L Podofillini

V N Dang

E Zio

P Baraldi

M Librizzi

USING EXPERT MODELS IN HUMAN RELIABILITY ANALYSIS -A DEPENDENCE ASSESSMENT METHOD BASED ON FUZZY LOGIC

Keywords: hum an reliability analysis, hum an action d epend ence, expert jud gm ent, fuzzy expert system, expert elicitation

In H um an Reliability Analysis (H RA), d ependence analysis refers to assessing the influence of the failure of the operators to perform one task on the failure probabilities of subsequent tasks. A com m only used approach is the Technique for H um an Error Rate Pred iction (TH ERP). The assessm ent of the depend ence level in TH ERP is a highly subjective jud gm ent based on general rules for the influen ce of five main factors. A frequently used alternative m ethod extend s the TH ERP m od el w ith decision trees.

Such trees should increase the repeatability of the assessm ents but they sim plify the relationships am ong the factors and the d epend ence level. Moreo ver, the basis for these sim plifications and the resulting tree is d ifficult to trace. The aim of this w ork is a m ethod for d epend ence assessm ent in H RA that captures the rules used by experts to assess d epend ence levels and incorporates this know led ge int o an algorithm and softw are tool to be used by H RA analysts. A Fuzzy Expert System (FES) und erlies the m ethod . The m ethod and the associated expert elicitation process are dem onstrated w ith a w orking m od el. The expert rules are elicited system atically and converted into a traceable, explicit, and com putable m od el. Anchor situations are provid ed as guid ance for the H RA analyst's jud gm ent of the input factors. The expert m od el and the FESbased d epend ence assessm ent m ethod make the expert rules accessible to the analyst in a usable and repeatable m eans, w ith an explicit and traceable basis.

Introduction

Expert jud gm ent is required in m any areas of risk analysis, w here the relevant factors and their relationships are com plex and the d ata are insufficient as a basis for either a statistical estim ate or for constructing an em pirical m od el w ith w hich estim ates m ay be obtained . Tw o w ays of using expert jud gm ent can be distinguished . The first w ay relates to collecting and aggregating the jud gm ent of experts on the variables of interest, e.g. a failure probability or a seism ic hazard curve (e.g. [START_REF] Cooke | Experts in uncertainty[END_REF]. Form al approaches for this exist, w hich are very useful to bring out the assum ptions and reasoning und erlying the jud gm ents and to d ocum ent them so that they can be appraised by others [START_REF] Cooke | Experts in uncertainty[END_REF]O'H agan et al., 2006). H ow ever, som e d isad vantages are the cost and tim e they require and the potential presence of biases in the expert estim ates (for a com plete d iscussion see: Otw ay & von Winterfeld t, 1992). A second w ay of using expert judgm ent is based on collecting inform ation from experts to build a com putable m od el (called the expert m od el) w ith w hich the d esired value m ay be obtained . Exam ples includ e the com puterized diagnostic aid s used in nuclear p ow er plants, e.g. [START_REF] Chang | Development of the Online Operator Aid System Oasys Using a Rule-Based Expert-System and Fuzzy-Logic for Nuclear-Power-Plants[END_REF], and clinical d ecision support system s used in med icine, e.g. Kaw am oto et al. (2005).

The w ork reported here ad d resses an application of expert jud gm ent in H RA, the part of PSAs that d eals w ith hum an perform ance and its im pact on risk. In H RA, d epend ence analysis refers to assessing the influence of the failure of the operators to perform one task on the failure probabilities of subsequent tasks [START_REF] Swain | Handbook of human reliability analysis with emphasis on nuclear power plant applications[END_REF]. In qualitative term s, a d epend ence is said to exist betw een tw o tasks, that is tw o H um an Failure Events (H FEs) if the failure of the second H FE is m ore likely given that the operators have failed in their perform ance of the first H FE than follow ing success of the first H FE.

The assessm ent of d epend ence has a significant im pact on the overall results of a PSA, since the d epend ent failure probability m ay be an ord er of m agnitud e or m ore larger than the ind epend ent one. An appropriate assessm ent of d epend ence is thus essential to avoid und erestim ation of the risk and to ensure a realistic risk profile from the PSA results. In id entifying the H FEs for w hich d epend ence should be consid ered , i.e. the scenarios in w hich m ultiple H FEs appear, a com m on practice is to use large screening probabilities for the H FEs. If the probabilities estim ated w ithout accounting for d epend ence are used , the relevant sequences (w ith m ultiple H FEs) m ay be truncated.

A quantification of the scenarios w ithout consid eration of d epend encies m ay m iss cand idates for potential d epend encies (N UREG-1792(N UREG- , 2005)).

The d evelopm ent of an expert m od el for H RA d epend ence assessm ent and an assessm ent m ethod based on this m od el is aim ed at increasing the repeatability of these assessm ents. The expert m od el can system atically and transparently represent the assum ptions and rules und erlying the assessm ent ; at the sam e tim e, it can represent relatively complex assessm ent rules that account for the interactions am ong the input factors. The attractiveness of a m ethod based on an expert mod el is that it m akes the expert know led ge and rules accessible to an H RA analyst. Since d epend ence assessm ents are need ed w ithin each H RA (each PSA stud y), such a m ethod can circum vent the need to convene an expert or experts in a form al elicitation for each stud y. This w ork focuses on depend encies am ong post-initiator H FEs. In current PSAs, the d epend ence m od el from the Technique for H um an Error Rate Prediction (TH ERP) H RA m ethod [START_REF] Swain | Handbook of human reliability analysis with emphasis on nuclear power plant applications[END_REF]) is com m only used . It has tw o parts: a qualitative assessm ent of a d epend ence level, ranging in d iscrete steps from zero (independ ent tasks or actions) to com plete d epend ence, and the quantification of the im pact of the assessed d epend ence level on the cond itional probability of the subsequent task based on a set of form ulas. The TH ERP m od el refers to five m ain factors: spatial relatedness, tim e relationship , functional relatedness, stress, and the sim ilarities am ong the personnel perform ing the tasks. While the TH ERP d epend ence m od el provid es general guid elines for the influence of these factors on the d epend ence level (cf. Table 10-1 in Sw ain & Guttm an, 1983), the assignm ent of the level is essentially a direct expert jud gm ent, a highly subjective process that can be w eak in term s of transparency and repeatibility. The ASME Standard for Probabilistic Risk Assessm ent notes that -the state of the art in H RA is such that the assessm ent of d epend ency is largely based on the analyst's jud gem ent.‖ (N ote (1) to H R-G7, ASME,

2005).

To ad d ress these issues and red uce the subjectivity inherent in jud ging the d epend ence level d irectly, the assignm ent of the d epend ence level is frequently supported w ith d ecision trees (DTs), for instance, in the SPAR-H [START_REF] Gertman | The SPAR-H Human Reliability Analysis Method[END_REF] method , in the EPRI H RA -calculator‖ [START_REF] Grobbelaar | Analysis of Dependent Human Failure Events Using the EPRI HRA Calculator[END_REF], as w ell as in the recently presented m ethod DEPEN D-H RA [START_REF] Cepin | Development of a method for consideration of dependence between human failure events[END_REF](Cepin, , 2008a[START_REF] Cepin | Importance of human contribution within the human reliability analysis (IJS-HRA)[END_REF]. H ow ever, the d ecision tree representation frequently very m uch sim plifies the relationships am ong the input factors and the d epend ence level. In add ition, the basis for the d ecision tree is d ifficult to trace. It should be noted that although the m entioned m ethod s have been specifically d eveloped for nuclear pow er plants applications, hum an failure d epend ence assessm ent is an im portant part of the H RA for any technical system (Kenned y et al., 2007).

Current practice has a num ber of w eaknesses. The absence of specific guid ance m akes the use of the TH ERP d epend ence method d ifficult and the results m ay lack traceability and repeatability. This also m akes the review of the assessm ent by a second person d ifficult (e.g. in peer or regulatory review s). The use of DTs im proves the situation: the analyst has to give jud gm ents on the input factors, but is not required to d raw conclusions on the d epend ence level, w hich the DT yield s. The central id ea is that the input factors should be less subjective quantities than the d epend ence level (optim ally, they should be -m easurable‖). Yet, DTs are not flexible in the sense that the analyst jud gm ents are typically constrained to rigid options, w hich refer to extrem e situations (Yes/ N o, H igh/ Low ). Moving aw ay from binary options also increases the num ber of branches and the com binations of factors to evaluate. Moreover, d ifferent im plem entations of DTs exist, w hich m ay prod uce significantly d ifferent results [START_REF] Cepin | Comparison of methods for dependency determination between human failure events within human reliability analysis[END_REF]: since DTs are often not built from a traceable process of expert elicitation, it is difficult to und erstand the reasons if tw o DTs give d ifferent results.

Section 2 d iscusses these shortcom ings in m ore d etail.

N ote that another recent subject of research related to d epend ence assessm ent is on how d epend ent H FEs should be incorporated in large system fault tree analysis (Vaurio, 2000). This subject relates to d epend encies am ong pre-initiator H FEs and a m ore d etailed d iscussion is outsid e the scope of the present paper . Also related to d epend ence assessm ent is the id ea of the existence of hum an performance lim iting values (H PLV) (Kirw an, 2008). It m ay be the case that accid ent sequences have very low joint hum an error probability (e.g. 10 -4 or 10 -5 ), even after d epend ence is evaluated: the id ea is that H PLV should be applied to includ e for possibly overlooked error m echanisms or error-inducing cond itions.

The aim of this w ork is a m ethod for d epend ence assessm ent in H RA that captures the rules used by experts to assess d epend ence levels and incorporates this know led ge into an algorithm and softw are tool to be used by H RA analysts. The Fuzzy Expert System (FES) form alism und erlies the m ethod . A FES collects the experts' know led ge as a set of Fuzzy Logic (FL) rules that are m athem atically m anipulated by Fuzzy Set theory (Zad eh, 1965). Fuzzy set theory has been exploited for H RA in a num ber of applications [START_REF] Terano | Human reliability and safety evaluation of man-machine systems[END_REF]Onisaw a, 1988aOnisaw a, , 1988b;;[START_REF] Liang | Evaluating human reliability using fuzzy relation[END_REF][START_REF] Kim | On assessing operator response time in human reliability analysis (HRA) using a possibilistic fuzzy regression model[END_REF][START_REF] Suresh | Uncertainty in fault tree analysis: A fuzzy approach[END_REF]Huang et al., 1996;[START_REF] Richei | The human error rate assessment and optimizing system HEROSa new procedure for evaluating and optimizing the man-machine interface in PSA[END_REF][START_REF] Konstandinidou | A fuzzy modeling application of CREAM methodology for human reliability analysis[END_REF][START_REF] Marseguerra | Quantitative Developments in the Cognitive Reliability and Error Analysis Method (CREAM) for the Assessment of Human Performance[END_REF]. In m ost of these, the focus is on using FL to convert hum an error context d escriptions into inputs for existing H RA m ethod s, w ith the aim of accounting for ambiguity and subjectivity of the d escriptions. For exam ple, in [START_REF] Konstandinidou | A fuzzy modeling application of CREAM methodology for human reliability analysis[END_REF] and [START_REF] Marseguerra | Quantitative Developments in the Cognitive Reliability and Error Analysis Method (CREAM) for the Assessment of Human Performance[END_REF], fuzzy logic is applied to com pute H EPs via the CREAM m ethod , by converting the characterization of the perform ance shaping factors into fuzzy num bers. Only in [START_REF] Richei | The human error rate assessment and optimizing system HEROSa new procedure for evaluating and optimizing the man-machine interface in PSA[END_REF] is the problem of build ing a FES from the expert know led ge also ad d ressed .

At this stage, the focus of the w ork has been to investigate the suitability and practicality of the FES representation for an H RA d epend ence assessm ent m ethod for post-initiator H FEs. This paper presents the basic concepts of the proposed m ethod and d em onstrates the approach using a w orking m od el of the d epend ence relationships. The w orking m od el is intend ed to represent a set of m od erately com plex relationships am ong the input factors and the d epend ence level, w hich could be expected from an expert elicitation. These relationships represent one possible interpretation of the TH ERP d epend ence guid elines, but one w ith m ore d etail. It ad m itted ly d oes not includ e all relevant factors but its com plexity is sufficient for the purpose of d em onstrating the m ethod ology. The d etails of the FES m odel are reported in a com panion paper [START_REF] Zio | A Fuzzy Expert System for modeling dependence among human errors[END_REF].

To illustrate its use, the FES-based has been applied for d epend ence assessm ent of a pair of operator actions in response to an accid ent scenario in a Boiling Water Reactor.

The FES-based m ethod for assessing d epend ence has the ad vantage of being able to represent fully the experts' rules (in this case, the rules of the w orking m od el), includ ing rules for the interaction of the d epend ence (input) factors. With anchor situations provid ed as guid ance for the H RA analyst's jud gm ent of the input factors, the m ethod yield s the depend ence level based on the expert rules. An expert elicitation to obtain a com prehensive set of rules to replace the w orking m od el is planned for future w ork.

The paper is organized as follow s. Section 2 gives an overview of the problem of d epend ence assessm ent, of the current practice and lim itations. Section 3 presents the features of the proposed d epend ence assessm ent m ethod . The approach for building the und erlying FES-based m od el is presented in Section 4. Section 5 presents an application of the m ethod . Section 6 d iscusses traceability, repeatability, verification and valid ity issues.

2 Dependence assessment in HRA: practice and limitations

The dependence assessment method in THERP

The d epend ence assessm ent m ethod in the TH ERP H RA m ethod [START_REF] Swain | Handbook of human reliability analysis with emphasis on nuclear power plant applications[END_REF]) is one of the m ost w id ely used in the PSA practice. and "m any social and psychological factors-).

For exam ple, for the factor closeness in tim e and space, the guid eline read s (item 3 of -Evaluate the spatial and tim e relationship am ong all events. Depend ence betw een any tw o events increases as the events occur closer in space and tim e. For exam ple, d isplays or controls that are physically close to each other or that m ust be m anipulated at about the sam e tim e have a higher level of d epend ence than item s that are w id ely separated either spatially or as to the tim e of their m anipulation.‖

These guid elines cannot be used system atically and consistently as a basis for assessing the d epend ence level because a lot of room is left to interpretation. This m akes the assessm ent a rather d ifficult task, requiring a consid erable am ount of expert jud gm ent, w hich m ay lack transparency and traceability and lead s to low repeatability of the results. Another problem w ith the d irect elicitation of probability is the presence of biases, of m any types [START_REF] Cooke | Experts in uncertainty[END_REF]Otw ay, H . & von Winterfeld t, D., 1992).

Supporting the THERP model with decision trees

The expert jud gm ent assessm ent of the level of d epend ence is in practice often supported w ith a d ecision tree (DT). In these cases, the quantitative im pact of the assessed d ependence level is still m od eled w ith the TH ERP d epend ence assessm ent m ethod .

Repeatability should improve w hen expert jud gm ent is structured and supported by a DT. The analyst has to give jud gm ents on the input factors, but is not required to d raw conclusions on the d epend ence level, w hich com es from the m od el. An exam ple is

show n in Figure 1, w hich reports the SPAR-H DT for post-initiator H FEs [START_REF] Gertman | The SPAR-H Human Reliability Analysis Method[END_REF]. The input factors of the m odel are (Figure 1):



INSERT Figure 1. The SPAR-H dependence decision tree

INSERT Table 1. The EPRI HRA Calculator ® dependence decision tree [START_REF] Grobbelaar | Analysis of Dependent Human Failure Events Using the EPRI HRA Calculator[END_REF].

Basic concepts of the dependence assessment method

Input factors

Sim ilarly to the DTs approach, each of the input factors is represented by a linguistic variable, qualified in term s of linguistic labels (Figure 3). For exam ple: input factor -sim ilarity of perform ers‖ m ay be qualified in term s of a linguistic variable w ith linguistic labels: N one -Low -Med ium … -Very high. Unlike w ith DTs, the num ber of linguistic labels for each input factor is higher than tw o, thus giving m ore flexibility to the input jud gm ents.

At the sam e tim e, the use of a higher num ber of linguistic labels m ay becom e a source of variability in the inputs, so that concrete guid ance is need ed for the analyst jud gm ents. As show n in Figure 3 With respect to the context characterization, the analyst can provid e jud gm ents on the input factors in d ifferent w ays, for exam ple on a scale (Figure 3). Four anchors are

show n in the figure: the analyst may provid e a point inpu t on the scale (input 1), or the range w here his/ her belief belongs (input 2).

A feature of FES is that they allow overlapping of the linguistic labels (overlapping horizontal bars in Figure 3) to represent the fact that in the com m on perception, the transition betw een the linguistic concepts associated to the labels (e.g. betw een -m ed ium ‖ and -high‖) is not crisp, but often uncertain and am biguous. This can be form ally accounted for by introd ucing overlapping fuzzy sets to represent the input variables. Figure 4 show s a possible association of fuzzy sets and trapezoid al m em bership functions. N ote that the association is not show n to the analyst w ho interfaces only w ith anchor points and linguistic labels.

Ind eed , the natural scale for the input factors is continuous and the d iscretization introd uced by the overlapping labels is a sim plification. Yet, this d oes not seem to be a lim itation. The five-level scale is actually attractive because experts and analysts are alread y very fam iliar w ith it from the five TH ERP levels. Furtherm ore, as it w ill be presented in the next Section 3.2, the basis of the fuzzy logic m od el is a set o f rules. This is a concept w ith w hich experts and analysts should be alread y fam iliar w ith, since rules (although m uch coarser) are at the basis of DTs as w ell.

Insert

The underlying model

The Insert Figure 5. Left: example of computation of the degree to which the Factor 1 input assessment matches the label "Low " and the Factor 2 input assessment the label "High" . Right: computation of the degree of activation of the rule If "Factor 1" is "Low" and "Factor 2" is "High" THEN "Dependence" is "Medium" as minimum value between the degrees to which Factor 1 and Factor 2 input assessments match the corresponding labels in the rule. The second type of output gives quantitative figures to the depend ence level. This output is the expected value of the conditional probability and its associated uncertainty. These are the figures that are includ ed into the PSA.

Outputs

The operation that allow s passing from the first type of output to the second is called d efuzzification (Zad eh, 1965) and , to be form alized , entails associating fuzzy sets and d egrees of m em bership to the levels of d ependence.

In the method proposed in this paper, this is d one by eliciting inform ation from the TH ERP hand book. In particular, Table 20-

Building the dependence model: example on a working model

The concepts of the elicitation process are here illustrated on a w orking m od el of d epend ence, applicable for post-initiator H FEs of a nuclear pow er plant for full-pow er scenarios. The actual expert elicitation exercise w ill be perform ed in subsequent w ork.

The inform ation that need s to be provid ed by the expert is:

 The im portant factor relevant to d epend ence and how they relate  Selection and p ositioning of the anchors  Im pact of the factors on the d epend ence level

Determining input factors and anchors

The first inform ation to elicit from the expert concerns the im portant factors for d epend ence and how they relate. An influence diagram like the one in Figure 7 is the result: it show s the w orking m od el used to explore the m ethod ology.

Table 2 lists the input factors, the qualitative labels and the anchor points used in the w orking m od el. The expert has to locate the anchors on the input scale, so as to build the input interface of Figure 3.

Accord ing to the w orking m od el, three factors d irectly im pact the d epend ence level (Figure 7): -closeness in tim e‖, -task relatedness‖ and -sim ilarity of perform ers‖.

-Tasks relatedness‖ is further specified in term s of the -sim ilarity of cues‖ and -sim ilarity of functions/ goals‖, as Figure 7 show s. These factors includ e m ost, but not all, of the relevant factors. For exam ple, the use of the sam e proced ures m ay also have influence on the d epend ence betw een tw o tasks. On the other hand, this w orking m od el w as consid ered to be of enough com plexity for this illustrative application of the m ethod ology.

N ote that the scale for factor -closeness in tim e‖ d oes not relate to an absolute time scale (Figure 3). For exam ple, the anchor point -5 m inutes‖ is m eant to be an exam ple of the concept of closeness in tim e, rather than a tim e m ea surem ent: a jud gm ent of -8 m inutes‖ could be also placed on the -5 minutes‖ anchor position if the analyst feels that the situations are not d ifferent. Alternative anchors for -closeness in time‖ are und er evaluation, relating to typical tasks in NPP. In t his w ay, as for exam ple it w as d one in Kirw an (1997c), the jud gem ent is not only connected w ith the num eric time separation.

Relationship between the input factors and dependence level

The expert know led ge on d epend ence is converted into the FES rules. This is d one by: 1) using statem ents given by the experts to fill som e of the rules of the fuzzy expert system , and 2) filling the rest of the fuzzy rules via a rules interpolation approach.

The statem ents from the expert can be of d ifferent form s. In this paper each statem ent evaluates particular com binations of the input labels. When the expert is asked to evaluate the selected contexts, he/ she is also show n the relative positioning of the anchors on the scale, so as to help him / her to contextualize his/ her statem ents (Figure 9). These evaluations allow partially filling the Table of rules, as show n in Figure 9 for -task relatedness‖.

Then, the m issing -relationships‖ are filled in by an autom atic -interpolation‖ proced ure w hich sm oothly spread s the consequent labels over the fuzzy rules [START_REF] Marseguerra | A fuzzy modelling approach to road transport with application to a case of spent nuclear fuel transport[END_REF][START_REF] Zio | A Fuzzy Expert System for modeling dependence among human errors[END_REF] (Figure 10).

Insert Figure 9. 5 Use of the working model: dependence in operators' early response to ATWS

Scenario description

The case stud y considered refers to a set of operator actions required to avoid excessive boron d ilution in the reactor cooling system in case of an Anticipated Transient Without Scram (ATWS) scenario in a nuclear Boiling Water Reactor (BWR).

In

Five cases of analyst judgment

At first, three jud gm ent cases are presented , correspond ing to different possible interpretations of th e context by the analyst. The last tw o cases show how the m od el respond s to the variation of one input from cases 2 and 3. m od el is built, it is easy to go back and verify the base expert's statem ents that originated the m od el. In principle, the traceability of the process to build DTs could be potentially im proved by provid ing better d ocumentation, but this has been rarely the case.

Case 1 -input judgments as point values on anchors

Verification and validation issues

Mod el verification and valid ation are tw o essential steps in the d evelopm ent of any m ethod and are being taken into consid eration in the d evelopm ent of the present d epend ence m ethod .

Verification is intend ed as the process to m ake sure that the m od el represents correctly the experts' know led ge [START_REF] O'keefe | -Validating Expert System Performance‖[END_REF]. After construction, the expert m od el has to be assessed (verified ) by the experts w hose expertise is captured in the m od el. In this phase, feed back need s to be provid ed to the experts to allow them to d eterm ine w hether the expert system m od el is a good representation of their know led ge, and if not, to m od ify the m odel appropriately. Techniques for provid ing this feed back are There are on-going efforts that should im prove the state of H RA d ata in the future.

One of these is an attempt to analyze operating experience and to obtain in this w ay em pirical relationships betw een the factors and the observed hum an failure events: the H um an Error Repository and Analysis (H ERA) project and d atabase sponsored by the U.S. N uclear Regulatory Com m ission (H allbert et al., 2006). A second effort is the International H RA Empirical Stud y being perform ed by an international group of organizations jointly w ith the OECD H ald en Reactor Project, in w hich the pred ictions of H RA m ethod s are being com pared w ith sim ulator d ata [START_REF] Lois | International HRA Empirical Study -Description of Overall Approach and First Pilot Results from Comparing HRA Methods to Simulator Data[END_REF][START_REF] Dang | An Empirical Study of HRA Methods -Overall Design and Issues[END_REF]. While both quantitative pred ictions (the H EPs) and qualitative pred ictions (the -d riving‖ or m ost im portant input factors id entified in the H uman Reliability Analysis) w ill be ad d ressed in this w ork, the num ber of d ata points w ill not be sufficient to valid ate com prehensively the relationship betw een the input variables and the pred icted failure probabilities, a relationship represented by each H RA m ethod .

Concerning the valid ation of a depend ence mod el, the basis or m echanism s that potentially lead to d epend ence w ithin a series of actions relate strongly to the d ecisionm aking of the personnel associated w ith these actions. Therefore, one may anticipate that d ata w ill be very d ifficult to collect. A m ajor reason is that the action and failure probability of interest are cond itioned on a previous personnel failure. Given the expected perform ance levels, this initial failure is relatively d ifficult to -provoke‖ system atically and realistically such that the subsequent perform ance can be exam ined.

In case the valid ation strategy w ould be to test the m od el's pred ictions against sim ulator d ata, this poses challenges also as to how the sim ulator experim ents should be d esigned (e.g. w hat accid ent scenarios should be sim ulated).

This suggests that a m od el of d epend ence for H RA cannot be based on (built from ) a set of d ata from w hich the overall relationship betw een the input variables and the output variable of interest can be quantitatively estim ated . For the sam e reason, it can be expected that the valid ation of such a m od el cannot be d one against a com prehensive set of d ata that is able to explore extensively the range of the m od el response.

H ow ever, these d ifficulties should not d iscourage and som e w ay of test ing the em pirical basis of the m od el should be pursued . Three concept alternatives can be anticipated here: It is expected that the experience w ith the m entioned International H RA Empirical Stud y w ill help in d efining h ow to go about the above concept alternatives.


While validation against em pirical d ata has the m entioned challenges, alternative approaches to valid ation are being consid ered for the short term .

Ind eed , there is a significant history w orking w ith the TH ERP d epend ence approach, in its original form ulation or supported by DTs. This can be used to d raw som e conclusions on the reasonableness of the num bers prod uced for d epend ence calculations, i.e. on its so-called face valid ity (Kirw an, 1997a).

Data from exp erts can also be used to replace empirical data for a valid ation exercise.

This can be d one in tw o w ays (w hich are not exclusive). The first is to give case stud ies to the experts and partition the cases in tw o sets: one set is used to inform the relationships and build the m od el and the rest is used to test the pred iction capability of the m od el. The other w ay is to test the pred ictions against those from ano ther set of experts. These options w ill be consid ered in the design of the expert elicitation process.

Additional discussion

It is w orth noting that other expert m od elling approaches exist that can hand le d epend ence am ong the input factors. Probabilistic m od els such as influence d iagrams and Bayesian belief netw orks [START_REF] Phillips | Techniques for verification of expert models for dependence assessment in human reliability analysis[END_REF] and connectionism networks (Sträder, 2000) are some examples. Research is also being perform ed by the authors to com pare the perform ance of these probabilistic approaches w ith Fuzzy approaches.

Finally, note that the so-called second -generation H RA m ethod s (ATH EAN A [START_REF] Cooper | A Technique for Human Error Analysis (ATHEANA)[END_REF], MERMOS (Le [START_REF] Bot | MERMOS: unprojet d'EDF pour la mise à jour de la méthodologie EPFH[END_REF] Another w ay of hand ling d epend ence is through the use of d ynam ic PSA tools, see e.g. [START_REF] Chang | Cognitive modeling and dynamic probabilistic simulation of operating crew response to complex system accidents: Part 1: Overview of the IDAC Model[END_REF], w hich allow to d irectly sim ulate the evolution of the system after each hum an intervention and therefore, in principle, to better d efine the context in w hich the depend ent actions are carried out.

Conclusions and Outlook

H um an failure d epend ence assessm ent is a highly subjective part of H RA and efforts to im prove the transparency and repeatability of the assessm ents are need ed . This paper proposes a d epend ence m ethod that is based on an expert m od el, built from a transparent expert elicitation process. The expert m od el is a Fuzzy Expert system . This representation has been selected since it is suitable for m od els m ostly built from expert The proposed m ethod is based on an explicit, com putable m od el. As in a d ecision tree, an analyst is required to give jud gm ents on the input factors of the mod el, and not d irectly on the depend ence level (w hich is the output of the m od el). While im proving the repeatability of the assessm ent, this is also expected to red uce its uncertainty, com pared to the case of giving jud gm ents d irectly on the d epend ence level. Ind eed, uncertainty on input jud gm ents exists as w ell, but w ith anchors to provid e references for the scale, the inputs can be mad e less subjective th an the d ependence level.

The com putable m od el is built from a system atic expert elicitation approach, m ad e up of tw o traceable steps. This is im portant because, in connection w ith w hat said above, the accuracy of the results prod uced by the m ethod d epend s on the accuracy of the com putable m od el. Given that em pirical valid ation of the m od el accuracy is extrem ely challenging, it is im portant that the build ing process is traceable, to allow scrutinizing the experts' statem ents contained in the expert mod el.

With the use of the expert m od el, the analyst's input jud gm ents are d irectly and form ally converted into the output, the (d iscrete) d epend ence level. Com pared to a d ecision tree-based approach, the result gives a d epend ence assessm ent that can m ore closely reflect the analysts' und erstand ing of the d epend ence factors for a given set of tasks.

Anchor situations are provid ed as guid ance for the analyst's assessm ent of the input factors. Using up to five input linguistic labels for the factors, com pared to the typical tw o of (binary) d ecision trees, m ay be perceived as subject to m ore subjectivity as w ell as cum bersom e by analysts and experts. H ow ever, the anchor points m ay counteract the effect of having m ore labels for each factor , by provid ing concrete references for d eterm ining the input factor for the specific case und er analysis.

N either the H RA analysts nor the experts w hose know led ge is represented by the expert m od el need to be fam iliar w ith Fuzzy Expert system s: no aspect of the Fuzzy form alism is show n to analysts and experts and they interface only w ith the input linguistic labels and w ith the an chor points. This is very sim ilar to the interface of d ecision trees com m only used (e.g. SPAR-H and the EPRI H RA Calculator ®).

Once the m od el is finally built, v erification and valid ation are also im portant aspects.

In particular, valid ation of the d epend ence m od el against em pirical d ata is significantly challenging, d ue to the d ifficulty of collecting failure probability d ata.

H ow ever, it is expected that it w ill be possible to d raw som e conclusions on the m od el face valid ity. Indeed , although the currently used TH ERP-based approaches m ay suffer from a num ber of lim itations, there is a significant experience in w orking w ith these and this can be used to check the reasonableness of the results prod uced by the proposed m ethod .

Same team

Same person

1 It is expected that multiple sets of time anchors will be distinguished in the final model. For example, time anchors should be placed in different locations on the scale for short and long term actions: a time separation of 20 minutes between the two actions, can be considered as wide if the first action is to be performed few minutes after the annunciation of the related cues: on the other hand, the same separation of 20 minutes can be considered as -very small‖ if the first action is to be performed within hours from the annunciation of the related cues.

Dependency Condition

  Crew s (Sam e/ Different)  Tim e (Close in tim e/ N ot close in time)  Location (Sam e/ Different)  Cues (Ad d itional cues/ N o ad d itional cues). Different im plem entations of DTs exist. Cepin (2008b) show s that this can lead to significant d ifferences in the result of the H RA and in the evaluation of the risk contributors. Since a traceable process of expert elicitation is often m issing , it is d ifficult to und erstand the reasons if tw o DTs give d ifferent results.Another lim itation is that DTs are not flexible and m ay not allow assessm ents to be representative of the context und er analysis. The need to avoid an excessive branching of the tree usually lim its the num ber of branches per factor to tw o to three values (labels). These labels represent extrem e Yes/ N o cond itions (see Figure1for exam ple), w hich m ay be d ifficult to m atch to a particular context. Ind eed, there m ay be consensus on consid ering a separation by 5 minutes as -close in tim e‖ and one of hours as -not close in tim e‖. H ow ever, a separation of 20 m inutes m ay be d ifficult to m atch to any of the tw o options, thus requiring a m ore interm ed iate jud gm ent that w ould better represent the context.

Figure 2

 2 Figure2show s a high -level overview of the depend ence assessm ent m ethod . The und erlying FES m od el and the expert elicitation process for its construction are presented in the next Section 4. The m athem atical d etails of the FES can be found in a com panion paper[START_REF] Zio | A Fuzzy Expert System for modeling dependence among human errors[END_REF]. The d ifferent com ponents of the m ethod are d escribed next.

  , this is provid ed through anchor points that represent prototype cond itions of the input factors for a typology of tasks . Different d epend ence m od els and thus d ifferent sets of anchors m ay be used for pre-initiators, differen t types of post initiators, etc. The selection of the proper anchors and their characterization in term s of the linguistic labels is one of the outputs of the expert elicitation process.N ote that num erous stud ies on expert jud gm ent elicitation have show n that the use of anchors m ay be counterprod uctive and bias the jud gm ents if the und erling scale is continuous (see Brew er & Chapm an, 2002 for an exam ple, am ong m any others, of a paper d iscussing the anchor effect, and[START_REF] Stevens | On the Theory of Scales of Measurement[END_REF], for the d efinitions of the m easurem ent scales). H ow ever, in our case the anchors are essential because the scale on w hich they are placed is very abstract for the analyst (w hat d oes high -sim ilarity of cues‖ m ean? or w hat d oes a similarity of perform ers of 0.33 m ean?). Anchors therefore are necessary to provid e reference situations that can orient an analyst.

Figure 3 .

 3 Analyst elicitation on anchored scale; two analyst input types are shown: as a point value (arrow) and as an interval (horizontal bar). Insert Figure 4. Possible association of fuzzy sets and membership functions (trapezoids) to the input qualitative variable.

  inference m od el represents the relations betw een the input factors and the d epend ence level. This represents the expert know led ge, w hich in FES is m od eled into a set of rules capturing the relationships betw een the d ifferent values of the input and output variables. An exam ple rule read s as follow s: IF -Factor 1‖ is -Low ‖ AND -Factor 2‖ is -Medium ‖ AN D … -Factor N ‖ is -H igh‖ TH EN Depend ence is -H igh‖ The next Section presents the expert elicitation process to convert the expert know led ge into fuzzy rules. The input jud gm ents of the analysts are converted into fuzzy num bers, w hich represent the d egree to w hich the jud gm ents match each of the qualitative labels. The fact that a jud gm ent can m atch, w ith d ifferent d egrees, m ultiple labels allow s FES to handle uncertain and am biguous statem ents. Multiple rules are then activated , w ith a d egree that follow s from the degree to w hich each input statem ent m atches the labels involved in the rule. The d egree of activation of the rules is then the basis for the d erivation of the output of the m od el, w hich, as d escribed in the next Section 3.3, is represented by d egrees of belief in the d ifferent d epend ence levels. The FL proced ure used in this w ork to associate the output of the m od el to a given input assessm ent is based on the Mam d am i fuzzy logic[START_REF] Zio | A Fuzzy Expert System for modeling dependence among human errors[END_REF]. Accord ingly, the d egree to w hich an input assessm ent matches a label involved in a rule is com puted as the m axim um valu e of the intersection of the input assessm ent and label fuzzy sets (Figure5, left), the d egree of activation of a rule is com puted as the m inim um value of the degree to w hich each input assessm ent matches the labels involved in the rules (Figure5, right) and the contribution to the output of a given rule is the m inim um value betw een the rule d egree of activation and the fuzzy set in the rule output(Figure 5, right). Finally the output fuzzy set is obtained by taking the union of all the involved rule output s.

From

  the input factors describing the context of tw o successive actions w ith respect to their failure d epend ence, the m ethod prod uces tw o outputs. The first consists in the d egrees of belief (expressed in term s of possibility) for the d ifferent d epend ence levels. The TH ERP d ependence levels are used (N one, Low , Med ium , H igh, Com plete). This output show s how the analysts' jud gm ents translate into a possibilistic distribution of the d epend ence levels.

  21 of[START_REF] Swain | Handbook of human reliability analysis with emphasis on nuclear power plant applications[END_REF] suggests nom inal values and uncertainty bound s for the cond itional probability associated to each d ependence level. A possible association of fuzzy sets to the TH ERP d epend ence levels consists in taking m em bership functions w ith triangular shape in log10 scale centered on the associated d epend ence level nom inal values and w ith supports given by the low er and upper confid ence bound s, as reported in Figure6.N ote that the presented m ethod is still based on the five TH ERP d epend ence levels, although a finer characterization of the d ependence level could have been obtained w ith m ore levels or by ad opting a continuous d epend ence scale (for exam ple, using Bayesian belief nets). H ow ever, it w as d ecid ed to use the TH ERP d epend ence levels and the TH ERP relationships betw een the levels and the cond itional H EPs because these are fam iliar to experts and analysts. This is an im portant point for the acceptance of the method.Insert Figure6. Fuzzy sets and membership functions associated to the THERP dependence levels. Elicited from THERP guidelines[START_REF] Swain | Handbook of human reliability analysis with emphasis on nuclear power plant applications[END_REF]).

Figure 8

 8 Figure 8 show s the results of the expert elicitation of the input factors and of the anchors. The Figure show s the input interface of the m od el as seen by the analyst.

  the consid ered scenario, the operators have successfully initiated the Stand by Liquid Control System (SLCS) to shut the reactor d ow n. To facilitate the reactor shut d ow n, the operators are d irected by the proced ures to increase the void ing by red ucing the level in the reactor to the Top of Active Fuel (TAF). Ad d itionally, they are required to inhibit the actu ation of the Autom atic Depressurization System (ADS), w hich is activated by the signal of low w ater level in the reactor, generated w hile low ering the reactor w ater level to TAF. In case of failure to inhibit the ADS, the reactor pressure w ould be autom atically d ecreased and low pressure injection system s (Core Spray System , CSS), w ould be activated. The injected w ater could dilute the boron injected by the SLCS and the consequential failure to control reactivity. In case of failure to inhibit ADS actuation, the operators are called to control the level in the reactor using low pressure injection, tripping one of the CSS pum ps and controlling the other pum p. The signal to activate the ADS is generated about 7 m inutes after the event of failure to scram . At that point, the operators have about 15 m inutes to take actions to lim it the low pressure injection flow . The pair of operator tasks involved in the d epend ence assessm ent are 1) inhibit the ADS and 2) control the reactor vessel level in ord er to prevent d iluting boron concentration after failure to inhibit the ADS. Both actions are d irected by the same em ergency proced ure.

Figure 11

 11 Figure11show s an exam ple of this type of input on the m odel interface and Figure12show s the correspond ing fuzzification of the jud gm ents by m eans of trapezoid al MFs.

Figure 13

 13 Figure 13 reports the output of the d epend ence m od el as it results from the above jud gm ents. The m od el assigns a level of -Low ‖, w ithout uncertainty (in the Figure, the possibility of -Low ‖ is 1, w hile the possibility of all the other levels is 0). Without entering into the d etails of the und erlying fuzzy expert system , the reason for this result is that the input jud gm ents are such that only one rule is activated , i.e.: IF Tim e is Close AN D Cue sim ilarity is N one AN D Sim ilarity of functions/ goals is H igh AN D Sim ilarity of perform ers is H igh

Figure 14

 14 Figure 14 show s the input of the analyst on the m od el interface and Figure 15 show s the corresponding fuzzification of the jud gm ents by m eans of trapezoid al MFs.

Figure 16

 16 Figure 16 reports the output of the d epend ence m od el in form of the possibility values of the d ifferent levels of d epend ence. It can be seen that the am biguity of the jud gm ent reflects in the m od el output, w hich assigns possibility to both levels of -low ‖ and -m ed ium ‖ (in particular, 0.8 to LOW and 0.2 to MEDIUM). The relative possibilities values of the low and med ium labels d epend on the location of the input assessm ent arrow of the analysis in Figure 14. The reason for this output is that as a result of the input jud gm ents, tw o rules are activated, i.e.: IF Tim e is Close AN D Cue sim ilarity is N one AN D Sim ilarity of functions/ goals is H igh AN D Sim ilarity of perform ers is H igh

Figure 19

 19 Figure 19 reports the output of the d epend ence m od el in form of the possibility values of the d ifferent levels of d epend ence. It can be seen that as a consequence of the varied input jud gm ent, the output assessm ent is spread on the three values of ZERO, LOW, and MEDIUM, peaked on the LOW level. The activated rules are in fact:

  currently und er investigation by the authors: they includ e visualization techniques as w ell as im portance m easures. Som e prelim inary results can be found in Pod ofillini et al. (2008).A fund am ental step for the acceptance of the depend ence m od el is its valid ation . Yet, the em pirical valid ation of a hum an error d epend ence m od el is a very d ifficult task. In w hat follow s, the status of H RA valid ation generally and as it regard s d epend ence is outlined . The m ost significant H RA valid ation efforts have ad d ressed m ostly failure probabilities for -execution‖, that is, carrying out a series of actions or steps on a system . A review of valid ation efforts for a num ber of H RA m ethod s can be found in Kirw an (1997b). These sources note the d ifficulty of valid ating the failure probabilities for d ecision or d iagnosis that are pred icted w ith H RA m ethod s. This is d ue in particular to the lack of reference d ata, w hich in turn is caused by the sensitivity of d ecision failures to a broad range of variables (contextual factors). Ind eed , d ata collection efforts have ad d ressed m ostly failure probabilities for -execution‖, as, for exam ple, inKirw an, et al. (2008), w here the focus is on com m unication errors.

  Valid ation of the m od el against a lim ited set of data, thus valid ating only som e of the input-output relationships, only those that cover the consid ered d ata.  Valid ation of the effect of individ ual factors. This w ould ad d ress the question if / how the effect of variations in one input factor (averaging the effect of the other factors or keeping these at fixed values) as anticipated by the m od el com pares w ith the em pirical d ata.  Valid ation of the relative strength of the factors and of their interactions. This w ould ad d ress the question if the factors that are pred icted as being im portant by the m od el result as being im portant also from the d ata.

  , CREAM (H ollnagel, 1998)) do not quantify d epend ence based on cond itional H FEs probabilities as the presented m ethod assum es. Their com m on notion is that the likelihood of H FEs is d riven by perform ance cond itions d eterm ined by the context w here the action takes place, rather than by intrinsic hum an error probabilities associated w ith the task. Follow ing this notion, the context m ust includ e preced ing H FEs and the failure probability estimated for any action should reflect a) the effect of preced ing H FEs on the scenario and on the operators' situation assessm ent, and b) the relationships betw een the actions, w hich w ould includ e m any of the d epend ence factors. In this w ay, a m od el of d epend ence rem ains essential in a second -generation analysis even if the proposed d epend ence assessm ent m ethod m ay not be applicable. As second -generation m ethod s have not yet been extensively applied , im proving d ependence assessm ent and quantifying cond itional probabilities rem ain issues of m ajor concern.

  jud gm ent, as opposed to em pirical d ata. A w orking m od el of d epend ence has been d eveloped to investigate the concepts und erlying the proposed m ethod ; its internal relationships have been set by the authors. The expert elicitation exercise w ill be perform ed in the future. The m od el has been applied for d epend ence a ssessm ent of tw o operator actions in response to an anticipated transient w ithout scram in a nuclear boiling w ater reactor.Im proving the transparency and repeatability of hum an reliability d epend ence assessm ent, w hile keeping the m ethod practical to use h ave been the goals of the research. The features of the m od el to achieve these goals are as follow s.

Figure 1 .

 1 Figure 1. The SPAR-H dependence decision tree (Gertman et al., 2005).

Figure 2 .Figure 3 .

 23 Figure 2. Overview of the dependence model. Different models are needed for preinitiators, and different types of post-initiators.

Figure 4 .Figure 5 .

 45 Figure 4. Possible association of fuzzy sets and membership functions (trapezoids) to the input qualitative variable.

Figure 6 .Figure 7 .

 67 Figure 6. Fuzzy sets and membership functions associated to the THERP dependence levels. Elicited from THERP guidelines (Swain & Guttman, 1983).

Figure 8 .Figure 9 .

 89 Figure 8. Results from elicitation of the input factors and the anchors: the dependence model as seen by the analyst. Anchors may change for different typologies of tasks.

Figure 10 .

 10 Figure 10.Table of rules for the intermediate variable Task relatedness (complete fill by rules interpolation).

Figure 11 .

 11 Figure 11. Analyst judgments on input factors for failure to control low pressure injection given failure to inhibit ADS -case 1: judgments given as point values matching the anchors.

FigureFigure 14 .

 14 Figure 12. Fuzzy input with trapezoidal MFs for case 1: point estimates matching the anchors.

FigureFigure 16 .

 16 Figure 15. Fuzzy input with trapezoidal MFs for case 2: point estimates between anchors and labels.

Figure 17 .

 17 Figure 17. Analyst input on the anchored scale for case 3: range assessment.

FigureFigure 20 .

 20 Figure 18. Fuzzy input with trapezoidal MFs for case 3: range assessment.

Table 10

 10

	-1 of Swain & Guttman (1983)):

Table of rules for the intermediate variable Task relatedness (partial fill from the expert statements) Insert Figure 10. Table of rules for the intermediate variable Task relatedness (complete fill by rules interpolation)

Table 1 . The EPRI HRA Calculator ® dependence decision tree (Grobbelaar et al., 2005).

 1

	Time between cues	Adequate resources	Stress	Level
	Simultaneous	No Yes	High Low High Low	CD CD HD
	0-15 min	Yes	High Low	CD HD
	15-30 min	Yes	High Low	HD MD
	30-60 min	Yes	High Low	MD LD
	> 60 min	Yes	High Low	LD ZD

NOTE:

The above table from the EPRI HRA Calculator ® applies for two actions performed by the same crew, at the same location (the control room) and guided by different cues

Table 2 . Linguistic variables, qualitative labels and anchor points for the working model

 2

	Linguistic variable	Qualitative labels	Anchors 1 (provid ed by the
			expert)
	Closeness in time	close in time, widely	24 h
		separated in time,	8 h
		neither	1 h
			30 min
			20 min
			5 min
	Cue similarity	None/very low, low, medium,	Different sets of indicators for different
		high, very high/complete	parameters
			Different sets of indicators for the
			same parameter
			Single indicator for the same parameter
			Different sets of indicators for the
			same physical quantity
			Same sets of indicators for the same
			sets of parameters
	Function/goal similarity	None/very low, low, medium,	Different functions by different
		high, very high/complete	systems
			Different functions by the same system
			Same function by different systems
			Same function by the same system
	Similarity of performers	None/very low, low, medium,	TSC vs control room shift
		high, very high/complete	Different teams
			Different individuals (same
			qualification)

Table

	Condition	Crew	Time	Location	Cues	Dependency Number of Human Action Failures Rule
	number	(same or	(close in time	(same or	(additional		□ -Not Applicable.
		different)	or not close in	different)	or no		Why?_________________
			time)		additional)
	1	s	c	s	na	Complete	When considering recovery in series
	2				a	Complete	e.g., 2 nd , 3 rd , or 4 th checker
	3			d	na	High
	4				a	High	If this error is the 3rd error in the
	5		nc	s	na	High	sequence, then the dependency is at
	6				a	Moderate	least moderate.
	7 8 9 10	d	c	d s	na a na a	Moderate Low Moderate Moderate	If this error is the 4th error in the sequence, then the dependency is at least high.
	11			d	na	Moderate
	12				a	Moderate
	13		nc	s	na	Low
	14				a	Low
	15			d	na	Low
	16				a	Low
	17					Zero

Insert Figure 18. Fuzzy input with trapezoidal MFs for case 3: range assessment.

Insert Figure 19. Output of dependence level for case 3: range assessment.

Cases 4 and 5 -response of the model to judgment variation on one input

This cases show how the m od el respond s to the variation of one input from the values that w ere used in cases 2 and 3. N ote, these last tw o cases d o not correspond to a specific d epend ence analysis assessm ent, but they are presented here as exam ples of sensitivity analysis.

The inputs for cases 4 and 5 are the sam e as those of cases 2 and 3, respectively, except for the jud gm ent on factor -sim ilarity of cues‖, w hich is now centered on the anchor -single ind icator for the sam e param eter ‖ (w ith falls on the in put label H IGH , w ithout overlapping to any other label).

The output of the d epend ence m od el is reported in Figure 20: as expected , both output assessm ents are shifted tow ard s higher d epend ence levels, as a consequence that the input jud gm ent has been m oved tow ard s higher sim ilarity of cues. In case 4, the level of H IGH is assigned w ithout uncertainty (Figure 20


Enrico Zio
email: enrico.zio@polimi.it

Francesco Di Maio

Marco Stasi

A data

Keywords: Failure Scenarios, Failure Mode Identification, Recovery Time Prediction, Data-driven Approach, Fuzzy Similarity Analysis, Nuclear Power Plant, Lead-Bismuth Eutectic eXperimental Accelerator Driven System (LBE-XADS)

Introduction

The primary purpose of prognostics is to indicate whether the equipment of interest can perform its function throughout its lifetime; in case it cannot, it is a desirable feature of the prognostic methodology to identify the system Failure Mode (FM), i.e., the physical manner in which the failure occurs as defined by a safety variable crossing a pre-established threshold, and estimate the available Recovery Time (RT) during a failure scenario, i.e., the time remaining until the system can no longer perform its function in an irreversible manner.

The attractiveness of prognostics for Nuclear Power Plant (NPP) accident management comes from the fact that by predicting the evolution of the equipment dynamic state, it is possible to provide advanced warning for managing the accident and preparing the necessary corrective actions to maintain the equipment in productive operation while avoiding any undesired impact on safety [IAEA, 2003].

In case of an accident, or an initiating event that may develop into an accident, the plant personnel must perform various tasks before taking counteracting actions:

• Identification of the plant state: this diagnostic task aims at identifying the cause of the problem and the states of a number of parameters critical for the plant operation and safety;

• Prediction of the future development of the accident; this task consists in:

-the identification of the system FM, to recognize the corrective actions necessary to avoid the failure; -the prediction of the available RT, which is the time remaining for taking the corrective actions.

• Planning of accident mitigation strategies, to be activated if safe control of the accident evolution was not successful.

NPP personnel have the capability to effectively manage a broad range of accidents; their successful management of complex accident behaviors requires that they detect the occurrence of the accident, determine the extent of challenge to plant safety, monitor the performance of active, passive, automatic and digital systems, select strategies to prevent or mitigate the safety challenge, implement the action strategies, and monitor their effectiveness. The capability to effectively carry out these tasks during an accident is influenced by the availability of timely and accurate plant status information, the awareness of the future accident progression towards the system FM and of the RT available for reaction. Poor decisions may be taken because of a misjudgment on the type of occurred accident and system progression towards failure and/or because of an assumed short time available for sorting out the information relevant to the plant status [START_REF] Glasstone | Nuclear reactor engineering[END_REF]; on the contrary, timely and correct decisions can prevent an event from developing into a severe accident or mitigate its undesired consequences.

Nowadays, operators are assisted by computer-based accident management support tools, since the complicated phenomena that take place in a NPP during an accident situation are more accessible to computerized handling than to human expert evaluation [Øwre, 2001]. Yet, the problem of what kind of decision support to provide to nuclear power plant operators, in particular during transients leading up to accidents, is far from trivial [NEA, 1992;[START_REF] Ec | EU research in Reactor safety: Achievements of the 4th and prospects for the 5Th Euratom framework programme[END_REF]USNRC, 1999;IAEA, 2003].

Accident management support tools usually combine tracking and predictive simulators [IAEA, 2003]. The former ones monitor the plant status and provide calculated values also of those parameters that are not directly observable by the monitoring systems; predictive simulators deliver the FM and available RT for accident management.

Concerning the FM identification for a developing accidental scenario, it has been shown that the order and timing of the fault events occurring along an accident sequence, and the magnitude of the process variables at the time of event occurrence can be critical in determining the evolution of the accident and the FM the system is heading to [Aldemir et al., 2008]. The problem of inferring the system state from the measured parameters can be tackled by two general approaches: the model-based techniques [Willsky, 1976] and the model-free methods or data-driven approaches [Reifman, 1997;Marseguerra et al., 2006;Zio et al., 2009c]. Approaches to RT prediction can also be categorized broadly into model-based and data-driven [START_REF] Chiang | Fault detection and diagnosis in industrial systems[END_REF].

Model-based approaches attempt to incorporate physical models of the system into the estimations. However, the requirement of high computational speed for on line response necessarily leads to limited detail in the phenomena modeled, with consequent limited accuracy in the representation of the actual plant behavior [Berglund et al., 1995;Serrano et al., 1999]. On the contrary, data-driven techniques utilize monitored operational data related to system health. These techniques can typically be deployed quickly and cheaply, still providing wide coverage of system behavior; one should, however, be aware of the limitations of the data-driven approaches, which cannot be guaranteed to function properly in situations that are not included in the database used to train them. In this work, we will resort to a data-driven technique for the FM identification and RT prediction.

In general, data-driven approaches can be divided into two categories: statistical techniques (regression methods, ARMA models, etc.) and Artificial Intelligence (AI) techniques (neural networks, fuzzy logic systems, etc.).

With respect to AI techniques, Neural Networks (NNs) and Fuzzy Logic (FL) techniques have gained considerable attention in the past few years, due to their ability to deal with the uncertainties and non-linearities of the real processes, especially in abnormal conditions [Øwre, 2001]. Successful prediction models have been constructed based on Neural Networks [Barlett et al., 1992;[START_REF] Campolucci | On-Line Learning Algorithms of Locally Recurrent Neural Networks[END_REF]Peel et al., 2008;[START_REF] Zio | Locally recurrent neural networks for nuclear dynamics modeling[END_REF][START_REF] Santosh | Diagnostic System for Identification of Accident Scenarios in Nuclear Power Plants using Artificial Neural Networks[END_REF] and Neuro-Fuzzy (NF) systems [START_REF] Wang | Prognosis of Machine Health Condition using Neuro-Fuzzy Systems[END_REF]. In spite of the recognized power of neural network modeling techniques, skepticism on their use in safety-critical applications relates to their black-box character which limits intuition with respect to the understanding of their performance [START_REF] Wang | A similarity based prognostic approach for Remaining Useful life estimation of Engineered Systems[END_REF]].

An opportunity for increased transparency and openness of data-driven models is offered by fuzzy logic methods, which are increasingly proposed in modern control and diagnostic technologies. Based on the principles of Zadeh's fuzzy set theory, fuzzy logic provides a formal mathematical framework for dealing with the vagueness of everyday reasoning [Zadeh, 1965]. As opposed to binary reasoning based on ordinary set theory, within the fuzzy logic framework measurement uncertainty and estimation imprecision can be properly accommodated [START_REF] Yuan | Data driven identification of key variables[END_REF][START_REF] Zio | Identification of nuclear transients via optimized fuzzy clustering[END_REF].

The present work has the goal of enhancing the data-driven framework of RT prediction proposed in [Zio et al., 2009b], by including a module of system FM identification; the extension provides real-time information that is helpful for setting adequate corrective actions. The computational tool considers a set of multidimensional trajectory patterns arising from different system accident scenarios (hereafter called reference trajectory patterns) and uses a fuzzy-based, data-driven similarity analysis for identifying the FM and predicting the RT of a newly developing failure trajectory (hereafter called test trajectory pattern). The pattern matching process is based on a fuzzy evaluation of the distance between the signals of the multidimensional test pattern and the patterns of reference [Angstenberger, 2001]; the fuzzy distances between the reference patterns and the test one are combined to transform the multidimensional data into a one-dimensional similarity indicator, which is used for the identification of the FM and prediction of the available RT. To keep the focus, the analysis does not cover the identification of the type of faults occurred during the developing accidental scenario nor the distinction/identification of the effects of control actions/maneuvers or faults, which also determine deviations in the process variables. Future work will be directed towards the implementation of a fault detection and classification module for further improving the overall capabilities of the accident management support tool.

Dynamic failure scenarios of the Lead Bismuth Eutectic eXperimental Accelerator Driven System (LBE-XADS) with digital Instrumentation and Control (I&C) [START_REF] Cammi | Modelling and control strategy of the Italian LBE-XADS[END_REF] are considered for the purpose of showing the feasibility of identifying the system FM and predicting the available RT. The analysis does not cover the study of the software and its possible failure modes, the benefits of fault tolerant features, the interactions of the software with the hardware and human components; eventually, these aspects will need to be addressed and included for the final implementation of the method in a qualified tool of accident management.

The paper is structured as follows. Section 2 provides a detailed description of the computational algorithm for the FM identification and RT prediction. Section 3 presents the mechanistic model of the LBE-XADS, with the description of the monitored signals. In Section 4, the results of the application of the approach to LBE-XADS failure scenarios are presented. Finally, some conclusions are drawn in Section 5.

Methodology

It is assumed that N trajectories (reference trajectory patterns) are available, representative of the evolution of relevant process signals during randomly selected reference failure scenarios, ending in anyone of the possible system end states, which can be of failure or not. These trajectories last all the way to system failure, i.e., to the time when anyone of the signals reaches the threshold value defining the system FM beyond which the system loses its functionality, or to a fixed time horizon of observation of the failure process, T .

At any time, a developing multidimensional signal trajectory (test trajectory pattern) is compared for similarity with the N multidimensional reference trajectory patterns stored in the database: the failure modes of these are used to identify the FM towards which the evolving transient is heading whereas their residual lifes are used to estimate the RT available. For illustration, the procedure is here followed step by step: the key modifications for FM identification with respect to the previous procedure for RT prediction [Zio et al., 2009a] are highlighted, together with the motivations behind it.

-Step 1: fault detection. The Z-dimensional trajectory of signals

( ) 1 2
, ,..., , As long as no abnormal signal deviation is detected, the system is qualified as working in nominal conditions, i.e., the Failure Mode ( ) FM t is identified with the label corresponding to safe system, and the estimate ( ) RT t of the available recovery time evaluated at the generic time t is taken equal to the system Mean Time to Failure ( ) MTTF t , obtained from the available recovery time ( ) i RT t of all the failure trajectories in the reference library:

( ) ( ) ( ) ( ) ( ) ( ) | | 1 1 | | | | i f f i i i i f i i t t i t t f f RT t MTTF t t t RT t i t t i t t > > = = -= > > ∑ ∑ (1)
where i f t is the time of system failure along the i-th reference trajectory (i.e., the time when the signal value exceeds the threshold beyond which the system loses its functionality), ( ) , until a fault is detected upon a deviation of the signal outside its range of allowed variability (which is a priori gauged with respect to the range of possible fluctuations in the signals); at this time, the algorithm for the identification of the FM and prediction of the available RT starts matching the similarity of the developing signal trajectory evolution to those in the reference library, combining their failure modes and failure times to provide an estimate of the system FM and available RT, respectively. Step 2: pointwise difference computation of multidimensional trajectory patterns.

| | i f i t t >
( ) ( ) ( ) ∑ = - = Z z z z j i r t x f j i 1 , , , , δ , 1, 2,..., i N = , 1, 2,..., j k = , 1, 2,..., z Z =
(2)

The matrix [ ]

N k
δ × contains the difference measures ( ) , i j δ between all n-long segments of the Z-dimensional reference trajectories and the test trajectory pattern of the monitored signals.

Step 3: computation of trajectory pointwise similarity and corresponding distance score.

To allow for a gradual transition in the similarity measure [START_REF] Binaghi | Fuzzy Reasoning Approach to Similarity Evaluation in Image Analysis[END_REF][START_REF] Joentgen | [END_REF], the pointwise difference between two trajectories is evaluated with reference to an "approximately zero" fuzzy set (FS) specified by a function which maps the elements

( ) ( ) , 1 , d i j i j µ = - , 1, 2,..., i N = , 1, 2,..., j k = (3)
In the application illustrated in this work, the following bell-shaped function is used [START_REF] Dubois | Weighted Fuzzy Pattern Matching[END_REF]:

( ) ( ) ( ) 2 2 ln , , i j i j e α δ β µ   - -      = (4)
The arbitrary parameters α and β can be set by the analyst to shape the desired interpretation of similarity into the fuzzy set: the larger the value of the ratio ( )

2 ln α β - , the
narrower the fuzzy set and the stronger the definition of similarity [Zio et al., 2009a]. Other common membership functions can be used, e.g. triangular and trapezoidal.

-Step 4: weight definition.

All failure trajectories in the reference library can bring useful information for determining the available RT and predicting the system FM of the trajectory currently developing; on the other hand, those segments of the reference trajectories which are most similar to the most recent segment of length n of the currently developing failure trajectory should be more informative in the extrapolation of the occurring trajectory to failure to identify ( ) FM t and estimate ( ) RT t . To account for this, ( ) FM t is identified as:

( ) = FM t K , with { } | max , 1, 2,..., K c c K W W c C = = (5)
where

| i c i i FM c W w = = ∑ , 1, 2,..., i N = , 1, 2,..., c C = ,
f i i i i t t RT t w RT t > = ⋅ ∑ , 1, 2,..., i N = (6)
To assign the weight i w , the minimum distance * i d along the i-th row of the matrix of Eq. ( 3) is first identified:

( ) * 1,..., min , i j k d d i j = = , 1, 2,..., i N = (7)
The weight i w is then computed as:

( ) * 1 * 1 i d i i w d e β   -     = - ⋅ , 1, 2,..., i N = (8)
and normalized:

1

N i i e e w w w = = ∑ (9)
Note that the smaller the minimum distance the larger the weight given to the i-th trajectory [Zio et al., 2009].

Step This allows a conservative RT estimation, biased towards "pessimistic" predictions of the available RT, because in the case that more than one segment along the i-th reference trajectory is closest to the developing test trajectory, the latest one is taken, i.e., the one closest to failure.

( ) i M i f j RT t t t = -, 1, 2,..., i N = (10) where ( ) ( ) ( )
Then, the estimate ( )

RT t of the remaining useful life along the developing trajectory is simply computed as in Eq. ( 6), with weights i w evaluated by Eq. ( 9).

The LBE-XADS

The case study considered is the same as in [Zio et al., 2009a], concerning failure trajectories in the Lead-Bismuth Eutectic eXperimental Accelerator Driven System (LBE-XADS), a sub-critical, fast reactor in which the fission process for providing thermal power ( ) P t is sustained by an external neutron source through spallation reaction by a proton beam ( ) Q t accelerated by a synchrotron on a lead-bismuth eutectic target [START_REF] Bowman | Nuclear energy generation and waste transmutation using an accelerator-driven intense thermal neutron source[END_REF][START_REF] Carminati | An Energy Amplifier for Cleaner and Inexhaustible Nuclear Energy Production Driven by a Particle Beam Accelerator[END_REF][START_REF] Rubbia | Conceptual Design of a Fast Neutron Operated High Power Energy Amplifier[END_REF]Van Tuyle et al., 1993;[START_REF] Venneri | Accelerator-driven Transmutation of Waste (ATW) -A New Method for Reducing the Long-term Radioactivity of Commercial Nuclear Waste[END_REF]. For completeness of the information in the paper, the physical description of the LBE-XADS and of the failures considered are here repeated, with reference to the simplified scheme of the plant of Figure 5. The primary cooling system is of pool-type with Lead-Bismuth Eutectic (LBE) liquid metal coolant leaving the top of the core, at full power nominal conditions, at temperature equal to 400 °C and then re-entering the core from the bottom through the down-comer at a temperature of 300 °C. The average in-core temperature of the LBE , av C LB T is taken as the mean of the entrance and exit temperatures. The secondary cooling system is a flow of an organic diathermic oil at 290-320 °C, at full power conditions. Cooling of the diathermic oil in each loop is obtained through an air flow ( ) a t Γ provided by three air coolers connected in series. A dedicated, dynamic simulation model has been implemented in SIMULINK for providing a simplified, lumped and zero-dimensional description of the coupled neutronic and thermohydraulic evolution of the system [START_REF] Cammi | Modelling and control strategy of the Italian LBE-XADS[END_REF]. The model allows the simulation of the system controlled dynamics as well as of the dynamics when the control module is deactivated and the air cooler flow is kept constant.

Both feedforward and feedback digital control schemes have been adopted for the operation of the system. The control is set to keep a steady state value of approximately 300 °C of the average temperature of the diathermic oil , av S o T : this value represents the optimal working point of the diathermic oil at the steady state, full nominal power of 80 MWth.

On the contrary, an oil temperature beyond the upper threshold , th u o T =340 °C would lead to degradation of its physical and chemical properties, whereas a temperature below the lower threshold , th l o T =280 °C could result in thermal shocks for the primary fluid and, eventually, for the structural components [START_REF] Cammi | Modelling and control strategy of the Italian LBE-XADS[END_REF]. Conservatively, no dependence on the duration of exposition to temperatures beyond the threshold values has been assumed: in other words, the system is considered to fail at such temperatures regardless of the time during which it exceeds the thresholds.

Multiple component failures can occur during the system life. To simulate this, the model has been embedded within a Monte Carlo (MC) sampling procedure for injecting faults at random times and of random magnitudes. Samples of component failures are drawn within a time horizon of 3000 s. The set of faults considered are:

• The PID controller fails stuck at time t 1 with a random flow rate output value 1 m sampled from a uniform distribution in [0,797] Kg/s.

• The air coolers fail stuck at time t 2 in a random position that provides a corresponding air flow mass 2 m uniformly distributed in [0,1000] Kg/s.

• The feedforward controller fails stuck at time t 3 with a corresponding flow rate value 3 m uniformly distributed in [0,797] Kg/s.

• The communication between air coolers actuators and PID controller fails at time t 4 so that the PID is provided with the same input value of the previous time step.

The first three faults are applicable to both analog and digital systems, whereas the last one is typical of digital systems. Furthermore, the fault magnitude probability distributions are assumed to be uniform, even if the components may more likely fail in a certain mode than in others. This includes also rare multiple events in the set of failure scenarios and further tests the robustness of the FM identification and RT prediction.

The sequence of multiple failures is generated by sampling the first failure time from the uniform distribution [0,3000] s and the successive failure times from the conditional distributions, uniform from the last sampled time to 3000 s. This assumption is conservative, favoring larger numbers of failures in the sequence.

The evolution of the failure scenarios may lead to three different Failure Modes (FMs), within the mission time of 3000 s, labeled with numbers from 1 to 3: The following three signals are taken for the identification of the system FM and the prediction of the available RT:

• Mean in-core LBE temperature, Notice that the sampling of the fault events here undertaken is not intended to reproduce the actual stochastic failure behavior of the system components; rather, the choices and hypotheses for modeling the faults (i.e., the time horizon of the analysis, the number and typology of faults, the distributions of failure times and magnitudes) have been arbitrarily made with the aim of favoring multiple failures. Further, the components considered subjected to fault and the fault mechanisms are not intended to provide a comprehensive description of the system fault behavior but are only taken as exemplary and used for generating the dynamic failure scenarios to be used as reference and test patterns.

Results

Application of the procedure for FM(t) identification and RT(t) prediction

A total of N =6400 reference failure scenarios have been simulated, differing in faulty components, times of faults occurrence and faults magnitudes. For each scenario, Z=2 evolution trajectories of the process variables For each of the test trajectories, the procedural steps 1-5 of Section 2 are performed.

As an example, for the 2-D test pattern trajectories of

Performance of the FM(t) identification and RT(t) prediction procedure

The performance of the method for identifying the FM and predicting the available RT has been verified on a batch of P=128 multidimensional test trajectories, different from the reference ones.

Concerning the performance of the FM identification, the fraction of correct identifications over the total number P of test trajectories tested is shown in Figure 11, in correspondence of three different prediction times 10% T , 50% T and 90% T corresponding to the time instants after 10%, 50% and 90% of the evolution of the test trajectory patterns, respectively; the performance increases as the developing trajectories approach the end of their lives, reaching a value of 86% at 90% T ; at this time, the classification performance can be considered satisfactory, e.g. in comparison with the results of other methodologies applied on the same literature case study [Zio et al., 2009c]. The accuracy of the RT prediction at any time t is expressed through the relative error (RE) between the estimate ( )

RT t and its true value ( )

RT t . To globally quantify the performance of the procedure over the batch of trajectories, the mean RE at time t has been evaluated:

( ) ( ) ( ) ( ) .

Figure 12 shows the empirical probability density function of the RT mean relative error.

The distribution is skewed towards small error values with mean and median equal to 0.09 and 0.04, thus proving that the procedure most frequently makes small relative estimation errors.

Conclusions

A data-driven similarity-based approach for identifying the Failure Mode (FM) of a system and predicting the available Recovery Time (RT) has been presented. The computational tool developed could be embedded in an operator support system for emergency accident management for timely and correct decisions on how to prevent an event from developing into a severe accident or mitigate its undesired consequences.

The approach considers the information carried out by multiple signals of multidimensional trajectories. Data from different transient failure scenarios are used to create a library of reference patterns of evolution. For identifying the FM towards which the system evolution is heading and predicting the available RT of a test pattern, its evolution data are matched to the reference patterns in the library within a multidimensional fuzzy pointwise similarity setting; the information from the reference patterns, i.e. their failure modes and residual life times, is combined based on the assessed similarity to provide the FM identification and RT prediction.

A number of fault scenarios in the Lead Bismuth Eutectic eXperimental Accelerator Driven System (LBE-XADS) have been analyzed by the proposed approach, with satisfactory results in terms of both accuracy and speed of computing.

Figure 1

 1 Figure 1 shows a schematics of the computational framework in the general case of multidimensional trajectories of Z monitored signals ( ) 1 2 , ,..., , Z f x x x t at time t.

Figure 1

 1 Figure 1 The flowchart of the fuzzy based data-driven approach

  the time horizon of observation T , starting from (discrete) time 1 t = ; at each discrete time t , its values are recorded and appended to the matrix of the values collected at the previous time steps.For reasons which will become clear in the following, the database containing the information related to the reference trajectory patterns is organized in a failure mode matrix [ ] 2 N FM × and in a 3-D structure of process signals patterns [ ] C is the maximum number of possible system FMs and N is the number of the reference trajectories. The 3-D process signals patterns structure [ ] N k Z R × × contains the partitions of the reference trajectories, where T k n = and its generic element ( ) , , r i j z is the projection on the z-th signal axis of ( ) , r i j which is the j-th segment of length n of values of the i-th reference trajectory, 1, 2,..., 2,0.8]. For clarity's sake, in Figures 2 and 3 a 2-D reference trajectory and its partition into 15 elements are shown, respectively (i.e., Z=2 and k=15).

Figure 2 Figure 3

 23 Figure 2 The two monitored signals of a safe bidimensional reference trajectory on a time horizon T=3000 s

  approximately zero". The distance score ( ) , d i j between two trajectory segments is then computed as:

  time index of the latest-in-life segment of the i-th trajectory among those with minimum distance * the failure threshold on the reference trajectory starting from the end time of the latest-in-life segment of minimum distance from the developing trajectory (Figure4).

Figure 4

 4 Figure 4 The RT i (t) for the i-th bidimensional reference trajectory starts from the end time of the latest-in-life segment of minimum distance from the occurring trajectory

Figure 5

 5 Figure 5 LBE-XADS simplified schematics. A = Accelerator; C = core; P = primary heat exchanger; S = secondary heat exchanger

FM = 1 .

 1 Low-temperature failure mode ( ,

••

  Mean oil temperature of the secondary heat exchanger hot side , Mean air flow rate at the secondary heat exchanger cold side, ( ) a t Γ

  z of the reference structure is compared for similarity with the z-th signal of the test trajectory pattern containing the values of the latest 50 time steps of the trajectory. The matrix

Figure

  Figure 6 FM identification (top) and RT estimation (bottom) for a trajectory belonging to the low-temperature failure mode (FM=1)

Figure 11 FM

 11 Figure 11 FM identification performance evaluated at times T 10% , T 50% and T 90% over the 128 test trajectories

Figure 12

 12 Figure 12 Empirical probability density function of the RE for the 128 test trajectories

Figure 13

 13 Figure 13 RT mean relative error evaluated at times T 10% , T 50% and T 90% over the 128 test trajectories

  is the cardinality of the set of reference trajectories whose failure time is larger is their residual life starting from t . At the following time steps, the algorithm continues to update the estimates of

	than t and	( )
			( ) RT t MTTF t ( ) =	, with the system in
	( ) ' FM t =	safe	'

i RT t

  At the current time t, the latest n-long segment of values of the test trajectory pattern

	between the n•Z values of pattern ( f x x 1 2 , ,..., , Z x t ɶ	)	and those of the generic reference
	trajectory segment ( r i j z , is computed: ) , ,
	( f x x 1 2 , ,..., , Z x t	) ( f x x 1 2 , ,..., , Z x t n = -+ -+ 1, t n	2,...,	t	)
						δ i

ɶ is normalized within an arbitrary chose range (a common choice is [0.2,0.8] which avoids numerical problems, e.g. arising from the zero value in a range centered at the origin). The pointwise difference ( )

Table 1

 1 ) until the first fault occurs and the pattern similarity matching starts. In the Figures, the bold vertical line indicates the time of diathermic oil temperature threshold exceedance, i.e., the time the system fails if effective recovery actions are not successfully completed before then.

	, the	( ) FM t identifications

Table 1 Times and magnitudes of faults occurring during the accidental scenarios considered in Figures 6-10

 1

	The estimates of the	( ) MTTF t are plotted in the lower subplots of Figures 6-10, in thin
	continuous lines with the bars of one standard deviation of the samples (	| t t t i f -	f	i	) > , where t	i t is f
	the time at which the diathermic oil temperature profile of the i-th reference trajectory exceeds
	either thresholds	, th u o T	or	, th l o T , with corresponding system loss of functionality. The	( ) RT t
	estimates, also obtained based on trajectory segments of	n =	50	s, are plotted in bold circles; at the
	beginning of the test trajectories, the predictions match the	( ) MTTF t ; then, once a component
	failure is detected, the	( ) RT t estimates move away from the	( ) MTTF t values towards the real
	RT(t) (dashed thick line). Notice that none of the	( )

RT t estimates exceeds the actual failure time.

Acknowledgments

The authors are thankful to the anonymous referees for the critical contribution, which has stimulated a significant improvement of the paper.