Emergency management for a nuclear power plant using fuzzy cognitive maps

Annals of Nuclear Energy 35 (2008) 2387–2396

Contents lists available at ScienceDirect

Annals of Nuclear Energy

journal homepage: www.elsevier .com/locate /anucene

Emergency management for a nuclear power plant using fuzzy cognitive maps

G. Espinosa-Paredes a,*, A. Nuñez-Carrera b, A.L. Laureano-Cruces c, A. Vázquez-Rodríguez a,E.-G. Espinosa-Martinez d

a Área de Ingeniería en Recursos Energéticos, Universidad Autónoma Metropolitana-Iztapalapa, Av. San Rafael Atlixco 186, Col. Vicentina, 09340 México D.F., Mexicob Comisión Nacional de Seguridad Nuclear y Salvaguardias, Doctor Barragán 779, Col. Narvarte, México D.F., Mexicoc Departamento de Sistemas, Universidad Autónoma Metropolitana-Azcapotzalco, San Pablo 180, 02200 México D.F., Mexicod Retorno Québec 6, Col. Burgos de Cuernavaca 62580, Temixco, Mor., Mexico

a r t i c l e i n f o

Article history:Received 3 January 2008Received in revised form 22 July 2008Accepted 23 July 2008Available online 9 September 2008

0306-4549/$ - see front matter � 2008 Elsevier Ltd. Adoi:10.1016/j.anucene.2008.07.007

* Corresponding author. Fax: +52 55 5804 4900.E-mail address: [email protected] (G. Espinosa

a b s t r a c t

This paper explores the application of fuzzy cognitive maps (FCM) to emergency operating procedures(EOPS), to represent the decision-making process during abnormal situations in a nuclear power plant(NPP). The decision-making process in a NPP is a complex process, due to the many elements involvedin its operation, and the permanent attention demanded by its maintenance. At the present time, thedecision making process in a NPP is analyzed and developed by reactor operators, based on a set ofinstructions as well as flow charts to mitigate the consequences of a broad range of transients, accidentsand multiple equipment failures, whose main characteristic is to be linear representations of eventswithin a scenario. One of the main objectives of this paper is to present a method based in FCM that couldbe applied in the development of EOPS, and show some simulations, specifically the loss of coolant acci-dent (LOCA) scenario in a boiling water reactor (BWR) with the Mark II containment design was studied.The FCM-based method represents with high fidelity the expert reasoning (the human expert is veryimportant) and the interpretation of the results aids instantly to the reactor operators in the surveillanceof the reactor proper functionality due that they have the responsibility of the decision taking in emer-gency situations. The simulations results show that the FCM predict properly the phenomenon in thereactor vessel and primary containment.

� 2008 Elsevier Ltd. All rights reserved.

1. Introduction

The accident at the Three Mile Island Unit 2 (TMI-2) nuclearpower plant near Middletown, Pennsylvania, United States, onMarch 28, 1979, where equipment malfunctions, design relatedproblems and worker errors led to a partial meltdown of theTMI-2 reactor core with small off-site releases of radioactivity(Eisenhut, 1980). This accident was the worst in the nuclear indus-try in that time, and induced to important changes in the philoso-phy of security. One of them was how the Nuclear RegulatoryCommission (NRC) regulates its licenses in order to reduce the riskto public health and safety.

The major changes occurred since the accidents (Rogovin andFrampton, 1980):

(1) Upgrading and escalation of plant design and equipmentrequirements.

(2) Identifying human performance as a critical part of plantsafety, improving operator training and staffing require-ments, followed by improved instrumentation and controls

ll rights reserved.

-Paredes).

for operating the plant, and the establishment of fitness-for-duty programs for plant workers to guard against alcoholor drug abuse.

(3) Improved instruction to avoid the confusing signals that pla-gued operations during the accident.

(4) Enhancement of emergency preparedness to include imme-diate notification requirements to the regulatory authorityfor plant events.

(5) Expansion of the regulatory authority resident inspectorprogram to provide daily surveillance of licensed adherenceto the regulations.

(6) Expansion of performance-oriented as well as safety-ori-ented inspections, and the use of risk assessment to identifyvulnerabilities of any plant to severe accidents.

(7) The installation of additional equipment by licensees to mit-igate accident conditions, and monitor radiation levels andplant status.

The items 2, 3, 4 and 6 are the basis of the emergency operatingprocedures (EOPS). The objective of the EOPS is to provide a set ofinstructions to the reactor operators to mitigate the consequencesof a broad range of transients, accidents and multiple equipmentfailures. Since TMI-2, many resources have been used in order to

mailto:[email protected]

http://www.sciencedirect.com/science/journal/03064549

http://www.elsevier.com/locate/anucene

2388 G. Espinosa-Paredes et al. / Annals of Nuclear Energy 35 (2008) 2387–2396

develop a friendly version of the EOPS to prevent misunderstand-ings to the reactor operators. Recently some innovative techniqueshave been used to develop an improved version of EOPS and obtainnew knowledge that will allow a better performance of the reactoroperator in a near future.

In August 1982, the guideline for the preparation of emergencyoperating procedures was published by the NRC (1982). This doc-ument was designed to identify the elements necessary for licens-ees and applicants to prepare and implement the EOPS. Thedocument also outlines the process by which licensees and appli-cants should develop, implement, and maintain EOPS. Otherimportant documents are the NUREG-0799 (NRC, 1981) that indi-cates an acceptable approach for preparing EOPS, and the NUREG-0660 (NRC, 1980a) where some items have been approved by theNRC for implementation at reactors to improve nuclear safety,but only those items that the NRC has approved for actual imple-mentation are included in NUREG-0737 (NRC, 1980b). These itemsare considered by the EOPS.

In NUREG-0899 (1982), four aspects of EOPS development andimplementation are identified as providing an adequate basis forreview. These are (1) plant-specific technical guidelines (P-STG);(2) a plant-specific writer’s guide; (3) a description of the programfor verification/validation of the EOPS; and (4) a description of theprogram for training operators on the EOPS. Information on each ofthese items is to be provided as procedures generation package(PGP). The PGP for each plant will provide the licensee with tech-nical and human factors basis for developing its EOPs and for mak-ing future revisions to its EOPS. The intent of reviewing the EOPtraining program is to ensure that operators will be trained priorto implementation of the EOPS, and that there is a reasonableassurance that the methods to be used in training are adequate.

In March 1980 the NRC issued an update of a letter of Septem-ber 13, 1979, related with qualification of reactor operator (NRC,1980b). This letter remarks strongly the need to review the criteriato be used by the staff in evaluating reactor operator training andlicensing where the EOPS play an important role. The Enclosures 2and 3 of this letter provide guidance for establishing training pro-grams in heat transfer, fluid flow, thermodynamics and mitigatingcore damage.

In a nuclear power plant whose objective is to generate electricpower, an important feature is the management of critical situa-tions due to operational transient or accidents where there are fail-ures of control systems; mechanical and/or electrical elements, andto restore the nuclear reactor to safe condition as soon as possibleis a paramount point.

The decision making process in a NPP is a complex process, dueto the many elements involved in its operation, and the permanentattention demanded by its maintenance. At the present time, thedecisions making process in the plant is analyzed and developedby a human operator, and is based on diagrams and emergencyprocedures (EOPS) whose main characteristic is to be linear repre-sentations of events within a scenario.

The main idea of this work is to present a method that can beapplied to develop the EOPS for a boiling water reactor (BWR)based on artificial intelligence (AI) techniques, particularly the as-pect related with the knowledge representation. In this case themodel was based on fuzzy cognitive maps (FCM). In AI there is avariety of techniques used for representing knowledge: productionrules, semantic networks, frameworks, scripts, statements, logicand fuzzy cognitive maps, among others. The choice of a particulartechnique depends on two main factors: the nature of the applica-tion and the user’s skills. This work refers to the fuzzy cognitivemaps (FCMs) as causal representations between knowledge/datato represent events relations. For instance, a rise in the engine tem-perature causes a severe damage in the entire system. In the case ofother kinds of knowledge representation, this kind of causality can

not be described as it involves limitations when it implies describ-ing relations of causality.

2. Preliminaries

Cognitive maps were introduced by Axelrod as a formal way ofmodeling decision making in social-economic and politic systems(Axelrod, 1976). In the last decade, the use of FCMs for many appli-cations in different scientific fields was proposed. FCM had beenemployed to analyze extend graph theoretic behavior (Zhang andChen, 1988), to make decision analysis and cooperate distributedagents (Zhang et al., 1989, 1992), they were used as behavioralmodels of virtual word (Dickerson and Kosko, 1994). FCMs wereproposed as system models for failures modes and effects analysis(FMEA) in process industry, specifically the oil refinery in the workof Pelaez and Bowles (1996). FCMs were also used to model andintelligent supervisory control system (Stylios and Groumpos,1998, 1999).

In this paper we proposed the use of FCMs from a differentstandpoint, as a model for emergency management for nuclearpower plants (NPP) in boiling water reactors (BWR).

FCMs are fuzzy-graph structure, which allow systematic causalpropagation, particularly forward and backward chaining (Styliosand Groumpos, 1999). The graphical illustration of FCM is a signeddirected graph with feedback, which consists of nodes andweighted arcs. Nodes of the graph stand for the concepts that areused to describe the behavior of the system and they are connectedby signed and weighted interconnections representing the causalrelationships that exist between the concepts, as is illustrated inFig. 1. It must be mentioned that all the values in the graph are fuz-zy, so concepts take the values in the range between [0,1] (i.e., FCMis a bivalent state) and the weights of the interconnections belongto the interval [�1,1]. From simple observation of the graphical rep-resentation of FCMs, it becomes clear, which concept influencesother concepts, showing the interconnection among concepts andit permits thoughts and suggestions for the reconstruction of thegraph, i.e., the adding or deleting of an interconnection or a concept.

The graphical representation of a FCM has a mathematical for-mulation. Values of concepts are fuzzy and arise from the transfor-mation of the real values of the corresponding variables for eachconcept, and also the values for the weights of the interconnectionsamong concepts are fuzzy. Then, in order to calculate the values ofthe concepts, we use the equation given by Stylios and Groumpos(1999)

Vti ¼ f

Xn

j¼1j–i

Vt�1j Pji

0BB@

1CCA ð1Þ

where Vti is the value of concept Ci at step t, Vt�1

j is the value of con-cept Cj at step t � 1, Pji is the weight of the interconnection fromconcept Cj to concept Ci and f is the threshold function that squashesthe result of the multiplication in the interval [0,1]. This equationindicates that a FCM is free to interact; at every step of interactionevery concept has a new value.

In this work the weight of the interconnection from concept Cj

to concept Ci was defined as follows:Pij = 0 indicates the absence of a relation between concepts i and

j, Pij > 0 denotes positive causality, which implies that an incrementin concept i results in an increment in concept j, and Pij < 0 denotesnegative causality, implying an increment in concept i results in adecrement in concept j or that a decrement in concept i results inan increment in concept j.

Several formulas can be used as threshold function (Kosko,1992), and as the interval of concept is bivalent (i.e., the conceptsbelong to the interval [0,1]), we propose the function

1C

2C

3C

4C

5C15P

12P52P

32P

35P45P

43P

34P

Fig. 1. A fuzzy cognitive map. Ci are the concepts Pji is the weight of the interconnection from concept Cj to concept Ci .

G. Espinosa-Paredes et al. / Annals of Nuclear Energy 35 (2008) 2387–2396 2389

f ðxÞ ¼ 11þ e�mx

ð2Þ

where m is a real positive number and x is given by

x ¼Xn

j¼1j–i

Vt�1j Pji ð3Þ

In this work we use m = 5, because this value showed best results inprevious works (Miao and Liu, 2000; Stylios and Groumpos, 2004).

The mathematical point of view and for a numerical analysis Vti

can be represented by a state vector v, and Pji by a fuzzy relationalmatrix, P. A concept is turned on or activated by making its vectorelement 1. New state vectors showing the effect of the activatedconcept are computed using method of successive substitution,i.e., by iteratively multiplying the previous state vector by the rela-tional matrix using standard matrix multiplication

vt ¼ vt�1P ð4Þ

The iteration stops when a limit vector is reached, i.e., whenvt = vt�1 or when vt� vt�1

6 e; where e is a residua, whose value de-pends on the application type (see Section 5 for more detail).

According with Hagiwara (1992), to represent the non-linear ef-fects the weights have the non-linear behavior. Then, in this workwe consider that the interconnection from concept Cj to concept Ci

is non-linear through a membership function given by Eq. (2).The build of a FCM model of a process or plant depends on a hu-

man expert who has the knowledge on the system operation, spe-cifically in this work on a human expert in emergency proceduresin NPP. The expert has observed the grade with which each vari-able of the system influences others and so, he determines the neg-ative, positive, with a fuzzy degree of causation.

3. Development

As a FCM describes a system in terms of concepts and the rela-tions between those concepts, then in order to build a map of a sys-tem, we can apply the following procedure to arrive at the modelto be implemented at the computer software. This process has astrength relationship with the analysis and design of the computersoftware core.

� Step 1. Describe the system behavior during an emergency in aNPP in order to identify the main physical processes, and thento establish the control variables, such as pressure, temperaturelevel, among others (i.e., the expert in the specific domain).

� Step 2. Definitions of concepts, this is accomplished with thevariables of the physical process (defined in the previous step).

� Step 3. Determining the arrows showing the relations betweenconcepts.

� Step 4. Assigning appropriate signs, and linguistic strength todescribe the relations.

This procedure was applied to the case of a small loss of coolantaccident (LOCA) in a BWR. The system considered in this work in-cludes the reactor vessel and the primary containment where thevessel is housed, a detailed description of the system is in Section3.1 of this work. The LOCA is a postulated accident that results in aloss of reactor coolant of the reactor due to breaks in the reactorcoolant pressure boundary, up to and including a break equivalentin size to the double-ended rupture of the largest pipe of the reac-tor coolant system. In general, a LOCA event involves the postula-tion of a spectrum of piping breaks inside containment varying insize, type, and location. The break type includes steam and/or li-quid process system lines.

The energy released from the nuclear reactor vessel to the con-tainment during a LOCA is comprised of the following: stored en-ergy in the reactor system, energy generated by fission productdecay, energy from fuel relaxation, sensible energy stored in thereactor structures, energy being added by the emergency coolantsystems pumps, and metal–water reaction energy. Following theLOCA the energy will be released, and will contribute to the sup-pression pool and containment heatup.

The leakage of coolant in the reactor vessel produces a reduc-tion of the water level and lowers the pressure in the reactor. Thislow pressure in the reactor vessel, low level in the vessel, highpressure in the drywell and high level in the suppression poolare the most relevant parameter that indicate a LOCA.

The LOCA is accomplished by the use of the containment cool-ing system, which is an operational mode of the residual heat re-moval (RHR) system. The purpose of this system is to preventexcessive containment temperatures and pressures thus maintain-ing containment integrity. To fulfill this purpose, the containment


cooling system will limit the temperature of the suppression poolto 210 �F without spray cooling system operation when consider-ing the energy additions to the containment following a LOCA.The containment cooling system is started manually; there areno signals which automatically initiate the containment coolingfunction.

The size of the small LOCA for this case of study can be approx-imated to the area of a safety/relief valve stuck in the open posi-tion. Within this category are considered liquid leaks less than0.004 sq.ft. and vapor leaks less than 0.005 sq.ft.

3.1. System description

The main objective of the nuclear regulation is to establishrequirements directed to protect the health and safety of the publicfrom uncontrolled release of radioactivity. At the design stage, pro-tection of public health and safety is ensured through the design ofphysical barriers to guard against the uncontrolled release of radio-activity. The ‘‘defense in depth” philosophy includes reliable designprovisions to safely terminate accidents and provisions to mitigatethe consequences of accidents. The three physical barriers that pro-vide defense-in-depth are: Fuel clad, reactor coolant systemboundary, and containment boundary. These barriers perform ahealth and safety protection function. They are designed to reliablyfulfill their operational function by meeting all the criteria andstandards applicable to mechanical components, pressure compo-nents and civil structures.

The containment system is a ‘‘multibarrier” which consists of aprimary containment of the pressure suppression type, surroundedby the reactor building (secondary containment). The fuel claddingand the reactor coolant pressure boundary form additional barriersagainst the release of fission products. The Mark II containment de-

RP RL

WL

DP

DT

PO

Fig. 2. Schematic diagram of the primary containment in

sign concept was used in this study (Comisión Federal de Electric-idad, 1979) and its conceptual model is illustrated in Fig. 2.

The primary containment system is a pressure suppression typeand consists of a chamber where the reactor vessel is located (dry-well), a pressure suppression chamber which stores a large volumeof water (wetwell), a drywell diaphragm floor which separates thedrywell and a suppression chamber, a connecting vent system(downcomers) between the drywell and the suppression chamber,isolation valves, a drywell–wetwell vacuum relief system, and aresidual heat removal subsystems for containment cooling. Thedrywell, is a steel-lined reinforced concrete vessel, in the shapeof the frustum of a cone, closed by a dome with an ellipsoidal head.The pressure suppression chamber is a cylindrical steel-lined rein-forced concrete vessel located below the drywell. The primary con-tainment system houses the reactor vessel, the reactorrecirculation system, and other branch connections of the reactorcoolant system.

The primary containment system is designed to withstand theeffects of the safe shutdown earthquake and the pressures andtemperatures resulting from a break of the reactor coolant pressureboundary up to and including an instantaneous circumferentialbreak of a reactor recirculation pipe. The drywell floor provides aleaktight pressure barrier, which separates the drywell and thesuppression chamber. The drywell portion, including the drywellfloor slab, serves to contain the effects (i.e., mass and radiation)of a LOCA and to direct the steam released from a reactor primarysystem pipe break into the suppression chamber. The suppressionchamber provides a pool of water, which serves as a heat sink.

All the components above described are shown in Fig. 2 andlisted in Table 1, and this is the model that we considered as theprimary containment for a BWR to evaluate LOCAs with the FCMsmethod. This model is described in the following sections.

WP

Containment

Wetwell

Reactor

Drywell

WT

a BWR showing the elements identified as concepts.

Table 1Concepts for the emergency procedures in a NPP

Concept Abbreviation Description

C1 RL Reactor level outside the acceptable rangeC2 RP Reactor pressure outside the acceptable rangeC3 PO Reactor power outside the acceptable rangeC4 WT Suppression pool temperature outside the acceptable

rangeC5 DT Drywell temperature outside the acceptable rangeC6 DP Drywell pressure outside the acceptable rangeC7 WL Suppression pool level outside of rangeC8 RG Reactor in good conditionC9 CG Stabilized primary contention


3.2. Concepts and trajectories

As it was mentioned previously the EOPs for a BWR, are a set ofsix procedures showed as a flow chart, which are the follow:

� Control of level/power.� Control of the reactor.� Control of primary containment.� Control of secondary containment.� Control of the radioactive release.� Flooding of the reactor.

Each EOP has key to control a specific parameter to reach thegoal of the procedure, but the EOPs are an integral set of instruc-tions. In this study we consider two procedures: control of thereactor and control of primary containment.

In order to represent the emergency scenario in a NPP using theFCMs it is necessary to consider the resulting trajectories of thescenario evolution during a small LOCA. The actions to mitigatecore and containment damages are the following:

� Mitigation of damages to the core(1) The actions to control the water level in the reactor establish

the suitable cooling of the core maintaining it flooded.(2) The actions for the control of the pressure in the reactor to

stabilize the pressure helping to control the water level inthe reactor and, if necessary, to depressurize and to cool-down reactor until optimal conditions for cold shutdown.

(3) The actions to control the power of the reactor if scram fails,it is to reduce the power of the reactor with the manualinsertion of control rods and boron injection.

� Mitigation of damage to primary containment(4) The taken actions to control any of the parameters of the pri-

mary containment can directly affect the control of otherparameters, and this executes all actions of concurrent form.Specifically: The changes in the temperature of the suppres-sion pool can directly produce changes in the pressure of theprimary containment. The changes in the temperature of thedrywell can directly produce changes in the pressure of theprimary containment. The changes of the water level of thesuppression pool can directly produce changes in the pres-sure of the wet-well.

(5) If the temperature of the suppression pool remains under thevalue of the condition limit of more restrictive, actions of theoperator are not required. Then, the action is to continue withthe monitoring process in order to control the temperature ofthe suppression pool using the systems available.

(6) The initial operation taken to control the water level of thesuppression pool is the same one employed during the nor-mal operation of the plant (i.e., monitoring its state, and tofill or to drain the suppression pool as it is required to main-tain the level within the limits given by engineeringspecifications).

The parameters needed to be controlled and the trajectoriesproduced if these parameters exit from their normal status of oper-ation constitute the base to identify the concepts, which the expertconsiders take part or being affected during the emergency of thesystem. Therefore in a first problem inspection nine concepts aredetected. The concepts during an emergency scenario in a NPPwere identified as potential relevant variables that represent nineconcepts, which are listed in Table 1. The model is inspired inthe physical system illustrated in Fig. 2. An interview with the ex-pert and a more detailed analysis can lead us to the discovery ofnew concepts and the relations between them.

3.3. Determining the arrows showing the relations between concepts

The nine identified concepts (Table 1) keep relations with eachother, which are established from the considered actions by thecontrol reactor and primary contention flow chart, in order to mit-igate the effects that one of them could produce over the rest. Therelations between concepts are given by:

(a) The changes in the temperature of the wetwell (WT) candirectly produce changes in the pressure of the drywell (DP).

(b) The changes in the temperature of the drywell (DT) candirectly produce changes in the pressure of the drywell(DP). Here it is generated an implicit relation between WTand DT due to the relation that both keep, respectively, withDP.

(c) The changes of the water level of the wetwell (WL) candirectly produce changes in the pressure in the drywell aswell as in the temperature.

(d) The water level in reactor (RL) cannot be stabilized and bemaintained within a specified band, if the reactor pressure(RP) is oscillating.

(e) The pressure in reactor (RP) cannot be stabilized nor be con-trolled suitably, if the power of the reactor (PO) is varying.Another implicit relation is the causality between PO andRL, because a greater water level in the reactor implies adiminution in the power of the reactor.

(f) Controlling of the water level in the reactor, it establishesthe suitable cooling of the nucleus, maintaining it flooded.This means that a relation of causality between the waterlevel in reactor outside acceptable rank (RL) and the reactorin good state (RG), then it would not guarantee suitable cool-ing of the core.

(g) The actions for the control of the pressure in the reactorhelping to control the water level in the reactor and, if nec-essary, to depressurize and to cool vessel of the reactor untilconditions for cold shutdown. This reinforces the relation ofcausality between the pressure of the reactor (RP) and thewater level in the reactor (RL), in addition it allows to estab-lish another implicit relation between RP and RG.

(h) Controlling the temperature of the suppression pool impliesan initial operation to control the water level of the suppres-sion pool. This means that a causality relation between WTand WL exists.

(i) To control any of the parameters of the primary containment(temperature of the drywell, temperature and level of thesuppression pool) can directly affect the control of the restof the parameters of the primary containment. Then, thethree implicit relations for each of the parameters are givenby:
(1) Between the temperature of the suppression pool (WT)
and the stabilized primary containment (CG).(2) Between the temperature of the drywell (DT) and the

stabilized primary containment (CG).

Table 2Causality relations between concepts

Actions Relations Value

(a) (1) Relation of positive causality between WT and DP 1(b) (2) Relation of causality positive between DT and DP 1

(3) Implicit positive relation between WT and DT, due to the 1


(3) Between the water level of the suppression pool (WL)and the stabilized primary containment (CG).

(4) Derived from these relations another is generated,between the primary stabilized containment (CG) andthe drywell pressure (DP).

relation that both keep with respect to DP(c) (4) Implicit negative relation between WL and DP derived of (2) �1(d) (5) Relation of negative causality between RL and RP �1(e) (6) Relation of negative causality between RP and PO �1

(7) Implicit relation of negative causality between PO and RL,because a greater water level in the reactor (RL) implies adiminution in reactor power (PO)

�1

(f) (8) Relation of negative causality between RL and RG, due to asuitable cooling of the core would not be guaranteeing

�1

(g) (9) Relation of implicit causality between RP and RG of thenegative type

�1

(h) (10) Relation of negative causality between WT and WL �1

(j) An appropriate water level in the reactor has effect on thepressure of the drywell and therefore on the temperatureof the drywell. Then, relation of causality between the waterlevel in the reactor (RL) and the drywell temperature (DT)exists.

(k) The temperature of the suppression pool is key for a stabi-lized containment and with it a reactor in good state. Inaddition the good state to the reactor influences in thepower of itself. Then, the following relation of causalitycan be defined:

(i) (11) Relation of negative causality between WT and CG �1(12) Relation of negative causality between DT and CG �1(13) Relation of negative causality between WL y CG �1(14) Relation of negative causality between CG and DP, derivedof (10–12)

�1

(j) (15) Relation of negative causality between RL and DT �1(k) (16) Relation of positive causality between CG and RG 1

(17) Relation of positive causality between PO and RG 1

(1) First, a relation of causality between the primary con-tainment stabilized (CG) and the reactor in good state(RG).

(2) Another relation of causality between the power ofthe reactor (PO) and the reactor in good state (RG).

(3) Implicit relation between the temperature to the sup-pression pool (WT) and the power of the reactor (PO).

(18) Implicit relation of negative causality between WT and PO �1

3.4. Assigning appropriate signs, and linguistic strength to describe therelationships

Based in observed actions between the concepts from the con-trol reactor and primary containment procedures, relation causal-ities are established; these can be either positive or negative of aconcept in respect with another.

3.4.1. Positive causalityIf the increased effect of one node over another is also a propor-

tional increase, it would be a positive causality relation; the samehappens when instead of an increase a decrease is presented. Forinstance, the pressure increase in the primary containment causesa temperature increment. Positive causality also involves a concepteffect of increasing the property of another concept. Therefore itcan be observed that a concept can have a positive causality overanother if it tends to stabilize it between normal operation ranges.

3.4.2. Negative causalityOtherwise, if an increase of one concept causes a proportional

decrease of another or vice versa, if the decrease of one conceptcauses the proportional increase of another, then it would be a neg-ative causality relation. For instance, the temperature decrease inthe reactor vessel can produce an increase in power. Negative cau-sality, also refers to the contrary effect that a concept has over an-other, it is to say; one concept can cause a decrease in the propertythat the other node has. Speaking of a negative causality the effectwould be to take it out of the normal operation range; it does notmatter if it’s done over or bellow it.

In order to indicate these causalities numerically, the relations(edges) take the value of 1 if it’s positive, �1 if it’s negative and0 if it’s neutral or if there is no effect. According to these, the fol-lowing causality relations are established between the identifiedconcepts.

3.4.3. Temperature out of rangeIt is defined as that temperature different from the established

in normal operation conditions.

3.4.4. Pressure out of rangeIt is defined as that pressure different from the established in

normal operation conditions.

3.4.5. Level out of rangeIt is defined as that level different from the established in nor-

mal operation conditions.The relations between concepts that were defined in previous

section are summarized in Table 2, where is indicated the valueof the effect between them.

4. Map and relations matrix

In this section the development of the cognitive map in functionwith the established relations previously mentioned is presented.Following the construction of the representation model andaccording to the FCMs technique, which says: ‘‘FCMs are repre-sented by a diagram in which the nodes are concepts that describethe main characteristics of cognitive or physical processes”.

The nine identified concepts (Table 1) constitute the modelsince they describe the main characteristics of the process in thesystem during an EOPS.

4.1. Fuzzy cognitive map

The fuzzy cognitive map constitutes the diagram with the iden-tified nodes and the edges are the arrows that illustrate the estab-lished causality relations between them. The neutral causalityrelation is not presented in Fig. 3, only negative or positive causal-ity relations are represented through edges whose values are be-tween the range (�1,0) and (0,1).

4.2. Relations matrix

The representation of the relations of causality is constitutedby a matrix with positive or negative values between each ofthe concepts and the rest of them; these values were obtainedwith analysis along with the human expert help in the domain.These relations matrix representative of the EOPS is shown inTable 3.

It is important to establish that the construction of the matrixrepresented in Table 3 does not consider a specific order, due thatthe analysis result is not affected.

RL

RP

PO

RG WT

DT

DP

WL

CG

Negative effectPositive effect

Fig. 3. FCM of the representative conjunction of the EOPS.

Table 3Relations matrix

Concepts RL RP PO WT DT DP WL RG CG

RL 0 �1 �1 0 �1 0 0 �1 0RP �1 0 �1 0 0 0 0 �1 0PO �1 �1 0 �1 0 0 0 1 0WT 0 0 �1 0 1 1 �1 0 �1DT �1 0 0 1 0 1 0 0 �1DP 0 0 0 1 1 0 �1 0 �1WL 0 0 0 �1 0 �1 0 0 �1RG 1 �1 1 0 0 0 0 0 1CG 0 0 0 �1 �1 �1 �1 1 0


5. Simulations, results and discussion

In each of the test scenarios we have an initial vector vi, repre-senting the events present at a ‘given instant of the process, and afinal vector vf, representing the last state that can be arrived at, gi-ven the presence of certain events in the current scenario.

For the interpretation of the results, an average is computedaccording to the following criteria:

SðxÞ ¼0; for SðxÞ 6 0:3371; for SðxÞP 0:850

�ð5Þ

where 0 represents the characteristic of the represented process bythe concept is null, and 1 represents, the characteristic of the pro-cess represented by the concept is present 100%. The final vectorapplying this criteria is denoted by v�f . This criterion can be modifiedaccording with the expert judgment.

The algorithm used to obtain the final vector v�f is the following:

(1) Definition of the initial vector vi that corresponds to the ele-ments identified in Table 1.

(2) Multiply the initial vector vi and the matrix defined in Table3, as indicated by the Eq. (4).

(3) The resultant vector is updating using Eqs. (1)–(3).

(4) This new vector is considered as an initial vector in the nextiteration.

(5) Steps 2–4 are repeated until vt � vt�16 e = 0.001.

The FCM performance is illustrated by means of simulation ofthe three scenarios in case of small LOCA:

� Suppression pool temperature outside the acceptable range.� Drywell temperature outside the acceptable range.� Water level of the suppression pool outside of range.

5.1. First scenario. Suppression pool temperature outside acceptablerange, WT

In this scenario the energy released from the reactor vessel afterLOCA is deposited in the primary containment, increasing the tem-perature in the drywell (DT), and through the downcomer pipes,the condensate with high energy from drywell is relocated in thewetwell increasing the temperature (WT). The increase of the pres-sure in the primary containment is a consequence of the incrementof the temperature.

The initial value (vi) of each of the concepts is indicated in Table4, in this case the WT concept is the only with a value of 1, the restof the concepts have a value of 0.

Table 4 gives the results of this scenario. The problem startswith temperature in the suppression pool out of range (WT = 1).According with LOCA phenomenon, the increase in the tempera-ture and pressure in whole containment is consequence of thehigh-energy pipe break. The system based on FCM predicts cor-rectly that WT, DT and DP take the value of 1 after 44 iterations.Therefore when the drywell temperature out of range is present,it is because the primary contention pressure is out of range, lead-ing to the instability of the primary contention, as well as the reac-tor failure.

The stability of a FCM depends on the sign of the arrow of thelink being analyzed (Pelaez and Bowles, 1996). In general, a systemis called stable if the value of no variable gets larger and larger in

Table 4Results of suppression pool temperature outside the acceptable range

RL RP PO WT DT DP WL RG CG

vi 0 0 0 1 0 0 0 0 0vf 0.00029 0.14496 0.00947 0.99995 0.99995 0.99995 0.00004 0.20870 0.000002vf

* 0 0 0 1 1 1 0 0 0

* Final vectors with using criteria given by Eq. (5).


any situation in which some external changes are introduced atsome other variables, i.e., the presence of feedback loops contrib-utes greatly to the stability of the system. If there are many feed-back loops, they often lead to the instability because small initialchanges can be amplified after each step in the iterative process.A good rule is that many positive feedback loops will lead toincreasing deviations and instability. Negative feedback loops leadto the stability. It is easy to identify positive or negative feedbackloops. A cycle corresponds to a positive feedback only and if ithas and even number of minus sign. The identification of positiveor negative feedback loops is an important step in the analysis. Thisconcept was discussed in the work ofPelaez and Bowles (1996). Inthis scenario, variable WT is called stable starting changes in thesystem lead to stability at every other variable. The stability anal-ysis is done given an initial increase in a variable under theassumption that further external influences are not introduced intothe system.

5.2. Second scenario. Drywell temperature outside acceptable range,DT

Again, temperature outside of range in the drywell is an indica-tor of leakage in the reactor vessel, therefore initially the DT con-cept is only node with the value of 1 while the rest of the nodeshave a value of 0, i.e., as initial value vi. This increment in the tem-perature produces a high pressure in the drywell (DP) and these re-sults are shown in Table 5, indicating that the drywell temperature(DT concept) has an immediate effect over the drywell pressure

Table 5Results of drywell temperature outside the acceptable range

RL RP PO WT D

vi 0 0 0 0 1vf 0.00051 0.07353 0.10629 0.99995 0vf

* 0 0 0 1 1


Table 6Results of suppression pool level outside of range

RL RP PO WT D

vi 0 0 0 0 0vf 0.00019 0.03125 0.08224 0.99990 0vf

* 0 0 0 1 1


Table 7Results of reactor power outside of acceptable range

RL RP PO WT

vi 0 0 1 0vf 0.000003 0.000386 0.503005 0.999181vf

* 0 0 0.503005 1


(DP concept) as well over the suppression pool temperature (WTconcept) due to the effect of the dowcorners that connect the dry-well with the wetwell. The final result after 31 iterations is insta-bility of the primary contention and the reactor (RG) becomesvulnerable.

5.3. Third scenario. Suppression pool level outside range, WL

After a LOCA the steam and liquid is deposited in the suppres-sion pool via downcomers increasing the pool level (WL), so ini-tially it has the value of 1 (Table 6), while the rest of the nodeshave a value of 0. The final results after 25 iterations are shownin Table 6, and their interpretations are the following. The WL con-cept has an immediate effect over the drywell pressure (DP) whichaffects directly the its temperature (DT), this is a clear indicator ofthe LOCA event. Therefore a pressure out of range of the primarycontention is presented, which leads as a consequence the instabil-ity of the primary contention and some reactor vulnerability (RGconcept).

5.4. Fourth scenario. Reactor power outside acceptable range, PO

The sequence starts with the reactor power offside of range dueto the reduction of water level (RL) in the vessel, so initially PO hasthe value of 1, and while the rest of the nodes have a value of 0, i.e.,as initial value vi. The leakage or/and liquid is easily detected in theprimary containment due to the high pressure (DP) and tempera-ture (DT) in the drywell (DP). The final stage of the reactor level

T DP WL RG CG

0 0 0 0.99993 0.99993 0.00007 0.50022 0.000006

1 0 0.50022 0

T DP WL RG CG

0 1 0 0.99995 0.99995 0.00004 0.65654 0.000004

1 0 0.6 0

DT DP WL RG CG

0 0 0 0 00.99995 0.99995 0.00004 0.343109 0.0000041 1 0 0.343109 0

Table 8Results of pressure reactor outside of acceptable range

RL RP PO WT DT DP WL RG CG

vi 0 1 0 0 0 0 0 0 0vf 0.001041 0.210831 0.013277 0.999951 0.99995 0.99995 0.00004 0.384254 0.000001vf

* 0 0 0 1 1 1 0 0.384254 0



is OK (RL = 0), but the leakage still remain and the main parametersof the primary containment are offside acceptable range (WT = 1,DT = 1, DP = 1). The initial low level in the reactor vessel producethe automatic shutdown of the reactor (SCRAM) and the actuationof the ECCS keep the reactor in low power condition (PO =0.503005) and the reactor vessel is vulnerable (RG = 0.343109). Inthis case the convergence is reached after 55 iterations. See Table 7.

5.5. Fifth scenario. Pressure of the reactor outside acceptable range, RP

In case of LOCA the pressure of the reactor drops (RP = 1) due tothe depressurization and this is the initial stage for this scenario,while the rest of the nodes have a value of 0, i.e., as initial valuevi Again, the leakage increases the main parameter of the primarycontainment as temperature, pressure and level in the suppressionpool (WT = 1,DT = 1,DP = 1), as is predicted in the last row in Table7 after ten iterations. The final stage of the reactor is a vulnerablecondition (RG = 0.384254). The results of this scenario after 33 iter-ations are shown in Table 8.

The scenarios results were compared with an expert’s analysis,all of them were congruent with the LOCA phenomenon. Any otherscenarios can be performed choosing the initial conditions of vi = 0,or vi = 1.

6. Discussion

The value of 1 for WT, DT and DP is an indication of LOCA insideof the primary containment of the reactor. In particular the firstcase starts with WT = 1 and the rest of the concepts are zero. Afterthe iterative process WT, DT and DP take the value of ‘‘1” (see Table4). This is an important result because it shows that the FCM hasthe capability to predict that in case of high temperature in thesuppression pool, the pressure and the temperature of the drywellshould be out of range too.

The Case 2 (Table 5) the initial vector is and indication that thedrywell temperature is outside of range, again after the iterativeprocess WT, DT and DP are equal to 1. The Case 3 (Table 6) – sup-pression pool level outside of range, Case 4 (Table 7) – reactorpower outside of range and Case 5 (Table 8) – reactor pressure out-side of range, show at the end of the iteration process that WT, DTand DP are equal to ‘‘1”. This is and indication of LOCA and showthat these parameters in the primary containment are well linkedamong then and with the reactor vessel through the FCM.

For nuclear power stations, the failure analysis in many compo-nents is resting in the traditional techniques of ‘‘fault tree analysis”(FTA). This is a very well know technique and it provides reliableresults. However the FTA is an expensive technique because it isnecessary to spend a lot of time in the development of fault treefor each system and then mixed to obtain the different minimalcut set that get to core damage, but it is a powerful tool. One ofthe main disadvantages is that the nuclear reactor operators arenot familiar with the results and with the techniques of the FTA.The interpretation of the minimal cut sets is easy for the fault treedevelopers but not for the rest of the people that are not involvedwith the ‘‘labels” used to denote the different failures of thecomponent.

The FCM provides new strategies for predicting failure effectsand causes in a complex systems as a nuclear power plant. In par-ticular during an operation transient, the nuclear reactor is out ofbalance and it is virtually impossible get precise information ofall of the possible relevant parameters to get the reactor to safetystage. Although not precise, the results obtained are better thanoversimplifying a model. The expert system developed with FCMhas the capability to warn the reactor operator about the relevantparameters in case of accident, event when the operator is focusedin few parameters. The implementation of the FCM is easy and theresults have friendly interpretation. On the other hand the FCM isan effective tool to represent and manipulate the knowledge of thenuclear reactor operators to identify failure modes and theirconsequences.

7. Conclusions

Fuzzy cognitive maps (FCM) provide a tool for capturing thesystem behavior from the information that is available. A propervertices selection is very important, because not only should therelevant concepts of the system be identified, but their activationmust be modeled in such a way that causal relationships are prop-erly identified. Specifically, the FCM provides a new strategy forpredicting effects and causes in a complex system, as well as emer-gency operating procedures (EOPS). The main idea of this work isto provide an additional tool in the decision process during anemergency in a nuclear power plant, and not replace the use ofEOPS.

The FCM-based method represents with high fidelity the expertreasoning (the human expert is very important) and the interpre-tation of the results aids instantly to the reactor operators in thesurveillance of the reactor proper functionality due that they havethe responsibility of the decision taking in emergency situations.At this point time is extremely critic due that the informationavailable is so vast that a proper decision is difficult to take. Withthe interpretation of obtained results according to actual statestaking a decision could be done in a more accurate, wisely and ina fast way.

The FCM were tested using one of the more important scenariosfor the licensing process of nuclear reactor that is the LOCA, andthe results show that the FCM predict properly the phenomenonin the reactor vessel and primary containment. The system consid-ered may be extended adding the ECCS, and manual and automaticaction to consider a complex system. The human performance dur-ing an emergency situation is one of the more relevant parameters,and a sensitivity analysis may carry on using the FCM to decisionmaking process.

References

Axelrod, R., 1976. Structure of Decision: the Cognitive Maps of Political Elites.Princeton University, NJ.

Comisión Federal de Electricidad, 1979. Final Safety Analysis Report (FSAR), CentralNuclear de Laguna Verde Nuclear Power Station, Unit 1 and 2.

Dickerson, J.A., Kosko, B., 1994. Fuzzy virtual words. AI Expert, 25–31.Eisenhut, D.G., 1980. Five additional TMI-2 related requirements to operating

reactors. Letter of Nuclear Regulatory Commission May 7.


Hagiwara, M., 1992. Extended fuzzy cognitive maps. FUZZ-IEEE1992, IEEEInternational Conference on Fuzzy Systems, March 8–12, San Diego, CA, pp.795–801.

Kosko, B., 1992. Neural Networks and Fuzzy Systems: A Dynamical SystemsApproach to Machine Intelligence. Prentice-Hall, New Jersey.

Miao, Y., Liu, Z.Q., 2000. On causal inference in fuzzy cognitive maps. IEEETransactions on Fuzzy Systems 8, 107–119.

NRC, 1980a. NRC action plans developed as a result of the TMI-2 accident, NUREG-0660. Nuclear Regulatory Commission, Washington DC.

NRC, 1980b. Clarification of TMI action plan requirements NUREG-0737. NuclearRegulatory Commission, Washington, DC.

NRC, 1981. Criteria for preparation of emergency operating procedures, NUREG-0799. Nuclear Regulatory Commission, Washington, DC.

NRC, 1982. Guidelines for the preparation of emergency operating procedures,NUREG-0899. Nuclear Regulatory Commission Washington, DC.

Pelaez, C.E., Bowles, J.B., 1996. Using fuzzy cognitive maps as a system models forfailure models and effects analysis. Information Sciences 88, 177–199.

Rogovin, M., Frampton, G.T., 1980. Three Mile Island; A report to the commissionersand to the public, NUREG/CR-1250, vols. I–II.

Stylios, C.D., Groumpos, P.P., 1998. The challenge of modeling supervisory systemusing fuzzy cognitive. Journal of Intelligent Manufacturing 9, 339–345.

Stylios, C.D., Groumpos, P.P., 1999. Fuzzy cognitive maps: a model for intelligentsupervisory control systems. Computers in Industry 39, 229–238.

Stylios, C.D., Groumpos, P.P., 2004. Modeling complex systems using cognitivemaps. IEEE Transactions on System, Man and Cybernetics Part A: Systems andHumans 34, 155–162.

Zhang, W., Chen, S.S., 1988. A logical architecture for cognitive maps. In: Proceedingsecond IEEE International Conference on Neural Networks, vol. 2. San Diego, CA,24–27 July, pp. 381–388.

Zhang, W.R., Chen, J.C., Besdek, 1989. Pool2: a generic system for cognitive mapdevelopment and decision analysis. IIE Transactions on Systems, Man, andCybernetics 19 (1), 31–39.

Zhang, W.R., Chen, J.C., Wang, W., King, R.S., 1992. A cognitive map-based approachto the coordination of distributed co-operative agents. IIE Transactions onSystems, Man, and Cybernetics 22 (1), 103–114.

Documents

Emergency management for a nuclear power plant using fuzzy cognitive maps