Safety study support system, safety study support device, and safety study support method

Abstract

To provide a safety study support system that comprehensively studies a plurality of safety devices and considers best design condition during safety study at the time of facility design.SOLUTION: A safety study support system of the present invention includes: an operation procedure database that records an operation of a safety device in an event of a risk occurring for a facility that is a subject of safety study; a design condition database that records a design condition related to the safety device and a condition candidate that is a candidate for the design condition; a transition probability database that records transition probability for each of the condition candidates related to an operation branch in the operation procedure database; a risk calculation unit that calculates a risk index by using the operation procedure database and the transition probability database; a transition probability calculation unit that calculates transition probability in the condition candidate that reduces the risk index to a degree that satisfies a predetermined criterion; and an output unit that outputs the transition probability and the safety device associated with the operation branch.SELECTED DRAWING: Figure 14

Description

[Technical field]

[0001] The present invention relates to a safety study support system, a safety study support device, and a safety study support method. [Background technology]

[0002] When considering safety during the design of equipment, safety studies and tests are conducted on individual safety devices. However, when risks arise from the complex interactions of numerous parts, safety devices, and human operations, it is difficult to comprehensively and quantitatively consider and discuss these elements. In order to comprehensively organize the operation of these safety devices and quantitatively consider risks, it is necessary to organize the operation of safety devices when a risk cause occurs in a format similar to a flow chart. The following are examples of prior art documents that organize the operation of each part in equipment, including safety devices, in a flow chart format.

[0003] The equipment fault diagnosis device of Patent Document 1 uses flow chart data and accumulated case data to calculate a quantitative value. The calculated quantitative value indicates what type of fault has occurred in the equipment and how it is most likely to be dealt with. The equipment fault diagnosis device of Patent Document 1 is based on the premise that there are multiple symptoms that can occur in a certain piece of equipment, creates a flow chart by linking nodes that branch whether or not each symptom has occurred, and prepares multiple measures according to the way the branch transitions.

[0004] The probabilistic risk assessment support device in Patent Document 2 quantitatively calculates the fire risk of equipment by using conditional branching to classify and organize the extent of damage into scenarios. The probabilistic risk assessment support device of Patent Document 2 creates an event tree in which, when a fire breaks out in a certain part of a facility (a control panel for a nuclear power plant, etc.), the fire spreads to the whole facility due to failure to isolate the fire. The branching points of the event tree are used to determine whether the fire has been isolated in a certain part. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2022-100082 A [Patent Document 2] JP 2022-028330 A Summary of the Invention [Problem to be solved by the invention]

[0006] The equipment failure diagnosis device of Patent Document 1 and the probabilistic risk assessment support device of Patent Document 2 do not consider that risk changes in accordance with various changes in the design conditions of the equipment, and are limited to calculating risk for one design condition. On the other hand, in safety studies at the design stage, it is necessary to consider which of multiple design condition candidates is preferable to combine for many safety devices and parts in the equipment. Therefore, an object of the present invention is to comprehensively consider a large number of safety devices and the like in the safety study at the time of designing facilities, and to consider what design conditions are preferable. [Means for solving the problem]

[0007] The safety study support system of the present invention is characterized in comprising an operation procedure database that records operations of safety devices when a risk occurs for equipment that is the subject of safety study, a design condition database that records design conditions related to the safety devices and condition candidates that are candidates for the design conditions, a transition probability database that records transition probabilities for each condition candidate regarding operation branches in the operation procedure database, a risk calculation unit that calculates a risk index using the operation procedure database and the transition probability database, a transition probability calculation unit that calculates transition probabilities for the condition candidates that reduce the risk index to a level that satisfies a predetermined standard, and an output unit that outputs the transition probabilities and the safety devices related to the operation branches. Other means will be described in the description of the embodiment of the invention. Effect of the Invention

[0008] According to the present invention, in safety considerations at the time of designing facilities, a large number of safety devices and the like can be comprehensively considered, and preferable design conditions can be considered. [Brief description of the drawings]

[0009] [Figure 1] 1 is a diagram showing an overall configuration of a safety study support system according to an embodiment of the present invention. [Diagram 2] FIG. 1 is a diagram illustrating an operation procedure database in a flowchart format. [Diagram 3] FIG. 13 is a diagram showing information associated with nodes in a flowchart. [Figure 4] FIG. 13 is a diagram showing a design condition database. [Diagram 5] FIG. 13 is a diagram showing a transition probability database. [Figure 6] FIG. [Figure 7] FIG. 13 is a diagram illustrating the process of a risk calculation unit. [Figure 8] FIG. 13 is a diagram illustrating an example of a method for calculating a risk index after calculating a risk probability. [Figure 9] FIG. 13 is a diagram showing a cost database. [Figure 10] FIG. 13 is a diagram showing risk indices and costs recorded by a temporary storage device. [Figure 11] FIG. 13 is a diagram showing the importance recorded by the temporary storage device. [Figure 12] This is a processing flow for the overall configuration shown in Figure 1. [Figure 13] This is an example of the risk index and cost overview screen. [Figure 14] 13 is an example of an operation procedure screen. [Figure 15] 13 is an example of a risk index / cost graph screen. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. In this embodiment, the equipment to be the subject of safety study is a storage battery equipment in which large-capacity storage batteries are connected in series and parallel. Risks in storage battery equipment include fire and the associated explosion accidents. A user who is a designer of the storage battery equipment and a user of the safety study support system conducts studies to prevent fire and explosion accidents.

[0011] An example of a means for preventing fires and explosions in battery storage equipment is the installation of safety devices. The safety devices are installed in the battery storage equipment itself or in its vicinity. The safety devices in this embodiment are heat detectors, smoke detectors, and gas-based fire extinguishers, but other safety devices such as fire doors and smoke exhaust devices can also be used. Risks and costs change depending on the specific specifications, the number of safety devices from which manufacturers are used in combination, etc. In order to analyze such changes, it is important to analyze the operational branching of, for example, whether heat detector A is normal or not, and whether the heat detector is capable of detecting a fire in terms of its performance or not.

[0012] (System Configuration) The safety study support system of this embodiment is one computer or a group (cloud) of multiple computers. Each computer constituting the safety study support system is a general one, and includes a central control device, an input device such as a keyboard, an output device such as a display, a main memory device, an auxiliary memory device, a communication device, etc. (not shown). Any of these individual computers includes each unit, each database, and a temporary memory device, which will be described later.

[0013] More specifically, the auxiliary storage device of any computer records each part as a program, and each database as data to be processed. In the following description, when the subject of an operation is described as "XX part", it means that the central control device of any computer reads each part from the auxiliary storage device of any computer to the main storage device of any computer and executes the processing described below. Furthermore, the parts of the safety study support system excluding each database constitute a safety study support device.

[0014] FIG. 1 is a diagram showing the overall configuration of a safety study support system 1 according to this embodiment. The past case database 101 records the data in the operation procedure database 103, the design condition database 104, and the transition probability database 105 that were created by the safety study support system 1 in the past, as well as the history of the results calculated by the transition probability calculation unit 109. The past case database 101 also records information such as the implementation date, various information related to the target case, and information on the user of the safety study support system 1.

[0015] The past performance values ​​in the past case database 101 may be rewritten with new performance values. For example, the transition probabilities of the safety devices in the transition probability database 105 may be rewritten for each regular inspection with transition probabilities that reflect the results of daily regular inspections.

[0016] The input data creation unit 102 creates an operation procedure database 103, a design condition database 104, and a transition probability database 105 for a new case while referring to the past case database 101 and information of the simulator 113. The simulator 113 calculates a specific value of the transition probability by repeatedly simulating (simulating) the transition probability for each condition candidate in the design condition database 104. The simulator may be located outside the safety study support system.

[0017] The operation procedure database 103 records how each safety device, other parts, or human operation operates until each risk event occurs after the occurrence of a starting event that causes a risk event. The operation procedure database 103 records the branching of operations when a failure or detection error occurs in each safety device or other parts, or when a human operation error occurs, and records what kind of risk event will ultimately occur. Details will be described later with reference to Figs. 2 and 3. In this embodiment, there is one operation procedure database 103, but multiple operation procedure databases 103 with different operation orders or different types of safety devices may be recorded.

[0018] The design condition database 104 records design conditions that are conditions to be considered when designing the target equipment. For example, the design conditions may record multiple condition candidates for the product type of the safety device, multiple condition candidates for the number of devices to be installed or the installation locations, or multiple condition candidates for the periodic inspection cycle of each safety device. These design conditions are the subject of consideration in this embodiment. This embodiment ultimately determines which of the condition candidates is most preferable from the viewpoint of risk reduction or cost reduction. Each design condition may be set as a discrete multiple type category, or may be set as a continuous value within a certain range. Details will be described later with reference to FIG. 4.

[0019] The transition probability database 105 records transition probabilities related to operation branches for safety devices and the like recorded in the operation procedure database 103. For example, the probability of failure of a safety device, the probability of detection by a detector, the probability of a human operation error, and the like are recorded. These transition probabilities are linked to certain operation branches in the operation procedure database 103 or certain condition candidates in the design condition database 104. Details will be described later with reference to FIG. 5.

[0020] The risk calculation unit 106 calculates a risk probability and a risk index based on the operation procedure database 103 and the transition probability database 105. The risk calculation unit 106 calculates the risk probability of each of a plurality of risk events graded by damage level. Furthermore, the risk calculation unit 106 calculates a "total risk value" that is a result of weighting the risk probability by the amount of damage when the risk event occurs, as a risk index. The risk calculation unit 106 may calculate other risk indexes. At this time, the risk calculation unit 106 acquires from the transition probability database 105 the transition probability corresponding to the condition candidate sampled in the design condition database 104 by the transition probability calculation unit 109 described later, and calculates the risk probability based on the acquired transition probability. Details will be described later in FIG. 7. Note that sampling means acquiring one of the condition candidates randomly or by a predetermined method.

[0021] The cost database 107 records the costs incurred for each condition candidate in the design condition database 104. The costs recorded here include product purchase costs, installation costs, operation costs, and maintenance costs such as inspections. The costs also include environmental burdens such as carbon dioxide emissions during each phase of introduction, operation, maintenance, and disposal. Details will be described later with reference to FIG. 9.

[0022] The cost calculation unit 108 calculates the cost of the condition candidates sampled by the transition probability calculation unit 109 from among the condition candidates in the design condition database 104 .

[0023] The transition probability calculation unit 109 samples one condition candidate for each design condition from the design condition database 104, and outputs it to the risk calculation unit 106 and the cost calculation unit 108. For example, when the design conditions are "heat detector product", "smoke detector product", and "number of smoke detectors installed", the transition probability calculation unit 109 acquires "heat detector product A", "smoke detector product A", and "number of smoke detectors installed: 3", which is a specific example of "sampling" here. Sampling a condition candidate is equivalent to acquiring (calculating) a calculated transition probability that is linked to the condition candidate in advance. The combination of condition candidates acquired here is also called a "scenario". The transition probability calculation unit 109 repeats acquiring (calculating) the transition probability until the risk index reaches a sufficiently small target value (described in detail later).

[0024] The importance calculation unit 110 calculates the importance indicating how important each operation branch recorded in the operation procedure database 103 and each condition candidate recorded in the design condition database 104 is from a risk perspective.

[0025] The temporary storage device 111 records the risk index calculated by the risk calculation unit 106, the cost calculated by the cost calculation unit 108, and the importance calculated by the importance calculation unit 110 for each combination of condition candidates in the design condition database 104. The results recorded in the temporary storage device 111 are sent to the output unit 112.

[0026] The output unit 112 displays the risk index calculated by the risk calculation unit 106, the cost calculated by the cost calculation unit 108, and the importance calculated by the importance calculation unit 110 to the user.

[0027] The simulator 113 calculates the transition probabilities in the transition probability database 105. The simulator 113 may use, for example, an externally created fluid simulation to calculate the transition probabilities of the fire detection rate by a smoke detector, and the like, and record the calculated transition probabilities in the transition probability database 105.

[0028] 2 is a diagram illustrating, in the form of a flowchart, the operation procedure database 103. In the operation procedure database 103, nodes from a starting event node 202 to a risk event node (e.g., reference numeral 203) are connected by links (e.g., reference numeral 204).

[0029] An action branch regarding a safety device failure, a detection error, etc. is recorded in an action branch node (e.g., reference number 205), and a risk event that will be reached is recorded according to an option ("Yes" or "No", e.g., reference number 206). The state of the equipment and safety devices during the transition may be recorded in a state node (e.g., reference number 207). When a subsequent transition is determined by a combination of multiple links, the subsequent transition may be recorded in the form of a logical expression by an AND node 208 or an OR node (e.g., reference number 209).

[0030] In this embodiment, the operation procedure database 103 is recorded in a flow chart format. However, the operation procedure database 103 may be recorded in other formats, such as in a natural language as a safety study manual. This embodiment describes a case where there is one operation procedure database 103. However, a plurality of different operation procedure databases 103 may be recorded.

[0031] The flowchart ID 201 is an identifier that uniquely identifies one flowchart. If there are other flowcharts, the flowchart ID 201 shall not be duplicated. In this embodiment, the identifier is named "flowchart ID". However, if the operation procedure database 103 is in another form, such as a natural language, this name may be any name that can uniquely identify the operation procedure database 103 in that other form. The flowchart in FIG. 2 is given the flowchart ID "F1".

[0032] The starting event node 202 is an event that causes a risk event to occur and is the starting point for risk event consideration. The starting event node in this embodiment is "cell ignition." The number of starting event nodes in this embodiment is one, but if a risk event occurs as a combination of multiple causes, the number of starting event nodes may be multiple.

[0033] A risk event node (e.g., reference numeral 203) is the final risk event. In this embodiment, the risk event nodes are classified into four categories according to the level of damage: "module damage", "rack damage", "equipment part damage", and "explosion". A plurality of different risk event nodes may be prepared using a method other than the level classification according to the level of damage, or the number of risk event nodes may be one.

[0034] Links (e.g., reference number 204) indicate transitions connecting various nodes. Options ("Yes" or "No", e.g., reference number 206) are assigned as conditions for action branching to links originating from action branching nodes (e.g., reference number 205). Here, if multiple actions of safety devices or the like occur simultaneously and in parallel from one event or state without any binary branching, multiple links may be recorded originating from one node. In the example of FIG. 2, after the originating event node "cell ignition", the links transition to two flows that attempt to detect fire using a heat detector or a smoke detector.

[0035] An action branching node (e.g., reference numeral 205) indicates a branch of an alternative action regarding a safety device, etc. For example, there is an action branching node regarding a failure of a safety device, such as "Is the heat detector normal?", an action branching node regarding detection performance, such as "Is the heat detector capable of detection?", and an action branching node regarding the success or failure of a function such as fire extinguishing, such as "Has the fire been extinguished by the gas-based fire extinguishing equipment?".

[0036] In addition, there may be an action branching node related to a human-mediated operation such as “Did the fire brigade properly extinguish the fire?” At each action branching node, the subsequent transition is determined according to the option.

[0037] A state node (e.g., reference numeral 207) records the state of the equipment or safety device in the current transition. For example, after "cell ignition", if the heat detector is working normally and can detect heat, the state transitions to "fire detected by heat detector".

[0038] An AND node 208 and an OR node (e.g., reference numeral 209) represent that a transition leading to a subsequent risk event is determined by a combination of transitions up to that point. For example, the AND node 208 represents that if a fire cannot be detected by either a heat detector or a smoke detector, the state transitions to "fire not detected." The OR node 209 represents that if a fire can be detected by at least either a heat detector or a smoke detector, the state transitions to "fire detected."

[0039] FIG. 3 is a diagram showing information associated with nodes in a flowchart. The flow chart ID 301 is the same as the flow chart ID 201 in FIG. The node ID 302 is an identifier that uniquely identifies each node within the same flowchart. For example, in this embodiment, a node ID of "N1" is assigned to the starting event node "cell ignition." Content 303 is the content of the node. In this embodiment, the content is recorded in a natural language. However, the content may be categorized into parts names, states, etc., and information may be written for each category.

[0040] The node type 304 is the type of node on the flowchart, and is any one of an origin event node, a risk event node, an action branch node, a state node, an AND node, and an OR node.

[0041] The source node 305 is the node ID of the node (the closest upstream node) that is the source of the link whose target node is the target in the flowchart. There may be multiple source nodes for the target node. If the source node is an action branching node, it also records which option at the action branching node is used to transition to the target node. In this case, information about the state of the target node, or the state or action branch immediately before the action branch is recorded.

[0042] The target node 306 is the node ID of the node (the nearest downstream node) that is the target of the link whose source is the target node in the flowchart. There may be multiple target nodes for a target node. If the target node is an action branching node, the option through which the action branching node transitions to the target node is also recorded. In this case, the state of the target node, or information on which option the node transitions to next is recorded.

[0043] The action branch option 307 records what options are available when the target node is an action branch node. The second line in Fig. 3 describes that there are two options, "Yes" and "No", for "Is the heat detector normal?"

[0044] The following can be seen from Figures 2 and 3: -The battery storage equipment is equipped with a heat detector and a smoke detector. The cell is expected to ignite. If a cell ignites, it is assumed that this can lead to one of four risk events: A flowchart has been prepared that takes these assumptions into account.

[0045] 4 is a diagram showing the design condition database 104. The design condition database 104 records what kind of design conditions exist when safety is examined. The design conditions here are, for example, design parameters. The design parameters are, for example, the type of safety device product, the number of devices to be installed, the installation locations, and the maintenance cycle. The design conditions may be discretely selected from a plurality of options, such as the product type, or may be selected from continuous values ​​within a certain range, such as the maintenance cycle.

[0046] The device ID 401 is an identifier that uniquely identifies the safety device that is the subject of the design conditions, other part names, the role of a person, etc. The device ID 401 is assigned so that there is no duplication, for example, "D1" for a "heat detector" and "D2" for a "smoke detector." The design condition ID 402 is an identifier that uniquely identifies the design condition related to the device or the like identified by the device ID 401 .

[0047] The condition candidate ID 403 is an identifier that uniquely identifies a candidate for a design condition (hereinafter, simply referred to as a "condition candidate") identified by the design condition ID 402. The transition probability calculation unit 109 samples one condition candidate from among multiple condition candidates corresponding to the same design condition. The transition probability calculation unit 109 performs sampling for all design conditions. The risk calculation unit 106 calculates a risk index for each combination of the condition candidates. The cost calculation unit 108 calculates a cost for each combination of the condition candidates.

[0048] When the condition candidate takes a continuous value, the condition candidate ID 403 may be set as a variable that is rewritten by a parameter of the continuous value. The condition candidate ID "D3-1-x" indicates that the maintenance cycle value, which can take a range of 1 month to 12 months, is set as the variable "x", and that a part of the condition candidate ID is rewritten with "x" by the value taken at the time of sampling.

[0049] The device name 404 is the name of a safety device, other part, or a person's role. The design condition name 405 is the name of the design condition. For example, if it is desired to examine the change in risk index due to the difference between two types of heat detector products, the design condition name would be "heat detector product." If it is desired to examine the change in risk index due to the number of smoke detectors installed, the design condition name would be "number of smoke detectors installed."

[0050] The condition candidate name 406 is the content of the condition candidate. For example, if the design condition name 405 is "heat detector product" and there are two product types, the condition candidate name will be "heat detector product A" or "heat detector product B." If the condition candidate can take continuous values, the condition candidate name will be the variable name that is the condition candidate and its settable range. If the condition candidate can take continuous values, the condition candidate name 406 includes the variable "x" described above.

[0051] The following can be seen from Figure 4: The heat detector can be selected from Heat Detector Product A or Heat Detector Product B. Smoke detectors can be selected from Smoke Detector Product A or Smoke Detector Product B. The number of smoke detectors to be installed can be selected from 3, 4 or 5. -The maintenance cycle for gas-based fire extinguishers can be selected from 1 month to 12 months. As is clear from the above, the condition candidates are technical options that the designer can select when designing a safety device. The condition candidates are, for example, specific types, specifications, manufacturers, methods, numbers, etc. of selectable safety devices, as shown in Fig. 4. Furthermore, the condition candidates may be the maintenance (maintenance, inspection, replacement, etc.) cycles of the safety device.

[0052] 5 is a diagram showing the transition probability database 105. The transition probability database 105 sets transition probabilities at operation branches in the operation procedure database 103. The transition probabilities are, for example, the failure probability and detection probability of a safety device. The transition probability database 105 also associates the transition probability with which condition candidate in the design condition database 104 the transition probability corresponds to.

[0053] The transition probability ID 501 is an identifier that uniquely identifies a combination of the transition probability name 502 and the transition probability 503 . The transition probability name 502 records which "Yes" and "No" for which action branch the transition probability corresponds. The transition probability name 502 in Fig. 5 is written in a format that matches the content 303 in Fig. 3, but the format is arbitrary as long as the corresponding content 303 is known.

[0054] Transition probability 503 is a combination of the transition probability of "Yes" and the transition probability of "No" in that action branch. For example, for transition probability ID "1-1", the probability that "Is the heat detector normal?" is "Yes" is "0.8", and the probability that it is "No" is "0.2". The options "Yes" and "No" described here match the action branch options 307 of the node identified by "Flowchart ID-Node ID" 505 described below.

[0055] The condition candidate ID 504 records to which condition candidate ID 403 in the design condition database 104 the target transition probability ID 501 is applied. The condition candidate ID 504 matches the condition candidate ID 403 in the design condition database 104.

[0056] For example, look at the transition probability IDs "1-1" and "1-2" in Fig. 5. In the case of the condition candidate name 406 "Heat detector product A" (see Fig. 4) corresponding to the condition candidate ID "D1-1-1", the transition probability of "Is the heat detector normal?" is "Yes=0.8, No=0.2". In the case of the condition candidate name 406 "Heat detector product B" (see Fig. 4) corresponding to the condition candidate ID "D1-1-2", the transition probability of "Is the heat detector normal?" is "Yes=0.9, No=0.1".

[0057] When a transition probability is set by combining multiple condition candidate IDs, multiple condition candidate IDs may be recorded. There are two condition candidate IDs 504 corresponding to the transition probability ID "3-1", which are "D2-1-1" and "D2-2-1". The corresponding transition probability 503 is the transition probability when the smoke detector is "smoke detector product A" and the number of installed units is three.

[0058] Flowchart ID-node ID 505 indicates which node in which flowchart the transition probability is a probability transition. Flowchart ID-node ID 505 matches the combination of flowchart ID 301 and node ID 302 in Fig. 3. For example, the transition probability specified by transition probability ID "1-1" corresponds to a node whose node ID 302 is "N2" in a flowchart whose flowchart ID is "F1". In other words, this node is an action branch node for content 303 "Is the heat detector normal?"

[0059] When the option candidates can be set as continuous values, a function may be set separately as the transition probability 503. The transition probability 503 of the transition probability ID "10-1" is set in the form of a function called "Function001". This function is set to output the transition probability that the gas-based fire extinguisher is normal. The transition probability output by the function varies depending on the "x" of the condition candidate ID 504 "D3-1-x", i.e., the maintenance cycle of the gas-based fire extinguisher.

[0060] The following can be seen from the first and second lines of Figure 5. At the action branching node "N2" for "Is the heat detector normal?", when heat detector product A is used, the transition probability of "Yes" is "0.8" and the transition probability of "No" is "0.2". When heat detector product B is used, the transition probability of "Yes" is "0.9" and the transition probability of "No" is "0.1".

[0061] The following can be seen from lines 5 to 7 of Figure 5. · At the action branching node “N5” for “Is the smoke detector detectable?”, if three smoke detector products A are used, the transition probability of “Yes” is “0.6” and the transition probability of “No” is “0.4”. If three smoke detector products B are used, the transition probability of “Yes” is “0.7” and the transition probability of “No” is “0.3”. If four smoke detector products A are used, the transition probability of “Yes” is “0.8” and the transition probability of “No” is “0.2”.

[0062] FIG. 6 is a diagram for explaining functions. The function records, in a graph format, the relationship between the maintenance cycle of the gas-based fire extinguisher and the transition probability at which the question "Is the gas-based fire extinguisher normal?" becomes "Yes." The range of variation of the maintenance cycle in FIG. 6 is from 1 month to 12 months. Function name 601 is the name of the function written in transition probability 503. The format of function 602 may be a mathematical formula or a graph.

[0063] 7 is a diagram showing the processing of the risk calculation unit 106. The risk calculation unit 106 calculates a risk probability and a risk index for a combination of condition candidate IDs 403 sampled by the transition probability calculation unit 109, based on the operation procedure database 103 and the transition probability database 105. This embodiment is an example in which a flow chart is converted into a Bayesian network to calculate a risk probability. However, any other method may be used, such as a method of trying transitions multiple times using the Monte Carlo method to derive a risk probability.

[0064] The flowchart 701 is one flowchart extracted from the operation procedure database 103. In the flowchart 701, "NodeA" is a starting event node, and "NodeF" and "NodeG" are risk event nodes. "NodeB" is a state node, and "ConditionC", "ConditionD", and "ConditionE" are operation branching nodes.

[0065] The risk calculation unit 106 generates a Bayesian network 702 by converting the flowchart 701. Among the nodes in the Bayesian network 702, the action branching node has the action branching options 307 (FIG. 3) as state candidates. The other nodes have two states: occurrence (=Yes) / non-occurrence (=No). Going back along the links from each state node and risk event node, the first state node or starting event node that appears becomes the parent node of the node that started going back along the link. In addition, an action branching node that appears on the path going back also becomes the parent node. The result of converting the flowchart 701 using the above method is the Bayesian network 702.

[0066] The action branching probability table 703 is set for the action branching nodes in the Bayesian network 702. For example, “Condition C” among them matches the flow chart ID-node ID 505 among the transition probabilities set in the transition probability database 105, and also matches the condition candidate ID 504 sampled by the transition probability calculation unit 109.

[0067] Besides the action branch probability table 703, probability tables 704 and 705 are set according to the logical expressions recorded in the AND node or OR node in association with the Bayesian network 702. For example, looking at the probability table 704 for "NodeF", if "NodeB", "ConditionC", "ConditionD" and "ConditionE" are all "Yes", then "NodeF" becomes "Yes".

[0068] Looking at the probability table 705 for "NodeG", if "NodeB" is "Yes" and at least one of "ConditionC", "ConditionD" and "ConditionE" is "No", then "NodeG" will be "Yes". In the above manner, when the structure of the Bayesian network 702 is generated and transition probabilities are assigned, the probability that a risk event will occur (risk probability) can be calculated.

[0069] FIG. 8 is a diagram showing an example of a method for calculating a risk index after calculating a risk probability. 8, the risk calculation unit 106 calculates the risk probability for each of "module damage", "rack damage", "equipment part damage", and "explosion" as the risk event node 203. The respective risk probabilities are written as p(r1), p(r2), p(r3), and p(r4).

[0070] The total risk value 801 is a risk index that comprehensively evaluates the four risk probabilities. The risk index in this embodiment is a scalar value. However, the risk index may be a vector consisting of multiple values. The risk calculation unit 106 calculates four risk probabilities (e.g., symbol 802) using the Bayesian network 702. In the simplest flow chart that does not have a merger after a branch, an AND node, an OR node, etc., the risk probability of reaching a certain risk event node is the product of the transition probabilities assigned to the links (options) through which transitions have been made before reaching the risk event node.

[0071] A risk weight (e.g., symbol 803) is a weight that indicates the relative importance of a certain risk event compared to other risk events. The risk weight is set, for example, taking into consideration the amount of damage if a risk event occurs, and the damage to the social credibility of the facility owner, designer, and product manufacturer. The risk calculation unit 106 calculates a total risk value 801 by summing up the results of multiplying the risk probability by the risk weight.

[0072] FIG. 9 is a diagram showing the cost database 107. The columns from device ID 401 to condition candidate name 406 are the same as those in FIG. The cost 901 is the cost required for each condition candidate identified by the condition candidate ID 403. The cost is a numerical value related to the cost of purchasing, installing, operating, maintaining, and disposing of each safety device, the cost of personnel, and the environmental load such as carbon dioxide emissions.

[0073] The cost 901 may be recorded as a function of cost with other condition candidates, such as the number of installations, as input, or may be recorded as a function with a variable of the condition candidate, which can be set as a continuous value, as input. In this embodiment, the cost 901 is described as a scalar value. However, the cost 901 may be a vector consisting of multiple values ​​that are the results of calculating different values ​​such as environmental load. The cost calculation unit 108 calculates the result of adding up various costs related to the condition candidates sampled by the transition probability calculation unit 109 as the "cost" here.

[0074] 10 is a diagram showing risk indices and costs recorded in the temporary storage device 111. The temporary storage device 111 records the risk indices calculated by the risk calculation unit 106 and the costs calculated by the cost calculation unit 108 in association with the condition candidates sampled by the transition probability calculation unit 109. The flowchart ID 1006 is an identifier that uniquely identifies a flowchart in the operation procedure database 103. The flowchart ID 1006 corresponds to the flowchart ID 201 in FIG. The scenario ID 1001 is an identifier that uniquely identifies a combination of condition candidates. The condition candidate ID 1002 is a combination of condition candidate IDs 403 (FIG. 4) that specify a plurality of condition candidates sampled by the transition probability calculation unit 109. The number of condition candidate IDs to be recorded matches the number of types of design condition IDs 402.

[0075] The node probabilities 1003 are the transition probabilities of transitioning to each node at the midpoint, and the risk probabilities of finally reaching each risk event node, calculated by the risk calculation unit 106 for the sampled condition candidates. The risk index 1004 is the value of the risk index calculated by the risk calculation unit 106. The risk index may be a scalar value or a vector value. The cost 1005 is a cost value calculated by the cost calculation unit 108. The cost may be a scalar value or a vector value.

[0076] 11 is a diagram showing the importance recorded in the temporary storage device 111. The importance calculation unit 110 calculates the importance for each design condition in the design condition database 104 and each operation branch in the flowchart in the operation procedure database 103. The importance indicates the degree of influence that the transition probability has on a risk event.

[0077] The importance calculation unit 110 calculates the variation of the risk index when the transition probability value of each action branching node is changed by a fixed value one by one for each sampled condition candidate. As a result, an action branching node with a large variation of the risk index can be determined to be important from a risk perspective. The importance calculation unit 110 determines the variation value of this risk index as the importance. The flowchart ID 1111 is the same as the flowchart ID 201. Scenario ID 1112 is the same as scenario ID 1001. Node ID 1113 is the same as node ID 302 in Fig. 3. Of the node IDs, only those related to the action branching nodes are excerpted here.

[0078] The importance 1114 is the value of the importance calculated by the importance calculation unit 110 . In this embodiment, the importance calculation unit 110 calculates the importance for each operation branch node, but the importance may be calculated collectively for each design condition by deriving the design conditions associated with the operation branch based on the transition probability database 105. For example, the importance calculation unit 110 may determine the change in risk index when the condition candidate is changed to another one for each design condition as the importance.

[0079] FIG. 12 shows a process flow in the overall configuration shown in FIG. In step S1201, the input data creation unit 102 creates each data of the design condition database 104, the operation procedure database 103, and the transition probability database 105. At this time, the input data creation unit 102 may reuse information from the past case database 101, or may use data of the external simulator 113.

[0080] In step S1202, the transition probability calculation unit 109 samples (selects) condition candidates for each design condition in the design condition database 104. At this time, the sampling method may be random sampling or a method using an optimization technique.

[0081] In step S1203, the risk calculation unit 106 calculates the risk probability and the risk index leading to each risk event node in the flowchart, and records the calculation results in the temporary storage device 111. The risk calculation unit 106 may store the calculation results in a permanent storage device other than the temporary storage device 111 (the same applies to steps S1204 and S1205). In step S1204, the cost calculation unit 108 calculates the cost, and records the calculation result in the temporary storage device 111. In step S 1205 , the importance calculation unit 110 calculates the importance of each action branch, and records the calculation result in the temporary storage device 111 .

[0082] In step S1206, the transition probability calculation unit 109 judges whether the scenario search is sufficient. Examples of the judgment method here include a method of judging whether a preset number of searches is satisfied, and a method of judging whether any of the calculated multiple risk indexes or costs is equal to or less than a preset target value. If the scenario search is sufficient (step S1206 "Yes"), the transition probability calculation unit 109 proceeds to step S1207, and otherwise (step S1206 "No"), the transition probability calculation unit 109 returns to step S1202. After returning, in step S1202, the transition probability calculation unit 109 samples another condition candidate. The transition probability calculation unit 109 repeats the process of acquiring (calculating) the transition probability in the condition candidate of the action branch node each time sampling is performed. In the end, the transition probability calculation unit 109 calculates the transition probability in the condition candidate that reduces the risk index or cost to a level that satisfies a predetermined standard.

[0083] In step S1207, the output unit 112 displays the results. Specifically, the output unit 12 displays a risk index / cost overview screen (FIG. 13), an operation procedure screen (FIG. 14), and a risk index / cost graph screen on an arbitrary device.

[0084] In step S1208, the transition probability calculation unit 109 judges whether or not an additional search is necessary. Specifically, if the transition probability calculation unit 109 receives an operation from the user to perform a scenario search again (step S1208 "Yes"), the transition probability calculation unit 109 returns to step S1202, and otherwise (step S1208 "No"), the process flow ends.

[0085] 13 to 15 are examples of outputs from the output unit 112. FIG. Figure 13 is an example of a risk index / cost overview screen. The risk index / cost overview screen is a screen for overviewing risk indexes and costs related to combinations (scenarios) of multiple condition candidates. Scenario ID 1301 is the same as scenario ID 1001 in FIG. The risk index 1302 and the cost index 1303 are the same as the risk index 1004 and the cost 1005 in FIG. When the user wishes to compare multiple scenarios, the user selects the scenarios to be compared and presses the difference display button 1304. In response, the output unit 112 outputs information on the differences (the lower diagram in FIG. 13). Difference information 1305 displays the design condition name “Heat Detector Product” of the difference among the condition candidates sampled in each scenario, as well as the condition candidate names “Heat Detector Product A” and “Heat Detector Product B.” If the user wishes to see a more detailed flowchart or the like after overviewing this information, he or she presses the operation procedure screen display button 1306. In response, the output unit 112 displays the operation procedure screen (FIG. 14).

[0086] FIG. 14 is an example of an operation procedure screen. A flowchart 1401 is a flowchart in the operation procedure database 103. Detailed information 1402 in the flowchart 1401 records sampled condition candidates, transition probabilities, importance, etc. for each operation branch. When multiple scenarios are selected in advance, they can also be compared. Scenario index information 1403 displays the risk index, cost, probability of each risk, etc. for each scenario.

[0087] 15 is an example of a risk index-cost graph screen. A risk index-cost graph 1501 plots the risk index and cost values ​​of each scenario. When the user selects a plot, the output unit 112 displays all the condition candidates sampled in that scenario as a condition candidate list 1502, and displays the risk index, cost, and each risk probability value of that scenario as scenario result information 1503.

[0088] The effects of this embodiment are as follows. (1) The safety study support system can calculate the risk index of equipment when the candidate design conditions of safety devices are changed in various ways. (2) The safety study support system can use the flowcharts, design conditions, and transition probabilities from previous safety studies for new cases. (3) The safety consideration support system can calculate the cost for each scenario. (4) The safety consideration support system can calculate how important an action branch itself and a change in a candidate condition at that action branch are from a risk perspective. (5) The safety review support system is suitable for designing heat detectors or smoke detectors to be installed in battery storage equipment. [Explanation of symbols]

[0089] 101 Past Case Database 102 Input Data Creation Department 103 Operational Procedure Database 104 Design Condition Database 105 Transition Probability Database 106 Risk Calculation Department 107 Cost Database 108 Cost Calculation Department 109 Transition Probability Calculation Unit 110 Importance calculation part 111 Temporary storage 112 Output section 113 Simulator

Claims

1. An operation procedure database that records the operation of safety devices for the equipment that is the subject of safety review when a risk occurs; and a design condition database in which design conditions related to the safety device and candidate conditions that are candidates for the design conditions are recorded; a transition probability database in which a transition probability is recorded for each of the condition candidates with respect to the operation branch in the operation procedure database; a risk calculation unit that calculates a risk index using the operation procedure database and the transition probability database; a transition probability calculation unit that calculates a transition probability in the condition candidate that reduces the risk index to a degree that satisfies a predetermined criterion; an output unit that outputs the transition probability and the safety device related to the operation branch; A safety review support system comprising:

2. a past case database for recording the operation procedure database, the design condition database, and the transition probability database relating to safety studies carried out in the past; an input data creation unit that creates the operation procedure database, the design condition database, and the transition probability database for a new case based on the past case database; 2. The safety study support system according to claim 1, further comprising:

3. a cost database that records costs related to the condition candidates; a cost calculation unit that calculates a cost based on the cost database and the condition candidates selected by the transition probability calculation unit; Equipped with The output unit is outputting the cost for each of the condition candidates; 2. The safety study support system according to claim 1,

4. a significance calculation unit that calculates a significance indicating how important an operation branch in the operation procedure database and a condition candidate in the design condition database are from a risk viewpoint; 2. The safety study support system according to claim 1,

5. The facility includes: It is a battery storage facility. The safety device comprises: Includes a heat detector or smoke detector; 2. The safety study support system according to claim 1,

6. An operation procedure database that records the operation of safety devices for the equipment that is the subject of safety review when a risk occurs; and a design condition database in which design conditions related to the safety device and candidate conditions that are candidates for the design conditions are recorded; a transition probability database that records a transition probability for each of the condition candidates with respect to an operation branch in the operation procedure database; a risk calculation unit that calculates a risk index using the operation procedure database and the transition probability database; a transition probability calculation unit that calculates a transition probability in the condition candidate that reduces the risk index to a degree that satisfies a predetermined criterion; an output unit that outputs the transition probability and the safety device related to the operation branch; A safety study support device comprising:

7. An operation procedure database that records the operation of safety devices for the equipment that is the subject of safety review when a risk occurs; and a design condition database in which design conditions related to the safety device and candidate conditions that are candidates for the design conditions are recorded; a transition probability database in which a transition probability is recorded for each of the condition candidates with respect to the operation branch in the operation procedure database; A safety study support method using a safety study support device connected to The risk calculation unit of the safety study support device includes: Calculating a risk index using the operation procedure database and the transition probability database; The transition probability calculation unit of the safety study support device includes: A step of calculating a transition probability in the condition candidate that reduces the risk index to a degree that satisfies a predetermined criterion; The output unit of the safety study support device includes: outputting the transition probabilities and the safeguards associated with the action branches; The safety review support method according to the present invention is characterized by having:

Images