E-Journal of Advanced Maintenance Vol.8-1 (2016) 23-31
Japan Society of Maintenology

Development of Resilience Evaluation Method for Nuclear Power Plant(Part 1: Proposal of Resilience Index for Assessment of Safety of Nuclear Power Plant
under Severe Accident)
Kazuyuki DEMACHI1, Masaaki SUZUKI1, Hiroshi MIYANO2, Shigeki ARAI4,Takao NAKAMURARAI3, Masaaki KAMAYA5, Atsunori YAMAGUCHI6, Tatsuya ITOI1,Naoto KASAHARA1, Kenta MURAKAMI1 and Masaaki MATSUMOTO7
1

School of Engineering, The University of Tokyo, 7-3-1 Hongo, Bunkyo, Tokyo 110-0033, JapanHosei University, 2-17-1 Fujimi, Chiyoda, Tokyo 102-8160, Japan
3Osaka University, 2-1 Yamadaoka, Suita, Osaka 565-0871, Japan
4Atomic Energy Society of Japan, 2-3-7 Shinbashi, Minato, Tokyo 105-0004, Japan
5
Institute of Nuclear Safety System, Inc., 64 Sata, Mihama-cho, Fukui 919-1205, Japan
6
Japan Society of Maintenance, 2-7-17 Ikenohata, Taito, Tokyo 110-0008, Japan
7
Mitsubishi Research Institute, Inc., 2-10-3 Nagata-cho, Chiyoda, Tokyo 100-8141, Japan
2ABSTRACTIn this research, we propose a new index “The Resilience Index” to evaluate the capability of nuclear powerplant to recover from the safety function loss situation. Three elements were assumed in order to evaluate theresilience index. These are the required function fulfilment rate L, necessary elapsed timeT, and probabilityof success X, for each accident management activity. The resilience index is expected to visualize theimprovement of safety of each nuclear power plant against severe accidents.

KEYWORDS
Resilience, Safety Assessment, Severe Accident, Accident Management,
System Safety

1.

ARTICLE INFORMATION
Article history:
Received 29 February 2016
Accepted 11 May 2016Introduction

After Fukushima Daiichi nuclear power plant accident, the capability of accident management(AM) to recover the important safety functions as soon as possible was recognized as highly
important for safety of nuclear power plants (NPPs). The AM capability of nuclear power plants torecover their safety function should be assessed considering the management scenario.
Each of these four series papers introduces “the Resilience Index” [1] that was developed by theMaintenance Index Subcommittee of Japanese Society of Maintenance, in concern with the following
topics; Basic Concept of Resilience Index (this paper), Reliability Assessment of Degradation of Static Equipment, Test Evaluation of Resilience Index for PWR,
 System Safety of Operating NPPs.

ISSN-1883-9894/10 © 2010 – JSM and the authors. All rights reserved.

23

K. Demachi, et al./Maintenance Index for System Safety Assessment for Aging Nuclear Power Plant

2.

Basic Concept of Resilience Index

2.1 What is Resilience of Safety Function?
“Resilience” means a capability to recover or restore to original state. Let us assume that the“Resilience” for NPP is the capability of AM to recover temporarily lost safety function such as thedecompressing function or the core cooling function, and so on.
Fig. 1 shows examples of safety function recovering curves due to AM scenarios (a. ~ d.) where
the plant safety rate is down to L = L0 at time t = T0, and then is recovered by AM. The path a.
corresponds to an AM scenario of quick and enough recovery of the lost safety function. The path e.
corresponds to an AM scenario of slow and insufficient recovery. The path e. intersects with the“irrecoverable domain,” that is surrounded by the time limit line and the necessary minimum safety
line. The paths intersecting with the “irrecoverable domain,” are decided to be “unsuccessful AMs.”
Conversely the AM scenarios avoiding an irrecoverable domain are "successful AMs". Here, we candefine several “Resilience Index;”1) The existence probability of the scenario paths of successful AMs.
2) Margin of converged safety
3) Margin to time-limit4) Minimum margin of safety
Try to assume that the paths in Fig. 1 are determined by three characteristic values of each AM;
1) Required function fulfillment rate: L2) Necessary elapsed time: T3) Probability of success: X

Fig.1 Resilience of Safety Function

2.2 AM scenario path
As shown in Fig. 2, an AM has a structure with layers of multiple stages of response. If the firststage fails or does not work sufficiently to restore the accident, the second stage will be executed. If
the second stage fails or does not work sufficiently to restore the accident too, the third stage will beexecuted. Of course, the true AM is more complicated, however, the existence probability of the AMscenario that does not intersect with the irrecoverable domain" may be evaluated by combining L,T and X mentioned above.

24

K. Demachi, et al./Maintenance Index for System Safety Assessment for Aging Nuclear Power Plant

Fig.2 Layered Accident Management

Fig. 3 shows the transitions of safety function recovery expressed by L, T and X. The safetyfunction is temporarily lost at time t = T0, then AMs consisting of layered responses are executed. The
recovery of safety function by the layered responses shown in Fig. 2 will be expresses by polygonal
pathways as Fig. 3. Here, the each AM is not independent to each other. So the safety function
recovery L and the elapsed time T are piled and summed. This is one of the biggest feature of“Resilience Index.”
The pathways will differ due to type and intensity of the hazards. Some pathways will intersectwith the irrecoverable domain and others will not. The probability of existence of the not intersecting
pathways can be thought as the sum of probability of successful AMs. Here, this probability is definedas the “Resilience Index.”

Fig.3 Resilience Index is obtained as the sum of probability of AM pathways without intersecting the irrecoverable
domain.

2.3 Expected Use of Resilience Index
One of the use of the resilience index is that it gives the comparison of the AM capability of each
NPP against hazards (Table 1). The second use is that the resilience index can visualize theimprovement of AM plans by the nuclear power company as the rising of the pathways (Fig. 4).

25

K. Demachi, et al./Maintenance Index for System Safety Assessment for Aging Nuclear Power Plant
Table 1 Comparison of Resilience Index Value of each NPP.

Fig.4 Improvement of AM Measure is visualized as the change of the AM management path.

3. Calculation Procedure of the Resilience Index
The procedure to calculate the resilience index is as follows,
1) Selection of accident sequence2) Deployment of AM scenario for the selected sequence3) Evaluation of L, T and X about all possible pathways for selected AM scenario.
4) Modeling of dependence of L, T and X upon the intensity of external hazards.
5) Setting of probability distribution of hazards
6) Resilience index is integration of AM scenario that avoids the irrecoverable domain.
3.1 Selection of accident sequence
The accident sequences that are designated in the examination guide “Standard Evaluation
Measure concerning effectiveness of preventive measures against damage of nuclear reactor andreactor containment vessel” by the Nuclear Regulation Committee (NRC) . The sequences for“prevention of severe damage of nuclear core” for BWR and PWR are as follows;
Sequences concerning severe core damage（BWR）
1) Loss of high and low pressure coolant water injection function
2) Loss of high pressure coolant water injection function and decompressing function3) Station blackout4) Loss of decay heat removal function

26

K. Demachi, et al./Maintenance Index for System Safety Assessment for Aging Nuclear Power Plant

5) Loss of reactor shutdown function
6) Loss of coolant water injection function at the time of LOCA
7) Bypass of Reactor Containment Vessel（Interface system LOCA）
Sequences concerning severe core damage（PWR）
1) Loss of heat removal from secondary cooling water system function2) Station blackout
3) Loss of component cooling water system function
4) Loss of heat removal of reactor containment vessel
5) Loss of reactor shutdown function
6) Loss of ECCS’s injection function
7) Loss of ECCS’s recirculation function
8) Bypass of Reactor Containment Vessel（Interface system LOCA, damage of steam generatorpiping）
3.2 Deployment of AM scenario for selected sequenceFig. 5 shows the example of AM scenario deployed for the “Loss of high and low pressure coolant
water injection function” of BWR. If the measure on the first stage succeeds to execute AMADS (AMAutomatic Decompression System) the reactor can be decompressed. If it fails, the SR (SafetyRelease) valve on the second stage will be operated to decompress the reactor. After this thedecompression is successful, if the AMLPCI (AM Low Pressure Coolant Injection) is executed, thecooling water can be injected into reactor to avoid reactor core damage. If the AMLPCI is not
executed sufficiently, the ECCS (Emergency Core Coolant System) on the second stage will be
executed to inject cooling water. Even then, if the safety function recovery is not enough, the MUW(Make Up Water) or pump vehicle will be used as the third stage to inject cooling water into reactor.

Fig.5 Example of AM scenario for Loss of High Pressure Cooling Water Injection Function and Loss ofDecompression Function

3.3

Estimation of Characteristic Values; L, T and X for each AM Pathway

Fig. 6 shows the AM pathways of j=1 and j=3 in the AM scenario shown in Fig. 5.

27

K. Demachi, et al./Maintenance Index for System Safety Assessment for Aging Nuclear Power Plant

Fig.6 Two AM paths for Loss of High Pressure Cooling Water Injection Function and Loss of Decompression
FunctionIn the j=1 pathway, the AMADS is operated to decompress the reactor, then AMLPCI and ECCS
are operated to inject cooling water into reactor. If the intensity of external hazard H is small,ΔL1(H,1)=1, ΔL2(H,1)=1 can be assumed for AMADS and AMLPCI. Then, for the pathway j=1, thetotal safety rate can be recovered up to L1 until the total elapsed time T1, where L1,2= L0+Min(ΔL1,ΔL2)= 1 and T1,2 = T0 +ΔT1(H,1)＋ΔT2(H,1). L0 and T0 are the initial safety rate and the initial elapsed
time respectively. The recovery pathway of safety rate can be expressed as the blue solid line in Fig.
7.
Here, the existence probability of j=1 pathway is defined as the probability for the decision thatAMADS and AMLPCI is to be applied, and then succeed to operate without failure due to degradationof equipment. If L0 is lower than the required minimum (=Lmin), AMADS and AMLPCI will bedecided to be applied. On the other hand, if L0 is higher than Lmin, they will be not be applied, because
the reactor’s safety rate exceeds the minimum required value. Similarly, T0 must be shorter than thetime-limit of core damage (=Tlim) in order to decide to apply AMADS and AMLPCI. Moreover, if they
are applied, they may work because of function loss by their degradation. Here the probability offunction loss of AMADS and AMLPCI are set as M1 and M2 that can be evaluated by the maintenanceindex value [2].
In such manner, the calculation of probability that j-th pathway is applied and succeed to beoperated should be evaluated considering these two elements;
1) Total safety rate until i-1-th AM action (=Lj,i-1) is less than the satisfactory safety rate (=Lsat), ornot.
2) The operated i-th AM action on j-th pathway succeeds with probability 1- Mi, where Mi is theprobability of failure by function loss due to degradation and Mi was defined as the“maintenance index” of i-th AM action [2].
The blue dotted line in Fig. 7 shows the recovery pathway of safety rate when j=1 and H is large.
Although ΔL 1(H,1)<1 and ΔL 2(H,1)<1 and then the total safety rate L1,2 = Min(ΔL 1, ΔL 2) cannot
reach to 1, L1,2 is larger than the satisfactory safety rate Lsat, there is no necessary to require more
accident managements.
In the recovery pathway j=3, AMADS and AMLPCI at the first stage are assumed not to work
enough or to fail, then so ECCS on the second stage is applied. But ECCS is assumed not to work
enough or to fail too, then so MUW and pump vehicles are applied on the third stage. The recovered
total safety rate and the total elapsed time of pathway j=3 can be calculated as L3,4 = L0 + Min(ΔL 1,ΔL 2)+ Min(ΔL 1, ΔL 3) + Min(ΔL 1, ΔL 4) < Lsat and T3,4 = T0 +ΔT1(H,3)＋ΔT2(H,3)+ ΔT3(H,3)＋
ΔT4(H,3).
In Fig. 7, the pathway j=4 is found to intersect with the irrecoverable domain. So this pathway is
judged to be the “failed pathway”.

28

K. Demachi, et al./Maintenance Index for System Safety Assessment for Aging Nuclear Power Plant

Fig.7 Probability of Hazard Strength and corresponding AM scenario paths

3.4 Model of dependency of ∆L, ∆T, ∆X upon the intensity of hazard (H)1) Required function fulfillment rate: LThe external hazard threshold C1, C2 for L(H, j) are determined for each AM. If there is noinfluence of external hazard H, the safety function works completely, L(H, j) = 1. If H exceeds C1,L(H, j) decreases linearly to zero during C1 < H < C2. L(H, j) is zero for C2 < H.

Fig.8 Dependency model of sufficiency rate of required performance of AM action upon the strength of hazard (H)2) Necessary elapsed time: T
The external hazard threshold C1, C2 for T(H, j) are determined for each AM. Here, we assumed
that if H is less than the higher threshold C2, the necessary elapsed time T(H, j) is equal to thedesigned value, T1. If H exceeds C2, here is no influence of external hazard H, the safety function
works completely, L(H, j) = 1. If H exceeds C1, this AM cannot be operated, so they move to thenext stage of AM.

Fig.9 Dependency model of necessary time of AM action upon the strength of hazard (H)3) Probability of success: X

29

K. Demachi, et al./Maintenance Index for System Safety Assessment for Aging Nuclear Power Plant

The probability of “success”, “failure” and “unnecessity” of each AM is determined using theintensity of hazard, H. “Unnecessity” means that the AM is not operated because the safety recovery L
has already satisfied the required function fulfilment rate Lsat. So, if L is larger than Lsat, X is zero.
“Success” and “failure” is applied when the AM needs to be operated because the safety recovery L
does not exceed Lsat until the previous AMs. These probability of “success” and “failure” areconsidered to be not affected by H, because the effect of hazard has already been considered at theevaluation of L(H, j) and T(H, j). So, X of “failure” corresponds to the probability that the AM
cannot be operated due to random failures and degradation, as X=M. So the probability of “success”
is X=1-M. Here, M is the “maintenance index” value [2] that is the predicted future probability ofloss of each function. The evaluation of M considers the random failure, degradation and maintenanceactivities.

Fig.10 Dependency model of success probability of AM action upon the recovered safety function of plant (L)

3.5 Evaluation of Resilience Index
Fig.11 shows the time-variation of plant safety by several AM pathways. Some pathways escapefrom intersecting to the irrecoverable domain. These are the “successful” AM pathways whose
coefficient  is 1. On the other hand, the coefficient  of the “failed” AM is 0. Then, the resilience
index was defined as the probability that the AM pathways can escape from intersecting to theunrecoverable domain as,I     H , j X ( H , j ) f ( H )dH ,0(1)jstep ( j )X ( H , j )   X i ( L ji ( H )) ,(2)i 1where f(H) is the probability that the hazard of intensity H occurs, and step(j) is the number of steps ofj-th AM pathway. The evaluation of I for every cases of accident sequences and hazards will give thecomparison table 1.

Fig.11 Calculation of Resilience Index Value from AM paths

30

K. Demachi, et al./Maintenance Index for System Safety Assessment for Aging Nuclear Power Plant

4.

Conclusion

A new index was proposed to estimate the reliability of nuclear power plant safety system overtime, taking into account aging and maintenance. This index will be useful to evaluate the impact ofmaintenance activity and to suggest improvements of maintenance protocols in order to increase of
the system safety.

Acknowledgement
This work has been performed as a part of the Japan Ageing Management Program on System Safety(JAMPSS) sponsored by the Nuclear Regulation Authority (NRA).

References[1] “Investigation about the frame of safety assessment index and assessment data for aging nuclearpower plants”, Results report of Japan Aging Management Program on System Safety for
Nuclear Power Plants by Nuclear Regulation Authority in 2016.
[2] “Investigation about the frame of safety assessment index and assessment data for aging nuclearpower plants”, Results report of Japan Aging Management Program on System Safety for
Nuclear Power Plants by Nuclear Regulation Authority in 2015.

31