E-Journal of Advanced Maintenance Vol.9 No.1 (2017) 1-14
Japan Society of Maintenology

Development of Resilience Evaluation Method for Nuclear Power Plants(Part 3: Study of Evaluation Method and Applicability of Resilience Index)
Masaaki SUZUKI1,* , Kazuyuki DEMACHI2, Hiroshi MIYANO3, Takao NAKAMURA4,
Masayuki KAMAYA5, Shigeki ARAI6, Atsunori YAMAGUCHI7, Tatsuya ITOI2, Kenta
MURAKAMI2, Naoto KASAHARA2 and Masaaki MATSUMOTO8
1Tokyo University of Science, 2641 Yamazaki, Noda-shi, Chiba 278-8510, JapanThe University of Tokyo, 7-3-1 Hongo, Bunkyo-ku, Tokyo 113-8656, Japan
3
Hosei University, 2-17-1 Fujimi, Chiyoda-ku, Tokyo 102-8160, Japan
4
Osaka University, 2-1 Yamadaoka, Suita-shi, Osaka 565-0871, Japan
5
Institute of Nuclear Safety System, Inc., 64 Sata, Mihamacho, Mikata-gun, Fukui 919-1205, Japan
6
Atomic Energy Society of Japan, 2-3-7 Shimbashi, Minato-ku, Tokyo 105-0004, Japan
7
Japan Society of Maintenology, 2-7-17 Ikenohata, Taito-ku, Tokyo 110-0008, Japan8
Mitsubishi Research Institute, Inc., 2-10-3, Nagatacho, Chiyoda-ku, Tokyo 100-8141, Japan
2

ABSTRACT
We have developed a new index, called the resilience index, that evaluates the dynamic stability of the systemsafety of a nuclear power plant during a severe accident by considering the ability to recover system safetyfunctions that have become lost in the situation. In this paper, a detailed evaluation procedure for the resilience
index is described. The system safety of a pressurized water reactor plant during a severe accident is thenassessed according to the resilience index in order to discuss the applicability of the index. We find that theresilience index successfully represents management capability and, therefore, the resilience capability of a
nuclear power plant.
KEYWORDS

ARTICLE INFORMATION

System Safety, Safety Assessment, Severe Accident, Accident Management,
Resilience, Safety Margin

Article history:
Received 12 October 2016
Accepted 29 May 2017

1.

Introduction

The word “resilience” has a large scope in terms of its definition and meaning, which aredependent on field and context. However, it typically means a system’s ability to adapt dynamically toperturbations due to changes inside and outside a system, to maintain normal operations in thefunctions it must fulfill, and to recover appropriately in the event of a loss of function (e.g., [1][2]).
An important representative example of resilience in the field of nuclear power is the ability of a
nuclear power plant to respond to situations that exceed its design bases.
When the safety of a nuclear power plant is assessed with regard to its ability to respond tosituations that exceed its design bases, in addition to risk assessments, resilience-based assessments
are essential to ensuring a plant’s safety and that its safety is highly robust. Such evaluations include
quantification and assessments of likelihoods and margins (e.g., functional margins, time margins,etc.) to determine how large they must be to maintain or recover safety-essential functions, as well as
assessments of how likelihoods and margins (“response margins”) change in response to elevatedhazard intensities and aging.
In this study, we define and evaluate a resilience index as an index of the ability of nuclear power
plants to respond to situations that exceed their design bases. The resilience index here is an aggregate
of probabilities and margins of functions essential to safety, which have been temporarily lost due to,for example, external hazards, being restored to minimum essential functional levels within therequired time through the execution of accident management (AM) strategies [3]. Regarding eachmeasure of AM strategies, probabilistic risk assessment (PRA) binary-logically evaluates whether
each measure is success or failure in accordance with the success criteria and does not indicate the*Corresponding author, E-mail: m-suzuki@rs.tus.ac.jp

ISSN-1883-9894/10 © 2010 – JSM and the authors. All rights reserved.

1

M. Suzuki, et al./ Development of Resilience Evaluation Method for NPP(Part 3: Study on Evaluation Method and Applicability of Resilience Index)
time required or the response margin explicitly. By contrast, resilience index evaluation ischaracterized by quantitatively evaluating the required time and response margin in consideration of
their accumulation and expressing them explicitly. Therefore, it is possible to evaluate the influenceon the response margin due to the change of the AM measures and maintenance activities including
education / training of personnel. In this manuscript, we present a specific evaluation procedure forthe resilience index, and perform a trial assessment for a simplified model of a pressurized water
reactor (PWR) plant in order to demonstrate its applicability.

2.

Evaluation Method for the Resilience Index

We consider a severe accident in which one or multiple functions critical to system safety are lost
due to an external hazard. Nuclear power plants execute AM strategies and take measures to recover
the safety functions that they have temporarily lost. The present study adopts the following
assumptions about how the recovery capacity for system safety should be evaluated (Fig.1):
 There exists a minimum level of safe functioning necessary to reach a target safety performance(hereafter “minimum safety function level”); moreover, there is usually a margin between safetyfunctional levels during normal operations and the minimum safety function level. Therefore,
after a severe accident occurs, it is not strictly necessary in the short term for the safety functionlevel to recover to the same level as during normal operations. We regard a system as having
recovered if it reaches the minimum safety function level.
 A system must recover to the minimum safety function level within a certain amount of time.
Therefore, there exists a time constraint.
 The success or failure of each measure comprising the AM strategy is probabilistic, being
dependent on ambient conditions. Therefore, it is probabilistic which AM sequence (i.e., aprogress path to recovery of safety function) takes place.
In this case, the probability of successful recovery of system safety can be evaluated as the integrated
value of the occurrence probabilities of all AM sequences that lead to recovery (i.e., the probability of
avoiding the “Recovery Impossible” Region in Fig.1). The response margins can be evaluated as the
distance of the progress curve of each AM sequence from the “Recovery Impossible” Region.
Moreover, we combine the occurrence probability of each AM sequence with the response margins to
calculate the statistics of the response margins, and evaluate the reliability of the plant level response
capability.

Fig.1. Recovery of safety function

2.1. Resilience Index Evaluation Procedure
We describe a specific evaluation procedure for the resilience index. During the evaluation, we

2M. Suzuki, et al./ Development of Resilience Evaluation Method for NPP(Part 3: Study on Evaluation Method and Applicability of Resilience Index)
consider temporal changes in a system’s safety function level. The workflow of the evaluation is asfollows:
1) Assumption of an Accident Scenario
2) Formulation of AM strategy
3) Analysis of AM sequences
Creation of AM event tree4) Evaluation of characteristic values of each AM measure
Evaluations of execution failure probability, required time, and functional margin5) Evaluation of Resilience Index
Evaluation of occurrence probability, cumulative required time,system functional margin, time margin, and recovery success or failure ofeach AM sequence6) Extraction of vulnerabilities
Importance analysis and resistance assessment
2.1.1. Assumption of an Accident Scenario
We evaluate and establish assumed hazards and the damage status of the plant under analysis
after investigating the plant’s structure and characteristics and after identifying an accident sequence
deemed important from a risk standpoint. We can apply data from past PRA and AM strategy
formulations.
2.1.2. Formulation of AM Strategy
With regard to the plant damage status established in Section 2.1.1, we analyze which measuresand actions made by operating personnel related to the recovery of safety function are feasible, andestablish an AM strategy. In addition, we evaluate and establish a time constraint for the timenecessary to reach minimum safety function level. We can apply data from past PRAs and AM
strategy formulations.
2.1.3. Analysis of AM Sequences (Creation of AM Event Tree)
We model the AM sequence in order to evaluate the progress of system recovery. Based on theplant damage status and AM strategy established through the previous subsection, we create an AM
event tree with each AM measure as headings, and identify all AM sequences that could occur.
At this time, we model the generation of functional and temporal margins in successive measures,
even for partial recoveries (i.e., when the extent of functional recovery due to a given measure in the
AM strategy has not reached the necessary level). In other words, success and failure of a given AM
measure (i.e., AM event tree heading) is determined after taking into account the accumulation ofpartial functional recoveries resulting from preceding AM measures. For example, assume a watersupply functional level of 100 [m3/h] is considered necessary. In the event that execution of the firstwater supply measure is successful, but for some reason the water supply function halts at 60 [m3/h],
subsequent water supply measures are executed, while the measure is deemed an “execution success”
but a “functional recovery failure”. Here, because there is partial functional recovery (60 [m3/h]) fromsuccessful execution of the first water supply measure, we judge the second water supply measure to
be a “functional recovery success” if it can achieve functioning of 40 [m3/h], in consideration of the
cumulative amount.
2.1.4. Evaluation of Characteristic Values of Each AM Measure
We consider the execution failure probability, required time, and functional margin described
below as quantities that characterize each measure in the AM strategy, and evaluate each individually.
Here, we take into account ambient conditions at the time of the accident, including hazard intensities.
(a) Evaluation of Execution Failure Probability
We create a fault tree for each AM measure, the top event of each of which is the execution3

M. Suzuki, et al./ Development of Resilience Evaluation Method for NPP(Part 3: Study on Evaluation Method and Applicability of Resilience Index)
failure of that measure. The creation of the fault trees takes into account: Damage to structures and components due to external forces; Deterioration of structures and components due to aging and random failures; and Human error.
We perform fragility assessments, aging assessments, and human reliability assessments for theevaluation of each of the above factors, and evaluate the execution failure probabilityof the AM
measure in question i. In addition, we can utilize the measure of the maintenance index [4] for the
aging assessments. Moreover, we take into account ambient conditions at the time of the accident as,
for example, the influence of a stressful situation on a human error probability for the humanreliability assessments.
(b) Evaluation of Required TimeWe evaluate the timerequired to execute each AM measure i. We can utilize data obtained
from training results. Moreover, we take into account ambient conditions at the time of the accident as,
for example, the influence of workplace accessibility and workability on the required time.
We consider the required time to be
0 in the event that the AM measure in question cannot
be executed, owing to, for example, loss of function of equipment whose operation was expected.
(c) Evaluation of Functional Margin
We evaluate the size of the margin between the functional level expected of each AM measure
and the minimum safety function level. For this purpose, we evaluate the type and level of thefunction possessed by each AM measure. (For example, we evaluate the measure Water injection byhigh pressure coolant injection system as a type of Water supply function with a level of 150 m3/h. In
addition, we calculate the minimum safety function level for each function, e.g., 100 [m3/h]. Here, foras the ratio of the functional level of theeach AM measure i, we define the functional margin
measure to the minimum safety functional level, e.g., 150 [m3/h] / 100 [m3/h] = 1.5. This is essentiallythe margin with respect to the minimum safety function level.
For realistic assessments, we employ the best estimate from, for example, a safety analysis as theminimum safety function level. A conservative treatment—such as by employing a design value—isalso acceptable in the event of an unclear best estimate.
2.1.5. Evaluation of Resilience Index (Quantification of AM Sequence, Assessment of AM
Effectiveness)
In order to evaluate the cumulative value of the occurrence probabilities in the AM sequenceleading to recovery of system safety and response margins, we use the AM event trees created andestablished through the previous subsection, as well as the characteristic values of each AM measure
to evaluate the occurrence probability, the cumulative required time, the system functional margin,
time margin, and the recovery success or failure of each AM sequence.
(a) Evaluation of Occurrence Probability for each AM Sequence
From the success and failure probabilities at each heading (AM measure) assessed in Section
2.1.4(a), we derive the conditional occurrence probability,of each AM sequence j withrespect to an hazard intensity a and plant damage status x evaluated and established in Section 2.1.1.
(b) Evaluation of Cumulative Required Time for each AM Sequence
From the required time of each AM measure assessed in Section 2.1.4(b), we derive thefor each AM sequence j.
cumulative required time(c) Evaluation of System Functional Margin for each AM Sequence
From the functional margin for each AM measure assessed in Section 2.1.4(c), we derive thesystem functional margin as described below for each AM sequence j in order to evaluate the extent ofrecovery of system safety.
For an AM strategy arranged in a series system (e.g., the one shown in Fig.2), the AM strategy inquestion fails (recovery failure sequence) in the event of the functional level of any measure falling
below the minimum safety function level (i.e., having a functional margin of <1). Therefore, we
defineas the system functional margin, and derive it as follows:4M. Suzuki, et al./ Development of Resilience Evaluation Method for NPP(Part 3: Study on Evaluation Method and Applicability of Resilience Index)
min

(1)

where
is the functional margin of the i th AM measure. Here, the functional level possessed byeach individual AM measure is dependent on hazard intensity (for example, the possibility offunctional decline due to partial damage to equipment caused by seismic motion). Accordingly, thefunctional margin, system functional margin, and system recovery success or failure are also
dependent on hazard intensity.

Fig.2. Example calculation of System functional margin in series system

For an AM strategy arranged in a parallel system (e.g., the one shown in Fig.3), every measure
has a functionally redundant measure, even in the event of the functional level of the measure inquestion falling below the minimum safety function level (i.e., having a functional margin of <1).
Accordingly, we define and derive the system functional margin as:∑(2)Here, in the event that the best estimate is unclear and a design value is employed as the minimum
safety function level, it is acceptable to employ the design value of the measure with the lowest
functional value within the measures comprising the parallel system in question as the minimum
safety function level.

Fig.3. Example calculation of System functional margin in parallel system

For an AM strategy arranged in a series-parallel system (e.g., the one shown in Fig.4), we can5

M. Suzuki, et al./ Development of Resilience Evaluation Method for NPP(Part 3: Study on Evaluation Method and Applicability of Resilience Index)
combine the above definitions for series systems and parallel systems to derive the system functional
margin.

Fig.4. Example calculation of System functional margin in series-parallel system(d) Evaluation of Time Margin for each AM Sequence
From the time constraint
evaluated and established in Section 2.1.2 and the cumulativerequired time
, we derive the time margin
as defined below for each AM sequence j:⁄(3)(e) Evaluation of Recovery Success or Failure for Each AM Sequence
We judge the recovery success or failure of each AM sequence based on the system functional
margin (or time margin) for each AM sequence evaluated above. If the system functional margin
at a time point when the time constraint
has elapsed becomes ≥1 (or, the time margin
at atime point when the minimum safety function level has achieved becomes ≥1), the recovery progress
path does not pass through the “Recovery Impossible” Region, and we consider the AM sequence inquestion j a recovery success.
Based on the results in Subsections 2.1.5(a)–(e) above, we derive the conditional probability ofsuccessful system recovery,
for an assumed hazard intensity a and plant damage status x
using the following equation:
∑

,

,

(4)

Here,
,
is the conditional occurrence probability of AM sequence j’ leading to a successful
recovery.
In addition, we evaluate the reliability of the plant level response capability. Here, we focus on
the probability distribution of the system functional margin at a time point when the time constraint
has elapsed and the probability distribution of the time margin at a time point when the minimum
safety function level has achieved (Fig.5). From the expectation values,
and the standard,

deviationsof、, we derive the plant level response margin、 asdefined below respectively:
∑

(5)

∑

(6)

6

M. Suzuki, et al./ Development of Resilience Evaluation Method for NPP(Part 3: Study on Evaluation Method and Applicability of Resilience Index)
⁄

∑

(7)

⁄

∑

(8)
⁄
⁄

(9)
(10)

Fig.5. Schematic illustration of plant level response margin2.1.6. Extraction of Vulnerabilities (Importance Analysis, Resistance Assessment)
We perform an importance analysis and an assessment of the dependence of the resilience index
on hazard intensity. Their purpose is to clarify the relationship of the reliability, availability, andresponse capacities of each component and essential personnel with the recovery capacity for systemsafety, as well as to understand latent vulnerabilities.

3.

Evaluation conditions

As a case study, we performed a trial evaluation of the recovery capacity for system safety basedon the concept of the resilience index for two different cases of AM strategies. We applied an accident
sequence group defined in the Screening Guide for Effectiveness Assessments of Core Damage
Prevention Measures and Containment Failure Prevention Measures for Commercial Power Reactors
for PWR plants by Japan’s Nuclear Regulation Authority.
3.1. Assumption of Accident Scenario
We suppose the accident scenario Loss of heat removal function from the secondary coolingsystem from within the screening guide. This scenario comes from an accident sequence group
designated as applicable to assessments of the effectiveness of measures for prevention of coredamage in PWR plants. This risk-dominant accident sequence assumes the loss of the heat removal
function from the secondary cooling system, a function fulfilled by the auxiliary feed water system,and the main steam relief valve or safety valve. In addition, we assume an earthquake as the hazard.
3.2. Formulation of AM Strategy
The screening guide shows example strategies of using feed-and-bleed by means of a power

7

M. Suzuki, et al./ Development of Resilience Evaluation Method for NPP(Part 3: Study on Evaluation Method and Applicability of Resilience Index)
operated relief valve and high pressure coolant injection system, and using a steam generator for analternative method for decay heat removal.
Here, we suppose the two cases of AM strategies below, and compare the results of their trial
assessments.
Case A: Considering Only Heat Removal from the Primary System (Fig.6).
This strategy aims
to stably cool the reactor core through the below steps:
1. Water injection by high pressure coolant injection system;
2. Primary system depressurization by power operated relief valve; and3. Reactor core cooling by residual heat removal system.

Fig.6. Accident management procedure: Case A

Case B: Considering Heat Removal from Both the Primary and Secondary Systems (Fig.7).
In
addition to heat removal from the primary system in Case A above, this strategy takes into accountheat removal from the secondary system. Because the heat removal equipment in the safety system of
the secondary system has lost functionality, AM equipment must be furnished in the form of heatremoval equipment. We provide for the two pieces of equipment below: equipment for water injection
into the steam generator (S/G), and equipment for releasing steam.
4. Portable S/G water supply equipment and5. AM main steam relief valve.
In addition, the following non-safety-system equipment can be utilized during this accident:
6. S/G water filling system.

Fig.7. Accident management procedure: Case B

In addition, we establish the time constraint as approximately 29 minutes after event occurrence.

8M. Suzuki, et al./ Development of Resilience Evaluation Method for NPP(Part 3: Study on Evaluation Method and Applicability of Resilience Index)
This value was chosen with reference to effectiveness assessments of severe accident
countermeasures conducted by electric power companies operating PWR plants. However, we
subtract 10 minutes for situation assessment, and use 19 minutes as the time constraint for trial
assessment calculations.
3.3. AM Sequence Analysis (Creation of AM Event Tree)We create AM event trees for the AM strategies of the two aforementioned cases. The AM
strategy for Case A forms the series system shown in Fig.2. This is because the strategy results inrecovery failure in the event of the functional level of any of the constituent measures dropping below
the minimum safety function level. Four paths constitute the sum of all AM sequences that could
occur in Case A. The AM strategy for Case B is a parallel system, since the water supply measurefulfilled by the portable S/G water supply equipment is redundant with the water supply measurefulfilled by the S/G water-filling system. In addition, these water supply measures have a series
relationship with the heat emission measure fulfilled by the AM main steam relief valve (i.e., recovery
fails if both of the water supply measures fail, or if the heat emission measure fails). Furthermore, theredundancy of the heat removal from the secondary system with the heat removal from the primarysystem forms a parallel system. Thus, this AM strategy forms a series-parallel system. Thirty-ninepaths constitute the sum of all AM sequences that could occur in Case B.
3.4. Evaluation of Characteristic Values of each AM Measure
For simplicity, in this manuscript, we consider only the primary equipment among the equipment
and facilities expected to operate at each measure, and decide to not take into account human error.
(We assume that the essential personnel are ideally trained.)(a) Evaluation of Execution Failure Probability
Fragility Assessment: Because we have assumed earthquakes are the hazard in the trial assessment
conditions, we configure the seismic fragility parameters Am, βR, and βU for typical equipment in eachmeasure with reference to PRA data from electric power companies operating PWR plants [5], andcalculate the fragility curve f(a): lna / Am   U   1  p  f a   
R



(11)

Here, p is reliability; we set it at 50% in this manuscript.
Aging Assessment:
We established failure rates by taking into account, in a simplified way, theinfluence of aging and maintenance activities for typical equipment in each measure. We did this withreference to NUCIA data, and also based on the concept of the maintenance index [4]. The
maintenance index is an indicator representing the reliability of safety-critical functions for nuclear
power plants, which incorporates the effects of aging and maintenance activities. For the assessmentof the failure rate of dynamic equipment within the evaluation procedure for maintenance index, forexample, one breaks down the failure rates for each failure mode by grouping them by cause, and thenconsiders time dependence. Then, increases and decreases in failure rate due to a variety ofmaintenance activities can be evaluated. At this time, we model the differences in effective
maintenance activities according to causes of failure. In this trial assessment, for example, we set thestart-up failure probability of the electrical pump at 4.3E−05 [1/demand]. Here, we consider thestart-up failure-related deterioration factors of immobility of the sliding portion and deterioration ofelectrical instrumentation and control system. We set the contributions to start-up failure of each (i.e.,
the proportion of each cause within the number of cases of start-up failure) as 9:1 based onengineering judgment. Here, for simplicity, if we assume that sliding portions are regularly checkedby means of periodic tests at appropriate intervals, the only continuous deterioration is of theelectrical instrumentation and control system. Therefore, we factor in the above contribution to set theequipment failure rate at 4.3E−05 × 0.1 = 4.3E−06 [1/ Demand].
(b) Evaluation of Required Time

9

M. Suzuki, et al./ Development of Resilience Evaluation Method for NPP(Part 3: Study on Evaluation Method and Applicability of Resilience Index)
We configure the required times for each measure with reference to the results of effectivenessevaluations of severe accident countermeasures conducted by electric power companies managing
PWR plants [6]. We do not take into account the dependence of required time on hazard intensity.
(c) Evaluation of Functional Margin
We establish the functional margins for each measure with reference to equipment design
specifications written in establishment license applications. For conservation analysis, we employ
design values for minimum safety function levels. We do not take into account the dependence offunctional margins on hazard intensity.
The characteristic values for each AM measure used in the trial assessment are shown in Table 1.
Table 1 Evaluation condition
AM measure

Typical equipment

Fragility

1

Electricalpump(150 [m3/h])
Air-operated
valve(100 [m3/h])Electricalpump andvalve
Electricalpump(160 [m3/h])
Air-operated
valve(180 [m3/h])Electricalpump(160 [m3/h])

Am
=
[G]
Am
=
[G]
Am
=
[G]
Am
=
[G]
Am
=
[G]
Am
=
[G]

2

3

4

5

6

4.

Water injection byhigh pressure coolant
injection system
Depressurization by
power operated relief
valve
Reactor core coolingby residual heatremoval system
Water injection into
S/G by portableequipment
Depressurization by
AM main steam relief
valve
Water injection into
S/G by S/G water
filling system

x2

x3

x2

x1

x1

x1

Failure rate
[1/Demand/unit]

Required
time
[min]

Functional
marginbR = 0.08
bU = 0.17

4.3E-06

1.5

1x2=2

4.80

bR = 0.21
bU = 0.25

1.5E-06

1.5

1x3=3

4.13

bR = 0.13
bU = 0.23

7.7E-06

3

1x2=2

3.01

bR = 0.15
bU = 0.50

4.3E-06

10

1.07

5.00

bR = 0.21
bU = 0.25

1.5E-06

3

1.8

3.03

bR = 0.20
bU = 0.19

4.3E-06

3

1.07

1.03

Results and discussion

4.1. Resilience Index Assessment (Quantification of AM Sequences, Assessment of AM
Effectiveness)
Based on the assessment conditions in the previous chapter, we evaluated the cumulative
occurrence probability of each AM sequence leading to recovery of system safety, and the response
margins.
AM Case A: Considering only Heat Removal from the Primary System. The occurrence probabilityof each AM sequence obtained for a configured hazard intensity of a = 0.0 [G] is shown in the left
side of Fig.8. Sequence 1, in which AM Measures 1, 2, and 3 were all successful, occurred as thedominant path. The right side of Fig.8 is a time history of the system functional margin, and shows therecovery paths of each AM sequence: the large arrow is the recovery path of Seq. 1. The system
functional margin MF reaches 2.0 (>1.0) in a total required time of 6 min (<19 min): the recovery
sequence can be seen to be successful because it does not pass through the established “Recovery
Impossible” Region (the shaded area in the figure). Sequences other than Seq. 1 are failed recovery
sequences: the conditional probability of successful system recovery is PRecov(a = 0, x) = 1 −7.78E−11.
Similarly, the occurrence probability of each AM sequence obtained for a configured hazard
intensity of a = 3.0 [G] is shown in the left side of Fig.9. Within the chart, the white portion represents

10

M. Suzuki, et al./ Development of Resilience Evaluation Method for NPP(Part 3: Study on Evaluation Method and Applicability of Resilience Index)
the successful recovery sequences and the shaded portion represents the failed recovery sequences.
For a = 3.0 [G], the major sequence Seq. 2 occurs in addition to Seq. 1. In Seq. 2, AM Measure 1(water injection by high pressure coolant injection system) and AM Measure 2 (depressurization ofprimary system by power operated relief valve) both succeed, but AM Measure 3 (reactor corecooling by residual heat removal system) fails. The conditional probability of successful system
recovery here is PRecov(a = 3.0, x) = 0.48. The probability distributions of the response margins can bederived from the occurrence probability of each AM sequence obtained following Section 2.1.5(a) and、of each AM sequence as shown in the right side of Fig.9. Using the equations
0.96,
0.96. For a = 5.0 [G], recovery(5)–(10), we obtain the plant level response margins
failure sequences are dominant, including Seq. 4, in which AM Measure 1 fails. Here, the conditional
probability of successful system recovery is PRecov(a = 5.0, x) = 2.62E−06.

Fig.8. Occurrence probability of each AM sequence (Left) andtime series of system functional margin (Right): AM Case A, a = 0.0 [G]

Fig.9. Occurrence probability of each AM sequence (Left) andprobability distribution of response margin (Right): AM Case A, a = 3.0 [G]

AM Case B: Considering Heat Removal from both the Primary and Secondary Systems. The
occurrence probability of each AM sequence obtained for a configured hazard intensity of a = 0.0 [G]is shown in the left side of Fig.10. Sequence 1 occurs as the dominant path: in it, AM Measure 6 (S/G
water supply by S/G water-filling system) and AM Measure 5 (depressurization by AM main steam
relief valve) succeed. The right side of Fig.10 shows the recovery paths of each AM sequence: thelarge arrow is the recovery path for Seq. 1. The system functional margin MF reaches 1.07 (>1.0) in a
total required time of 6 min (<19 min): it can be seen to be a successful recovery sequence. The
conditional probability of successful system recovery is PRecov(a = 0, x) = 1 − 1.17E−16.
If we compare Fig.10 and Fig.8 (the result of AM Case A), we see that the conditional
probabilities of successful system safety recovery are equal at approximately 1. In this trial

11

M. Suzuki, et al./ Development of Resilience Evaluation Method for NPP(Part 3: Study on Evaluation Method and Applicability of Resilience Index)
assessment, AM case B is a strategy in which AM measures with relatively low functional margin are
executed first (Fig.7 and Table 1). When the hazard intensity is small and the execution failure
probability of each AM measure is sufficiently low, therefore, the response margin of the dominant
AM sequence is relatively small. Nonetheless, more sequences having larger latent response margins
exist in AM Case B (which provided for a greater variety of AM measures). We successfully
visualized this finding quantitatively.
Similarly, the occurrence probability of each AM sequence obtained for a configured hazard
intensity of a = 3.0 [G] is shown in the left side of Fig.11. For a = 3.0 [G], the failed recovery
sequence Seq. 33 occurred in addition to the successful recovery success sequences Seq. 27 and Seq.
32. In Seq. 33, heat removal from the secondary system fails because of the failure of AM Measures 5
and 6, and, moreover, heat removal from the primary system fails because of the failure of AM
Measure 3. Here, the conditional probability of successful system recovery is PRecov(a = 3.0, x) = 0.75.
The right side of Fig.11 are the probability distributions of the response margins. Using the equations(5)–(10), we obtain the plant level response margins
1.46,
1.70. Comparing this with theresults of AM Case A at the same hazard intensity, a = 3.0 G, (Fig.9; PRecov(a = 3.0, x) = 0.48;
0.96,0.96) revealed that both the probability of successful system recovery
and theplant level response margins rose. We thus achieved a quantitative effectiveness assessment of AM
strategy modifications and improvements from both viewpoints of the probability of successful
recovery and the margin. For a = 5.0 [G], recovery failure sequences are dominant: the conditional
probability of successful system recovery is PRecov(a = 5.0, x) = 4.27E−03.

Fig.10. Occurrence probability of each AM sequence (Left) andtime series of system functional margin (Right): AM Case B, a = 0.0 [G]

Fig.11. Occurrence probability of each AM sequence(Left) andprobability distribution of response margin (Right): AM Case B, a = 3.0 [G]

4.2. Extraction of Vulnerabilities

12M. Suzuki, et al./ Development of Resilience Evaluation Method for NPP(Part 3: Study on Evaluation Method and Applicability of Resilience Index)
4.2.1. Importance analysis
In order to quantitatively assess the effects of each AM measure on the recovery capacity forsystem safety, in this trial assessment we firstly calculate FVe (equivalent to the Fussell–Vesely
measure) and RAWe (equivalent to risk assessment worth (RAW)) from the conditional probability ofsuccessful system recovery, PRecov(a, x), using the following equations respectively:

FVe ( a, x ) 

1  PRe cov a, x   1  PRe cov a, x  P 0 
1  PRe cov a, x RAW e ( a , x ) f1  P

a, x  P 1 
1  PRe cov a, x 
Re cov

(12)

(13)

f

For AM Case B, the calculation results for hazard intensity a = 3.0 [G] are shown in Fig.12. Under theconditions of this trial assessment, AM Measure 5 (depressurization by AM main steam relief valve)and AM Measure 3 (reactor core cooling by residual heat removal system) were extracted based on
their importance to the probability of successful recovery.
In addition, we evaluate the sensitivity of the plant level response margins to functional margin
and required time of each AM measure. For AM Case B, the evaluation results for hazard intensity
a = 3.0 [G] are shown in Fig.13. Under the conditions of this trial assessment, functional margin of
AM measure 4 (water injection into S/G by portable equipment) and AM Measure 5 (depressurization
by AM main steam relief valve) were extracted based on its importance to the plant level functional
margin. Required time of AM measure 4 (water injection into S/G by portable equipment) was
extracted based on its importance to the plant level time margin.
4.2.2. Resistance Assessment
We varied hazard intensity from 0.0 to 5.0 [G] at 0.5-G intervals. The results of an assessment of
the dependence of conditional probability of successful system recovery on hazard intensity are
shown in Fig.14. In the figure, the results corresponding to AM Case A and AM Case B are shown
together. As stated before, we find that the probability of successful system recovery has risen forCase B, owing to the increased number of successful recovery sequences, which is a result ofincorporating measures for heat removal from the secondary system. Looking at the graph from theperspective of the cliff edge effect, both AM Cases broadly share the trend of the probability ofsystem safety recovery dropping dramatically in the vicinity of a =3.0 [G]. This is because, under theconditions of this trial assessment, the fragility of Measure 5 (depressurization by AM main steam
relief valve), which has the smallest seismic resistance margin among the measures for heat removalfrom the secondary system, is similar to the fragility of Measure 3 (reactor core cooling by residual
heat removal system), which has the smallest seismic resistance margin among the measures for heatremoval from the primary system (Am = 3.03 [G] and 3.01 [G], respectively). These results
corroborate the results of the importance value analysis in the previous subsection.

13

M. Suzuki, et al./ Development of Resilience Evaluation Method for NPP(Part 3: Study on Evaluation Method and Applicability of Resilience Index)

Fig.12. Importance values equivalent to FV and RAW importance: AM Case B, a = 3.0 [G]

Fig.13. Sensitivity of plant level response margin tofunctional margins and required time of each AM
measure: AM Case B, a = 3.0 [G] (Symbols are incommon with those of Fig.12)

5.

Fig.14. Hazard intensity dependency of
success probability of system recovery

Conclusion

We demonstrated a specific evaluation procedure for our proposed resilience index, a measure foruse in assessments of system safety in nuclear power plants with respect to situations that exceed theirdesign bases. During the assessment, we considered margins with respect to a minimum safetyfunction level and a time constraint, as well as their temporal changes. In addition, for a simplified
PWR plant model, we conducted a trial assessment of the recovery capacity for system safety basedon the concept of the resilience index for the accident sequence Loss of heat removal function from thesecondary cooling system, as defined in a screening guide by the Nuclear Regulation Authority ofJapan. Basing our analysis on the concept of the resilience index made possible the following: aquantification of AM sequences leading to recovery of system safety; a quantitative analysis of
response margin, response reliability, and successful recovery probabilities resulting from AM
strategy modifications and improvements, as well as changes in the successful recovery probabilities’
dependences on hazard intensity; and a quantitative evaluation of the effects of each AM measure on
recovery capacity for system safety. Trial assessments and investigations that specifically take into
account human error are important topics for future research.

Acknowledgement
This work has been performed as a part of the Japan Ageing Management Program on System
Safety sponsored by the Nuclear Regulation Authority.

References[1] E. Hollnagel, D.D. Woods and N. Leveson (Eds.): “Resilience engineering: Concepts and precepts”,
Ashgate Publishing Co. (2006).
[2] L. Carlson, G. Bassett, W. Buehring et al.: “Resilience: Theory and applications”, Argonne National
Laboratory, ANL/DIS-12-1 (2012).
[3] K. Demachi, M. Suzuki, H. Miyano et al.: “Development of resilience evaluation method for nuclear

14

M. Suzuki, et al./ Development of Resilience Evaluation Method for NPP(Part 3: Study on Evaluation Method and Applicability of Resilience Index)
power plant (Part 1: Proposal of resilience index for assessment of safety of nuclear power plant under
severe accident)”, E-Journal of Advanced Maintenance, Vol.8, No.2, pp.23-31 (2016).
[4] K. Demachi, H. Miyano, S. Arai et al.: “Maintenance index for system safety assessment for aging nuclear
power plant”, E-Journal of Advanced Maintenance, Vol.7, No.3, pp.199-205 (2015).
[5] Atomic Energy Society of Japan: “A standard for procedure of seismic probabilistic safety assessment for
nuclear power plants 2007”, AESJ Standards, AESJ-SC-P006:2007 (2007).
[6] Kyushu Electric Power Company: “Effectiveness evaluations of severe accident countermeasures in No.1
and No.2 reactor at Sendai nuclear power plant”, Materials for Review of No.1 and No.2 Reactor at Sendai
Nuclear Power Plant, SA-004, Rev.68 (2014). (In Japanese)15