E Chojnacki
email: eric.chojnacki@irsn.fr.

W Plumecocq

L Audouin

An expert system based on a Bayesian network for fire safety analysis in nuclear area

Keywords: Bayesian network, Expert system, Pressure effects Nomenclature

For fire safety studies in nuclear installations, IRSN uses the SYLVIA software. The SYLVIA two-zone model was developed by IRSN to simulate a full ventilation network, fire scenarios in a highly confined and mechanically ventilated facility, and airborne contamination transfers inside nuclear installations. In order to take into account the different sources of uncertainty coming from initial and boundary conditions as well as from model parameters, the SYLVIA software is associated with the SUNSET statistical software. However, such a use of SYLVIA software has a major drawback: it requires a large number of runs and a significant statistical analysis what is not always compatible with the requirements of safety assessments in terms of deadlines. To overcome this difficulty, IRSN is currently developing an expert system based on a SYLVIA database. This approach allows deriving the most likely diagnosis or prognosis in a very short time, but also deriving a more complex form of reasoning intertwining prognostic and diagnostic inferences. The proposed expert system is based on the Bayesian Belief Network (BBN) methodology and consists in two steps: First, a large database obtained from SYLVIA runs allows the estimation of Conditional Probability Tables. Then, a message passing algorithm is used to exploit dynamically this data base. The illustrating example is based on the study of pressure effects due to fire scenarios in nuclear facilities and the database is made up of 1,600,000 runs of the SYLVIA software. The goal of this paper is to detail the methodology and process to carry out an expert system for fire safety studies, and is supported by one example showing how it can be used as a decision support tool for fire safety analysis in nuclear area. To our opinion, the development of expert systems represents a new generation of computational tools in the field of probabilistic fire simulation.

Mass concentration [g m -3 ]

Greek letters α Fire growth factor [kW s -2 ] φ

Free volume [-] χ

Correction factor [-] ρ

Gas density [kg m -3

Introduction

The SYLVIA software system [START_REF] Plumecocq | Numerical method for determining water droplets size distributions of spray nozzles using a two-zone model[END_REF] has been developed by the Institut de Radioprotection et de Sûreté Nucléaire (IRSN) to simulate a full ventilation network, fire scenarios in a highly confined and ventilated facility, and airborne contamination transfers inside nuclear installations. This software is based on a two-zone approach and is used by IRSN for fire safety studies. To evaluate the impact of uncertainties, the SYLVIA software is coupled to the SUNSET statistical tool [START_REF] Chojnacki | Description of the IPSN method for the uncertainty and sensitivity analysis and the associated software: SUNSET[END_REF] also developed by IRSN. This coupling makes it possible to directly carry out a set of parametric studies and then measure the impact on some selected responses. A typical use of the SYLVIA/SUNSET coupling is to perform a Monte Carlo simulation in which a set of variables, known as study parameters, is modeled by random variables. The results obtained from a Monte Carlo simulation constitute a database linking parametric configurations determined by the set of values assigned to the study parameters and uncertainties to the corresponding results. However, the direct use of this database in the context of a safety assessment encounters two main difficulties:

-The database is necessarily very limited considering the possible configurations. The SYLVIA simulations constituting the database represent a small percentage of the possible parametric configurations. This is due to the combinatorial explosion of the configurations as a function of the possible values taken for each parameter and the number of parameters considered. For instance, if we consider 16 parameters and each of them can take only 3 values, the number of combinations of values is 3 16 , i.e. approximately 43 million configurations. -The database is not specific to the characteristics of a safety assessment. It is necessary to extract from the database the information compatible with the specificities of the case of interest. For example, a safety assessment can focus more specifically on large volumes, high heat release rates, etc. and seek to discriminate configurations compatible with safety issues, such as maximum gas temperature, maximum pressure, etc. in a compartment.

To meet this dual challenge, it is necessary to be able to correctly update the information contained in the database by integrating the characteristics of each safety assessment. One solution is to develop an expert system. This approach allows deriving in a negligible time prognostic and diagnostic like inferences, but also more complex forms of reasoning intertwining prognostic and diagnostic inferences. To achieve this aim, a large SYLVIA results database has to be built.

In a first section, we will describe the methodology used to create an expert system from a consequent SYLVIA database. Then, we will detail how we have established an expert system corresponding to a case of application dealing with the study of pressure effects due to a fire in an enclosure. In the last section, a practical use of the expert system will be analyzed, illustrating the interest of this expert system-like approach as a support tool for both training and safety assessment.

The expert system

An expert system is a tool that aims to simulate the cognitive mechanisms of an expert, in a particular field. This is one of paths leading to artificial intelligence. More precisely, an expert system in artificial intelligence is defined as a computer program that has the ability to represent and reason on knowledge. In fire safety, it is useful to be able to quickly discern the configurations at risk of an installation. The idea behind the expert system approach is to make the most benefit of the SYLVIA software to build a database covering a wide range of configurations, and then to use the expert system reasoning abilities to discern configurations of this database useful to one specific case of interest.

An expert system can be divided into three separated components [START_REF] Jackson | Introduction to expert systems[END_REF], as shown in Fig. 1:

-The knowledge base that contains all the generic information in which the expert system will operate. This information will be encoded by means of conditional probability tables (cf. the green rectangle in Fig. 1). -The observation base that gathers all the contingent or specific information from which inferences can be performed. This information has to be provided by the users in terms of likelihood or probability. -The inference engine, a set of algorithms (the yellow arrows in Fig. 1) that propels the information coming from the observation base through the knowledge base. Contrary to "physical" computer codes that intertwine the numerical data coming from initial and boundary conditions with the solving algorithms, the expert systems algorithms are designed to be independent and separated from the data. The general principle is to update in a real-time process the knowledge related to the variables defined in the expert system. More precisely, the SYLVIA expert system objective is to have a numerical tool able to perform three types of inferences:

1. in a forward chaining, to determine for a configuration of input data, the possible responses;

2. in a backward chaining, to identify for a given configuration of the responses, the compatible input data; 3. in a mixed chaining, an inference that combines the two previous inferences.

The knowledge base

In our case, the generic information is implicitly contained in the computer code. Thus, the first step to develop an expert system is to transcribe numerically the knowledge related to the different physical phenomena modelled by the code.

Since the computation time is short enough to perform many calculations, our approach consists in building a database, which relates to the case studied -such as the pressure effects in a compartment -by performing a stratified Monte-Carlo study by a Latin Hypercube Sampling (LHS) method [START_REF] Helton | Davis Latin Hypercube Sampling and thePropagation of Uncertainty in Analyses of Complex Systems[END_REF]. This Monte Carlo study is carried out by varying the input parameters of the calculation code in the study area under consideration. Thus, if we want the expert system to be able to answer to queries for volume ranges between 100 and 500m 3 , we will model this parameter by a random variable between 100 and 500m 3 in the Monte-Carlo simulation. This way, we can build a large database made of SYLVIA calculations. This database is made up of all the data corresponding both to the parameters and outputs. Then, this database can be interpreted as a numerical transcription of the generic knowledge carried by the SYLVIA code.

In a formal way, the SYLVIA software can be seen as a mapping of the parameters domain to the responses domain (see Fig. 2). This can be written:

Ri = S(P1, … , PN) ( 1
)
where Ri is any response of interest, Pj, the parameters and S, the SYLVIA software acting as a transfer function. The principle followed to establish the SYLVIA knowledge base consists in transcribing the transfer function S into numerical tables (one for each response). In order to carry out this transcription of SYLVIA into numerical tables (see Fig. 3), two simplifications are necessary. The first one consists in discretizing all the continuous variables of the equations (1) as: * = * , … , * (2) where * and * can only take discrete values.

The second simplification [START_REF] Pearl | Causality[END_REF] concerns the identification of influential parameters for each response to limit the combinatorial aspect induced by the numerical transcription of the equation [START_REF] Chojnacki | Description of the IPSN method for the uncertainty and sensitivity analysis and the associated software: SUNSET[END_REF].

Therefore, a preliminary step before making the knowledge base is the identification for each response Ri, of its most ni influential parameters. In the case of the application described in this paper, it has been done with a covariance analysis. Once the most ni influential parameters have been determined and the equations (2) become:

Ri = S(P1, … , Pni ,Ui) ( 3
)
where Ui is a random variable modeling the loss of information induced by the discretization step and by neglecting the less influential variables of the response Ri. It is worth noting that this model is stochastic, since for a given parametric configuration of P1, …, Pni , Ri may have different values.

From these simplifications, each SYLVIA calculation is replaced by a set of discrete values: the levels of the parameters and of the responses. Then, the whole set of SYLVIA simulations is used to calculate the conditional probability of each response knowing the combination of its influential parameters. A practical way to check the effect of information loss due to these simplifications is to analyze the range of the conditional probability distributions. If for a combination of influential parameters, the corresponding conditional distribution is limited to one discrete value that means that the knowledge of the discrete values taken by the influential parameters is enough to determine the response value, so that the information loss has no effect. On the contrary, if the conditional distribution is flat, this means that the combination of influential parameters does not help to determine the response value.

Response R i

Let's take an example to fully understand the meaning of the system of equations (3). Considering the simple case defined by only one response and one parameter, the system of equations (3) is falling down to a unique equation: R = S(P,U). Now, suppose that R is the maximum pressure difference at fire break door and discretized into three levels ("<20hPa", "20-60hPa", ">60hPa") and P the fire power ("<800kW", ">800kW"). The equation (3) corresponds to the set of the two triplets (a1, a2, a3) and (b1, b2, b3) meaning if P is lower than 800kW (resp. >800kW) then R is lower than 20hPa with the probability a1 (resp. b1), between 20 hPa and 60hPa with the probability a2 (resp. b2) and upper than 60hPa with the probability a3 (resp. b3).

The equation ( 3) can now be written in an equivalent matrix form: In the BBN formalism, p1 denotes the belief that P is "<800kW " and p2 the belief that P is ">800kW" so that (1, 0) means P is "<800kW", (0, 1) P is ">800kW", (0.5, 0.5) the belief that P is unknown. The coefficients ai (resp. bi) of the matrix are the conditional probabilities of R = ri knowing P is "<800kW" (resp. P ">800kW"), and a1 + a2 + a3 = b1 + b2 + b3 = 1.

= ( 3
The equation (3') allows the forward propagation mechanism of knowledge (see section 2.3), i.e. the propagation of knowledge on causal factors (here given by p1 and p2 into knowledge on their direct consequence (here given by r1, r2, r3).

By using the theorem of conditional probabilities, the equation (3') can also be used in reverse:

= (3'')
where α is a proportionality coefficient used to normalize the vector (p1, p2)

The equation (3'') allows the backward propagation mechanism of knowledge (see section 2.3), i.e. the propagation of knowledge on consequences into knowledge on their direct causes.

In the general case, to each equation of the system (3) corresponds a matrix M of size n x p where n is the number of parametric configurations and p is the number of levels considered for the response so that mij is the probability of the response R being equal to its j th level when the parametric configuration of the influent parameters is fixed. A convenient way to associate a specific parametric configuration defined by a u-plet (i1, i2, ..., ij) to a line i of the matrix M is to take i = ((…(i1 -1) × n1+ i2 -1) × n2 .... ) × nj + ij.

Following this method, any SYLVIA computation can be schematically represented as in Fig. 2. It becomes then possible to transcribe the generic knowledge defined by the physical models implemented in the SYLVIA computer code in the form of multidimensional numerical charts associating input and output values (e.g. from Monte-Carlo simulations). Moreover, from the set of equations (3), a graph can be defined by joining with an arrow the variables of the right-hand of the equation to the variable of the left-hand. This graph constitutes the directed acyclic graph (DAG)1 of a Bayesian network.

In summary, the SYLVIA knowledge base is made up of two components:

-A graph modeling the structural relationships. The SYLVIA Bayesian network graph is composed of two floors, as shown schematically in Fig. 4. On the first floor are the parameters P1,..., PN, and on the ground floor are the Rk responses. -A set of numerical tables encoding the numerical link between a response and its influential parameters (cf. the determination of the coefficients ai and bi in the example). These tables are called Conditional Probability Tables (CPT). The numerical values of the CPTs are derived from the analysis of the database gathering all the SYLVIA simulations.

Fig. 4. Scheme of the knowledge base associated with the expert system.

The observation base

In the SYLVIA expert system, the variables of the observation base are identical to the variables of the knowledge base. Unlike the knowledge base that encodes the generic information (i.e. the information carried out through the SYLVIA code), the observation base encodes the contingent knowledge for which we wish to solicit the expert system.

In a Bayesian network, each variable receives two kinds of information: an upstream information and a downstream information. This distinction is essential to correctly perform the information propagation in a network. We will come back to this notion in the next section, as for now, it is sufficient to know that upstream information is required for the parameters and downstream information for the responses. This information is given by means of probability or likelihood. For example, if a variable V (associated to either a parameter or a response) is discretized into four levels (very low, low, high, very high) a (2, 1, 1, 0) u-plet is equivalent to the (0.5, 0.25, 0.25, 0) u-plet and means that the very low level is twice likely as the low or high level and the very high level is either impossible or not considered. More generally, the observational data base consists in providing for each parameter Pi and for each response Rj some information that specifies (by means of vectors and the domain in which the expert system will operate. As the purpose of the expert system is to identify the configurations at risk and/or the safety criteria most likely to be exceeded, in most of the practical cases, it is sufficient to use 0 and 1 as values for the observation data: 1 meaning the level is possible and 0 otherwise. In summary, the SYLVIA observation base is made up of two information vectors:

-A vector modeling the upstream information associated to the parameters. -A vector modeling the downstream information associated to the responses.

The inference engine

As shown in the section 2.1, the knowledge base is made up of two parts:

-A structural part corresponding to the set of equations (3).

-A numerical part which is actually given by the conditional probability tables (CPT), thus there are as many CPTs as equations in the system (3).

A Bayesian network is not merely a passive code storing factual knowledge but also a computational architecture reasoning on that knowledge. This means that the links in the network have to be seen as mechanisms that propel information in order to update it. The CPTs attached to the nodes (cf. the left-hand variables of the equations in the system 3) act as individual processors so that the inference engine is the set of processors (as many individual processors as equations in the system 3).

To propagate and update information, the inference engine distinguishes upstream and downstream information. For a parameter Pi, the upstream information is the information provided by the vector defined in the observation base and the downstream information is the vector which will be calculated by the inference engine. In a similar way, for a response Rj, the downstream information is the information provided by the vector defined in the observation base and the upstream information is the vector , which will be calculated by the inference engine.

From this distinction between upstream and downstream information, each individual processor is able to perform three kinds of local computation independently of other things happening in the network:

-A forward propagation mechanism. It consists into gathering all the upstream information coming from the right-hand variables and transforming it into upstream information of the left-hand variable. -A backward propagation mechanism. It consists into gathering all the downstream information coming from the left-hand variables and transforming it into downstream information of the right-hand variables. -An updating mechanism. It consists for a variable X into combining all the downstream information coming from the equations in which X is on the left-hand side with all the upstream information where X is on the right-hand side.

As each processor is connected to another in a Bayesian network, the local information can circulate through the whole network. These propagation mechanisms proposed by J. Pearl [START_REF] Pearl | Probabilistic reasoning in intelligent systems[END_REF] are called the "message passing" algorithms: they act as information propellers from one variable to its neighbors.

In order to understand how the message passing algorithm works, it is useful to consider how it works for a simple case and then to generalize.

The simplest network

Let us consider a network composed of two nodes X and Y connected by an arrow from X to Y. If the node X is discretized in m levels and Y in n levels, the CPT is a matrix M of size m × n. Let's now look at how a Bayesian processor performs its local computations:

-The forward propagation mechanism. In this case, let us call the upstream information of X and ! the upstream information of Y. The upstream information of X is passed through the CPT and becomes upstream information of Y by a vector-matrix multiplication: " ! = " # (where the upper script T is used for transpose). -The backward propagation mechanism. In a similar way, denote ! the downstream information of Y and the downstream information of X. The downstream information of Y is passed through the CPT and becomes the downstream information of X by a matrix-vector multiplication:

= # ! .

-The updating mechanism. The updated information for X (resp. Y) is then given by the normalized product term by term of πx × λx (resp. πY × λY).

The theoretical proofs of all these mechanisms come straight away from the probability calculation.

To illustrate, let us take again our previous example, and look at it in three different ways:

1. No information is available on the fire power (πp1 = 0.5, πp2= 0.5)

The forward mechanism allows the computation of (πr1, πr2, πr3) by using the equation 3' 0.93 0.05 0.02 = 0.5 0.5 0.98 0.02 0 0.88 0.08 0.04 2. The pressure difference (∆P) at fire break door is >60hPa. The backward mechanism allows the computation of (λp1, λp2) by using the equation 3'' 0 1 = 0.98 0.02 0 0.88 0.08 0.04 0 0 1

The updating mechanism applied to:

-The fire power:

0 1 = 0.5 * 0 0.5 * 1 * 0 1
The fire power is > 800kW, the uncertainty on the fire power has been removed due to the observation of ∆P>60hPa.

-The pressure difference at fire break door:

0 0 1 = 0.93 * 0 0.05 * 0 0.02 * 1
Here, we observe that the updating mechanism cannot modify the value of a "hard" evidence (value without uncertainty).

The SYLVIA Bayesian network

To understand how an individual processor performs its local computations for an equation of the type: R = S(P1, … , Pk ,U), let us call the upstream information coming from Pi and the upstream information coming to R. In the same way, λ stands for the downstream information of R and for the downstream information of Pi .

The forward propagation mechanism. If P1, ..., Pk are discretized respectively in m1, ..., mk, the number of parametric configurations is m = m1 × .... × mk and if R is discretized in n levels, the CPT associated to the former equation is a matrix M of size m x n. The forward propagation mechanism is made up of two steps:

-First, all the upstream information provided by the is pooled into a single vector π of size m and each of its components are the product of the components associated to each . By denoting the value of the j th component of the vector and . , the value of the k th component of the vector π, we have the relation:

. = (/ × / × … × 0 / 0 ( 4
)
where k is an index corresponding to the u-plet (i1, i2, …, ik). -Second, the upstream information π is passed through the CPT and becomes the upstream information of R by the vector-matrix multiplication: " ! = " #.

The backward propagation mechanism. The backward propagation mechanism is made up of two steps:

-First, the downstream information provided by the response is transformed into downstream information for the influential parameters by: = #

where is a vector of size m. -Then, is reduced for each parameter Pi to a vector λpi of size mi by weighting and summing out with all the other parameters:

/ =∑ / × / × … × 0 / 0 × . 345 (6)
The updating mechanism. The updated information for any Pi or R is then given by the normalized product term by term of

× or × .
These propagation mechanisms are sufficient if there are no multiple paths joining two variables. However, if there are several paths, some virtual nodes must be added. The virtual nodes consist in adding new processors which task is to separate and distribute properly upstream and downstream information so that the same information cannot be counted twice. The implementation of these nodes is a bit tricky and won't be described here, however full details and proofs can be found in [START_REF] Pearl | Probabilistic reasoning in intelligent systems[END_REF].

To sum up, the inference engine is a set of processors able to perform information propagation at a local level.

The inference engine makes it possible to dynamically use the knowledge base derived from a very large number of SYLVIA simulations. The (upstream and downstream) information relevant to the current safety assessment is automatically propelled through the knowledge, so that the likelihood of each variable of the Bayesian network is updated.

Building of the knowledge base

The knowledge base collects all the generic information from which the expert system will perform inferences. It determines the application domain of the expert system. Thus, a first step consists in delimiting the general framework of the study and in defining the parameters and responses of the study and their variation ranges. In a second step, the SYLVIA database is built and the conditional probability tables are computed.

Delimitation of the general framework

The perimeter of the knowledge base is delimited by the general framework of the study. In this work, our expert system is applied to the study of the pressure effects on fire barriers resulting from a fire in a confined and mechanically ventilated environment.

To prevent a fire spread, nuclear facilities are divided into fire sectors so as to confine a potential fire departure in its initial zone. Fire barrier elements, such as fire break-door, fire dumpers, are then located at the edge of the fire sectors. Nevertheless, the possible consequences of the pressure effects on fire barriers resulting from a fire are:

-A mechanical effect that can lead to the severe damage or even the breakdown of the fire barrier elements. The underlying problematic is the fire spread to other fire sectors.

-An aeraulic effect with the smoke and other pollutants transfer. Here, there are two underlying problematics, the malfunction of electrical equipment due to the combined effect of gas temperature and soot concentration, as well as the intervention of the fire brigade due to the vitiation of the atmosphere.

To lead a safety assessment, we must be able to identify the fire volumes for which overpressures generated by a fire would likely undermine the safety sectorization, either by mechanical breakdown of the fire barrier elements or by smoke transfer.

The general framework of the study is shown in Fig. 5. It consists in two fire sectors, represented by two compartments, connected by a fire break-door. Compartments height is set to 4 m, whatever the volume. Each compartment is equipped with fire dampers at the inlet and exhaust air vents. An independent management of the mechanical ventilation is assumed for each fire sector. In order to cover all kinetics of the fire in the study, the fire source is modeled by a design fire, characterized by its maximum heat release rate in open atmosphere and by its fire growth factor. The fire source is centered in compartment 1, at the level of the floor. In nominal conditions, the fire break-door is closed and no pressure difference between the two fire sectors is considered (-20 Pa relative to the atmospheric pressure is set in each compartment).

Parameters and responses of the study

According to the issue addressed in this study, the responses are of two types: responses related to mechanical effect (maximum pressure in each compartment and maximum pressure difference at fire break door) and responses related to aeraulic effect (maximum gas temperature and maximum soot concentration in each compartment). A total of seven responses have been retained. The discretization of the responses is reported in Table 1. The pressure discretization integrates threshold values of fire break-door rupture from IRSN experiments [START_REF] Bouilloux | Characterization of the behaviour of containment equipment under mechanical and thermal stresses in STARMANIA facility[END_REF] and the ones for gas temperature and soot concentration integrate threshold values of malfunction of electrical equipment tested at IRSN [START_REF] Piller | Effect of smoke and thermal stress on electrical equipment failure, 15 th International[END_REF]. Classes of response constitute the columns of the conditional probability tables.

Table 1

Discretization of the responses of the study.

Response Discretization

Maximum pressure difference at fire break door, ∆PFBD Sixteen parameters have been identified as influencing the responses of the study. They are split into four categories, as reported in Table 2. Also specified in this table is the discretization of theses variables. [6000 -9000]

Parameters related to oxygen available for combustion

Volumes of fire sectors. The amount of oxygen initially available for the fire source is an important parameter of the study. This parameter is directly related to the compartment size. Thus, volumes of the fire sectors range from 100 to 7000 m 3 . Moreover, these volumes are representative of the fire sector volumes of the French nuclear power plants. In addition, the "stable external environment" configuration is also studied, which consists in including the modality "infinite volume" in the random draw of the compartment-2 volume.

Closing time of the fire dampers. A conventional closing of the fire dampers at 2 minutes and 30 seconds is considered in the study, corresponding to a servo control of the fire dampers to the automatic fire detection. Nevertheless, in operational French nuclear power plants, the majority of the fire dampers in electrical buildings are not enslaved to the automatic fire detection, but are closed by thermal fuse melting at 70 °C or by action of the shift personal on the local synoptic. In order to consider the case of an aleatory failure of the closing of fire dampers, longer or even infinite closing times are also considered. In addition, the configuration with the closing of fire dampers at the beginning of the fire is also considered. Thus, four closing times of fire dampers are retained: 0 min, 2 min 30 s, 20 min and infinite time. It is assumed a simultaneously closing of fire dampers at inlet and exhaust lines of the compartment.

Air renewal rate of fire sectors. IRSN's onsite measurements revealed significant air renewal rates, up to 40 h -1 . Based on these measurements, the variation range of air renewal rate of compartments ranges from 1 to 40 h -1 in the study. For the "stable external environment" configuration, the air renewal rate of compartment 2 is zero.

Leak rate of fire sectors. A fire sector may have one or more fire break-doors, opening on the outside of this sector. Leaks associated with these potential doors are considered in the study. All the leaks of the compartment, except the one of the fire break-door of the study, are modeled by an equivalent leak connected to a boundary condition node at atmospheric pressure (see Fig. 6). Thus, a pressure variation of the compartment induces a gas flow through the equivalent leak, according to the following law based on NF EN 12207 standard [9]:

∆ = 6 ρ / 8 6 / ( 7
)
where Rl is the aeraulic resistance of the leak, ρ, the gas density, and Ql, the volume flow rate of the gas through the leak.

The aeraulic resistance, Rl, is calculated from the nominal conditions in the compartment and from a leak rate that constitutes a parameter of the study. It is assumed that the leak rate ranges from 0 to 1 vol h -1 .

Free volume of fire sectors. The presence of equipments in a room results mainly in a decrease of the gas volume of the room (free volume). If they are not in contact with the walls, they don't reduce the heat exchange surfaces between gas and walls. In addition, mass of materials also acts as a heat sink. The formal consideration of heat sinks requires knowledge of the physical properties of materials, their exchange surface with the surrounding gas as well as their elevation in the compartment. Since these data are too difficult to parameterize, heat sinks are simply modeled by an exchange surface, consisting of a 2 mm thick steel plate whose height is fixed to the compartment height so as to take into account heat sink over the entire height of the compartment. The total volume of materials is assumed to be cubic. In this case, the relation between the exchange surface with the surrounding gas and the volume of equipment is given by:

9 = 6[ 1 -φ =] / ( 8
)
where φ is the free volume of the compartment and V the physical volume of the compartment.

The compartment free volume is a parameter of the study. Free volumes of fire sectors of the French nuclear power plants usually range from 0 to 20%.

Parameter related to the ventilation network

Resistivity of the ventilation network. The aeraulic resistivity of the ventilation network and the air renewal rate of compartments are coupled due to the permissible power of fans. In order to avoid the exclusion of scenarios related to the decoupling of these two parameters, such as scenarios involving a high air renewal rate with a high resistivity of the ventilation network, the differential pressure between the upstream node of the inlet dilution line of the ventilation network (cf. node D4 in Fig. 7) and the node of the compartment fire is taken as a parameter of the study. The resistivity of the ventilation network is then calculated from the differential pressure between these two nodes and the air renewal rate of compartment 1, by using the following relation:

∆ = ρ8 (9)
where R is the quadratic resistance of the ventilation network and Q the air volume flow rate at the inlet of the compartment.

The same approach is used for the calculation of the resistivity of the ventilation network related to compartment 2. The maximum value of the differential pressure between the upstream nodes of the dilution lines and the two compartments is set to 10 hPa, based on values from IRSN experiments performed in the DIVA facility. Thus, the differential pressure for the calculation of the resistivity of the ventilation network ranges from 1 to 10 hPa.

Parameters related to the fire source

Fire growth factor. This is one of the two parameters characterizing a "design fire". In order to classify fire sources according to their fire growth kinetics, fire sources are characterized by their fire growth factor or by their fire growth characteristic time, i.e. the time required to reach a fire power of 1055 kW [START_REF] Quintiere | Principles of fire behavior[END_REF]. It is assumed that fire growth follows a t 2 law as:

? = @AA B C D E = E ( 10
)
where α is the fire growth factor, t1, the fire growth characteristic time, HRR, the heat release rate in open atmosphere and t, the time.

As the type of the fire source is a priori not known, the fire growth factor is a parameter of the study. This one encompasses values of α for different growth rates according to NFPA 92B [START_REF]NFPA 92B: Standard for Smoke Management Systems in Malls, Atria, and Large Spaces[END_REF]. Thus, the discrete values of the fire growth factor which are considered in the study are: 2 10 -4 kW.s -2 (ultra-slow kinetics), 3 10 -3 kW.s -2 (slow), 0.012 kW.s -2 (medium), 0.047 kW.s -2 (fast) and 0.19 kW.s -2 (ultra-fast).

Maximum heat release rate in open atmosphere. This is the second parameter characterizing a "design fire". The study considers 200 kW as the lowest value of this parameter, in order to have comparison points with certain scenarios retained by operators. The highest value is set to 5000 kW, given the range of variation of compartment volumes of the study (7000 m 3 for the largest one). Thus, the maximum heat release rate in open atmosphere ranges from 200 to 5000 kW.

Oxygen-limiting law and fire extinction criterion. An oxygen-limiting law is applied to the fire heat release rate in open atmosphere (cf. Eq. ( 10)), which takes into account the oxygen depletion in the fire compartment due to the confinement of the fire source. In addition, a fire extinction criterion by lack of oxygen is also considered in the study. The oxygen threshold below which the fire extinguishes (fire source type dependent) is a parameter of the study. In order to make comparisons between "realistic" and "envelope" scenarios adopted by IRSN in its fire probabilistic safety analyzes, four sets of parameters for the oxygen limiting law and fire extinction criterion are considered in the study:

-Parameter set 1: no oxygen limitation ("envelope scenario") and fire extinction at 0 v/v % of oxygen. -Parameter set 2: no oxygen limitation and fire extinction at 8 v/v % of oxygen.

-Parameter set 3: no oxygen limitation and fire extinction at 12 v/v % of oxygen.

-Parameter set 4: Peatross & Beyler law ("realistic scenario") and fire extinction at 12 v/v % of oxygen.

The Peatross & Beyler law [START_REF] Peatross | Ventilation effect on compartment fire characterization[END_REF] is a linear regression as a function of oxygen volume fraction available for combustion close to the fuel:

χ= 0.1X -1.1 ( 11
)
where χ is the correction factor to be applied to HRR in open atmosphere and X the oxygen volume fraction close to the fuel.

In SYLVIA software, the flame is supplied by oxygen available in the zone where the flame is located. In the case where the interface height is in the flame area, this oxygen volume fraction is calculated from the oxygen volume fractions of the two zones, by a weighting ratio of the flame lengths crossing the lower and upper zones.

Yield of soot. Soot being involved in the malfunction of electrical equipment, the yield of soot (ratio of the produced mass of soot to the pyrolysed mass of fuel) is a parameter of the study. On the basis of the yield from the combustion of polyvinyl chloride, close to 18 kg/kg %, the yield of soot ranges from 0 to 20 kg/kg % in the study. In addition, the production of soot influencing the radiative fraction of the fire power, a linear variation of this fraction as a function of yield of soot is assumed here, from 0.2 in absence of soot up to 0.4 for a yield of soot of 20 kg/kg %.

Parameter related to fire barrier elements

Fire break-door resistance. The aeraulic resistance of the fire break-door is assumed to be independent of the differential pressure exerted on the door (case of the BAUMERT firebreak door tested in the STARMANIA facility in a hot gas flow [START_REF] Bouilloux | Characterization of the behaviour of containment equipment under mechanical and thermal stresses in STARMANIA facility[END_REF]). Characteristic values of fire break-door resistance encountered in nuclear power plants and in tests carried out by IRSN in the STARMANIA facility are used in the study. Thus, the quadratic resistance of the fire break-door ranges from 1000 to 9000 m -4 . The aeraulic resistance of fire dampers is not a parameter of the study since the most sensitive fire barrier elements to pressure effects are fire break-doors. A value of 3.2 10 6 m -4 is set for the resistance of this element in the study, based on fire dampers tested in the STARMANIA program [START_REF] Bouilloux | Characterization of the behaviour of containment equipment under mechanical and thermal stresses in STARMANIA facility[END_REF].

3.3

The SYLVIA database

The two-zone model SYLVIA

The SYLVIA software [START_REF] Plumecocq | Numerical method for determining water droplets size distributions of spray nozzles using a two-zone model[END_REF] was developed at IRSN. This software is designed to predict the behaviors of mechanical/natural ventilation, fire growth, hot gas and smoke propagation, and airborne contamination transfer in confined and mechanically ventilated enclosures. Indeed, it is a simulation tool for calculating the consequences of multi-compartment fires in nuclear facilities, which are equipped with a full ventilation network (including ducts, room leaks, fire dampers, fans, horizontal/vertical openings, filters, etc.). The fire design of the SYLVIA software belongs to the well-known two-zone fire modeling [START_REF] Quintiere | Fundamental of Fire Phenomena[END_REF]. In such software, each compartment is described with two Lagrangian control volumes separated by a thermal interface (see Fig. 6). Mass and energy balances are performed in each zone: the lower zone simulating the fresh gas and the upper zone simulating the combustion products and the gas entrained by the plume. In a two-zone approach, a plume feeds the upper zone of the fire room, whose volume increases, which has the effect of lowering the interface and leading to the under-oxygenation of the fire source if the gas flow in the exhaust duct or at the level of openings of the fire room is not sufficient to remove all gases supplied by the plume. The features of ambient atmosphere (pressure, temperature, mass fraction of species) in each control volume are assumed to be uniform at a given time. These control volumes can be connected by various ventilation components representing either natural or mechanical ventilation. The convective/conductive/radiative heat transfers inside the compartments and in the ventilation network (walls, gas phase) are fully modelled and play a major role for predicting temperature and pressure, especially in rooms and ventilation ducts near the fire. The fire itself is described by correlations (plume, flame height, etc.) available in the literature [START_REF] Quintiere | Fundamental of Fire Phenomena[END_REF].

Fig. 6. Two-zone approach of fire compartments.

The design of ventilation network is based on the node-and-branch method [START_REF] Nishio | Development of the FACE computer code to evaluate the safety of an air ventilation system during a postulated solvent fire in a nuclear fuel reprocessing plant[END_REF]. A node is a point (no volume) or a simple zone (with a fixed volume) in the ventilation network, where the different physical quantities (pressure, temperature, particle and gaseous species mass fractions, etc.) are considered uniform. A point can be considered as a simple junction between two or more ducts, or linked with an exterior environment (boundary condition node).

A zone, which leads to inertial effects under transient conditions due the fixed volume, may involve a node between two branches. A branch represents a passive element of the network (for instance, pipe, filter, fire damper, leak, etc.) or an active element (for instance, fan, motor-driven valve, etc.). A mass flow rate is assumed to be uniform in 0D branches and is a function of the pressure difference at its boundaries (nodes).

The SYLVIA modeling of the ventilation network of the study is reported in Fig. 7.

The size of the database

To study a set of configurations, the SYLVIA software is coupled to the SUNSET software, an IRSN statistical tool used in support of risk analysis studies. This coupling directly allows Monte Carlo simulations. For this, a set of variables, known as study parameters, is modeled by random variables. Thus, each study parameter is associated with a variation domain and a distribution function (a uniform distribution function is assumed in the study). For each study parameter, a value is randomly drawn in its range of variation (or imposed as for the closing time of fire dampers), creating a set of values for the parameters characterizing the SYLVIA calculation to be performed. By performing this simulation, one obtains the values of the responses associated with this parametric configuration. The Monte Carlo method consists in reiterating this procedure a large number of times. The storage of the values taken by the study parameters and by the responses for all the runs constitutes the SYLVIA database. The Monte Carlo simulation provides a means of exploring the whole variation range of the study parameters and to know the impact of these variations on responses of interest. The size of the database depends on the number of influential parameters and on the level of discretization of these parameters. The minimum number of SYLVIA calculations to be performed is given by the product of the highest value of the number of classes of individuals among the responses by a number of runs to have a sufficient statistics for each combination of classes. For a given response, the number of classes of individuals is the sum of all the class combinations of its influential parameters and corresponds to the number of rows of the conditional probability table associated with this response. The identification of the influential parameters of a response is based on its correlations with the parameters determined from the Monte-Carlo simulation. It was obtained from the results of a Monte-Carlo simulation performed on a sampling of 10,000 runs, by a covariance calculation. The results are reported in Table 3. In this table, it can be seen that the free volume of the two compartments, the air renewal rate of compartment 2 and the resistivity of the ventilation network are the least influential parameters with respect to the responses of the study and with respect to their range of variation. As a consequence, they will not explicitly appear in the knowledge base. Nevertheless, the variability induced by the less influential parameters is taken into account in the conditional probability tables.

The number of classes of individuals for each response of the study is reported in Table 4.

The maximum value (92,160) is obtained for the response "pressure difference at fire breakdoor". According to this value, and in order to have a sufficient statistics for each combination of classes, 1,600,000 runs with SYLVIA software were performed. For information, this number of runs required 9 full days of CPU-time distributed on 60 cores. 100% of successful runs were obtained.

Computation of the conditional probability tables

As seen previously, the computation of the conditional probability tables of each response Ri requires the discretization of both the influential parameters and the response. From this dis-cretization, the formal model of SYLVIA is transcribed into a structural model. More precisely, for each response, the Monte-Carlo simulations are reordered according to the configurations defined by its influential parameters, and then for each configuration the values of the conditional probability tables are given by the empirical distribution.

For example, let us consider the response "maximum pressure in the fire compartment". For this response, seven influential parameters are determined (see Table 3) and according to their discretization, the total number of its parametric configurations is: 3 × 4 × 4 × 5 × 4 × 4 × 4 = 15,360 and therefore the conditional probability table for this response has 15360 rows and 4 columns. The first row of this table is obtained by extracting among the database all the calculations that have, for the seven influential variables, their respective values in their minimal class. In the database, there were 105 SYLVIA runs for this parametric configuration, with the following distribution: 72 (< 20 hPa), 23 (20 -40 hPa), 10 (40 -60 hPa) and 0 (> 60 hPa). Thus, the first row of the conditional probability table is: 0.69 (< 20 hPa), 0.22 (20 -40 hPa), 0.09 (40 -60 hPa) and 0 (> 60 hPa). By repeating this procedure for each one of the 15,360 parametric configurations, one obtains the conditional probability table associated to the response "maximum pressure in the fire compartment". By proceeding in the same way for each response, it is obtained seven conditional probability tables that are the numerical transcription of the SYLVIA model into a structural model.

Application of the expert system

The graph of the knowledge base

The expert system is used from EXCEL. The graphical user interface is composed of 9 sheets: a main sheet, the graph of the knowledge base, as shown in Fig. 8, that gathers data entered for the analysis and the associated results; one sheet to visualize a priori and a posteriori likelihoods in the form of histograms; and seven sheets that group, for each of the seven responses of interest, the conditional probability tables resulting from the Monte-Carlo simulation. The graph of the knowledge base is divided into three zones: at the top, the twelve influential parameters of the study on which the expert system can make inferences; at the bottom, the seven responses of interest on which the expert system can also make inferences; and in the center, an image that, when clicked, launches a dialog box providing three modes of operation (queries on mechanical effects of the pressure, on aeraulic effects or queries combining both effects). To each influential parameter and each response of interest reported on the graph of the knowledge base are associated three columns. The first column corresponds to the discretization of the variable, the second column to the a priori likelihoods taken by the variable (data entered in binary mode: 1 to consider in the query the corresponding class, 0 in the other case) and the third column to the a posteriori likelihoods of the variable (results of the query). Depending on the choice of the operation mode, the time required for a query ranges from 5 s for a query on the mechanical effect of the pressure up to 30 s for a query on the mechanical and aeraulic effects.

Application

To illustrate the potential interest of an expert system as an aid tool for safety assessment, we consider the following issue: how to identify the configurations that could lead to a pressure difference at fire break door beyond 60 hPa (∆PFBD > 60 hPa) in the specific case of a medium kinetics fire growth in a compartment with leaks? This pressure difference threshold corresponds to the breaking point of a BAUMERT fire break door (63.5 hPa) tested in the STARMANIA facility [START_REF] Bouilloux | Characterization of the behaviour of containment equipment under mechanical and thermal stresses in STARMANIA facility[END_REF] and used in the French nuclear power plants.

First, if the expert system is used as a prognostic tool or in a forward chaining (see Fig. 8), only the knowledge relative to the parameters can be used. In this case, the result of the expert system is rather like a direct exploitation of the database. There are 239,967 runs out of the 1,600,000 computations in the database that meet this parametric configuration and their distribution is 238,170 < 20 hPa, 1602 [20 -40 hPa], 163 [40 -60 hPa] and 32 > 60 hPa, or respectively 99.25%, 0.66%, 0.07% and 0.01%. To fully answer the question -what are the configurations that could lead to ∆PFBD > 60 hPa in the specific case of a medium kinetics fire growth in a compartment with leaks? -it seems necessary to combine the forward and the backward chaining (see Fig. 10). The crossing of the upstream information (a medium kinetics fire growth in a compartment with leaks) and downstream information (∆PFBD > 60 hPa) indicates that fire compartment volumes must be in the range [500 -3000 m 3 ], that the maximum heat release rate of the fire source in open atmosphere must be greater than 1500 kW, with 92.49% of cases in the range [3000 -5000 kW], that the air renewal rate of the fire compartment must be high, in the range [20 -40 vol. h -1 ] and that 100% of cases are obtained for a late closing time of the fire dampers of the fire compartment, at 20 minutes, corresponding to a manual closing by the shift personal. Thus, the expert system informs us that, in the event of a malfunction of the automatic detection of the fire, a manual closing of the fire dampers by the shift personal at 20 minutes is not desirable in this configuration and could lead to a loss of the sectorization of this fire sector. To model equipment damage, such as the break of a fire break-door at the achievement of the rupture criterion, it would require to model the state of the equipment by another node (e.g. damaged or not damaged) and add a conditional probability table modelling the damage mechanism between the physical quantities and the equipment state. No damage mechanisms are integrated into this expert system. However, their integration would be immediate in case the damage mechanism does not depend on physical quantities, not modelled in the expert system.

Conclusion

In fire safety assessment, it is essential to be able to quickly discern configurations at risk in a nuclear facility. For that purpose, an expert system approach was undertaken to take advantage of the SYLVIA software. The proposed methodology is made up of two steps: the building of a knowledge database covering a wide range of configurations, then, the implementation of an inference mechanism corresponding to the reasoning abilities of the expert system. The developed expert system is based on Bayesian networks and can be used to discern configurations of this database useful to one specific case of interest. The expert system was conceived to study the pressure effects on fire barriers in the case of fire in nuclear facilities. The large knowledge database includes the results of 1,600,000 runs of the SYLVIA software. The values used for the parameters of the study in every SYLVIA calculation were obtained by coupling SYLVIA with SUNSET (IRSN statistical software) and performing Monte-Carlo calculations.

The first results confirm the interest of the expert system approach in order to dynamically use large databases as part of a fire safety analysis. As illustrated in the previous section, the expert system can help the identification of configurations increasing the risk for a particular scenario from the exploitation of a large data base of SYLVIA runs. Moreover, the computing time being negligible, this kind of tools can be highly profitable for training. This new software can be considered as a complementary tool of SYLVIA software allowing an analyst to quickly target the configurations of interest in a specific safety assessment. The perimeter of the knowledge database, which determines the scope of the expert system, is determined by the general framework of the study. If the framework were to change, it would then be necessary to integrate the new generic knowledge (enrichment of the knowledge base). For any other safety assessment needs, the database, the identification of the responses of interest and their influential parameters, as well as the characterization of the conditional probability tables are likely to be different. However, the general framework is generic. Thus, for new issues coming from some fire safety analysis, another study done with SYLVIA / SUNSET software may be necessary, enriching the knowledge base. The algorithmic part (the inference engine), is, in principle, unchanged, but may however need to be adapted in order to take into account the characteristics specific to the new question of interest in terms of parameters and responses.

To our opinion, the development of expert systems represents a new generation of computational tools in the field of probabilistic fire simulation.

Fig. 1 .

 1 Fig. 1. Flow chart of the expert system.

Fig. 2 .

 2 Fig. 2. The formal model of SYLVIA.

Fig. 3 .

 3 Fig. 3. The structural model of SYLVIA.

Fig. 5 .

 5 Fig. 5. Scheme of the general framework of the study.

<

  20 [20 -40] [40 -60] > 60 Maximum pressure in each compartment, Pmax,C1 and Pmax,C2 (hPa) < 20 [20 -40] [40 -60] > 60 Maximum gas temperature in each compartment, Tmax,C1 and Tmax,C2 (°C) < 65 [65 -100] [100 -140] [140 -180] [180 -210] [210 -300] [300 -350] [350 -400] [400 -500] > 500 Maximum soot concentration in each compartment, Ymax,C1 and Ymax,C2 (g m -3 ) < 1 [1 -2] [2 -3] [3 -5] [5 -10] > 10

[0 - 2 ]

 2 [2 -5] [5 -10] [10 -15] [15 -20] Aeraulic resistance of the fire break-door, RFBD (m -4 ) [1000 -3000] [3000 -6000]

Fig. 7 .

 7 Fig. 7. SYLVIA modeling of the ventilation network of the study. Arrows indicate the nominal direction of the gas flow.

Fig. 8 .Fig. 9 .

 89 Fig. 8. Example of inference in a forward chaining (zoom of the Graphical User Interface of the expert system to the area of interest).

Fig. 10 .

 10 Fig. 10. Example of inference in a mixed chaining (zoom of the Graphical User Interface of the expert system to the area of interest).

Table 2

 2 Discretization of the parameters of the study, {discrete values}, [continuous values].

	Parameter	Discretization
	Volume of compartments, V C1 and V C2	[100 -300] [300 -500] [500 -700]
	(m 3 )	[700 -1000] [1000 -3000] [3000 -7000]
		{∞}
	Closing time of fire dampers, tFD C1 and	{0 ; 150 ; 1200 ; ∞}
	tFD C2 (s)
	Free volume of compartments, φ C1 and φ C2 (%)	[80 -90] [90 -100]
	Leak rate of compartments, τl C1 and τl	{0} [0.1 -0.4] [0.4 -0.7] [0.7 -1]
	C2 (vol. h -1 )
	Air renewal rate of compartments, Rr C1	[1 -5] [5 -10] [10 -20] [20 -40]
	and Rr C2 (vol. h -1 )
	Aeraulic resistivity of the ventilation	[1 -4] [4 -7] [7 -10]
	network through a pressure difference,
	∆Pvn (hPa)
	Fire growth factor, α (kW s -2 )	{2 10 -4 ; 3 10 -3 ; 0.012 ; 0.047 ; 0.19}
	Maximum heat release rate in open at-	[200 -800] [800 -1500] [1500 -3000]
	mosphere, HRRmax (kW)	[3000 -5000]
	Oxygen-limiting law and fire extinction	{no limit ; 0} {no limit ; 8}
	criterion, O2 law (-; v/v % of oxygen)	{no limit ; 12} {Peatross ; 12}
	Yield of soot, yS (kg/kg %)

Table 3

 3 Correlations (in percent) of the responses with respect to the parameters (influential parameters are highlighted in grey).

		P max C1 P max C2 ∆P max FBD T max C1 T max C2 Y max C1 Y max C2
	V C1	-3	0	-4	-52	-14	-13	4
	V C2	-3	-8	2	0	-20	0	-12
	Rr C1	4	2	4	3	1	-6	-2
	Rr C2	0	-1	1	0	-3	0	-3
	RFBD	7	0	10	0	-3	0	-1
	tFD C1	-18	-9	-17	11	-10	-29	-7
	tFD C2	-5	-10	3	0	-1	0	-5
	α	17	4	21	12	5	-1	-1
	HRRmax	20	9	21	55	28	5	11
	∆Pvn	2	1	1	0	2	0	1
	φ C1	2	1	2	3	3	-1	1
	φ C2	0	0	0	0	-1	0	-1
	τl C1	-34	-19	-32	0	-25	1	-18
	τl C2	-7	-18	4	0	9	0	7
	O 2 law	-4	-3	-3	-25	-13	-22	-15
	yS	-2	-1	-2	-4	-1	78	22

Table 4

 4 Number of classes of individuals according to responses.

		P max C1 P max C2 ∆P max FBD T max C1 T max C2 Y max C1 Y max C2
	Number of classes	15,360 35,840 92,160	9,600	43,010 7,680	35,840
	of individuals

Directed means that nodes are connected by arrows, and acyclic means that it is impossible starting from a node to come back to it by following the arrows.