education Network (ENEN). This will for instance permit to invite a number of selected students and young researchers to participate in the first NARSIS International Workshop to be held in Warsaw on September 2019 and which proposes a training on Probabilistic Safety Assessment for Nuclear Facilities (http://nuclear.itc.pw.edu.pl/narsis-workshop). At this occasion and all along the project duration, pedagogic materials and lectures targeted towards students (e.g. masters) and young researchers or professionals will be
produced. Proceedings of the two international workshops planned in the project will be also available through the NARSIS web site (http://www.narsis.eu).

Finally, regarding dissemination activities, apart from newsletters and participation in international conference (e.g. NUGENIA Forums, scientific conferences), the project has regular meetings with its International Advisory Board, which members are part of international organisations with close links to nuclear safety issues (NUGENIA, IAEA, JRC, etc.).

## 4 General conclusion

The ASAMPSA_E and the NARSIS projects prove that the European R&D framework is the convenient environment to develop and promote the improvement of the PSA methodologies and, by the way, contribute to the risk identification and assessment in nuclear industry.

New horizons for collaborative projects on PSAs in Europe shall be defined. They should promote and support the improvement of the methodologies, sustain the extension of the issues considered in PSAs as well as the sharing the knowledge upon the main and dominant contributions to NPP risk.

The building of a European Forum in this area, relying upon the network created through ASAMPSA_E, will be an intermediate step to stimulate the continuous development of European activities in this area in the aim at enhancing nuclear safety by design and operation.

The ASAMPSA_E and NARSIS projects have been co-funded by the European Commission and performed as part of the EURATOM 7th Framework and Horizon 2020 Programmes respectively, under contract 605001 (ASAMPSA_E) and 755439 (NARSIS).

## References

All ASAMPSA reports are available at http://asampsa.eu.

1. Lessons of the Fukushima Dai-ichi accident for PSA, ASAMPSA_E/WP30/D30.2/2017-32, January 2017

2. List of external hazards to be considered in ASAMPSA_E, ASAMPSA_E/WP21/D21.2/2017-4

3. Guidance for Decision Making based on Extended PSA – summary report) Vol. 1, ASAMPSA_E/WP30/D30.7/2017-31, Vol. 1

4. Methodology for Selecting Initiating Events and Hazards for Consideration in an Extended PSA, ASAMPSA_E/WP30/D30.7/2017-31, Vol. 2

5. Risk Metrics and Measures for an Extended PSA, ASAMPSA_E/WP30/D30.7/2017-31, Vol. 3

6. The Link between the Defence-in-Depth Concept and Extended PSA, ASAMPSA_E/WP30/D30.7/2017-31, Vol. 4

7. The PSA assessment of Defense-in-Depth – Memorandum and proposals, ASAMPSA_E/WP30/D30.7/2017-31, Vol. 5

8. Guidance document on practices to model and implement EARTHQUAKE hazards in extended PSA ASAMPSA_E/D50.15/2017-33-, Vol. 1&2

9. Guidance document on practices to model and implement FLOODING hazards in extended PSA, ASAMPSA_E/D50.16/2017-34-, January 2017

10. Guidance document on practices to model and implement EXTREME WEATHER hazards in extended PSA ASAMPSA_E/D50.17/2017-35

11. Guidance document on practices to model and implement LIGHTNING hazards in extended PSA, ASAMPSA_E/D50.18/2017-36

12. Guidance document on practices to model and implement BIOLOGICAL hazards in extended PSA ASAMPSA_E/D50.19/2017-37

13. Guidance document on practices to model and implement MAN-MADE HAZARDS AND AIRCRAFT CRASH in extended PSA, ASAMPSA_E/D50.20/2017-38

14. Best-Practices Guidelines for L2PSA Development and Applications, General, Reference ASAMPSA2, Technical report ASAMPSA2/WP2-3-4/D3.3/2013-35, dated 2013-04-30, Vol. 1

15. Best-Practices Guidelines for L2PSA Development and Applications, Best practices for the Gen II PWR, Gen II BWR L2PSAs, Extension to Gen III reactors, Reference ASAMPSA2, Technical report ASAMPSA2/WP2-3-4/D3.3/2013-35, dated 2013-04-30, Vol. 2

16. Best-Practices Guidelines for L2PSA Development and Applications, Extension to Gen IV reactors, Reference ASAMPSA2, Technical report ASAMPSA2/WP2-3-4/D3.3/2013-35, dated 2013-04-30, Vol. 3

17. Final guidance document for extended Level 2 PSA – Summary, Technical report ASAMPSA_E/WP40/D40.7/2017-39, Vol. 1

18. Guidance document on practices to implement External Events in L2 PSA, ASAMPSA_E/WP40/D40.7/2017-39, Vol. 2

19. Verification and improvement of SAM strategies with L2 PSA, ASAMPSA_E/D40.7, ASAMPSA_E/WP40/D40.7/2017-01, Vol. 2

20. Complement of existing ASAMPSA2 guidance for shutdown states of reactors, Spent Fuel Pool and recent R&D results, Technical report ASAMPSA_E/WP40/D40.6/2016-25, June 2016

21. Synthesis of the initial survey related to PSAs End-Users needs, Technical report ASAMPSA_E/WP10/D10.2/2014-05, January 2015

22. Synthesis report of the End-Users survey and review of ASAMPSA_E guidance, and final workshop conclusions. Identification of follow-up useful activities after ASAMPSA_E, ASAMPSA_E/WP10/D10.5/2017-40, January 2017

23. Bibliography – Existing Guidance for External Hazard Modelling, ASAMPSA_E/WP21/D21.1/2015-09, March 2015

24. Summary report of already existing guidance on the implementation of External Hazards in extended Level 1 PSA, ASAMPSA_E/WP22/D22.1/2015-11, August 2015
25. Summary report of already published guidance on L2 PSA for external hazards, shutdown states, spent fuel storage, ASAMPSA_E/WP40/D40.2/2014-08, December 2014

26. Bibliography on regulatory requirements on the implemen-
tation of defense in depth for nuclear power plants,
ASAMPSA_E/WP30/D30.1/2016-29, July 2016

27. P. Gehl, D. D'Ayala, Development of Bayesian Networks for the Multi-Hazard Fragility Assessment of Bridge Systems, Struct. Saf. **60**, 37 (2016)

28. P. Ladeveze, J.C. Passieux, D. Néron, The LATIN multi-scale computational method and the Proper Generalized Decomposition, Comput. Methods Appl. Mech. Eng. **199**, 1287 (2010)

Cite this article as: Evelyne Foerster, Emmanuel Raimond, Yves Guigueno, Probabilistic safety assessment for internal and external events/European projects H2020-NARSIS and FP7-ASAMPSA_E, EPJ Nuclear Sci. Technol. 6, 38 (2020)