Safety grading method, system and equipment based on risk guidance technology and medium

Abstract

The invention relates to a safety grading method, system and equipment based on a risk guidance type technology and a medium. The method comprises the steps of obtaining failure modes and corresponding failure probabilities of a to-be-evaluated item in an internal event and an external event; inputting the failure mode and the failure probability of the to-be-evaluated item in the internal event into the internal event probability safety evaluation model to obtain an internal risk measurement value, and determining the safety importance level of the to-be-evaluated item according to the risk measurement value; when the security importance level is low security importance, inputting the failure mode and the failure probability of the to-be-evaluated item in each external event into a probabilistic security evaluation model corresponding to the external event to obtain each external risk metric value, and updating the security importance level of the to-be-evaluated item according to the internal and external risk metric values; and when the updated security importance level is low security importance, performing depth defense assessment, and updating the security importance level of the to-be-assessed item according to an assessment result. According to the invention, the accuracy of safety importance grade division is improved.

Description

Technical Field

[0001] The present invention relates to the field of nuclear power technology, and in particular to a safety grading method, system, equipment and medium based on risk-guided technology. Background Art

[0002] Safety is the cornerstone of nuclear power, and the guarantee of nuclear safety depends on whether the structures, systems and equipment (hereinafter referred to as "SSC" or "items") that realize the three basic safety functions are highly reliable. In this regard, my country's nuclear safety regulations require that all nuclear power operating units and / or designers must carry out item classification for nuclear power plant items, including safety classification, seismic classification, selection of engineering design rules, and quality assurance classification. Among them, "safety classification" divides nuclear power plant items into two categories: safety level and non-safety level. For safety-level items, requirements that exceed ordinary commercial standards or industrial standards are stipulated to ensure that these important items can complete their intended design functions under design basis conditions.

[0003] The safety classification method based on traditional determinism is conservative to a certain extent, which will increase the management burden of some safety-level but non-safety-critical equipment to a certain extent, and may also ignore the potential risks of some non-safety-level but safety-critical equipment to power plant operation. Therefore, it is necessary to provide a safety classification method, system, equipment and medium based on risk-guided technology. Summary of the invention

[0004] In view of the shortcomings of the prior art mentioned above, the purpose of the present invention is to provide a safety classification method, system, equipment and medium based on risk-guided technology, which improves the problem that the prior art divides safety importance levels according to determinism, lacks comprehensive evaluation of multiple risk factors, and leads to low accuracy.

[0005] To achieve the above-mentioned purpose and other related purposes, the present invention provides a safety grading method based on risk-guided technology, including: obtaining the failure mode and corresponding failure probability of the item to be evaluated in internal events and each external event; inputting the failure mode and corresponding failure probability of the item to be evaluated in internal events into the probabilistic safety evaluation model of the internal event to obtain the internal risk measurement value of the item to be evaluated, and determining the safety importance level of the item to be evaluated based on the risk measurement value; when the safety importance level is low safety importance, inputting the failure mode and corresponding failure probability of the item to be evaluated in each external event into the probabilistic safety evaluation model of the corresponding external event to obtain each external risk measurement value of the item to be evaluated, and updating the safety importance level of the item to be evaluated based on the internal risk measurement value and all external risk measurement values; when the updated safety importance level is low safety importance, performing a defense-in-depth assessment on the item to be evaluated, and updating the safety importance level of the item to be evaluated based on the assessment result.

[0006] In one embodiment of the present invention, the failure mode and corresponding failure probability of the item to be evaluated in the internal event are input into the probabilistic safety assessment model of the internal event to obtain the internal risk measurement value of the item to be evaluated, and the safety importance level of the item to be evaluated is determined based on the risk measurement value, including: inputting the failure mode and corresponding failure probability of the internal event into each fault tree of the probabilistic safety assessment model of the internal event to obtain the internal risk measurement value of the item to be evaluated; calculating the Fussell-Vesely importance and risk increase factor of the item to be evaluated based on the internal risk measurement value; judging whether the Fussell-Vesely importance and risk increase factor meet the preset screening criteria: if so, the item is determined to be of high safety importance; otherwise, the item is determined to be of low safety importance.

[0007] In one embodiment of the present invention, the failure mode and corresponding failure probability of the internal event are input into each fault tree of the probabilistic safety assessment model of the internal event to obtain the internal risk measurement value of the item to be evaluated, including: inputting the failure mode and failure probability of the item to be evaluated into the corresponding fault tree, and determining the position of the failure mode of the item to be evaluated in each branch path of the fault tree; wherein the fault tree extends downward from the top event to form multiple branch paths; taking the position in each branch path of the fault tree as the first starting point, calculating the probability of each branch path in the fault tree leading to the top event; inputting the failure mode of the item to be evaluated and the probability of the top event into the corresponding event tree, and determining the failure mode / failure probability of the corresponding path in the event tree according to the probability of the top event. The failure probability of a fault event is determined, and the position of the failure mode of the item to be evaluated in the branch path of each corresponding event tree is determined; wherein the event tree includes multiple branch paths extending from the top, and each branch path includes multiple different failure modes / fault events arranged in sequence; taking this position as the second starting point, determining the corresponding end point in the event tree, and screening out the branch path with the end point being core damage; for each screened branch path of core damage: identifying all the passed failure modes / fault events along the branch path, and calculating the joint probability of the corresponding branch path based on the failure probability of each passed failure mode / fault event and the failure probability of the equipment to be evaluated in the internal event; and calculating the joint probability of all screened branch paths of core damage as the internal risk metric of the equipment to be evaluated.

[0008] In one embodiment of the present invention, the failure mode and the corresponding failure probability of the item to be evaluated in each external event are input into the probabilistic safety assessment model of the corresponding external event to obtain each external risk measurement value of the item to be evaluated, and the safety importance level of the item to be evaluated is updated according to the internal risk measurement value and all external risk measurement values, including: inputting the failure mode and the corresponding failure probability of the item to be evaluated in each external event into the probabilistic safety assessment model corresponding to the external event to obtain the external risk measurement value corresponding to the item to be evaluated; determining the comprehensive risk measurement value of the item to be evaluated based on the internal risk measurement value and all external risk measurement values; calculating the Fussell-Vesely importance and risk increase factor of the item to be evaluated according to the comprehensive risk measurement value; judging whether the Fussell-Vesely importance and risk increase factor of the item to be evaluated meet the preset screening criteria: if satisfied, the item is determined to be of high safety importance; otherwise, the item is determined to be of low safety importance.

[0009] In one embodiment of the present invention, the screening criteria include: the risk increase factor is greater than a preset risk increase factor threshold; the Fussell-Vesely importance is greater than a preset importance threshold.

[0010] In one embodiment of the present invention, the in-depth defense assessment is performed on the item to be assessed, and the safety importance level of the item to be assessed is updated based on the assessment result, including: determining the design basis events and the number of redundant systems / columns corresponding to the item to be assessed; based on a preset in-depth defense matching criterion, determining the new safety importance level of the item to be assessed according to the design basis events and the number of redundant systems / columns; judging whether the new safety importance level is consistent with the safety importance level of the item to be assessed: if they are consistent, keeping the safety importance level of the item to be assessed unchanged; otherwise, using the new safety importance level as the safety importance level of the item to be assessed.

[0011] In one embodiment of the present invention, after performing a defense-in-depth assessment on the item to be assessed and updating the safety importance level of the item to be assessed based on the assessment result, it also includes: when the safety importance level is low safety importance, performing a sensitivity analysis on the device to be assessed, and updating the safety importance level of the item to be assessed based on the sensitivity analysis result.

[0012] In one embodiment of the present invention, a safety grading system based on risk-guided technology is also provided, the system comprising: a data acquisition module, used to obtain the failure mode and corresponding failure probability of the item to be evaluated in internal events and each external event; an internal event analysis module, used to input the failure mode and corresponding failure probability of the item to be evaluated in internal events into the probabilistic safety evaluation model of the internal event, obtain the internal risk measurement value of the item to be evaluated, and determine the safety importance level of the item to be evaluated based on the risk measurement value; a comprehensive evaluation module, used to input the failure mode and corresponding failure probability of the item to be evaluated in each external event into the probabilistic safety evaluation model of the corresponding external event when the safety importance level is low safety importance, correspondingly obtain each external risk measurement value of the item to be evaluated, and update the safety importance level of the item to be evaluated based on the internal risk measurement value and all external risk measurement values; a depth defense module, used to perform a depth defense evaluation on the item to be evaluated when the updated safety importance level is low safety importance, and update the safety importance level of the item to be evaluated based on the evaluation result.

[0013] In one embodiment of the present invention, an electronic device is also provided, comprising: one or more processors; a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the electronic device implements any of the risk-guided technology-based security grading methods described above.

[0014] In one embodiment of the present invention, a computer-readable storage medium is also provided, on which a computer program is stored. When the computer program is executed by a processor of a computer, the computer executes any of the above-mentioned security grading methods based on risk-guided technology.

[0015] As described above, the safety classification method, system, device and medium based on risk-guided technology of the present invention have the following beneficial effects: the failure modes and corresponding failure probabilities of the items to be evaluated in internal and external events are input into the probabilistic safety evaluation model of internal and external events, which can comprehensively evaluate the risk contribution of the items in various potential accident scenarios and avoid the risk miscalculation caused by a single event scenario. And through the in-depth defense assessment, this multi-level assessment method can more accurately reflect the safety importance of items in different scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A schematic diagram of risk-based security classification provided by an embodiment of the present invention;

[0017] Figure 2 A schematic diagram of a process flow of a security grading method based on risk-guided technology provided by an embodiment of the present invention;

[0018] Figure 3 The overall flow chart of SSC safety classification using risk analysis in the present invention;

[0019] Figure 4 A flow chart for evaluating the safety importance level of equipment involved in the internal event safety of the present invention;

[0020] Figure 5 A flow chart for evaluating the safety importance level of equipment involved in the external event safety of the present invention;

[0021] Figure 6 It is a flow chart of equipment safety importance level assessment of the shutdown safety management outline of the present invention;

[0022] Figure 7 The defense-in-depth matrix of the present invention;

[0023] Figure 8 A flow chart for classifying the safety importance of the present invention;

[0024] Fig. 9Schematic diagram of the acceptance criteria of the core damage frequency (CDF) of the present invention;

[0025] Fig.10 Schematic diagram of the acceptable criteria for the early release frequency (LERF) of a large amount of radioactivity of the present invention;

[0026] Fig.11 Shown is a structural block diagram of a security grading system based on risk-guided technology provided by an embodiment of the present invention;

[0027] Fig.12 Shown is a structural schematic diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0028] The following describes the embodiments of the present invention by specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict.

[0029] It should be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present invention, and thus the drawings only show components related to the present invention rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.

[0030] In the following description, numerous details are discussed to provide a more thorough explanation of the embodiments of the present invention. However, it is obvious to those skilled in the art that the embodiments of the present invention can be implemented without these specific details. In other embodiments, well-known structures and devices are shown in the form of block diagrams rather than in detail to avoid making the embodiments of the present invention difficult to understand.

[0031] The inventors found that the traditional safety classification based on the deterministic method was generated and developed in the period when there was a lack of actual operation data of nuclear power plants. It usually focused on accident types, releases of radioactive materials and consequences, but less consideration was given to the probability of different accident sequences. With the continuous accumulation of reactor years of global reactor operation, data related to actual transients, accidents and power plant SSC (Structure, System and Component) performance have gradually become abundant. After using these data to conduct probabilistic safety analysis (PSA) of various accident sequences, the corresponding insights show that some safety-level SSCs in the traditional safety classification are of little safety importance, while some non-safety-level SSCs have higher safety importance. This traditional classification is based on the principle of deterministic defense in depth, and the basic idea is to ensure the reliability of equipment that performs the following three safety functions. These safety functions include: emergency shutdown of the reactor and maintaining the reactor in a safe shutdown state, cooling of the core and containment building (including medium-term and long-term cooling), and sealing of radioactive materials and limiting emissions to the environment and controlling them within the specified limits.

[0032] The safety classification of equipment is to find out the equipment that performs the above safety functions from the equipment of nuclear power plants or nuclear facilities, namely the so-called "safety level", and divide them into different levels according to the importance of their safety functions. Under this classification concept, the equipment of nuclear power plants is divided into two levels: "safety-related" and "non-safety-related", which are usually called safety level and non-safety level. Equipment belonging to "safety-related" needs to implement the "special handling requirements" mentioned above, such as quality assurance, environmental identification and technical specification requirements. Among them, special handling requirements: refers to requirements that exceed normal commercial and industrial practices to provide reasonable guarantees to ensure that the structures, systems and equipment of nuclear power plants can perform their design basis safety functions under design basis conditions. These special handling requirements include design considerations, identification, change control, documentation, reporting, maintenance, testing, monitoring and quality assurance. However, this traditional deterministic safety analysis method is too conservative and lacks dynamic response capabilities, resulting in low accuracy in the assessed safety importance level.

[0033] In order to improve the above problems, the present invention provides a safety grading method based on risk-guided technology. On the basis of deterministic grading, it introduces the risk insights of probabilistic theory, combines the advantages of both deterministic and probabilistic analysis methods, comprehensively considers the influence of various factors, conducts risk-guided safety grading for nuclear power plants, and implements differentiated treatment. By identifying safety-related equipment with low safety importance, the classification of nuclear power plant equipment is optimized, so that the focus and resources of management can be concentrated on truly important equipment to improve the safety of nuclear power plants, while reducing the management burden. On the basis of ensuring the safety of nuclear power plants, limited resources can be more reasonably allocated to SSCs with high safety importance, reducing the waste of resources caused by unnecessary conservative requirements in traditional safety grading, and effectively improving the economy and safety of nuclear power plants.

[0034] First, the scheme of the present invention is generally described: Figure 1 As shown, RISC (Risk-Informed Safety Classification) divides SSC into "HSS (High Safety Significant)" and "LSS (Low Safety Significant)" according to the importance of risk. The present invention further subdivides SSC into four categories: RISC-1, RISC-2, RISC-3 and RISC-4 on the basis of traditional safety classification, wherein RISC-1 refers to a safety-level SSC with high safety importance; RISC-2 refers to a non-safety-level SSC with high safety importance; RISC-3 refers to a safety-level SSC with low safety importance; RISC-4 refers to a non-safety-level SSC with low safety importance. The present invention considers different risks corresponding to SSC, including the risk insights of the power plant and the contribution of defense in depth. The classification process mainly includes: power plant specific input, system engineering assessment, equipment safety importance assessment, defense in depth assessment, preliminary engineering classification of functions, risk sensitivity research, and comprehensive decision-making research, and finally realizes the classification of items (i.e., structures, systems and equipment).

[0035] See also Figure 1 ,The security classification method based on risk-guided technology includes the following steps:

[0036] S1. Obtain the failure modes and corresponding failure probabilities of the item to be evaluated in internal events and various external events.

[0037] For an item to be evaluated, based on its basic information such as name, model, operating status and function, all internal and external events that may affect the item to be evaluated are determined, where external events include but are not limited to earthquakes, fires, floods, etc. For each internal and external event, the possible failure mode of the item to be evaluated in the event and the failure probability of the failure mode are determined, where the failure mode is the way the item fails in the corresponding event, and the failure probability refers to the probability of the item malfunctioning or failing under preset conditions. For example, for a certain electric valve, its failure mode in internal events can be either refusing to close or refusing to open, and the failure probability of refusing to close is 0.001, and the failure probability of refusing to open is 0.003.

[0038] It should be noted that the failure mode and failure probability are determined based on the relevant resources of the power plant, where the resources include but are not limited to the system design document information, PSA (Probabilistic risk assessment) model and report, other relevant power plant documents, etc. Specifically, through the system design document information, such as system design manual, flow chart, etc., the relevant analysis information and document materials of the equipment and related analysis reports, other data, information and relevant regulations and standards, etc., the failure mode and corresponding failure probability of the item to be evaluated in different events are obtained. In addition, the event tree and fault tree in the PSA model can be constructed through the above information to generate risk measurement values ​​for determining the safety importance level of the item.

[0039] It should be further explained that since items often work in conjunction with other items or equipment, it is necessary to conduct a system engineering assessment of the items to determine the status of other equipment related to the items and ensure that the system can operate safely and effectively under various conditions so that the PSA model can be used to generate risk metrics later. Specifically, according to the specific situation of the item, the system engineering assessment can include the following three steps:

[0040] (1) System selection and system boundary determination: This step includes defining the boundaries of the system interface with other systems. The basis for determining the system boundary is generally the system "three-letter code" or other recognized methods. The scope of the system should include all equipment within the defined boundary. However, when expanding beyond the system boundary, care should be taken to avoid introducing new systems and functions. For example, many systems require support from other systems, such as power supply systems and cooling systems. The definition of the system boundary should include any equipment from another system that only supports the safety functions of the main system, which may result in the system boundary including some circuit breakers but not including upstream control cabinets or busbars.

[0041] If an SSC has high safety importance for the specific system under consideration, it should be classified as high safety importance. However, in some cases, because the candidate low safety importance SSC also supports multiple systems, the classification cannot be completed within the scope of the system being considered. In this case, the SSC is not classified until all involved systems are considered. For example, the cooling water system piping on the ventilation system cooler is considered to be part of the ventilation system, and the impact of the SSC failure on the ventilation system can be considered, but the impact of the SSC failure on the cooling water system cannot be fully evaluated until the associated system (cooling water system) is considered. Therefore, the SSC is not classified and continues to maintain its current processing requirements.

[0042] (2) System function identification: This step involves the identification of all system functions. There are many sources for identifying system functions, including: functions in the system design manual, maintenance rule functions, functions considered in the plant-specific risk information, and operating functions. All design basis functions and beyond design basis functions identified in the PSA model should be used in the assessment. System functions should be as consistent as possible with the functions defined in the design basis documents and maintenance rule functions (as appropriate). Although maintenance rule functions may include beyond design basis functions, the PSA model should be reviewed to ensure that any functions of the selected system modeled in the PSA model are modeled. System functions should also be reviewed to ensure that any special considerations for external events, plant startup and shutdown, and refueling are also reflected. Certain functions can be further subdivided to distinguish between potential safety importance and LSS equipment associated with a given function. Other functions can be identified to group and consider potential low safety importance equipment, which may initially be associated with a safety-critical function but does not support the critical part of that safety-critical function.

[0043] (3) Rough mapping of devices to functions: This step involves decomposing system devices into the system functions they support, identifying and documenting the systems and devices associated with each function, defining the paths associated with each function, and then defining the devices associated with that path. The mapping of devices to functions can be carried out with reference to Appendix 2. In this case, the path definition must take into account branches and interfaces with other paths to ensure that the entire path is appropriately modeled and the boundaries are clearly described. Some functions (such as instruments supporting the function or isolation of functions) do not have true paths, but once the system boundaries are determined, the devices associated with these functions can be identified from the system drawings. In this step, SSCs must be assigned to each function to ensure that each SSC with the label of the system under consideration is reflected in at least one function. If the identified SSCs are not assigned to any function, new functions must be created for these SSCs. In subsequent steps, all system functions will be classified and reviewed again. The classification assigned to each system function will be initially applied to the SSCs associated with that function.

[0044] It should be noted that the basis of the SSC classification process in the present invention is the PSA model of internal events in nuclear power plants, which is maintained in accordance with the standards of Living PSA and reflects the actual situation of the power plant. In addition, the PSA models of other external events and power plant operating modes should be reviewed to ensure that the results and / or insights are applicable to nuclear power plants. In addition, the PSA models of other external events and power plant operating modes should be reviewed to ensure that the results and / or insights are applicable to nuclear power plants. The review results of internal event peer reviews and other risk information should be recorded in the description of the adequacy of the PSA model. This feature will serve as the basis for the adequacy of the risk information used in the classification process and will be used for subsequent secondary review judgments.

[0045] S2. Input the failure mode and corresponding failure probability of the item to be evaluated in the internal event into the probabilistic safety assessment model of the internal event to obtain the internal risk measurement value of the item to be evaluated, and determine the safety importance level of the item to be evaluated based on the risk measurement value.

[0046] The present invention takes into account various hazards and nuclear power plant shutdown safety issues. Due to the different uncertainties and conservative levels of each risk contribution, the risk importance of SSC will be evaluated from six risk perspectives to identify SSCs with potential safety importance. These risk events include internal events (i.e., internal event risks) and external events. External events include: earthquake risks, internal fire risks, internal flooding risks, other external risks (such as strong winds, etc.), and shutdown risks. By separately evaluating the risk metrics of various types of events, it is possible to effectively avoid the situation where individual risk contribution results are obscured by relying on comprehensive results. Among them, as shown in Table 1, each risk event can be evaluated based on the corresponding PSA model to obtain a risk metric value, and the safety importance level of the item is determined accordingly.

[0047] Table 1 Safety importance assessment

[0048]

[0049]

[0050] Furthermore, in order to improve the evaluation efficiency and reduce unnecessary evaluation workload, in the present invention, screening is first carried out at the system / structure level. If the system / structure plays a role in a specific part of the risk profile of the power plant, further evaluation can be carried out at the equipment level. Specifically, before the failure mode and corresponding failure probability of the internal event of the item to be evaluated are input into the probabilistic safety assessment model of the internal event, it also includes: judging whether the item is used to prevent or mitigate severe accidents. If the system / structure does not participate in the prevention or mitigation of severe accidents (including the containment function), the risk assessment process is terminated, and the system function classification candidate is LSS. For the candidate LSS system / structure, it must still undergo a defense-in-depth assessment and be reviewed by machine learning or IDP. On the contrary, if the system / structure participates in the prevention or mitigation of severe accidents, internal and external events can be screened at the equipment level to determine the safety importance level of the equipment.

[0051] If the system or structure is involved in preventing or mitigating severe accidents, the PSA model assessment of internal events is carried out first. When evaluating, it is necessary to consider not only whether it is explicitly modeled in the PSA model (i.e., in the form of basic events), but also whether it is implicitly evaluated in the model in the form of operator actions, giant components, etc. Among them, internal events refer to events that occur inside a nuclear power plant or similar complex facilities that affect the safety or operational reliability of the system. The cause of the event is the operation inside the facility, equipment failure, etc., not the external environment or natural disasters. The assessment includes the following three aspects: whether the failure of the equipment will lead to an initiating event; whether it is used to prevent core damage or early large-scale radioactive release; and whether another system or structure evaluated in the PSA is needed to prevent or mitigate the event. There is implicit modeling of some equipment in the PSA model of internal events. By focusing on the importance of system functions, these functions are associated with specific equipment that supports the function to deal with some implicitly modeled equipment. For example Figure 3 As shown, if the internal event PSA model evaluates the device, the internal event PSA model importance is used to determine whether it should be considered safety-critical. When it is evaluated as high safety importance, there is no need to evaluate the external event for the time being, and it is directly reviewed through machine learning or IDP to verify whether its importance is correct; conversely, when it is evaluated as low safety importance or if the device is not evaluated in the internal event PSA model, then from the perspective of internal event risk, the device candidate is LSS, and each external event risk assessment continues.

[0052] In one embodiment of the present invention, the step of inputting the failure mode and the corresponding failure probability of the item to be evaluated in the internal event into the probabilistic safety assessment model of the internal event to obtain the internal risk measurement value of the item to be evaluated, and determining the safety importance level of the item to be evaluated based on the risk measurement value includes:

[0053] Inputting the failure mode and corresponding failure probability of the internal event into each fault tree of the probabilistic safety assessment model of the internal event to obtain the internal risk measurement value of the item to be assessed;

[0054] Calculating the Fussell-Vesely importance and risk increase factor of the item to be evaluated based on the internal risk metric value;

[0055] Determine whether the Fussell-Vesely importance and risk increase factor meet the preset screening criteria:

[0056] If satisfied, the item is determined to be of high safety importance;

[0057] Otherwise, the item is determined to be of low safety importance.

[0058] When evaluating the internal events of the item to be evaluated, the failure mode and corresponding failure probability of the internal event are input into each fault tree in the internal event PSA model, and the joint probability of each event tree path is calculated to obtain the risk measurement value of the item in the internal event scenario, wherein the risk measurement value is CDF (Core damage Frequency) or LERF (Large Early Release Frequency). According to the risk measurement value, the RAW (Risk Achievement Worth) and Fussell-Vesely importance (FV) of the item to be evaluated can be calculated. These two values ​​are standard PSA model importance measurement value screening tools, which can identify the candidate safety important equipment level. Among them, the risk reduction factor (RRW) can also replace FV, because FV can be converted to RRW under certain conditions. It can be understood that in order to ensure the accuracy of the results, CDF and LERF are used in the present invention to calculate the corresponding RAW and Fussell-Vesely importance.

[0059] It should be noted that, whether it is an internal event or an external event, the RAW importance of the equipment considers the maximum value of the basic event RAW value of each failure mode of a single device. For equipment with common cause failures, common cause events are considered using standards different from the RAW of a single device. The RAW value of a common cause event reflects the relative increase in CDF / LERF if a group of equipment or the entire system is unavailable. Therefore, the risk significance of the RAW value of a common cause basic event should be considered separately from the basic event reflecting a single device. The RAW value is conservatively selected as 20 to reflect the fact that the common cause RAW characterizes the failure of two or more columns, including the possibility of a higher failure of the second column due to the common cause. As with the RAW value of a single device, if the device being evaluated is included in more than one common cause basic event, the maximum value of the common cause RAW value is used to evaluate its importance. After obtaining the RAW and Fussell-Vesely importance, it is determined whether it meets the preset screening criteria. If it meets any of the screening criteria, the candidate is of high safety importance. Among them, in one embodiment of the present invention, the screening criteria include: the risk increase factor is greater than the preset risk increase factor threshold; the Fussell-Vesely importance is greater than the preset importance threshold. Specifically, if the FV importance of a single device is >0.005, the sum of the FV importance of all its basic events (including common cause failures) is taken; if the RAW importance of a single device is >2.0, the largest RAW of the basic events other than common cause failures (the common cause failure basic events are considered separately) is taken. Furthermore, considering that some equipment is also affected by common cause groups, the screening criteria also include: the risk increase factor of the common cause group of the item is greater than the preset common cause risk increase factor threshold. Specifically, if the RAW importance of the common cause group of the equipment is >20.0, the largest RAW of all common cause failure basic events is taken.

[0060] It should be noted that when evaluating the importance of internal or external events and subsequent sensitivity analysis of the equipment, the FV and RAW importance of the equipment should be calculated according to the CDF and LERF models respectively. If the three importances calculated do not meet the screening criteria for safety importance, the equipment is initially selected as a low safety importance candidate, pending further sensitivity analysis.

[0061] For example, assume that a certain electric valve A has two failure modes: refusal to open and false opening, and has common cause failure with similar valves B and C in the refusal to open mode. Table 2 lists the calculation and screening process of the importance of valve A. As can be seen from Table 2, valve A meets the requirements of the screening criteria in terms of both FV and common cause RAW importance, so valve A is a candidate for safety-important. At the same time, the failure mode that has a significant impact on the importance of valve A is refusal to open, which will be used to identify its safety-important attributes. If the failure mode of a single device does not meet its screening criteria, the failure mode with significant contribution will be used to define its attributes.

[0062] Table 2 Equipment importance assessment example

[0063]

[0064]

[0065] The SSC importance index is calculated using the following formula: FV=∑FVi; FVi is the FV value of the i-th basic event involved in this device, RAW=MAX(RAWi); RAWi is the RAW value of the i-th basic event involved in this device.

[0066] Furthermore, if Figure 4 As shown, when analyzing internal events, if the PSA model importance analysis results do not cover the impact of equipment importance on initiating events, qualitative analysis is used to solve the equipment safety classification related to initiating events. The qualitative analysis process considers whether the equipment will directly lead to the occurrence of complex initiating events (i.e., FV is greater than 0.005). If so, the equipment candidate is of high safety importance, and the initiating events it may cause are identified. Among them, complex initiating events refer to events that shut down the power plant and affect critical safety functions. The assessment of equipment importance includes identifying the basic events of the PSA model that represent the equipment, including events that explicitly model equipment performance (such as a pump startup failure), events that implicitly model equipment (such as certain personnel actions, initiating events, etc.) or combinations of events.

[0067] In one embodiment of the present invention, the step of inputting the failure mode and the corresponding failure probability of the internal event into each fault tree of the probabilistic safety assessment model of the internal event to obtain the internal risk metric value of the item to be assessed includes:

[0068] Inputting the failure mode and failure probability of the item to be evaluated into the corresponding fault tree, and determining the position of the failure mode of the item to be evaluated in each branch path of the fault tree; wherein the fault tree extends downward from the top event to form multiple branch paths;

[0069] Taking the position in each branch path of the fault tree as the first starting point, calculating the probability that each branch path in the fault tree leads to the top event;

[0070] Input the failure mode of the item to be evaluated and the probability of the top event into the corresponding event tree, determine the failure probability of the failure mode / fault event passed by the corresponding path in the event tree according to the probability of the top event, and determine the position of the failure mode of the item to be evaluated in the branch path of each corresponding event tree; wherein the event tree includes a plurality of branch paths extending from the top, and each branch path includes a plurality of different failure modes / fault events arranged in sequence;

[0071] Taking this position as the second starting point, determining the corresponding end point in the event tree, and screening out the branch path whose end point is core damage;

[0072] For each branch path of core damage screened: identifying all the failure modes / fault events that have passed along the branch path, and calculating the joint probability of the corresponding branch path based on the failure probability of each failure mode / fault event that has passed and the failure probability of the equipment to be evaluated in the internal event;

[0073] The joint probability of all branch paths of core damage that are statistically screened is used as the internal risk metric value of the device to be evaluated.

[0074] When the risk metric is selected as the core damage frequency, the failure mode and corresponding failure probability of the item to be evaluated are input into the fault tree model. Starting from the top event of the fault tree, each node of the fault tree is traversed downward layer by layer to find the node consistent with the input failure mode, so as to locate the specific position of the failure mode of the item to be evaluated in the fault tree. Among them, the fault tree is a tree structure that expands from the top event downward, which includes multiple branch paths, each branch path is composed of a series of nodes, and these nodes are logically combined to eventually lead to the occurrence of the top event. Taking the specific position of the input failure mode in the fault tree (i.e., the node in each branch path) as the first starting point, the joint failure probability from the first node to the top event is calculated along the corresponding branch path (i.e., the product of the failure probabilities of all nodes on the branch path starting from the first node) as the probability of the top event caused by this first starting point. The probability of the top event and the failure mode of the item to be evaluated are input into the event tree corresponding to the failure mode. According to the probability of the top event, the failure probability of the node (i.e., failure mode / failure event) passed through on each branch path in the event tree is determined, and according to the identification of the failure mode of the item to be evaluated, all branch paths related to the failure mode are found from the event tree of the PSA model, and the position of the failure mode in each branch path found is determined, and the position is used as the second starting point. Among them, each event tree starts from the top initial event, has multiple branch paths, and each branch path represents a different event process or result. Each branch path consists of multiple nodes (failure mode / failure event), representing a series of possible events from the initial event to the final result. In the event tree, the terminal position of each branch path starting from the second starting point node is determined, and the branch paths with the terminal as core damage are screened out. These paths represent the situation where the core damage is caused by the current failure mode. For each selected branch path, all nodes from the starting point to the end point on the path are identified, and the joint probability of the path is obtained based on the failure probability of each node and the failure probability of the item. After the joint probability of all branch paths with core damage as the end point is calculated, all joint probabilities are summed up to represent the internal risk metric of the item. It can be understood that the risk metric value of the large number of early release frequencies is similar to the processing process of the core damage frequency mentioned above, which will not be repeated here.

[0075] Furthermore, whether it is an internal event or an external event, the PSA model has a large uncertainty, such as the probability of human failure, common cause failure parameters, etc., which will affect the PSA model importance analysis results. In addition, the common cause failure model introduced in the PSA model to consider the correlated failure of redundant equipment in the system will also affect the equipment importance analysis results. Based on the PSA model analysis results, for equipment whose FV and RAW importance do not meet the above screening criteria, further sensitivity analysis is required to determine whether there are other potential situations that cause the equipment to be safety-critical, and a secondary review is conducted by IDP or machine learning. Specifically, the sensitivity analysis is mainly conducted on human error, common cause failure and equipment unavailability in the model to ensure that the PSA model assumptions do not mask the safety importance of the equipment. The sensitivity analysis methods include but are not limited to: increasing all human error basic event values ​​to their 95% percentile, reducing all human error basic event values ​​to their 5% percentile, increasing all common cause failure basic event values ​​to their 95% percentile, reducing all common cause failure basic event values ​​to their 5% percentile and setting all maintenance unavailability to 0. The risk measurement values ​​can be calculated again according to the above five items, and according to the same screening criteria before the sensitivity analysis, if the device meets the screening criteria in the calculation results of any setting, then the device candidate is of high safety importance; if the device does not meet the screening criteria in the calculation results of any setting, then the device candidate is of low safety importance.

[0076] It should be noted that, whether it is an internal event or an external event, in the process of equipment importance assessment, the calculation of equipment importance requires analysis of the power plant PSA model. Due to the complexity of the nuclear power plant system, a large number of cut sets will be generated when the PSA model is solved, which will seriously affect the speed of model solution. Therefore, it is necessary to use data truncation to control the solution time and calculation accuracy. There are currently two commonly used data truncation methods: ① probability truncation; ② order truncation. According to the actual application and the specific situation of the power plant, the probability truncation method is recommended. Probability truncation refers to setting a value during model analysis. If the frequency value or probability value represented by the calculated cut set is less than this value, the cut set is discarded. When calculating the importance of equipment, it is recommended to select a truncation value that is more than 5 orders of magnitude lower than the benchmark CDF / LERF value of the power plant. For example, if the magnitudes of CDF and LERF of a power plant are 1.0E-06 / reactor-year and 1.0E-07 / reactor-year, respectively, the cutoff values ​​of CDF and LERF should be lower than 1.0E-11 / reactor-year and 1.0E-12 / reactor-year, respectively, when calculating the equipment importance (including sensitivity analysis). At the same time, we can consider seeking a reasonable balance, taking different cutoff values ​​for CDF and LERF for calculation and analysis, and comparing the results to determine a reasonable cutoff value.

[0077] S3. When the safety importance level is low safety importance, the failure mode and corresponding failure probability of the item to be evaluated in each external event are input into the probabilistic safety evaluation model of the corresponding external event, and each external risk measurement value of the item to be evaluated is obtained accordingly, and the safety importance level of the item to be evaluated is updated according to the internal risk measurement value and all external risk measurement values.

[0078] When the level corresponding to an internal event is low safety importance, since external events (fire, earthquake, etc.) may still have an impact on the item, in order to comprehensively evaluate the safety level of the item and prevent underestimation of the role of the item in overall safety due to ignoring external events, it is also necessary to evaluate the safety importance level of the item in each external event.

[0079] Specifically, in one embodiment of the present invention, the failure mode and the corresponding failure probability of the item to be evaluated in each external event are input into the probabilistic safety assessment model of the corresponding external event, and each external risk metric value of the item to be evaluated is obtained accordingly, and the safety importance level of the item to be evaluated is updated according to the internal risk metric value and all external risk metric values, including:

[0080] Inputting the failure mode and corresponding failure probability of the item to be evaluated in each external event into a probabilistic safety assessment model corresponding to the external event to obtain an external risk measurement value corresponding to the item to be evaluated;

[0081] Determining a comprehensive risk metric value of the item to be evaluated based on the internal risk metric value and all external risk metric values;

[0082] Calculating the Fussell-Vesely importance and risk increase factor of the item to be evaluated based on the comprehensive risk metric value;

[0083] Determine whether the Fussell-Vesely importance and risk increase factor of the item to be evaluated meet the preset screening criteria:

[0084] If satisfied, the item is determined to be of high safety importance;

[0085] Otherwise, the item is determined to be of low safety importance.

[0086] Each external event corresponds to a PSA model. The possible failure modes and corresponding failure probabilities of the item to be evaluated in the external event are input into the PSA model corresponding to the external event to obtain the external risk measurement value of the item in this external event, where the external risk measurement value is the core damage frequency or the frequency of large-scale early release. After all external events have been processed, in order to provide a comprehensive assessment of the safety importance of the equipment, a comprehensive importance calculation is required. This comprehensive importance calculation is essentially a weighted ratio of the importance of each risk factor (for example, internal events, internal flooding, internal fire, earthquakes and other external events) to the risk measurement value caused by the factor to obtain a comprehensive risk measurement value. Exemplarily, for the comprehensive core damage frequency (CDF), the comprehensive FV and comprehensive RAW can be calculated as the comprehensive risk measurement value in the following manner: Comprehensive FV importance: Among them, IFVi is the comprehensive FV importance of device i to the CDF of the PSA model of all events (including internal events and all external events), FVi,j is the FV importance of device i to the CDF of the PSA model of the jth event (internal event or an external event), CDFj is the CDF of the PSA model of the jth event; comprehensive RAW importance: Among them, IRAWi is the comprehensive RAW importance of device i to the CDF of all event PSA models; RAWi,j is the RAW importance of device i to the CDF of the j-th event PSA model, and CDFj is the CDF of the j-th event PSA model. After obtaining the comprehensive risk metric value, the above two importances are evaluated again according to the above screening criteria to determine the importance level of the item. It should be noted that in any case, the comprehensive importance should not be higher than the maximum importance of a single risk factor.

[0087] Furthermore, the risk measurement value of each external event will vary due to different actual scenarios. Specifically, Figure 5As shown, when the external event is an internal fire, the equipment importance process of the fire PSA is similar to the evaluation process of the internal event PSA. Considering that most fire PSAs are unable to combine the impact of the equipment on the mitigation system with the impact on the fire initiation, the equipment importance evaluation process is adaptively adjusted. Therefore, when evaluating the importance of equipment in the fire PSA, only its impact on the mitigation function is considered. Apart from this, the evaluation process is the same as that of the internal event PSA. It should be noted that if the CDF of the fire PSA is a small part of the CDF of the internal event (i.e. <1%), then from the perspective of the fire PSA, the safety-critical equipment analyzed can be directly regarded as low safety importance. Furthermore, when the external event is a fire, if the final calculated FV or RAW does not meet the aforementioned screening criteria, a sensitivity analysis is still required to identify its importance. Among them, sensitivity analysis includes but is not limited to increasing all basic event values ​​of human error to their 95% percentile, reducing all basic event values ​​of human error to their 5% percentile, increasing all basic event values ​​of common cause failure to their 95% percentile, reducing all basic event values ​​of common cause failure to their 5% percentile, setting manual fire extinguishing to failure, and setting all maintenance unavailability to 0. The importance of the equipment is calculated according to the above 6 settings, and the same screening criteria are used. If the equipment meets the screening criteria in the calculation results of any setting, the equipment candidate is of high safety importance; if the equipment does not meet the screening criteria in the calculation results of any setting, the equipment candidate is of low safety importance. At this time, the equipment can be evaluated according to its safety level. If the safety level of the equipment is Figure 1 If the device is RISC-3, then the device is considered to be of safety level. At this time, it is necessary to identify the reasons why the device is not safety-critical and regard it as low safety importance. Otherwise, the device is directly regarded as low safety importance.

[0088] It should be noted that if the sensitivity analysis determines that a certain equipment is of high safety importance, its safety importance attributes should also be identified. If after the sensitivity analysis, a certain equipment is still of low safety importance and is a safety-level equipment, it is necessary to analyze and determine why the equipment is of low safety importance (for example, it does not perform important functions, has too much redundancy, has a low failure rate, etc.). This equipment importance assessment process should be performed for both CDF and LERF. If LERF cannot be quantitatively associated with the fire model, the insights from the internal event LERF model should be qualitatively combined with the assessment of the impact of the fire on the containment in order to formulate recommendations on the LERF contribution to the IDP.

[0089] When the external event is internal flooding, such as Figure 5As shown in the figure, the equipment importance process of flooding PSA is similar to the evaluation process of internal event PSA. Considering that most flooding PSAs are unable to combine the impact of equipment on the mitigation system with the impact on flooding, the equipment importance evaluation process is adaptively adjusted. Therefore, when evaluating the importance of equipment in flooding PSA, only its impact on the mitigation function is considered. It should be noted that if the CDF of flooding PSA is a small part of the CDF of internal events (i.e. <1%), then from the perspective of flooding PSA, the safety-critical equipment analyzed can be directly regarded as low safety importance. Similarly, when the FV or RAW corresponding to flooding does not meet the above screening criteria, it is still necessary to perform a sensitivity analysis on the equipment importance of flooding PSA. Among them, the sensitivity analysis method includes but is not limited to increasing all human error basic event values ​​to their 95% percentile, reducing all human error basic event values ​​to their 5% percentile, increasing all common cause failure basic event values ​​to their 95% percentile, reducing all common cause failure basic event values ​​to their 5% percentile, setting manual flood prevention to failure, and setting all maintenance unavailability to 0. Similarly, the equipment importance is calculated according to the above 6 settings, and the same equipment importance screening criteria are used. If the equipment meets the screening criteria in the calculation results of any setting, the equipment candidate is of high safety importance; if the equipment does not meet the screening criteria in the calculation results of any setting, the equipment candidate is of low safety importance. If the sensitivity analysis determines that a certain equipment is of high safety importance, its safety importance attributes should be identified at the same time. If after the sensitivity analysis, a certain equipment is still of low safety importance and is a safety-level equipment, it is necessary to analyze and determine why the equipment is of low safety importance (for example, it does not perform important functions, has too much redundancy, has a low failure rate, etc.). This equipment importance assessment process should be performed for both CDF and LERF. If LERF cannot be quantitatively associated with the flooding model, the insights of the internal event LERF model should be qualitatively combined with the assessment of the impact of flooding on the containment in order to formulate recommendations on LERF contributions for IDP.

[0090] When the external event is an earthquake, the equipment importance process of the earthquake PSA is similar to the assessment process of the internal event PSA. Considering that power plant equipment cannot cause earthquake events, the equipment importance assessment process is adaptively adjusted. Figure 5As shown. If the CDF of the earthquake PSA is a small part of the CDF of the internal event (i.e. <1%), then from the perspective of the earthquake PSA, the safety-critical equipment analyzed can be considered as low safety-critical. When the FV or RAW corresponding to the earthquake does not meet the above screening criteria, it is still necessary to perform a sensitivity analysis on the equipment importance of the earthquake PSA. Among them, the sensitivity analysis method includes but is not limited to increasing all basic event values ​​of human error to their 95% percentile, reducing all basic event values ​​of human error to their 5% percentile, increasing all basic event values ​​of common cause failure to their 95% percentile, reducing all basic event values ​​of common cause failure to their 5% percentile, using associated fragility for all equipment in a region, and setting all maintenance unavailability to 0. According to the above 6 settings, the equipment importance is calculated respectively, and the same equipment importance screening criteria are used. If the equipment meets the screening criteria in the calculation results of any setting, the equipment candidate is of high safety importance; if the equipment does not meet the screening criteria in the calculation results of any setting, the equipment candidate is of low safety importance. If the sensitivity analysis determines that a certain equipment is of high safety importance, its safety-critical attributes should also be identified. If after the sensitivity analysis, a certain equipment is still of low safety importance and is a safety-level equipment, it is necessary to analyze and determine why the equipment is of low safety importance (for example, it does not perform important functions, has too much redundancy, has a low failure rate, etc.). This equipment importance assessment process should be performed for both CDF and LERF. If LERF cannot be quantitatively associated with the earthquake model, the insights from the internal event LERF model should be qualitatively combined with the assessment of the impact of the earthquake on the containment to formulate recommendations on the LERF contribution to the IDP.

[0091] When the external event is other external events, the equipment importance process of other external event PSA is similar to the assessment process of internal event PSA. Considering that power plant equipment cannot cause external events such as floods, tornadoes and strong winds, the equipment importance assessment process is adaptively adjusted. The specific process is as follows: Figure 5As shown. If the CDF of other external events PSA is a small part of the CDF of internal events (i.e. <1%), then from the perspective of other external events PSA, the safety-critical equipment analyzed can be considered as low safety-critical. When the FV or RAW corresponding to other external events does not meet the above screening criteria, it is still necessary to conduct a sensitivity analysis on the equipment importance of other external events PSA. The sensitivity analysis method includes but is not limited to increasing the values ​​of all basic events of human error to their 95% percentile, reducing the values ​​of all basic events of human error to their 5% percentile, increasing the values ​​of all basic events of common cause failure to their 95% percentile, reducing the values ​​of all basic events of common cause failure to their 5% percentile, and setting all maintenance unavailability to 0. According to the above five settings, the equipment importance is calculated respectively, and the same equipment importance screening criteria are used. If the equipment meets the screening criteria in the calculation results of any setting, the equipment candidate is of high safety importance; if the equipment does not meet the screening criteria in the calculation results of any setting, the equipment candidate is of low safety importance. If the sensitivity analysis determines that a certain equipment is of high safety importance, its safety-critical attributes should be identified at the same time. If after the sensitivity analysis, a device is still of low safety importance and is a safety-level device, it is necessary to analyze and determine why the device is of low safety importance (e.g., not performing important functions, too much redundancy, low failure rate, etc.). This equipment importance assessment process should be performed for both CDF and LERF. If LERF cannot be quantitatively associated with other external event models, the insights from the internal event LERF model should be qualitatively combined with the impact assessment of other external events on the containment to develop recommendations for the IDP regarding the LERF contribution.

[0092] When the operation is shutdown safety, shutdown safety importance assessment usually has two forms, namely shutdown condition PSA and shutdown safety management outline. At present, power plants have both shutdown condition PSA model and shutdown safety management outline. Therefore, when conducting shutdown safety importance assessment, shutdown PSA analysis is mainly used, supplemented by the method of comprehensive judgment of shutdown safety management outline. Due to the similarity between shutdown PSA and power PSA, the equipment importance assessment process of shutdown PSA is the same as that of internal event PSA, such as Figure 4As shown. If the CDF of the shutdown PSA is a small part of the CDF of the internal event (i.e. <1%), then from the perspective of the shutdown PSA, the safety-critical equipment analyzed can be considered as low safety-critical. When the FV or RAW corresponding to the shutdown does not meet the above screening criteria, it is still necessary to conduct a sensitivity analysis on the equipment importance of the shutdown PSA. The sensitivity analysis method includes but is not limited to increasing the values ​​of all basic events of human error to their 95% percentile, reducing the values ​​of all basic events of human error to their 5% percentile, increasing the values ​​of all basic events of common cause failure to their 95% percentile, reducing the values ​​of all basic events of common cause failure to their 5% percentile, and setting all maintenance unavailability to 0. The equipment importance is calculated according to the above five settings, and the same equipment importance screening criteria are used. If the equipment meets the screening criteria in the calculation results of any setting, the equipment candidate is of high safety importance; if the equipment does not meet the screening criteria in the calculation results of any setting, the equipment candidate is of low safety importance. If the sensitivity analysis determines that a certain equipment is of high safety importance, its safety-critical attributes should be identified at the same time. If after sensitivity analysis, a device is still of low safety importance and is a safety-level device, it is necessary to analyze and determine why the device has low safety importance (for example, it does not perform important functions, has excessive redundancy, has a low failure rate, etc.).

[0093] Furthermore, the analysis can be conducted in conjunction with the outage safety management outline. Specifically, Figure 6 As shown, if the equipment meets any of the following conditions, it can be determined to be of high safety importance to the shutdown condition: Condition 1: For each defined shutdown critical safety function, a defense-in-depth approach should be adopted. A given critical safety function is achieved by specifying an operating and backup system / column. When there are multiple systems / columns available to meet the critical safety function, only equipment that supports the primary and first alternative methods to meet the critical safety function can be considered a "primary shutdown safety system" and is therefore a candidate for safety importance. Condition 2: Failure of the equipment will trigger a shutdown event (for example, loss of shutdown cooling, etc.). If the equipment does not meet any of the above conditions, it is considered to be of low safety importance in terms of shutdown safety. In this assessment, a primary shutdown safety system refers to a system with the following attributes: it has the technical basis to perform the function, has a margin to meet the safety function, and does not require a large amount of manual operation to achieve its safety function.

[0094] S4. When the updated safety importance level is low safety importance, a defense-in-depth assessment is performed on the item to be assessed, and the safety importance level of the item to be assessed is updated according to the assessment result.

[0095] In order to more comprehensively evaluate the safety importance level of items, a defense-in-depth assessment is also required when the safety importance level is low. The defense-in-depth assessment is mainly for items that are not included in the probabilistic safety assessment model and are considered to be of low safety importance during the risk assessment stage. The process evaluates the functions of structures, systems and equipment in three aspects: core residual heat extraction, early containment failure / bypass and long-term containment integrity. If any aspect is judged to be of high safety importance to defense-in-depth, the structure, system and equipment are identified as high safety importance.

[0096] Specifically, in one embodiment of the present invention, the performing of a defense-in-depth assessment on the item to be assessed, and updating the security importance level of the item to be assessed according to the assessment result, includes:

[0097] Determine the design basis events and number of redundant systems / columns corresponding to the item to be evaluated;

[0098] Based on the preset defense-in-depth matching criteria, according to the design basis events and the number of redundant systems / columns, determine the new safety importance level of the item to be evaluated;

[0099] Determine whether the new safety importance level is consistent with the safety importance level of the item to be evaluated:

[0100] If they are consistent, the safety importance level of the item to be evaluated remains unchanged;

[0101] Otherwise, the new safety importance level is used as the safety importance level of the item to be evaluated.

[0102] The assessment should take into account the level of defence in depth to prevent core damage and the frequency of design basis accidents. Figure 7 An example of such an assessment is shown in Figure 1. This figure depicts the design basis accidents (i.e., events used to determine the SSC as safe) considered in the safety analysis report and considers the available level of defense in depth based on the success criteria used in the PSA. This ensures that there is sufficient defense in depth to mitigate the design basis accidents. The defense in depth matrix is ​​similar in form to the importance determination process used in the reactor surveillance process and the same concepts of diverse and redundant columns and systems are used when assessing the level of defense in depth. For equipment / functions classified as LSS, the following process is required: identify and confirm the design basis accidents required for the function; for each design basis accident, identify other systems and columns that can support the function or provide an alternative success path to avoid core damage. Figure 7 The top row of describes the potential combinations of other systems and columns. For example, for item A, its design basis event is the loss of condenser, and the item has 2 redundant systems, then the item can be considered as low safety importance.

[0103] For each design basis accident, determine the mitigation capability of the nuclear power plant Figure 7 The area in which the plant mitigation capability does not include functions / SSCs of low safety importance, nor any identical redundant SSCs in the system that are also classified as low safety importance. If the result is in the "confirmed low safety importance" area, the function / SSC is of low safety importance. If the result is in the "potential safety importance" area, since it is different from the high safety importance obtained in the above manner, it should be classified as high safety importance and submitted to IDP or used for secondary verification using machine learning, and it should be pointed out that the basis is the core damage defense in depth. After completion, if all SSC functions are confirmed as LSS, the SSC is still a candidate for low safety importance submitted to IDP or machine learning for secondary verification. It should be noted that machine learning is to adjust internal parameters for model training by learning data that has been verified by IDP.

[0104] Furthermore, the defense-in-depth assessment also includes the containment defense-in-depth assessment. This is to take into account that in addition to the core damage defense-in-depth assessment, the SSC defense-in-depth assessment in preventing early large-scale radioactive releases should also be assessed. The secondary PSA has identified key contributions to LERF. These include containment bypass events such as ISLOCA and SGTR, containment isolation failures, and early hydrogen combustion. The containment defense-in-depth assessment of the SSC, which plays a role in preventing large containment failures (e.g., due to loss of containment heat removal), is also assessed. For each SSC function classified as a candidate LSS, its defense-in-depth assessment uses the following criteria: (1) Containment bypass, which includes: whether the SSC will trigger a primary coolant loss accident caused by interface rupture; whether the SSC can provide important mitigation capabilities for primary coolant loss accidents caused by interface rupture; whether the SSC can isolate the steam generator after a steam generator heat transfer tube rupture accident. (2) Containment isolation, including: whether the SSC is used to support the isolation of the following containment penetrations: directly connected to the containment atmosphere, with a diameter greater than 5.08 cm, not locked in the closed position or only operated in situ; whether the SSC is used to support the isolation of the following containment penetrations: part of the core coolant system pressure boundary, with a diameter greater than 0.95 cm, not locked in the closed position or only operated in situ. (3) Early hydrogen combustion: whether the SSC supports the operation of the hydrogen igniter in the containment. (4) Long-term containment integrity: whether the SSC is used to support system functions that are not considered in the CDF and LERF calculations, but are the only way to maintain long-term containment integrity after core damage (such as containment heat removal). For any of the above questions, if the answer is yes, the SSC should be classified as high safety importance. Only when the answer to all questions is no, the SSC can be determined as low safety importance and left for the next step of confirmation. It should be noted that when the SSC is determined to be of high safety importance, its safety importance analysis process should be defined and this information should be provided to the IDP.

[0105] In one embodiment of the present invention, after performing a defense-in-depth assessment on the item to be assessed and updating the safety importance level of the item to be assessed based on the assessment result, it also includes: when the safety importance level is low safety importance, performing a sensitivity analysis on the equipment to be assessed, and updating the safety importance level of the item to be assessed based on the sensitivity analysis result. Specifically, the failure rate of all equipment that is a candidate for LSS is increased by 3-5 times, and the potential impact of the core damage frequency (CDF) and the early large release frequency (LERF) is calculated. If the assessment result falls into Fig. 9 or Fig.10 If the area is I, it is necessary to adjust the thresholds of the above-mentioned screening criteria for FV and RAW (for example, adjust FV importance>0.005 to FV importance>0.0025) and re-conduct various assessments. Fig. 9The horizontal axis represents the currently calculated CDF value, and the vertical axis represents the difference between the changed and previously calculated CDF values. When the relevant data falls in area II or area III, the safety importance level can be changed. Fig.10 The horizontal axis represents the currently calculated LERF value, and the vertical axis represents the difference between the LERF value after the change and the LERF value obtained by the previous calculation. When the relevant data falls in area II or area III, the safety importance level can be changed.

[0106] The present invention assigns preliminary safety importance to each previously determined function through preliminary engineering classification based on functions, and the safety-important SSC from the equipment safety importance assessment is mapped to the appropriate function that makes it have high safety importance. If the SSC is classified as high safety importance based on the equipment safety importance assessment or the depth defense assessment, the relevant system function is initially classified as high safety importance. All other SSCs can be initially classified as low safety importance. Then, all preliminary classifications classified as high safety importance or low safety importance are submitted to IDP or machine learning for automatic learning for final review and approval. Once the system function is determined to be of high safety importance, all equipment supporting the system function is temporarily classified as high safety importance. All other equipment is temporarily classified as low safety importance. Due to the overlap of functions and equipment, many devices can support multiple functions. In this case, structures, systems and equipment or their related parts should be divided according to the highest risk importance corresponding to the functions they support. For high safety-important functions / SSCs, it is necessary to determine the reasons why the functions / SSCs are classified as high safety importance. The characteristics of the SSC should be included, which are crucial to the safety importance of the function. Identification of reasons for high safety importance can also be used as a justification for the classification of non-safety related SSCs as RISC-2. For each system function, at least the following information should be provided to the IDP or related machine learning model: system name, functions being evaluated and the SSCs supporting these functions, SSCs used as alternatives in the safety importance assessment, risk importance assessment results for each hazard and the combined assessment results, any applicable insights from sensitivity studies, results of the defense-in-depth assessment, and a summary of the basis for the classification recommendation.

[0107] like Figure 8As shown, the comprehensive safety importance assessment based on PSA involves the consideration of the classification results and overall assessment of each single hazard. The following guidelines are provided to assist in conveying the classification results to the IDP or machine learning model: If the SSC is found to have safety importance based on the internal event PSA without considering the sensitivity study, then it is recommended to be a high safety importance category; if the SSC is found to have low safety importance based on the internal event PSA, but has potential high safety importance based on the internal flooding, internal fire, earthquake, other external events or shutdown PSA assessment, then these PSA assessment results and the comprehensive assessment results should be submitted to the IDP or machine learning model for secondary verification. Conversely, if the external event or other PSA assessment item is of low safety importance, a depth defense assessment is required. When it is re-evaluated as low safety importance, a sensitivity study method is required to adjust the threshold of the aforementioned screening criteria and conduct another assessment. If the SSC is found to be a high safety importance category based on the sensitivity study, it should be manually verified again based on the basis and overall importance of each hazard.

[0108] In order to conduct a secondary verification of the safety importance level obtained above, the present invention also conducts a secondary verification based on comprehensive consideration of probabilistic safety assessment and sensitivity analysis, in-depth defense assessment, safety margin assessment, insights from other risk-guided projects (such as maintenance rules, risk-guided in-service inspections, etc.), operation and maintenance experience, etc. Specifically, first, the main technical basis for the initial classification is reviewed: based on the basis for the adequacy of the PSA results, the system functions and their classification basis. The IDP or the machine learning model obtained through big data learning should conclude that the risk information is sufficient to support the classification of the selected system. Whether the way the SSC / function is reflected is appropriate should be judged based on the scope of functions considered and the way risk information is incorporated into these functions. If the IDP determines that the SSC / function is not appropriately reflected, it is returned to the preliminary classification and re-evaluated based on the opinions of the IDP or the relevant model.

[0109] The review of the function / SSC classification need not include verification that all SSCs mapped to that function are appropriate. Based on the coarse mapping from equipment to system functions, the approved system function classification will be used to define the safety importance of each SSC. Therefore, if a system function is found to be safety important, then all equipment supporting that function will be preliminarily considered to be safety important equipment.

[0110] Further, if an IDP is used, if a more detailed classification of SSCs associated with functions important to safety is performed after the initial decision, the basis for the reclassification must be considered in a subsequent IDP meeting. And in the subsequent meeting, the IDP should review the basis for the reclassification and evaluate the impact of the reclassification on the risk significance and defense in depth of the candidate low safety significance SSCs, using the same criteria as the initial IDP meeting.

[0111] Further, during the second review, detailed classification of the equipment can be guided and approved. It can be considered that a certain SSC / function has not been properly evaluated, and based on the revised evaluation, the LSS equipment / function may be changed to HSS, but there are restrictions on changing the equipment / function classification from preliminary HSS to LSS (i.e., it will not easily downgrade an item from RISC-1 to RISC-3). As shown in Table 3, the equipment is assigned its final RISC category after approval.

[0112] Table 3 Limitations for changing preliminary HSS to LSS

[0113]

[0114] Further, after approving the classification of system functions, the safety importance of each SSC can be roughly classified with reference to the relationship between SSCs and functions. If the IDP or related machine learning model considers a system function to be safety-important, then all SSCs that support that system function should be considered safety-important. In some cases, an SSC may support both important high safety-important and low safety-important functions. If an SSC supports any safety-important system function, it should be considered an HSS. Similarly, if all system functions supported by an SSC are of low safety importance, the SSC can be considered an LSS. For some systems or system functions, SSC classification based on coarse mapping can provide sufficient benefits to the power plant. In other cases, this approach may be too conservative and a more detailed classification can be used.

[0115] In addition, since the necessity of each equipment or each part of equipment is determined based on the power plant's expected functional objectives. The power plant can determine whether the classification of all SSCs of a system or subsystem is reasonable based on whether the system or subsystem as a whole performs safety-critical functions. In this case, all equipment within the subsystem or system boundary will be considered as the same safety-critical function group. Each power plant can choose to classify the entire system based on the estimated benefits, or determine the importance of SSCs through additional engineering analysis. These two options include: (1) Classifying all SSCs supporting a certain function to the safety-critical classification of that function. Although this is a conservative allocation, for a specific system, it is most suitable for the cost-benefit assessment of regulatory requirements. That is, the next step of effort may not be commensurate with the benefits obtained. (2) Classifying selected SSCs to a lower level based on the functional attributes supported by the SSC. This is mainly applicable to classifying selected SSCs with safety-critical functions as low safety-critical. In this case, the potential failure of the SSC is evaluated based on the safety-critical function attributes (e.g., allowing flow, blocking flow, preventing fission product release, etc.).

[0116] For (2), the following criteria can be applied to this process: The criterion for classifying SSCs supporting important safety functions as low safety importance is that their failure will not affect the implementation of important safety functions. Among them, specific considerations that allow SSCs supporting important safety functions to be determined as low safety importance include, but are not limited to, that the SSC has no reliable failure mode that can prevent the implementation of the safety function (for example, a valve that is locked open or closed, a manual control valve, etc.); the failure of the SSC will not prevent the implementation of important safety functions (for example, the exhaust pipe or drain pipe of an unimportant bypass, the SSC downstream of the first isolation valve in the functional path, etc.); and the instrumentation that does not hinder the performance of important safety functions (for example, a radiation monitoring device without direct diagnostic function, etc.). For SSCs that are consistent with the classification of the supported functions and have no difference from the assessment considered in the initial IDP or related model, there is no need to conduct an IDP or related model review. For SSCs that are reclassified to a lower level (for example, equipment that is determined to be an important safety function based on the above considerations is LSS), the new classification and its basis should be reclassified using the same stringency procedures as described above. If an SSC to be reclassified to a lower level is modelled in the PSA, a risk sensitivity analysis must be completed prior to submission to the IDP or associated model.

[0117] See also Fig.11, the safety grading system 100 based on risk-guided technology includes: a data acquisition module 110, an internal event analysis module 120, a comprehensive evaluation module 130, and a defense-in-depth module 140. The data acquisition module 110 is used to obtain the failure mode and corresponding failure probability of the item to be evaluated in the internal event and each external event. The internal event analysis module 120 is used to input the failure mode and corresponding failure probability of the item to be evaluated in the internal event into the probabilistic safety evaluation model of the internal event, obtain the internal risk measurement value of the item to be evaluated, and determine the safety importance level of the item to be evaluated based on the risk measurement value; the comprehensive evaluation module 130 is used to input the failure mode and corresponding failure probability of the item to be evaluated in each external event into the probabilistic safety evaluation model of the corresponding external event when the safety importance level is low safety importance, obtain the corresponding external risk measurement value of the item to be evaluated, and update the safety importance level of the item to be evaluated based on the internal risk measurement value and all external risk measurement values. The defense-in-depth module 140 is used to perform a defense-in-depth assessment on the item to be assessed when the updated safety importance level is low safety importance, and to update the safety importance level of the item to be assessed according to the assessment result.

[0118] For the specific limitations of the security grading system based on risk-guided technology, please refer to the limitations of the security grading method based on risk-guided technology mentioned above, which will not be repeated here. Each module in the above-mentioned security grading system based on risk-guided technology can be implemented in whole or in part through software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in hardware format, or can be stored in the memory of the computer device in software format, so that the processor can call the corresponding operations of each of the above modules.

[0119] It should be noted that, in order to highlight the innovative part of the present invention, the present embodiment does not introduce modules that are not closely related to solving the technical problem proposed by the present invention, but this does not mean that there are no other modules in the present embodiment.

[0120] See also Fig.12 The electronic device 1 may include a memory 12, a processor 13 and a bus, and may also include a computer program stored in the memory 12 and executable on the processor 13, such as a security grading program based on risk-guided technology.

[0121] Among them, the memory 12 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, mobile hard disk, multimedia card, card-type memory (for example: SD or DX memory, etc.), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 12 can be an internal storage unit of the electronic device 1, such as a mobile hard disk of the electronic device 1. In other embodiments, the memory 12 can also be an external storage device of the electronic device 1, such as a plug-in mobile hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the electronic device 1. Further, the memory 12 can also include both an internal storage unit of the electronic device 1 and an external storage device. The memory 12 can not only be used to store application software and various types of data installed in the electronic device 1, such as security-graded codes based on risk-guided technology, but can also be used to temporarily store data that has been output or is to be output.

[0122] In some embodiments, the processor 13 may be composed of an integrated circuit, for example, a single packaged integrated circuit, or a plurality of packaged integrated circuits with the same or different functions, including one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and a combination of various control chips. The processor 13 is the control core (Control Unit) of the electronic device 1, and uses various interfaces and lines to connect the various components of the entire electronic device 1, and executes or executes the programs or modules stored in the memory 12 (such as the security classification program based on risk-guided technology, etc.), and calls the data stored in the memory 12 to execute various functions of the electronic device 1 and process data.

[0123] The processor 13 executes the operating system and various installed applications of the electronic device 1. The processor 13 executes the applications to implement the steps in the security classification method based on risk-guided technology.

[0124] Exemplarily, the computer program may be divided into one or more modules, which are stored in the memory 12 and executed by the processor 13 to complete the present application. The one or more modules may be a series of computer program instruction segments capable of completing specific functions, which are used to describe the execution process of the computer program in the electronic device 1. For example, the computer program may be divided into a data acquisition module 110, an internal event analysis module 120, a comprehensive assessment module 130, and a defense-in-depth module 140.

[0125] The above-mentioned integrated unit implemented in the form of a software function module can be stored in a computer-readable storage medium, and the computer-readable storage medium can be non-volatile or volatile. The above-mentioned software function module is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a computer device, or a network device, etc.) or a processor to perform part of the functions of the security classification method based on risk-guided technology described in each embodiment of the present application.

[0126] In summary, the present invention discloses a safety grading method, system, equipment and medium based on risk-guided technology. Without changing the existing safety grading method, the concept of risk importance in probabilistic safety analysis is introduced to determine the management requirements of the equipment from two dimensions: whether it is safety-related and whether the risk is important. This can take into account both reducing management input and improving economic benefits as well as strengthening resource allocation and improving safety levels (for SSCs with safety level but low risk. On the basis of ensuring the safety of nuclear power plants, the technology can be used to reduce management input and exempt special handling requirements in equipment procurement, in-service inspections, preventive maintenance, environmental assessment, seismic assessment, quality assurance, etc., thereby improving economic benefits. For SSCs with non-safety level but high risk, the relevant requirements for such items need to be strengthened to ensure that they can better perform relevant functions and improve the safety of nuclear power plants). Therefore, the present invention effectively overcomes various shortcomings in the prior art and has a high industrial utilization value.

[0127] The above embodiments are merely illustrative of the principles and effects of the present invention, and are not intended to limit the present invention. Anyone familiar with the art may modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by a person of ordinary skill in the art without departing from the spirit and technical concept disclosed by the present invention shall still be covered by the claims of the present invention.

Claims

1. A security grading method based on risk-based technology, characterized in that: The method comprises: Obtain the failure modes and corresponding failure probabilities of the items to be evaluated in internal events and various external events; Inputting the failure mode and corresponding failure probability of the item to be evaluated in the internal event into the probabilistic safety assessment model of the internal event to obtain the internal risk measurement value of the item to be evaluated, and determining the safety importance level of the item to be evaluated based on the risk measurement value; When the safety importance level is low safety importance, the failure mode and corresponding failure probability of the item to be evaluated in each external event are input into the probabilistic safety evaluation model of the corresponding external event, and each external risk metric value of the item to be evaluated is obtained accordingly, and the safety importance level of the item to be evaluated is updated according to the internal risk metric value and all external risk metric values; When the updated safety importance level is low safety importance, a defense-in-depth assessment is performed on the item to be assessed, and the safety importance level of the item to be assessed is updated according to the assessment result.

2. The risk-based security classification method according to claim 1 is characterized in that: The step of inputting the failure mode and the corresponding failure probability of the item to be evaluated in the internal event into the probabilistic safety assessment model of the internal event to obtain the internal risk measurement value of the item to be evaluated, and determining the safety importance level of the item to be evaluated based on the risk measurement value, includes: Inputting the failure mode and corresponding failure probability of the internal event into each fault tree of the probabilistic safety assessment model of the internal event to obtain the internal risk measurement value of the item to be assessed; Calculating the Fussell-Vesely importance and risk increase factor of the item to be evaluated based on the internal risk metric value; Determine whether the Fussell-Vesely importance and risk increase factor meet the preset screening criteria: if so, determine that the item is of high safety importance; Otherwise, the item is determined to be of low safety importance.

3. The risk-based security classification method according to claim 2 is characterized in that: The step of inputting the failure mode and the corresponding failure probability of the internal event into each fault tree of the probabilistic safety assessment model of the internal event to obtain the internal risk measurement value of the item to be assessed includes: Inputting the failure mode and failure probability of the item to be evaluated into the corresponding fault tree, and determining the position of the failure mode of the item to be evaluated in each branch path of the fault tree; wherein the fault tree extends downward from the top event to form multiple branch paths; Taking the position in each branch path of the fault tree as the first starting point, calculating the probability that each branch path in the fault tree leads to the top event; Input the failure mode of the item to be evaluated and the probability of the top event into the corresponding event tree, determine the failure probability of the failure mode / fault event passed by the corresponding path in the event tree according to the probability of the top event, and determine the position of the failure mode of the item to be evaluated in the branch path of each corresponding event tree; wherein the event tree includes a plurality of branch paths extending from the top, and each branch path includes a plurality of different failure modes / fault events arranged in sequence; Taking this position as the second starting point, determining the corresponding end point in the event tree, and screening out the branch path whose end point is core damage; For each branch path of core damage screened: identifying all the failure modes / fault events that have passed along the branch path, and calculating the joint probability of the corresponding branch path based on the failure probability of each failure mode / fault event that has passed and the failure probability of the equipment to be evaluated in the internal event; The joint probability of all branch paths of core damage that are statistically screened is used as the internal risk metric value of the device to be evaluated.

4. The risk-based security classification method according to claim 1 is characterized in that: The step of inputting the failure mode and the corresponding failure probability of the item to be evaluated in each external event into the probabilistic safety assessment model of the corresponding external event, obtaining each external risk metric value of the item to be evaluated, and updating the safety importance level of the item to be evaluated according to the internal risk metric value and all external risk metric values, comprises: Inputting the failure mode and corresponding failure probability of the item to be evaluated in each external event into a probabilistic safety assessment model corresponding to the external event to obtain an external risk measurement value corresponding to the item to be evaluated; Determining a comprehensive risk metric value of the item to be evaluated based on the internal risk metric value and all external risk metric values; Calculating the Fussell-Vesely importance and risk increase factor of the item to be evaluated based on the comprehensive risk metric value; Determine whether the Fussell-Vesely importance and risk increase factor of the item to be evaluated meet the preset screening criteria: If satisfied, the item is determined to be of high safety importance; Otherwise, the item is determined to be of low safety importance.

5. The security grading method based on risk-guided technology according to claim 2 or 4, characterized in that: The screening criteria include: The risk increase factor is greater than the preset risk increase factor threshold; The Fussell-Vesely importance is greater than the preset importance threshold.

6. The risk-based security classification method according to claim 1 is characterized in that: The performing of a defense-in-depth assessment on the item to be assessed, and updating the safety importance level of the item to be assessed according to the assessment result, includes: Determine the design basis events and number of redundant systems / columns corresponding to the item to be evaluated; Based on the preset defense-in-depth matching criteria, according to the design basis events and the number of redundant systems / columns, determine the new safety importance level of the item to be evaluated; Determine whether the new safety importance level is consistent with the safety importance level of the item to be evaluated: If they are consistent, the safety importance level of the item to be evaluated remains unchanged; Otherwise, the new safety importance level is used as the safety importance level of the item to be evaluated.

7. The risk-based security classification method according to claim 1 is characterized in that: After performing a defense-in-depth assessment on the item to be assessed and updating the safety importance level of the item to be assessed based on the assessment result, the method further includes: when the safety importance level is low safety importance, performing a sensitivity analysis on the equipment to be assessed, and updating the safety importance level of the item to be assessed based on the sensitivity analysis result.

8. A security grading system based on risk-based technology, characterized in that: The system comprises: A data acquisition module is used to obtain the failure modes and corresponding failure probabilities of the items to be evaluated in internal events and various external events; An internal event analysis module, used to input the failure mode and corresponding failure probability of the item to be evaluated in the internal event into the probabilistic safety assessment model of the internal event, obtain the internal risk measurement value of the item to be evaluated, and determine the safety importance level of the item to be evaluated based on the risk measurement value; A comprehensive assessment module, for, when the safety importance level is low safety importance, inputting the failure mode and corresponding failure probability of the item to be assessed in each external event into the probabilistic safety assessment model of the corresponding external event, and correspondingly obtaining each external risk metric value of the item to be assessed, and updating the safety importance level of the item to be assessed according to the internal risk metric value and all external risk metric values; The defense-in-depth module is used to perform a defense-in-depth assessment on the item to be assessed when the updated safety importance level is low safety importance, and to update the safety importance level of the item to be assessed according to the assessment result.

9. An electronic device, characterized in that: The electronic device comprises: one or more processors; A storage device for storing one or more programs, which, when executed by the one or more processors, enables the electronic device to implement the security grading method based on risk-guided technology as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed by a processor of a computer, the computer is caused to execute the security grading method based on risk-guided technology as described in any one of claims 1 to 7.

Images