System and method for managing the reliability of safety systems in a nuclear device

Abstract

A computer system (10) is proposed for managing the reliability of at least one safety system (Sn) of a nuclear device (20). The system (10) comprises: a module (110) for receiving input data relating to the system (Sn); a module (120) for generating a relational database (120-10); a module (130) for modeling EPS, generating a set of minimal cross-sections, each representing a minimal combination of failures causing the failure of the system (Sn); and a module (140) for processing the cross-sections, determining failure probabilities associated with each modality of the system (Sn). The system (10) further determines at least one criticality indicator relating to the contribution of the modality to the total probability of a feared event occurring. This criticality indicator is used to improve the reliability of the system (Sn) during the design and / or production phases of the nuclear device. Figure for the abstract: [Fig. 2]

Description

Title of the invention: System and method for managing the reliability of safety systems of a nuclear device Technical field

[0001] The present invention relates generally to safety systems, and in particular to a system and method for managing the reliability of safety systems of a nuclear device.

[0002] Probabilistic Safety Assessments (PSA) are risk assessment methods that study the operation of safeguard systems in nuclear accident scenarios. In particular, level 1 Probabilistic Safety Assessment modeling allows the identification and analysis of accident scenarios, with a view to quantifying the core meltdown frequency of a nuclear reactor. As a result, such modeling makes it possible to identify the weak points of a nuclear facility for which design and / or operating (i.e. production) modifications may be useful, or even necessary (importance of the various potential initiating events and of the equipment used to prevent and limit the consequences of accidents).For example, in the design phase, such modeling can be used to make safety choices and / or to check the overall consistency of management, as well as the minimization of incidents and accidents. In the production phase, such modeling also allows the optimization of modification costs in relation to the expected gain in terms of the overall level of safety.

[0003] There are known systems for estimating and improving the reliability of nuclear installation safety systems using Probabilistic Safety Assessments to study these safety systems. However, Probabilistic Safety Assessments use thousands of events encoded according to the system to which a studied component belongs, its reference on the design diagrams, the type of component, and its failure mode. Probabilistic Safety Assessment modeling then generates tens of thousands of results representing minimal conjunctions of events causing the failure of the studied safety systems. Thus, it is difficult for specialist users and a fortiori non-specialist users to be able to quickly analyze such results and extract relevant information from them.

[0004] There is thus a need for an improved system and method for managing the reliability of nuclear installation safety systems. Summary of the invention

[0005] The present invention improves the situation by proposing a computer system for managing the reliability of at least one safety system of a nuclear device. The computer system comprises:

[0006] - a module for receiving input data relating to at least one system of safety;

[0007] - a module for generating a relational database constructed from of at least part of the received input data;

[0008] - a statistical modeling module for Probabilistic Safety Studies of at least a safety system configured to generate a set of minimum cuts from at least a portion of the input data, each minimum cut representing a minimal conjunction of failures causing the failure of at least one system among the at least one safety system;

[0009] - a module for processing the set of minimal cuts to determine, for each minimum cut, a plurality of failure probabilities each associated with a modality of the at least one safety system from the relational database.

[0010] The computer system is further configured to determine at least one criticality indicator relating to the contribution of at least one of the modalities to the total probability of reaching a feared event, from the pluralities of failures determined for the minimum cuts of the set of minimum cuts, the at least one criticality indicator being used to improve the reliability of the at least one safety system in the design phase and / or in the production phase of the nuclear device.

[0011] Advantageously, the computer system can further be configured to apply at least one remedial action based on at least one criticality indicator to improve the reliability of at least one safety system of the nuclear device.

[0012] In embodiments, the remediation action may consist of adding additional backup systems, diversifying and / or modifying the hardware families or component types, for example, during the design phase of the nuclear device, or triggering or improving predictive maintenance during the production phase of the nuclear device.

[0013] The input data may include at least the following elements:

[0014] - Fault Trees;

[0015] - Event Trees;

[0016] - a list of basic events;

[0017] - a list of common mode failure events;

[0018] - failure probability parameters upon request;

[0019] - operating failure probability parameters;

[0020] - mission time parameters;

[0021] - parameters of the beta or MGL reliability model.

[0022] According to certain embodiments, the generation module may be able to translate the input data to form a plurality of decomposed files, and able to initialize the relational database from tables of data and information according to a predefined organization of the input data, the generation module being further able to translate the decomposed files to populate the tables.

[0023] The statistical modeling module of Probabilistic Safety Studies may include risk probability calculation software, such as RiskSpectrum® software, to generate the set of minimum cuts.

[0024] Alternatively, the processing module may comprise a decoding unit configured to apply, to each minimal cut, a lexical and syntactic analysis of the structure of some or all of the literals of the minimal cut, the decoding unit being further configured to construct and apply a plurality of alphanumeric data extraction requests from the analysis, the processing module being further configured to determine at least one of the modalities of the at least one safety system and the plurality of failure probabilities.

[0025] In embodiments, the minimum cuts of the set of cuts to be processed may comprise a single literal corresponding to a base event defined at the solicitation, the plurality of associated failure probabilities corresponding to the probability of failure at the solicitation of the base event.

[0026] Advantageously, at least one of the minimal cuts of the set of cuts to be processed may comprise a single literal corresponding to a basic event defined in operation, the plurality of associated failure probabilities being determined as a function of the probability of failure in operation and the value of the mission time of the basic event following an exponential law.

[0027] At least one of the minimal cuts of the set of cuts to be processed may comprise a single literal corresponding to an event relating to a common cause failure, the plurality of associated failure probabilities being determined as a function of parameters of the beta or MGL reliability model as a function of the number of events involved in the common cause failure.

[0028] At least one of the minimal cuts of the set of cuts to be processed may comprise a set of literals. At least one of the modalities of the at least one of the minimal cuts may be associated with at least two literals of the set of literals each corresponding to a basic event and / or an event relating to a common cause failure, the probability of failure associated with the modality associated being determined as a function of the product of the probability of failure calculated separately for the at least two literals considered.

[0029] Embodiments of the invention also provide a computer-implemented method for managing the reliability of at least one safety system of a nuclear device. The method comprises at least the following steps:

[0030] - receive input data relating to at least one safety system;

[0031] - generate a relational database constructed from at least one part received input data;

[0032] - generate a set of minimal cuts from statistical modeling of Probabilistic Safety Studies of at least one safety system, from at least part of the input data, each minimal cut representing a minimal conjunction of failures causing the failure of at least one system among the at least one safety system;

[0033] - process the set of minimal cuts to determine, for each cut minimal, a plurality of failure probabilities each associated with a modality of at least one safety system from the relational database.

[0034] The method further comprises the step of determining at least one criticality indicator relating to the contribution of at least one of the modalities to the total probability of reaching a feared event, from the pluralities of failures determined for the minimum cuts of the set of minimum cuts, the at least one criticality indicator being used to improve the reliability of the at least one safety system in the design phase and / or in the production phase of the nuclear device.

[0035] The system and method for managing and / or controlling the reliability of safety systems of a nuclear device according to the embodiments of the invention make it possible to improve the study of all the results of modeling Probabilistic Safety Studies and detection of risk of failure of the safety systems of a nuclear device.

[0036] They make it possible in particular to generate a synthetic analysis solution for these results comprising massive data. In particular, the embodiments of the invention make it possible to provide the characteristics of the safety systems studied, and to produce very quickly and easily synthetic results representing the contribution of each failure mode, of each material, or even of each elementary function of safety systems studied to the total probability of occurrence of the feared event (i.e. meltdown of the core of a nuclear reactor). Description of figures

[0037] Other characteristics, details and advantages of the invention will emerge on reading the description given with reference to the appended drawings given as examples.

[0038] [Fig.l] [Fig.l] is a diagram representing an overall structure comprising a computer system for managing the reliability of safety systems of a nuclear device, according to embodiments of the invention.

[0039] [Fig.2] [Fig.2] is a diagram showing a computer system for managing the reliability of safety systems of a nuclear device, according to embodiments of the invention.

[0040] [Fig.3] [Fig.3] is a diagram representing input data in the form of an RSA type text file, according to embodiments of the invention.

[0041] [Fig.4] [Fig.4] is a diagram showing an example of data organization input in the form of a relational database, according to embodiments of the invention.

[0042] [Fig.5] [Fig.5] is a diagram representing the decomposition of the name of a literal of a minimal cut, according to embodiments of the invention.

[0043] [Fig.6] [Fig.6] consists of two graphs (a) and (b) illustrating representations graphical representations resulting from the exploitation of the results file for managing the reliability of safety systems of a nuclear device, according to embodiments of the invention.

[0044] [Fig.7] [Fig.7] is a flowchart representing a process for managing the reliability of safety systems of a nuclear device, according to embodiments of the invention.

[0045] Identical references are used in the figures to designate identical or similar elements. For reasons of clarity, the elements shown are not to scale. Detailed description

[0046] [Fig.l] schematically represents an overall structure 1 comprising a computer system 10 for managing the reliability of N safety systems of a nuclear device 20 implementing a reliability management method, according to certain embodiments of the invention.

[0047] The computer system 10 is implemented by at least one computer 30 in communication with the various safety systems of the nuclear device 20, for example via a computer cloud 40 (or “cloud” according to the Anglo-Saxon expression).

[0048] The safety systems Sn are safeguard systems of the nuclear device in accident scenarios. The parameter 'n' designates an index associated with a safety system and is an integer between 1 and N. The number N of safety systems can be for example a positive integer greater than or equal to 1. The safety of a nuclear device is governed by the operation of these safeguard systems intended to ensure the proper functioning of this nuclear device. These safeguard systems include, for example, a reactor water supply backup system, a boron safety injection system into the reactor core, or a reactor residual power removal system. Each safety system Sn includes a plurality of components associated with possible failure modes.

[0049] The computer system 10 is configured to determine one or more criticality indicators (also called 'critical elements' or 'criticality parameters') linked to the reliability of the system 20, i.e. having an impact on the reliability of the N safety systems of a nuclear device 20. The computer system 10 can be implemented in the design phase and / or in the production phase of the systems Sn and the device 20.

[0050] For example and without limitation, the computer system 10 may be adapted to determine one or more criticality indicators having an impact on the reliability of the nuclear device 20. A criticality indicator may correspond or be associated for example with:

[0051] - one or more hardware families identifying the hardware family(ies) associated with all Sn systems capable of contributing most to the probability of reaching a nuclear risk. A nuclear risk refers to a critical event (such as, for example, the meltdown of the core of a nuclear reactor of the nuclear device 20);

[0052] - one or more failure modes such that the failure mode(s) having the greatest impact on all Sn systems, or

[0053] - an importance ranking, allowing classification in order of importance the influence of the different criticality indicators contributing most to the probability of reaching a nuclear risk.

[0054] The system 10 is capable of using the determined criticality indicators to improve the reliability of the N safety systems of a nuclear device 20, by triggering one or more remediation actions. For example, the system 10 can trigger a modification action, in the design phase, and / or a monitoring action in the production phase, of identified components or families of equipment. A remediation action can be determined by one or more criticality indicators and information determined according to selection criteria.For example, the selection criteria may consist of modifying the operation of identified equipment (or components) having a probability of unavailability and / or a probability of failure that is too high (evaluated in relation to a comparison threshold), if the criticality indicators identify these families of equipment, or of modifying the most impactful failure modes among the identified failure modes, if the in . Criticality indicators identify failure modes. The selection criteria may also consist of modifying, for example, elementary systems (corresponding to subsystems or support systems of safety systems) having the greatest influence on reliability based on an order of importance ranking of such elementary systems, if the criticality indicators also identify importance ranking information.

[0055] [Fig.2] schematically represents the system 10 for managing the reliability of the nuclear device 20 comprising a set of computer modules, according to certain embodiments of the invention.

[0056] The system 10 for managing the reliability of the nuclear device 20 may comprise a module 110 for receiving input data (also called a reception unit). The remainder of the description will be made with reference to input data compiled and represented in the form of a text file (or compilation file), by way of non-limiting example.

[0057] Such input data includes, for example and without limitation, AdEs event trees, AdDs fault trees, or even a description of the Probabilistic Safety Studies modeling associated with a scanning duration.

[0058] It should be noted that an AdE event tree is associated with an initiating event. As used here, the term “initiating event” refers to an event that disrupts the normal operation of the nuclear device 20, leading to a drift in certain parameters of the facility (pressure, temperature, reactivity, etc.) from which an accident sequence and therefore a nuclear risk can develop. This AdE event tree makes it possible to model scenarios by identifying the different periods or mission times of the systems and the chronological order of the sequences. An AdD fault tree makes it possible to model the combination of basic events (also called elementary failures) that could lead to the failure of a safety system.These basic events, also noted BEV (acronym for the corresponding Anglo-Saxon expression "basic events"), are characterized by 'reliability parameters' which are probabilities of failure if this concerns the failure of a material "on demand" (i.e. at the start of the safety system of which the component is part), 'hourly failure rates' if this concerns a material which can fail "in operation". The probability of failing after a certain operating time follows a probability distribution, such as an exponential law of hourly failure rates.

[0059] An AdD fault tree also makes it possible to take into account the failures of groups of components, designated by the expression 'common mode failures' or 'common cause failures', and also noted CCF (acronym for the corresponding Anglo-Saxon expression "common cause failure"). These component group failures are failures that can affect several redundant components during the duration of the safety system mission, and which originate from design, manufacturing, assembly or maintenance errors. It should be noted that if a member of a group of components (simply called 'group' or 'CCF group') fails individually, then the reliability of the other members of the same group is deduced from the associated common cause model. In other words, the probability of failure of a component in a group is dependent on the probability of failure of the other components in this group. In particular, the probability of failure of the components in a group can evolve increasingly with the number of failing components in this group.For example, the repaired state of each failed and repairable BEV base event is deduced based on the repair time in hours of the base event.

[0060] Advantageously, the input data may also comprise additional information such as the list of BEVs of the AdDs fault trees, the list of CCFs comprising the BEVs which constitute them, a list of "on-demand" failure probability parameters (called "P01 type" parameters), a list of "in operation" failure rate parameters (called 2 or "P02 type" parameters), a list of mission duration or mission time parameters (denoted MT parameters), a list of safety system reliability data which may be, for example, P parameters of the reliability model, beta or MGL, associated with CCFs (denoted / i, 5 and F parameters), or even repair information to indicate whether repairs must be considered and their duration and / or a time step in hours, etc.

[0061] Such input data are constructed beforehand, manually and / or automatically (i.e. dynamically), and constitute a functional database, also called a functional knowledge base, of all the N safety systems of a nuclear device 20. In particular, the text file can be defined in an RSA type format, as shown as an example in [Fig.3], obtained from risk probability calculation software, such as the RiskSpectrum PSA® software.

[0062] A functional knowledge base may include, in particular, thousands of BEV basic events or events relating to common cause failures CCF.

[0063] The reliability management system 10 also comprises a module 120 for generating a relational database 120-10 capable of generating a database from part or all of the input data.

[0064] The relational database 120-10 uses a relational database management system, such as, for example, and without limitation, the mySQL system, and stores in a structured manner the characteristics of all the N safety systems of the nuclear device 20. The relational database 120-10 is capable of providing the data and information that it stores in response to a query. An example of organization of the input data in the form of such a relational database 120-10 is shown in [Fig.4]. In this example, a basic BEV event can be characterized by a type (or mode) of failure and parameters of types P01, P02 and MT, and be associated with a specific hardware component and elementary system. In addition, each component is associated with one or more hardware families and each elementary system falls under one or more functional assemblies.In this example also, each common cause failure CCF can be linked to one or more BEVs, notably by a join table for example, and be characterized by the parameters of the MGL reliability model when it belongs to a CCF group.

[0065] To construct such a base 120-10, the module 120 may be able to dynamically translate the input data compilation file in the form of a plurality of decomposed files, which can then be analyzed individually. This translation may be implemented in response to data extraction requests for example. Thus, the module 120 may be able to generate the following text files:

[0066] - a “BEV” file comprising the name and description of the different events basic relating for example to reliability parameters, to the repair time in hours of the basic event, or to an initiating event with a specific probability of occurrence;

[0067] - a “CCF” file comprising the description of groups of failures of components having a common cause of failure with the list of basic events, in each group, and the parameters of the failure model;

[0068] - files “P01”, “P02”, “MT”, “”, “5”, or even “F” relating to BEVs and CCF.

[0069] Furthermore, the module 120 may be able to initialize the relational database 120-10 from tables of data and information to be filled, each table being associated with an element of a category defined for example according to the organization of the input data as represented in [Fig.4], a first category being associated with the different basic events “BEV”, a second being “CCF”, etc. The module 120 may thus be able to identify the different elements and information from the decomposed files to be analyzed individually and dynamically fill the previously initialized relational database 120-10.

[0070] In particular, each table of data and information to be completed may include the name and / or the identifier (i.e. code) of the recognized element, i.e. at least the abbreviation of the element defined during the prior construction of the database. functional.

[0071] In embodiments, the module 120 may be able to dynamically translate the decomposed files to be analyzed individually into intermediate analyzed files (in text format for example). Such analyzed files may make it possible to feed (i.e., fill) tables of data and information corresponding to the associated elements. Such analyzed files may also make it possible to link these tables together using the nomenclature of the information in the table of the associated element.

[0072] For example and without limitation, such analyzed files may in particular be files describing elementary systems and functional assemblies (noted fic_se.txt and fic_fe.txt), making it possible to feed the data and information tables of the base 120-10 corresponding to the elements of the categories “elementary system” and “functional assembly” respectively. In addition, the tables may be linked together using the code of a functional assembly constituting the beginning of the name of an elementary system or of a part of an elementary system.

[0073] Similarly, such analyzed files may in particular be files describing types of failure, components and families of equipment (noted type_def.txt, fic_composant.txt and famille_Materiel.txt), making it possible to feed and possibly link the corresponding information tables of the relational database 120-10.

[0074] Advantageously, the relational database 120-10, and more precisely the set and number of data and information tables associated with the different elements and the different categories, can be adapted in response to the insertion (i.e., the filling) of data flows resulting from the processing of the decomposed files to be analyzed individually and / or the intermediate analyzed files.

[0075] It should be noted that a modification of the functional knowledge base (i.e. of the input data) may induce the implementation of a modification (or update) of the relational database 120-10.

[0076] The reliability management system 10 may also comprise a module 130 for statistical modeling of Probabilistic Safety Studies of safety system(s) Sn from the input data from the reception module 110, and in particular from the analysis of the fault trees to estimate the probability(s) of failure of the system(s) Sn.

[0077] The statistical modeling module 130 of Probabilistic Safety Studies is then configured to generate an output file 130-10 comprising a set of minimal cuts.

[0078] As used herein, the term "minimum cut" refers to a conjunction (i.e. a minimal combination) of failures causing the failure of one or more modeled safety systems Sn, and associated with a probability of occurrence of unavailability and / or failure of system(s). A minimal cut may thus comprise a set of basic events BEV and / or events relating to common cause failures CCF, corresponding to the failure mode(s) of one or more components of the safety system Sn. The conjunction of this set of events, studied by the modeling module 130, may be sufficient to lead to the failure or loss of the modeled safety system Sn.

[0079] Thus each minimal cut MCSj is constructed from a number Hj of basic BEV events and / or events relating to common cause failures CCF, called in the remainder of the description “MCS j cut literals fjh”. The index 'h' is used to designate the h-th literal of a cut, and is thus between 1 and Hj. The different numbers Hj are strictly greater than 2 and depend on the MCSj cut.

[0080] For example and without limitation, the output file 130-10 may be a file comprising a number J of lines and a plurality of columns. Each line may correspond to a minimum cut MCSj determined by the module 130. The index 'j' is used to designate the j-th line of the file, and is thus between 1 and J, the number J being strictly greater than 1.

[0081] The output file 130-10 may comprise a large quantity of data (i.e. large volumes of data also called “massive data”), corresponding for example to several tens of thousands of minimal MCSj sections to be analyzed (or exploited) to deduce one or more criticality indicators impacting the reliability of the N safety systems of a nuclear device 20.

[0082] In an example of output file 130-10, columns of the file associated with a line j may comprise the number of the minimum cut MCSj considered, the probability of occurrence of the cut £Fj corresponding to the contribution of the minimum cut MCSj as a percentage to the total probability of reaching the feared event, or the identifier of the event initiating the minimum cut MCSj. One or more other columns of the file associated with a line j may respectively comprise a literal fjh of the minimum cut MCSj (i.e. a basic event BEV and / or an event relating to common cause failures CCF, among the set of events considered in the conjunction).

[0083] By way of illustration, a minimum cut MCSj of an output file 130-10 may include a probability of occurrence (P, equal to g 45 x 10-i a contribution of the cut to the total probability of reaching the feared event equal to 5 gç x IO 2%, an initiating event EI_PP1 equivalent to the “loss of a primary pump”, as well that a number Hj of literals equal to 5, which can be represented by the following mathematical expression (01):

[0084] LAV2101BTA_DF-4 A LHI1110GAD_DF-4 a LHI2110GAD_DF-3 a MDTE_IND A OP_OUV TRAP-VANT_RRB (01)

[0085] In the mathematical expression (01), the first literal is LAV2101BTA DF - 4, the second literal G is LHH110GAD DF - 4, the third literal fj3 is LHI2110GAD DF- 3, the fourth literal fj4 is MDTE_IND, and the fifth literal fj5 is OP_OUV TRAP - VANT_RRB.

[0086] In embodiments, the J minimum cuts MCSj of the output file 130-10 can be classified in decreasing order of probability of occurrence of the cut (Py In particular the first line can correspond to the minimum cut MCSi having the highest probability of occurrence determined by the implementation of the statistical modeling of Probabilistic Safety Studies of safety system(s) Sn from the input data from the reception module 110.

[0087] In order to be able to exploit all of the massive data from the modeling module 130 (to deduce one or more criticality indicators relating for example to families of equipment and / or to failure modes, or even to an order of classification of influence of the elementary systems), the computer system 10 can also comprise a module 140 for processing the J minimum cuts MCSj of the output file 130-10, and implemented from the relational database 120-10 from the module 120.

[0088] In particular, the module 140 can be configured to generate a file called a “result file” allowing the improvement of the management of the reliability of N safety systems Sn from the processing of the J minimum cuts MCSj. Advantageously, the remainder of the description will be made with reference to a file represented in the form of a data table, by way of non-limiting example.

[0089] A result file 140-10 may contain U x V elements Euv, each element being associated with a row Lu and a column Cv of the table. The indices 'u' and 'v' are used to designate respectively the u-th column and the v-th row of the data table, and is thus between 1 and U, and 1 and V, the numbers U and V being strictly greater than 1.

[0090] To facilitate understanding of the invention and for simplification, the remainder of the description will be made mainly with reference to a number U equal to the number J of minimal cuts MCSj from the output file 130-10, the index 'u' then being substituted for the index 'j'. As a result, each line Lj (or Lu) then corresponds to a specific minimal cut MCSj.

[0091] In embodiments, each column Cv may correspond to a category modality. As used herein, the term "modality" refers to any component or event associated with the safety system(s) considered. For example and without limitation, a Cv modality can be a family of equipment, a failure mode called "on demand" or a failure mode called "in operation" of a component, or even a category of an elementary system of the safety system.

[0092] Furthermore, the module 140 may be able to initialize such a result file 140-10 from a data table to be filled, each element of the data table Ejv being initialized to a zero value. Advantageously, in the result file 140-10, the number of columns may be fixed by the statistical modeling of Probabilistic Safety Studies implemented in the module 130, and the number of lines may be adapted according to the number of minimum cuts MCSj resulting from this EPS modeling. In particular, the number of lines of the initialized result file 140-10 may increase in response to the insertion (i.e., the filling) of data streams resulting from the processing of the minimum cuts MCSj.

[0093] For each element Ejv, the processing module 140 can subsequently be configured to calculate, for each minimum cut MCSj, the failure probability value of the modality Cv corresponding to the contribution of this modality with respect to the probability of occurrence ^j of the minimum cut MCSj. The value associated with this element Ejv is called in the remainder of the description “contribution value Ejv” and depends on this probability of occurrence

[0094] Advantageously, the contribution value Ejv can in particular be determined from the alphanumeric data available in the relational database 120-10 to be associated with each of the literals fjh of the section MCSj.

[0095] Furthermore, as illustrated by equation (01), each literal / jh of the MCSj section (i.e. basic event BEV or relating to a common cause failure CCF) is constructed (or encoded) according to a certain number Kjh of fhk sections. The index 'k' is used to designate the k-th section of a literal of a section, and is thus between 1 and Kjh. The different numbers Kjh are strictly greater than 2 and depend on the literal / jh of the MCSj section. Thus, each rjhk section corresponds to an encoding element of the literal fjh considered. A section can correspond to the identifier encoding the elementary system of belonging of the examined component, the type of component, its reference on the design diagrams (e.g. identification number), the equipment family, or even the associated failure mode, as illustrated in [Fig.5].

[0096] Advantageously, the module 140 for processing the J minimal cuts MCSj can comprise a decoding unit 1402 configured to apply a lexical and syntactic analysis of the structure of a part or all of the literals associated with each minimal cut MCSj processed.

[0097] For example and without limitation, unit 1402 may be configured to identify each literal of a minimum cut MCSj as being either a basic event BEV or an event relating to a common cause failure CCF. It should be noted that the literal of an event relating to a common cause failure CCF begins with the letter C, the other literals not beginning with the letter C then being basic events BEV. The module 140 can also be configured to identify each literal of a basic event BEV of the minimum cut MCSj as being defined "at demand" or defined "in operation". In the notations which follow, the literal of a BEV event defined "at demand" will end with an alphabetical identifier relating to an alphabetical data item of failure in operation, while the literal of a BEV event defined "in operation" will end with a numerical identifier relating to a numerical data item of mission time MT, as illustrated by equation (01).

[0098] Furthermore, for each minimal cut literal MCSj, the module 140 can be configured to identify sections or groups of sections of the literal from the punctuation of the literal, such as for example the dash “_” (or underscore in English) or the hyphen “-”.

[0099] By way of illustration, in the example of the first literal fji relating to the expression (01), that is to say LAV2101BT _DF -4, a first section rjn is LAV, a second section ^2 is 2101, a third section u3 is BT, a fourth section ^4 is DF, and a fifth section rj[3 is 4. Thus the lexical and syntactic analysis makes it possible to identify an operating failure (DF) relating to a mission time corresponding to MT4 (4) of an electrical accumulator (BT) no. 2101 in a BT DC electrical backup panel (LAV).

[0100] In another example, the basic event noted "jR7M13O1VÆ_Æ(?" corresponds to the refusal to open upon request (RO) of the air valve (VAE) no. 1301 identified on the residual power evacuation system located in the tank for an RNRNa type reactor (RRA).

[0101] Similarly, the event noted “C8LAXJA2OI - 3 - 236” corresponds to a common cause failure of 3 elements (2, 3, 6) of a group made up of 8 basic events (C8), and concerns an untimely opening mode (Ol) of a contactor component (JA) n°2 identified on a LV DC electrical backup panel (LAX) relating to a mission time corresponding to MT3 (3).

[0102] The event noted "C2RRAV A\RO - ALL" corresponds to a failure of all the basic elements (ALL) of a group of common cause failures consisting of 2 events (C2), associated with a refusal to open (RO) valves marked by 1 (VA1) identified on each line of the residual power evacuation system located in the tank (RRA) for an RNRNa type reactor.

[0103] In embodiments, following decoding of each literal 4jh (i.e. of each associated fjhk sections) for a minimum cut MCSj, the unit 1402 can be configured to determine all the modalities Cv relating to the minimum cut MCSj. This determination can also be implemented from one or more alphabetical data extraction requests intended for the relational database 120-10 relating to some or all of the fjhk sections considered associated with the minimum cut MCSj.

[0104] In the example of the basic event “LAV2101BTADF - 4”, the unit 1402 can be configured to extract the information (i.e. alphabetical data) of the modality of the functional assembly and of the modality of the equipment family associated with this literal and to possibly define them as modalities Cv relating to the basic event of the section considered, i.e. respectively to the category of electrical systems (for the alphabetical data FE_L), or even to a so-called unlisted category (for the alphabetical data M_NR).

[0105] The unit 1402 may also be capable of implementing one or more digital data extraction requests intended for the relational database 120-10 in relation to some or all of the sections rjhk considered associated with the minimum cut MCSj.

[0106] Also, in the example where from the basic event “LAV2101BT A_DF - 4”, the unit 1402 can be configured to extract the digital data corresponding to the value of the mission time MT (for example MT4 = 74 hours) and to the probability of failure in operation (for example pQ2 — 1.86 x 10'6 h"1)-

[0107] Advantageously, for each modality Cv considered with respect to the minimum cut MCSj, the processing module 140 can be configured to calculate the contribution value (i.e. probability) of each element Ejv to be filled in the data table of the result file 140-10, from the digital data extractions determined by the decoding unit 1402.

[0108] In embodiments where a minimum cut MCSj comprises a unique literal / ji corresponding to a basic event BEV defined "at the request", for each modality Cv relating to the minimum cut MCSj (i.e. to the unique literal f ji), the unique value of the elements Ejv considered may correspond to the probability of failure at the request (i.e. parameter P01) of the basic event BEV multiplied by the probability of occurrence of the initiating event considered.

[0109] In the example of the basic event “RRA1301V AE _RO”, the Cv modalities (contributions) identified to a cut can be:

[0110] - failure to open upon request (RO), [YES] - the air valve (VAE),

[0112] - the identified component 1301, and

[0113] - the residual power evacuation system located in the tank for a reactor of type RNRNa (RRA).

[0114] Thus, each element Ejv of the data table relating to one of the identified modalities Cv can have a contribution value (i.e. probability) equal to the probability of the request, i.e. for example a value equal to 10“2.

[0115] In embodiments where a minimum cut MCSj comprises a unique literal fji corresponding to a basic event BEV defined "in operation", for each modality Cv relating to the minimum cut MCSj (i.e. to the unique literal / ji), the unique value of the elements Ejv considered can be determined as a function of the probability of failure in operation (i.e. parameter  or P02) and the value of the indicated mission time MT of the basic event BEV. In particular, the unique value of the elements Ejv can be the calculated probability P- defined from an exponential law described in the following equation (02):

[0116] Ejv (in operation) = Pz = 1 - exp( - P02 x MT) (02)

[0117] In the example of the basic event “LAV2101BTADF - 4”, the Cv modalities (contributions) identified to a cut can be:

[0118] - operating failure (DF),

[0119] - the electric accumulator (BT),

[0120] - the LV DC electrical backup panel (LAV), and

[0121] - the modalities identified from the relational database 120-10, that is, the category of electrical systems (FE_L) and a so-called unlisted category (M_NR).

[0122] Thus, each element Ejv of the data table relating to one of the identified modalities Cv can be equal to the calculation of the probability Py = 1 - exp( - P02 x MT4) described in the previous equation (02), that is to say that it can have for example a value equal to p, = ]_ exp( -1.86 x 10*6 x 74) = 1.37 x 10"4-

[0123] In embodiments where a minimum cut MCSj comprises a unique literal corresponding to an event relating to a common cause failure CCF, for each modality Cv relating to the minimum cut MCSj (i.e. to the unique literal / ji), the unique value of the elements Ejv can be determined according to the model [3 or MGL of common cause failure and the associated parameters defined according to the number of events involved in the common cause failure. In particular, it should be noted that a CCF event corresponds to a common cause failure of a group consisting of R basic events, and is associated with a failure of r elements among these R basic events. Thus, the unique value of these elements Ejv can be the calculated probability QR defined from the general formula of the MGL model for RiskSpectrum PSA® studies, described according to the following equation (03):

[0124] g*.p ü-p- ,)e (03)

[0125] In equation (03), the elements Q . each correspond to the probability (P01 or P4 associated with the basic event n considered among the r basic events involved. In addition, the element corresponds to the number of combinations of basic events BEV of size (r-1) among all the BEVs of the CCF group considered deprived of a subset of elements of size (R-1). The different elements P correspond to a parameter / 5, <5 or F of the reliability model beta or MGL, associated with the basic event ri considered.

[0126] In the previous example where the CCF event “C8LAXJA2OI - 3 - 236”, the Cv modalities (contributions) identified to a cut can be at least:

[0127] - the untimely opening mode

[0128] - the BT DC electrical backup panel (LAX),

[0129] - the contactor component (-M),

[0130] - as well as possibly modalities identified from the database re lational 120-10, that is to say for example the category of electrical systems (FE_L) and a so-called unlisted category (M_NR).

[0131] This event relating to a common cause failure CCF being associated with the 3 basic events defined according to a failure in operation, the elements Q. correspond to the calculation of the probability Q = Py = 1 - exp ( - P02 X MT3 ) described in the previous equation (02). The digital data from the data extraction implemented by unit 1402 can correspond to the value of the mission time MT (for example MT3 = 64 hours) and to the values ​​of the parameters of the failure model MGL (for example p — x 10"2 hF § = 1 06 X 10 1 lï^ ct y = 6.27 x 101 H1 for the group consisting of 8 basic events C8). Thus, each element Ejv of the data table relating to one of the modalities Cv identified in this case can be equal to the calculation of the calculated probability Q* adapted from the previous equation (03), that is to say according to the following equation (04): [01321 ^ = ^Wi-8s)Q^

[0133] In embodiments where a minimal cut MCSj comprises a set of literals 4jh, for each modality Cv identified relating to the minimal cut MCSj, the processing module 140 (for example the decoding unit 1402) can be configured to determine the redundancy of the modalities Cv (contributions) identified on the different literals Zjh of a minimal cut MCSj.

[0134] In particular, in embodiments where the set of literals fjh of a minimal cut MCSj corresponds to basic events BEV defined "at the solli citation", in the case where a modality Cv appears in a single literal of the minimum cut MCSj (i.e. no redundancy), the value of the associated element Ejv can correspond to the probability of failure at the request (i.e. parameter P01) of the basic BEV event considered. In the case where a modality Cv appears in a number X of literals of the minimum cut MCSj (i.e. redundancy, for a number X being a positive integer greater than or equal to 2), the value of the associated element Ejv can correspond to the product of the probabilities of failure at the request (i.e. parameter P01x) of the X basic BEV events considered as described in the following equation (05):

[0135] Ejy(at the request] = Hx P01x (^5)

[0136] In embodiments where the set of literals fjh of a minimal cut MCSj corresponds to basic events BEV defined "in operation", in the case where a modality Cv has no redundancy, the value of the associated element Ejv may correspond to the associated probability P / described in equation (02). In the case where a modality Cv appears in a number X of literals of the minimal cut MCSj (i.e. redundancy, for a number X being a positive integer greater than or equal to 2), the value of the associated element Ejv may correspond to the product of the probabilities P^x of the X basic events BEV considered as described in the following equation (06):

[0137] Ej^ / i operation] = IIX P /

[0138] In embodiments where the set of literals fjh of a minimal cut MCSj corresponds to basic events BEV defined "at the request" and "in operation", in the case where a modality Cv has no redundancy, the value of the associated element Ejv may correspond to the associated probability (P01 or Py). In the case where a modality Cv appears in a number X of literals of the minimal cut MCSj (i.e. redundancy for a number X being a positive integer greater than or equal to 2), the value of the associated element Ejv may correspond to the product of the probabilities (P01 and Pf) of the X basic events BEV considered.

[0139] As an illustration, for the minimum cut MCSj noted " RRA1301VAE_R() / \ RRAÏ 102PGA_DF_4 » the first literal is associated with a probability of failure at the request P01 and the second literal fj2 is associated with a probability P; calculated, defined from as a function of the probability of failure in operation P02 and the value of the mission time MT4. Thus, the value of the element Ejv of the data table relating to the identified modality Cv of the elementary system (RRA) can be equal to the product of the probabilities associated with the literals considered, that is to say for example a value equal to P01X P, . It is to note that in this example, the value of the element Ejv of the data table relating to the modalities Cv identified with the component “air valve”, with the material “valve” (from the first literal) can be equal to the probability of failure at the request P01, while the value of the element Ejv of the data table relating to the modalities Cv identified with the component “electromagnetic pump”, with the material “water supply” (from the second literal fj2) can be equal to the probability of failure at the calculated probability P(.

[0140] In embodiments where the set of literals fjh of a minimal cut MCSj corresponds to basic events BEV and an event relating to a common cause failure CCF, in the case where a modality Cv has no redundancy, the value of the associated element Ejv may correspond to the associated probability (P01, Py or g*). In the case where a modality Cv appears in a number X of literals of the minimal cut MCSj (i.e. redundancy for a number X being a positive integer greater than or equal to 2), the value of the associated element Ejv may correspond to the product of the probabilities calculated separately (g^ and P01 and / or P^) for the X events considered.

[0141] The reliability management system 10 may further comprise a module 150 for exploiting the result file 140-10 from the processing module 140.

[0142] In particular, the exploitation module 150 can be configured to calculate, for each modality Cv, the sum 7V of all the contribution values ​​Ejv of the associated modality Cv on the set of minimal cuts MCSj, as described in the following equation (07):

[0143] _yJ p (07)

[0144] In equation (07), the value of the sum Jv associated with the modality Cv represents a criticality indicator of the safety system(s) studied making it possible to improve the reliability of the safety system(s) Sn studied of the nuclear device 20.

[0145] In embodiments, the operating module 150 may be configured to generate graphical and / or synthetic representations for analyzing the data in the result file 140-10. For example, the module 150 may be configured to generate synthetic graphs, such as pie charts and correlation matrices, representing the results of the values ​​of the sums Iv associated with each of the identified modalities Cv of the safety system(s) Sn studied. The analysis of these graphical and / or synthetic representations makes it possible to quickly and easily recognize the most relevant information (i.e. the total probabilities of occurrence of the feared event) relating for example to the most important contributions (to the probability of reaching a nuclear risk) among the safety modes failure (illustrated for example in [Fig.6] [a]) or even to the most important contributions among the functional sets (illustrated for example in [Fig.6][b]).

[0146] As mentioned previously, these criticality indicators can make it possible to improve the reliability of the N safety systems of a nuclear device 20 by triggering remediation actions. In the design phase, these criticality indicators can, for example, make it possible to trigger, via the system 10, an action to modify the nuclear device 20 consisting of adding additional safeguard systems, diversifying and / or modifying the hardware families or the types of components, modifying the architecture of certain elementary systems, or even validating the design of the safety systems making it possible to implement a physical manufacturing phase of the nuclear device 20.In the production phase, these criticality indicators can, for example, make it possible to trigger, via the system 10, a monitoring action on the nuclear device 20 consisting of triggering, implementing or improving predictive maintenance on the nuclear device 20.

[0147] Advantageously, the reliability management system 10 may comprise a memory 180 configured to store the input data, the generated relational database 120-10, the output file 130-10, the result file 140-10, and / or the post-processing elements of the result file.

[0148] [Fig.7] is a flowchart describing the method for improving and enhancing the reliability of N safety systems of a nuclear device 20, implemented by a computer system 10, according to embodiments of the invention.

[0149] In step 710, input data are received in the computer system 10 for managing the reliability of safety systems of a nuclear device via a reception module 110.

[0150] In step 720, a relational database 120-10 is generated from some or all of the input data.

[0151] In step 730, a statistical modeling of Probabilistic Safety Studies is applied from part or all of the input data to generate an output file 130-10 comprising a set of minimum cuts MCSj.

[0152] In step 740, the minimum cuts MCSj are processed according to the relational database from the relational database 120-10 to generate a result file 140-10, advantageously in the form of a data table, comprising for each minimum cut MCSj a set of failure probabilities of a modality Cv of safety systems of a nuclear device (i.e. a type of component, a family of equipment, a failure mode "on demand" or "in operation" of a component, or even a category of an elementary system of the safety system for example).

[0153] In step 750, the results of processing the minimum cuts MCSj are used to determine criticality indicators relating to the contribution of each modality of safety systems with respect to the total probability of reaching the feared event.

[0154] Those skilled in the art will easily understand that certain steps can be carried out simultaneously and / or in a different order, for example in an order defined by the computer system 10.

[0155] Advantageously, it should be noted that the analysis of the fault trees (and therefore such a module 130) can be implemented from risk probability calculation software, such as the RiskSpectrum® software, using an approach for determining and calculating minimal cuts (i.e. estimating the probabilities of failure or unavailability scenarios) based on binary decision diagrams (or BDD for Binary Decision Diagram in English) making it possible to estimate probabilities of unavailability or failure of the backup system(s) with reasonable calculation times. Those skilled in the art will understand that the module 130 for modeling Probabilistic Safety Studies of the safety system Sn can use other software and other approaches to analyze the fault trees.For example and without limitations, the module 130 may use an approach based on Petri nets developed by the companies Framatome and Technicatome, or the so-called BDMP approach (acronym for the corresponding English expression “Boolean Logic Driven Markov Processes”), developed by the company EDF®, and based on Markov process modeling as described in the article “Boolean approximation for calculating the reliability of a very large ESREL”, Glasgow, Scotland, 2016 by Bouissou and Hernu. The results of the calculations by these methods produce sets of minimum cuts associated with probabilities of occurrence.

[0156] Those skilled in the art will understand that the invention may be implemented as a computer program comprising instructions for its execution. The computer program may be recorded on a recording medium readable by a processor. Reference to a computer program that, when executed, performs any of the functions described above, is not limited to an application program executing on a single host computer. Rather, the terms computer program and software are used herein in a general sense to refer to any type of computer code (e.g., application software, firmware, microcode, or any other form of computer instruction) that may be used to program one or more processors to implement aspects of the techniques described herein.The IT means or resources can in particular be distributed ("Cloud computing"), possibly according to . peer-to-peer technologies. The software code may be executed on any suitable processor (e.g., a microprocessor) or processor core or a set of processors, whether provided in a single computing device or distributed among several computing devices (e.g., as may be accessible in the device environment). The executable code of each program enabling the programmable device to implement the processes according to the invention may be stored, for example, in the hard disk or in read-only memory. Generally, the program(s) may be loaded into one of the storage means of the device before being executed. The central unit may control and direct the execution of the instructions or portions of software code of the program(s) according to the invention, instructions which are stored in the hard disk or in read-only memory or in the other aforementioned storage elements.

[0157] The computer system 10 may be implemented on a distributed computing unit comprising a plurality of physical cores (for example 16 cores). The embodiments of the invention are particularly suitable for such a distributed implementation as well as for porting to multi-core hardware technologies, which makes it possible to obtain a rapid response to a user query regardless of the size of the classification model considered. The computer system 10 may be implemented in different languages, such as the C++ language.

[0158] The invention is not limited to the embodiments described above by way of non-limiting example. It encompasses all the variant embodiments that may be envisaged by those skilled in the art. In particular, those skilled in the art will understand that the invention is not limited to the different modules of the computer system 10 described by way of non-limiting example.

Claims

Claims

1. Computer system (10) for managing the reliability of at least one safety system (Sn) of a nuclear device (20), characterized in that said system (10) comprises: - a module (110) for receiving input data (AdDs, AdEs, Datafiab, MTS) relating to said at least one safety system (Sn); - a module (120) for generating a relational database (120-10) constructed from at least part of the input data received (AdDs, AdEs, BEVs, CCFs, POls, P02s, MTs, p, ô and Y); - a statistical modeling module (130) for Probabilistic Safety Studies of said at least one safety system (Sn) configured to generate a set of minimum cuts (MCSj) from at least part of the input data (AdDs, AdEs, BEVs, CCFs, POls, P02s, MTs, 0, ô and Y), each minimum cut (MCSj) representing a minimum conjunction of failures causing the failure of at least one system among said at least one safety system (Sn); - a module (140) for processing said set of minimum cuts (MCSj) to determine, for each minimum cut (MCSj), a plurality of failure probabilities (Ejv) each associated with a modality (Cv) of said at least one safety system (Sn) from said relational database (120-10); said system (10) being further configured to determine at least one criticality indicator relating to the contribution of at least one of said modalities (Cv) to the total probability of reaching a feared event, from the pluralities of failures determined for the minimum cuts of said set of minimum cuts (MCSj), said at least one criticality indicator being used to improve the reliability of said at least one safety system (Sn) in the design phase and / or in the production phase of said nuclear device (20).

2. A computer system (10) according to claim 1, wherein said system (10) being further configured to apply at least one remedial action based on said at least one criticality indicator to improve the reliability of said at least one safety system (Sn) of said nuclear device (20).

3. A computer system (10) according to claim 2, wherein said remediation action consists of adding additional backup systems, diversifying and / or modifying hardware families or component types for example in the design phase of said nuclear device (20), or triggering or improving predictive maintenance in the production phase of said nuclear device (20).

4. Computer system (10) according to any one of the preceding claims, wherein said input data (AdDs, AdEs, BEVs, CCFs, POls, P02s, MTs, [5, 5 and Y) comprise at least the following elements: - Fault Trees (AdDs); - Event Trees (AdEs); - a list of basic events (BEVs); - a list of common mode failure events (CCFs); - failure probability parameters at demand (POls); - failure probability parameters in operation (P02s); - mission time parameters (MTs); - parameters of the beta or MGL reliability model (^, <5 and T).

5. Computer system (10) according to any one of the preceding claims, wherein said generation module (120) is capable of translating said input data (AdDs, AdEs, BEVs, CCFs, POls, P02s, MTs, |3, ô and Y) to form a plurality of decomposed files, and capable of initializing said relational database (120-10) from tables of data and information according to a predefined organization of the input data (AdDs, AdEs, BEVs, CCFs, POls, P02s, MTs, P, b and Y), said generation module (120) being further capable of translating said decomposed files to feed said tables.

6. Computer system (10) according to any one of the preceding claims, in which the statistical modeling module (130) of Probabilistic Safety Studies comprises risk probability calculation software, such as the RiskSpectrum® software, for generating said set of minimum cuts (MCSj).

7. Computer system (10) according to any one of the preceding claims, wherein said processing module (140) comprises a decoding unit (1402) configured to apply, to each minimal cut (MCSj), a lexical and syntactic analysis of the structure of a part or all of the literals of said minimal cut (MCSj), said decoding unit (1402) being further configured to construct and apply a plurality of alphanumeric data extraction requests from said analysis, said processing module (140) being further configured to determine at least one of said modalities (Cv) of said at least one safety system (Sn) and said plurality of failure probabilities (Ejv).

8. Computer system (10) according to claim 7, wherein at least one of said minimal cuts (MCSj) of said set of cuts to be processed comprises a single literal corresponding to a basic event (BEV) defined at the request, said plurality of associated failure probabilities (Ejv) corresponding to the probability of failure at the request of said basic event (BEV).

9. Computer system (10) according to any one of the preceding claims 7 to 8, in which at least one of said minimum cuts (MCSj) of said set of cuts to be processed comprises a single literal corresponding to a basic event (BEV) defined in operation, said plurality of associated failure probabilities (Ejv) being determined as a function of the probability of failure in operation and the value of said mission time of said basic event (BEV) following an exponential law.

10. Computer system (10) according to any one of the preceding claims, wherein at least one of said minimal cuts (MCSj ) of said set of cuts to be processed comprises a single literal corresponding to an event relating to a common cause failure (CCF), said plurality of associated failure probabilities (Ejv) being determined as a function of parameters of the beta or MGL reliability model (fi, 5 and F) as a function of the number of events involved in the common cause failure.

11. Computer system (10) according to any one of the preceding claims, wherein at least one of said minimal cuts (MCSj) of said set of cuts to be processed comprises a set of literals, and wherein at least one of said modalities (Cv) of said at least one of said minimal cuts (MCSj) is associated with at least two literals of said set of literals each corresponding to a basic event (BEV) and / or an event relating to a common cause failure (CCF), the probability of failure (Ejv) associated with said associated modality (Cv) being determined as a function of the product of the probability of failure calculated separately for said at least two literals considered.

12. Method for managing the reliability of at least one safety system (Sn) of a nuclear device (20), implemented by computer, characterized in that the method comprises at least the following steps consisting of: - receive (710) input data (AdDs, AdEs, Datafiab, MTS) relating to said at least one safety system (Sn); - generating (720) a relational database (120-10) constructed from at least part of the received input data (AdDs, AdEs, BEVs, CCFs, POls, P02s, MTs, P, ô and Y); - generating a set of minimum cuts (MCSj) resulting from a statistical modeling (730) of Probabilistic Safety Studies of said at least one safety system (Sn), from at least part of the input data (AdDs, AdEs, BEVs, CCFs, POls, P02s, MTs, P, 8 and Y), each minimum cut (MCSj) representing a minimal conjunction of failures causing the failure of at least one system among said at least one safety system (Sn); - processing (740) said set of minimum cuts (MCSj) to determine, for each minimum cut (MCSj), a plurality of failure probabilities (Ejv) each associated with a modality (Cv) of said at least one safety system (Sn) from said relational database (120-10); said method further comprising the step of determining at least one criticality indicator relating to the contribution of at least one of said modalities (Cv) to the total probability of reaching a feared event, from the pluralities of failures determined for the minimum cuts of said set of minimum cuts (MCSj), said at least one criticality indicator being used to improve the reliability of said at least one safety system (Sn) in the design phase and / or in production phase of said nuclear device (20).

Images