Dynamic Event Trees for PSAPSA動(dòng)態(tài)事件樹

1、.International Workshop on Level 2 PSA and Severe Accident Management29th to the 31st of March 2004, Köln, GermanyMCDET and MELCOR An Example of a Stochastic Module coupled withan Integral Code for PSA Level 2M. Sonnenkalb, J. Peschke, M. Kloos, B. Krzycacz-HausmannGesellschaft für Anlagen

2、- und Reaktorsicherheit (mbH), Germany1IntroductionAccident sequences evolve over time through the interaction of dynamics and stochastics in the system of “Man, Machine, Process and Environment”. In the customary event tree analysis of Level 1 PSA and in the accident sequence analysis of Level 2 PS

3、A, the analysts prescribe the stochastic events together with the order in which they occur. While temporal information may be available for few selected sequences in Level 1 and on an event scale in Level 2, time is usually not considered in the conventional event tree. These customary trees largel

4、y develop along a so-called effect line rather than a time line. Branching points of Level 1 event trees are prescribed by the order of safety system demands at set points. Usually, there are only two branches per point, namely one each for “system starts” and for “fails to start”. Due to limitation

5、s of the customary event tree methodology no consideration can be given, for instance, to the consequences of gradual failure to run for the intended time and/or with the required capacity. Branches in Level 2 accident sequence trees are frequently used to account for classes of possible consequence

6、 magnitudes from complex physico-chemical processes. Consequently, the number of branches often exceeds two. Presently, the spectrum of possible accident sequences in Level 2 PSA is reduced to the degrees of freedom of a rather coarse grid in time (i.e. “early”, “l(fā)ate” or “before”, “after”), in spac

7、e (i.e. “top”, “bottom”) and in magnitude (i.e. “small”, “medium”, “l(fā)arge”), etc. This does not permit to model the interactions of phenomena, processes, component behavior and human actions as close to reality as is desirable. Inherent to the coarse grid is the danger that:- important sequences, re

8、sulting from details in time, space, magnitude and order of events, remain unknown,- unrealistic sequences are generated, based on analyst specified conditions which otherwise would result from preceding events.The methods of probabilistic dynamics enable us to fully account for the interaction of d

9、ynamics and stochastics and for the temporal dependency in the evaluation of accident consequences in addition with their conditional probabilities (condition is the initiating event). Probabilistic dynamics operates on the actual time/state space and its computational effort is considerably larger

10、compared to a conventional event tree analysis. For this reason its application is still restricted to specific aspects of a PSA. The vision is, however, to be able to perform a dynamic PSA. Such an analysis would account for the interactions between the time-dependent dynamics quantities and set po

11、ints in the time/state space on one hand and the stochastics in environmental conditions and in the failure behavior of technical components and systems as well as in human actions on the other hand. The most straightforward numerical procedure for such an analysis would be a Monte Carlo simulation.

12、 Its transition probabilities may depend on the state of the dynamic quantities, systems and components and even on residence times as well as on details of the sequence history. It suffices to prescribe rules for the evaluation of the probabilities of transitions to those states that are directly a

13、ccessible from the present state. One Monte Carlo element generates only one sequence out of the population of possible sequences and low probability transitions will be adequately represented only if the sample is of sufficiently large size. The generation of each sequence requires a complete dynam

14、ics calculation starting from the initiating event and ending in one of the “absorbing” states. The latter include specified damage states, the state of no damage and controlled operation and possibly the arrival at the endpoint of the specified observation time.The literature reports on a variety o

15、f dynamic event tree methods /AND 98, ASE 97, COJ 96, SIU 94/. They generally permit a considerable reduction of the computer time for the numerous dynamics calculations through variance reduction and organization of the model runs such that duplications are avoided for sequence sections. To this en

16、d, continuous and discrete random transitions are treated probabilistically through repeated branching of the sequence at systematically chosen points in time according to user specified probability distributions. The dynamics calculations are only performed for the sequence sections starting at the

17、 branch points. Deterministic and discrete random transitions can be adequately treated by these methods, although transitions of many discrete states generate many branches, thereby blowing up the tree. This is especially the case, if continuous random variables are discretized. The method describe

18、d in the next paragraph tries to handle continuous random transitions in a more appropriate way.2 The stochastics module MCDETA combination of Monte Carlo Simulation and Dynamic-Event-Tree analysis was developed and tested /HOF 01/. It is called MCDET (Monte Carlo Dynamic Event Tree) and permits an

19、approximate treatment of discrete and continuous random transitions. An estimate of the approximation error is provided by the method. Deterministic transitions are taken into account as part of the general control module of the deterministic dynamics code. This module, for instance, contains the po

20、ints in the time/state space where automatic reactions of the safety systems are initiated (set points). Discrete transitions generally are treated by event tree analysis. Continuous random transitions or discrete random transitions, where the number of discretization points is high, are accounted f

21、or by Monte Carlo simulation. For each Monte Carlo simulation a separate Dynamic Event Tree is generated where full account of the interactions between stochastics and dynamics is achieved along the time line. MCDET can be identified as a special case from the class of so-called "variance reduc

22、tion by conditioning" Monte Carlo simulation methods. Any scalar output quantity Y of a (dynamic) model h subject to aleatory uncertainties (stochastic events) can be represented as Y=h(V) with V being the set of all stochastic variables involved. V is then divided into two subsets Vd and Vs wi

23、th Vd = subset of selected discrete variables treated by event tree analysis and Vs =VVd = subset of all remaining variables, i.e. all continuous and the remaining discrete variables. For instance, the variables in Vd may be regarded as representing the discrete system states into which the aleatory

24、 transitions may take place, the variables in Vs as representing the continuous aleatory times at which these transitions may occur. The MCDET procedure may roughly be considered as consisting of two main computational parts:(a) generate a value vs of the variables from subset Vs by Monte Carlo simu

25、lation this part will involve biasing techniques like sampling the failure to run time of a system from the conditional distribution where the condition is the run time failure within the required operation time of the system and the failure branch probability is the condition probability, (b) perfo

26、rm the computer model runs with the value vs for the variables from subset Vs and with all possible combinations of all discrete values of the variables from the subset Vd (considered as paths of an event tree). From this the respective discrete conditional distribution FY|Vs(y|Vs=vs) of the output

27、Y given Vs=vs and its expectation EY|Vs=vs can be computed analytically. Repeating these two steps n times independently, a sample of n conditional distributions/expectations is obtained from which many useful statements on the aleatory uncertainty in Y can be derived. In applications with computati

28、onally intensive models, a probabilistic "cut off" criterion must often be introduced to keep the computational effort practicable. It ignores all paths (=combinations of values of variables from Vd) which have a conditional probability less than a user specified threshold value. Due to th

29、e well known relationships E(EY|Vs) = EY and var(EY|Vs) = var Y - E(varY|Vs) it turns out that the estimate of any kind of expected values obtained from the MCDET procedure is more efficient, i.e. has smaller variance, than the corresponding estimate obtained from the crude Monte Carlo simulation wi

30、th all aleatory variables, discrete as well as continuous, sampled with the same sample size n. Of course, the processing time of a single MCDET run with all its paths may be much longer than the processing time of a run of the dynamics model for a single sample element of the crude Monte Carlo simu

31、lation. To obtain continuous event trees one would need to analytically solve the equations of probabilistic dynamics (for their formulation in a rather simplified situation see /SMI 94/). With the combination of discrete dynamic event tree analysis and Monte Carlo simulation, as in MCDET, an approx

32、imate solution of these equations in their most general formulation is obtained. MCDET is implemented as a stochastics module that may be operated in tandem with any deterministic dynamics code, some basic input/output properties of the code assumed. For each element of the Monte Carlo sample, the t

33、andem generates a discrete dynamic event tree and computes the time histories of all dynamics variables along each path together with the path probability. Each tree in the sample provides a conditional probability distribution (conditioned on the initiating event and on the values of the randomly s

34、ampled aleatory uncertainties) for each of the dynamics quantities. The mixture of these distributions in the sample is the result. From the random sample of discrete dynamic event trees, the probabilities of all dynamics and system states of interest may therefore be estimated. Together with these

35、estimates confidence intervals are available that quantify the possible influence of the sampling error which is due to the limited sample size of the Monte Carlo simulation. Modeling the stochastics requires the formulation of random laws and the specification of their parameter values. Laws and pa

36、rameter values but also model formulations, model parameter values, the relevance of phenomena that may or may not contribute to the accident propagation as well as input data of the dynamics code are subject to epistemic (i.e. state of knowledge) uncertainty. The combined influence of these uncerta

37、inties on the solution estimates provided by MCDET needs to be quantified. This requirement also should be accomplished for any other PSA method. To this end the state of knowledge to each of the epistemic uncertainties is quantitatively expressed by a subjective probability distribution. The immedi

38、ate way to estimate the combined influence of the epistemic uncertainties would again be by Monte Carlo simulation. This would lead to two nested Monte Carlo loops (also known as “double randomization” or “two-stage sampling”) where the outer loop varies the epistemic quantities and the inner loop i

39、s the Monte Carlo simulation of MCDET which varies the aleatory (i.e. stochastic) quantities. Frequently, the dynamics model is very processor time intensive and thus the obvious way of two nested Monte Carlo loops is often not practicable. The methodology for an approximate epistemic uncertainty an

40、alysis was therefore suggested in /HOF 01, HOF 02/. It is based on decomposition of the total variance into two variance contributions, namely from the epistemic and from the aleatory uncertainties. It requires only one repetition of the Monte Carlo simulation in MCDET.3 Illustrative application of

41、MCDET with MELCORThis paragraph describes an application of MCDET to a transient simulation with MELCOR which was chosen for demonstration purposes. First the transient is briefly discussed, followed by a short summary of main points of the plant representation in MELCOR and by a compilation of the

42、stochastic events considered.3.1 The transientA total station black-out in a 1300 MWe pressurized water reactor of Konvoi type at nominal power (end of cycle) was chosen to illustrate the applicability of MCDET in tandem with the dynamics code MELCOR /NRC 97/. The transient is characterized by the t

43、otal loss of power (including emergency diesels and other sources). Furthermore, the analysis assumes that external power is restored not earlier than 5700 s and not later than 12000 s after the initial event. Due to the loss of power, the main coolant pumps and all operational systems fail. For som

44、e period of time batteries guarantee DC power supply to all battery supported functions. Scram and turbine trip are performed automatically. Automatic pressure limitation via the pressurizer relief valve and the two safety valves is possible. After the corresponding signal indicates that a plant spe

45、cific criterion is satisfied, primary side pressure relief (primary bleed as an accident management measure) is principally assumed. Once the pressure on the primary side has decreased far enough, the accumulators can inject their coolant inventory, provided the associated source and additional isol

46、ation valves open on demand. The high pressure and low pressure emergency coolant injection systems can be activated only once the power supply has been restored. After power restoration the four trains are reconnected to the grid one by one, each requiring some preparation time. In any case, some t

47、ime is required after the bleed operation until coolant is injected into the primary side. Depending on how much time goes by, the core may experience gradual damage. The effects of this, particularly in connection with the finally occurring injection of coolant, depend on details of the timing of v

48、arious events. The high core melt temperatures in combination with high system pressure (in the case of unsuccessful bleed operation) may lead to failure of main coolant piping in the hot leg or of the pressurizer surge line before the vessel integrity is lost.Of particular interest are the time his

49、tories of dynamics quantities like pressure in the vessel as well as in the containment, core exit temperature and the degree of core degradation as expressed by the total melt mass and hydrogen mass generated. Also of interest is the conditional probability of the event of primary side pressure rel

50、ief with successful core cooling, etc.3.2 Representation of the plant in MELCORMELCOR is a deterministic fully integrated, full plant severe accident simulation code for nuclear power plants. It was developed for applications in integrated severe accident analyses and probabilistic safety assessment

51、s (PSA) by Sandia National Laboratories. A detailed description of all its models may be found in /NRC 97/. The MELCOR code is used to model a wide range of phenomena including, among others, thermal hydraulics, core heat-up and degradation, core concrete interaction, radio-nuclide release and trans

52、port and melt ejection phenomena. The version MELCOR 1.8.4 was used in tandem with MCDET for the illustrative application described here. With respect to the plant representation the following should be mentioned:- The four main coolant loops are represented by two model loops. Each loop is divided

53、into five volumina and contains a model of the main coolant pump. The loop connected to the pressurizer, is one of the two model loops. The remaining three loops are combined into one loop. The pressurizer, its surge line to the hot leg and its relief tank are represented separately by altogether fi

54、ve volumina. The volumina are connected by flow paths which describe, as far as possible, the actual flow conditions. Pressurizer heating, relief valve and safety valves as well as rupture discs are modeled separately in agreement with the situation in the reference plant.- Of the existing coolant i

55、njection systems the accumulators (their controls are modeled in detail, i.e. including their shut-off at the cold leg 500 s after the relevant emergency coolant injection signal) are represented together with their additional isolation valves. Especially for investigations of the reflooding phase a

56、fter a total SBO each of the four high pressure and low pressure safety injection systems is modeled together with its isolation valve including the shut-off specifications of these three-way valves.- The reactor core was modeled by five non-uniform radial rings and ten axial levels for the active c

57、ore according to e.g. the axial and radial power profile.For further details see /SON 01/. Different to /SON 01/ a simplified model of the containment was used since the main interest focused on the processes within the reactor circuit.3.3 Stochastic eventsWhether the pressurizer relief valve and/or

58、 any of the two safety valves will fail during the many demand cycles of the automatic pressure limitation is subject to aleatory uncertainty (stochastics). Their failure probability is assumed to increase with the number of demand cycles performed. Further aleatory uncertainties are the number of t

59、he failure cycle and whether the failure mode will be “fails to open” or “fails to close” (gradual failures can be considered in MCDET but was not done so in this illustrative application). Primary side pressure relief (primary bleed) is assumed to be initiated by the crew with some delay time, after the corresponding signal indicates that the relevant criteria are satisfied. The length of this delay time as well as the opening of valves that have not yet failed during the pressu