Search

EcoSMR was a Business Finland funded co-innovation project with two research partners and ten company partners. The aim of EcoSMR project was to enable Finnish companies to participate in emerging small modular reactor markets through supply chain development and developing competences in certain topics. EcoSMR research partners were VTT and LUT University. Company partners were AFRY, Clenercon, EnviroCase, Fortum, Helen, Platom, Refinec, Rockplan, TVO and Vantaan Energia.The research work in EcoSMR was conducted under three main topics: licensing, heating reactor prospects and business model and ecosystem development. In addition, active dissemination work was conducted through organizing several webinars and seminars and writing articles in magazines and newspapers. In licensing, a suggestion on the basis for new regulation framework was proposed, EPZ determination was reviewed, prediction of licensing costs was examined and the applicability of safety analysis tools for SMRs were studied. In heating reactor prospects, different kind of analysis were conducted related to competitiveness, load following capabilities, integration to district heating network, market potential and carbon footprint. Additionally, pre-design of a heat exchanger for Finnish district heating reactor was drawn up. The research work on business models and ecosystem development focused on revisioning the quality assurance procedures of the global supply chains, fleet ownership and operation models on small modular reactors and co-ownership models of SMRs.EcoSMR project created an SMR community in Finland and brought it to the consciousness of international SMR actors. The project facilitated discussion between Finnish SMR actors and between Finnish and foreign actors. The work will continue under EcoSMR Hub. The Hub aims to bring together Finnish SMR actors and keep the discussions and supply chain development, which was started under EcoSMR, ongoing.

This report is the deliverable of the task 2.3, a specification on the key features of efficient and integrated safety engineering process in the scope of the BESEP project. Safety engineering processes in the scope of BESEP support the safety design of the plant, special focus given to the assessment of the safety margin. The project focuses on finding the most efficient safety engineering practices to support safety margins determination and safety requirement verification for design basis exceeding external hazards. This task supports the overall aim of the project by describing the basis of the safety engineering. The report suggests basic properties related to a structured safety engineering process in the scope of systems engineering (and the related standard ISO/IEC/IEEE 15288). A high-level safety engineering process is described through different system engineering workflow models, like the V-model, consisting of the system structure, the system life cycle stages and the systems engineering workflow phases. The safety engineering process is also approached from a different angle by describing the safety margins concept and the failure analyses. Safety margins in the context of deterministic, probabilistic, and human reliability analyses are defined. Failure analyses are discussed in the context of the safety margin verification and in regards with the interaction between safety analyses, such as deterministic and probabilistic safety analyses and human factors engineering. The report identifies the key aspects of an efficient and integrated safety engineering process, listing them to be used in later tasks of the project.

Tämä raportti on perusselvitys räjähdekohteiden kvantitatiivisesta riskianalyysistä (quantitative risk analysis, QRA). Raportin tarkoitus on osaltaan tarjota tietoa ja näkökohtia QRA:n käyttöönottoa Suomessa koskevalle keskustelulle sekä valmistelu- ja kehitystyölle. Raportin koostamisessa käytettyjä menetelmiä ovat olleet kirjallisuus- ja säädöskatsaukset, lähinnä sähköpostitse tapahtuneet asiantuntijahaastattelut, sekä alan suomalaisten asiantuntijoiden näkemysten kirjaaminen.Norjassa, Ruotsissa ja Sveitsissä QRA:ta käytetään laajasti räjähdekohteiden luvanhaussa. Ruotsissa ja Norjassa on sotilaspuolella käytössä sama hyväksytty menetelmä. Itävallassa räjähdekohteiden turvallisuusanalyysi perustuu suojaetäisyyksiin. Lähemmin tarkastellaan kuutta QRA-menetelmää. Menetelmissä on eroja esimerkiksi sen suhteen, minkätyyppisiä rakennuksia tai rakenteita pystytään tarkastelemaan, sekä sen suhteen kuinka tarkoilla menetelmillä räjähdyksiin liittyviä fysikaalisia ilmiöitä analysoidaan. Siviili- ja sotilaspuolella lasketaan samoja riskimittoja - yksilö- ja ryhmäriskiä - ja tarkasteltavat räjähdysten vaikutukset ovat samoja; erot liittyvät tarkasteltuihin räjähteisiin, niihin liittyvään toimintaan, tarkasteltaviin kohteisiin (esim. varastotyypit) ja alueisiin.Ruotsin ja Norjan lainsäädäntöä on tarkasteltu hyväksyttävään riskitasoon ja sen määrittelyyn liittyen. Hyväksyttävän riskitason asettavat molemmissa maissa viranomaiset. Hyväksyttävä riskitaso asetetaan yksilöriskille Norjassa sillä perusteella, että kohteen aiheuttamat riskit kasvattavat muista onnettomuuksista johtuvaa kuolemisriskiä vain vähän, ja yhteiskunnallista riskiä tarkasteltaessa otetaan kuolemisriskin lisäksi huomioon myös räjähdekohteen tuottama hyöty. Ruotsissa sekä yksilöriskin että ryhmäriskin tasojen määrityksessä käytetään muilla keinoin turvalliseksi todetun kohteen tuottamaa riskitasoa.QRA-menetelmiä on kelpoistettu eri puolilla eri tavoin, mutta järjestelmällistä ja kattavaa kelpoistusmenettelyä ei ilmeisesti ole otettu käyttöön missään päin maailmaa.Ydinvoimateollisuudessa ovat pitkän kehitystyön tuloksena kvantitatiiviset riskianalyysimenetelmät, lainsäädäntö ja menetelmien kelpoistaminen saavuttaneet asteen, jossa niistä on otettavissa elementtejä räjähde-QRA-analyysien tekemiseen, hyödyntämiseen ja alan lainsäädäntöön liittyen.

The objective of SEARCH (2019–2022) is to develop methods and tools for assessing technical design solutions related to overall instrumentation and control (I&C) system architectures. A particular focus is on trade-offs between requirements related to safety, dependability and security. We also aim to broaden the scope in which formal methods can effectively be used to verify properties on how the I&C systems operate as a whole. In the first two project years, SEARCH has developed models and methods for early hybrid assessment of safety and security of overall I&C architectures. In addition, we have further developed methods of performing software model checking, accounting for hardware failures and communication delay. We have also developed a practical tool for explaining counterexamples.

In model checking, a model of instrumentation and control (I&C) system’s application logic is created to formally verify the correct functioning of a system model by examining all of its possible behaviours. Model checking can provide important information on the failures of digital I&C systems and their software in particular.The integration of model checking with probabilistic risk assessment (PRA) modelling has been studied previously in two separate case studies. In the report, an overview to the common taxonomy of failure modes and current practices of modelling digital I&C systems in PRA is given. Findings from the previous case studies are reflected to the PRA modelling practices. Design issues identified by model checking in various VTT customer projects are compared to the failure modes and failure effects of software modules collected from different taxonomies for PRA.The case studies propose a coupling approach where the results of PRA are used to support model checking. The model checking analysis is restricted to a limited set of postulated hardware failures based on PRA results, potentially improving scalability of model checking. In this report, the focus is reversed and the focus is on studying how model checking can support PRA and its taxonomy.In order to use the model checking method as a support analysis for PRA modelling the complementary uses of the modelling methods should be developed. Potential complementary uses are for example: 1) The identification and analysis of extraordinary failure modes, including software failure modes, and potential detection of these failure modes; 2) Software reliability assessment of important functions; 3) The analysis and modelling of dynamic, i.e. time-dependent, features.

A practical modelling approach for assessing cascading effects of critical infrastructures (CIs) is presented. The overall objective in the modelling is to specify threats and dependencies leading to the cascading effects of identified CIs. The threats are presented as threat functions describing the expected level of intensity of threats at a certain time and location. The dependencies are presented in interdependency tables stating the rules of CI dependencies. The predicted cascading effects are set on a timeline in order to create a common picture of the situation. The timeline can be used to understand the incident evolution and to mitigate the consequences. For the modelling approach two initial requirements were set. The modelling approach should be versatile to be used in different accident scenarios implementing information from different kinds of threat functions. It should be scalable in the level of detail so that the spatial modelling of the accident scenario concurs with the overall assessment objectives. In an accident scenario, the overall assessment objective is often two-fold. It can be the crisis management during the accident, or it can be the accident recovery to normal life with functioning CIs. In the crisis management during the accident, the main focus is in the short-term operations trying to minimize the injury of people and the damage to the environment and property. In the accident recovery, the focus is more in the long-term operations trying to repair the subsequent damages. The two overall objectives are of course overlapping and their actual difference is in the time span of the operations. The modelling approach was developed using a flooding scenario in a densely populated area as an example. The crisis management during the accident was chosen as the overall assessment objective. An accident scenario map, locating the initiating events and CIs, was defined and a hexagonal grid was laid on the map. The relevant CIs for each hex were identified, and their interdependencies and vulnerabilities were defined in the model. A reference point was chosen for each hex. The threat function results on the reference point were then applied to all CIs in the hex. The threat function describing the expected level of water in the different locations of the polder area at a certain time was provided by a separate modelling tool. The initial failure times (i.e. not considering the interdependencies) of the CIs were determined. The final failure times were determined taking into account the interdependencies between the CIs, and the cascading effects were assessed. The modelling approach results are best utilized in the preparedness and training phase of crisis management. It gives guidance for the planning of emergency response by revealing the CIs that are important to protect in order to prevent or mitigate the escalation of the accident. The failure times can be compared with the estimated response times to evaluate the feasibility of different accident responses and what kind of impact the responses can have to the overall accident sequence.

An essential issue in the construction of new or in the replacement of the old analogue automation applications in nuclear power plants is the reliability of computer-based systems, and especially the question of how to assess their reliability. The reliability issue is particularly important when the system under assessment is considered as a safety-critical system, such as the reactor protection system. To build sufficient confidence on the reliability of computer-based systems appropriate reliability assessment methods should be developed and applied. The assessment methods should provide useful and plausible reliability estimates, while taking the special characteristics of the reliability assessment of computer-based systems into consideration.The Bayesian inference has proved to be an efficient methodology in the reliability assessment of computer-based automation applications. Practical implementation of Bayesian inference, Bayesian networks, allow the combination of the different safety arguments concerning the system and its development process to a unified reliability estimate. Bayesian networks are also a convenient way to communicate on the safety argumentation between various participants of systems design and implementation as well as between the participants in the licensing processes of computer-based automation systems. This study is a part of the research project “Programmable Automation System Safety Integrity assessment (PASSI)”, belonging to the Finnish Nuclear Safety Research Programme (FINNUS, 1999–2002). The project aimed to provide support for the authorities and utilities in the licensing problems of computer-based automation systems. Particular objective of the project was to acquire, develop and test new and more cost-effective methods and tools for the safety and reliability assessment, and to gather practical experience on their use in order to achieve a more streamlined licensing process for the computer-based automation systems.The project is financed together by the Radiation and Nuclear Safety Authority (STUK), the Ministry of Trade and Industry (KTM) and the Technical Research Centre of Finland (VTT).

Often to make justified reliability claim of a certain system different kinds of evidence needs to be combined. Some of the evidence supporting the claim may be of qualitative type, whereas some of the evidence may be of quantitative type. Combination of disparate evidence together is not always straightforward and the reasoning behind the conclusions obtained from the combination may be hard to explain. Bayesian networks provide a consistent and transparent method for the combination of the evidence and for the reasoning of one's beliefs on the relation of different pieces of evidence. In the special report we demonstrate the combination of disparate evidence with a case study on the reliability assessment of a software-based motor protection relay, where the combination of the reliability related evidence has been carried out using Bayesian networks. The reliability related evidence in the case study is the expert judgement on the development process and the operational experience estimated for the software-based motor protection relay.

Failure mode and effects analysis (FMEA) is one of the well-known analysis methods having an established position in the traditional reliability analysis. The purpose of FMEA is to identify possible failure modes of the system components, evaluate their influences on system behaviour and propose proper countermeasures to suppress these effects. The generic nature of FMEA has enabled its wide use in various branches of industry reaching from business management to the design of spaceships. The popularity and diverse use of the analysis method has led to multiple interpretations, practices and standards presenting the same analysis method. FMEA is well understood at the systems and hardware levels, where the potential failure modes usually are known and the task is to analyse their effects on system behaviour. Nowadays, more and more system functions are realised on software level, which has aroused the urge to apply the FMEA methodology also on software based systems. Software failure modes generally are unknown-"software modules do not fail, they only display incorrect behaviour"-and depend on dynamic behaviour of the application. These facts set special requirements on the FMEA of software based systems and make it difficult to realise. In this report the failure mode and effects analysis is studied for the use of reliability analysis of software-based systems. More precisely, the target system of FMEA is defined to be a safety-critical software-based automation application in a nuclear power plant, implemented on an industrial automation system platform. Through a literature study the report tries to clarify the intriguing questions related to the practical use of software failure mode and effects analysis. The study is a part of the research project "Programmable Automation System Safety Integrity assessment (PASSI)", belonging to the Finnish Nuclear Safety Research Programme (FINNUS, 1999-2002). In the project various safety assessment methods and tools for software-based systems are developed and evaluated. The project is financed together by the Radiation and Nuclear Safety Authority (STUK), the Ministry of Tradeand Industry (KTM) and the Technical Research Centre of Finland (VTT).

In the licensing of a programmable automation system different kind of evidence is collected and analysed in order to make sure that the system fulfils the safety requirement set for the system by the authority. The PASSI project aims to provide support for the authorities and utilities in the licensing process of programmable automation systems. This report presents a summary of the tasks and results gathered in the PASSI project.

Due to the nature of software faults and the way they cause system failures new methods are needed for the safety and reliability evaluation of software-based safety-critical automation systems in nuclear power plants. In the research project "Programmable automation system safety integrity assessment (PASSI)", belonging to the Finnish Nuclear Safety Research Programme (FINNUS, 1999-2002), various safety assessment methods and tools for software based systems are developed and evaluated. The project is financed together by the Radiation and Nuclear Safety Authority (STUK), the Ministry of Trade and Industry (KTM) and the Technical Research Centre of Finland (VTT). In this report the applicability of Bayesian networks to the reliability estimation of software-based systems is studied. The applicability is evaluated by building Bayesian network models for the systems of interest and performing simulations for these models. In the simulations hypothetical evidence is used for defining the parameter relations and for determining the ability to compensate disparate evidence in the models. Based on the experiences from modelling and simulations we are able to conclude that Bayesian networks provide a good method for the reliability estimation of software-based systems.

Quantitative reliability models of programmable systems are presented. The models are based on Bayes network approach. The models are applied to a simple example case where data from different operational profiles are combined. In addition, the approach is applied to determine the amount of data from another operational profile needed to compensate the lack of data from the operational profile under consideration.

Quantitative reliability models of programmable systems are presented. The models are based on Bayes network approach. The models are applied to a simple example case where data from different operational profiles are combined. In addition, the approach is applied to determine the amount of data from another operational profile needed to compensate the lack of data from the operational profile under consideration.