Version classiqueVersion mobile
OpenEdition Books

Proceedings of the fourth Resilience Engineering Symposium

Erik Hollnagel
Éric Rigaud
Denis Besnard

A Neuro-Fuzzy System to Improve the Resilience in Nuclear Power Plant Operation

Paulo Victor Rodrigues de Carvalho, Rafael G. Costa et Antonio C. A.  Mol


Early identification of possible accident situations is an essential issue to improve the resilience in the operation of NPPs, because the operators can anticipate accident scenarios and have more time to plan their in actions in critical situations. Artificial intelligence techniques are suitable to identify complex systems accident situations because the system faults and anomalies lead to different pattern evolution in the correlated processes variables, which can be identified by artificial neuron networks (ANNs). The system developed aims to support operators’ attention direction during accidents in NPPs using a Neuro-Fuzzy approach for early event identification. ANNs are used for event identification and, and a fuzzy-logic system analyzes the results giving a confidence level of the identification. The results show that the system can help the operators to direct their attention and narrow their information search field in the noisy background of the operation during accident situations in nuclear power plants, having more time to plan and develop mitigating actions.

Texte intégral

1 Introduction

1Human work in high risk organizations is still based on tasks that prescribe the correct way to do the work (Bourrier, 1999). These tasks are written in procedures that have to be followed to avoid human errors. The main objective of this type of safety management approach is to control (reduce) the variability and autonomy of human agents, through accurate procedures, strong oversight and supervision, and a division of labor with clearly defined roles and responsibilities. According to this view, to follow procedures as a script is the basis for reliable and safe operation in many operating nuclear power plants around the world. Under such safety paradigm, human error - the problem to be avoided -is defined as any performance deviation when compared with the action sequence specified in the procedure. To perform the sequence of actions exactly as it is written in the procedures, operators need correct and unambiguous information about plant situation. Based on this view, ambiguous response from instrumentation systems, for example, “there is 80 % chance to have a Loss of Coolant Accident (LOCA)” may undermine and difficult operators work, because it provides uncertain information. In this context, operator support systems for accidents diagnosis should provide only the answer when they have 100 % certainty about the situation.

1.1 A New Paradigm for Failure Management in Complex Systems

2The major nuclear accidents such as TMI, Chernobyl and Fukushima have shown that NPPs in accident situations behave as an intractable system (a system is intractable if the principles of functioning are partly unknown, if descriptions are elaborate and detailed, and if it changes before a description can be completed (Hollnagel, 2009)). In accident situations, to perform a prescribed action sequence may not be enough because there is no absolute certainty about what is really happened in the plant, or the situation changes the structure of the system in a way that to perform prescribed tasks make no sense anymore, as the Fukushima accident dramatically indicated. In the maneuver called “feed and bleed”, Japanese engineers performed a Hail Mary style attempt at cooling the troubled Fukushima reactors that has at least partially melted down. The maneuver, which is not prescribed in any procedure, involves feeding, or rather pumping, cold (see) water into the reactor’s pressure vessel, but they can only do that for a short time. As the water hits the overheated fuel rods, it boils. The resulting steam raises the pressure inside the chamber to a point where no more water can be pumped in. To allow more cold water to be pumped in, the chamber must be bled. Bleeding is accomplished by allowing the superheated radioactive gases to escape to atmosphere through vents.

3Therefore, the operation paradigm currently used for normal operations must be change to deal with accident situations, because the current approach limits the action possibilities of operators to cope with system complexity due:

  • System designers cannot provide a complete set of actions that are needed in the entire range of plant operational situations because of constraints imposed by the system/environmental variability.

  • The operators may have difficult to determine if the procedures, they are supposed to follow, are the best choice to dealing with a new situation (Carvalho et al, 2007).

  • Operating teams do not have the necessary help to determine whether (and why, when) procedures could be modified without jeopardize safety.

  • In uncertain, partly unknown situations, in which operators do not have the support of written procedures and completely correct (unambiguous) information such as FAIL or NOT FAIL, RIGHT or WRONG, operators have faced situations in which they have to improvise, making sacrifice decisions, and searching for ad hoc re-configurations in the plant systems (Carvalho et al., 2007) without adequate support.

4These factors justify the use of support systems that provide partial information about situations that may be evolving in the plant, to support the development of new cognitive strategies, improving the operational resilience (Woods, 2006). The difficulties in actual fault management systems that are based on information provided by alarms during accident situations have already been identified: alarms avalanche, meaningless alarms, unclear or underspecified alarm messages, alarm inflation, alarms indicating the state of the system rather than abnormalities (Woods, 1995). The temporal dynamics is also relevant. Because the close correlation between the variables of NPPs processes, the period when a lot of alarms occur is just during the beginning of the accident, when operators have identify what is happening in the plant. It is precisely during this period of high workload that technological artifacts should provide the necessary assistance to the operators assess the situation. However, in most of actual nuclear power plants, it is in this period that occurs most of meaningless alarms, coming from systems that are not important to solve the problem (Carvalho et al., 2007). Therefore, the alarm system distracts operators and disrupts their activities, making diagnosis more difficult and hindering the activities of information search and prioritization. These factors constitute the so-called alarm system problem (Woods, 1995).

5To help accident diagnosis in accident situations, we develop a neuro-fuzzy system that assumes the role of an agent trying to anticipate problems in order to direct the attention of the operators to the potentially more interesting events that are occurring, in a situation with a huge number of variables, limited time to make decisions, and multiple action selection possibilities. The direction of attention, as early as possible, to the type of event that is occurring in the plant is paramount for the operator plan their actions in the near future, achieving an adequate situation awareness (Vidal et al ., 2009).

6In a system in which control and time are indispensable aspects in the control room operators’ work, the control of attention allows an anticipation of action plans, and occurs when attention driven signals provide important information for action selection, or when the attention driven signals show information that can be ignored, or may be delayed, safely, in accordance with the situation. In general, an attention driven signal says, “there is something I believe you will find interesting or important, so you should check it out.” The criteria for an effective attention direction requires that the attention driven signals can be received by the operator in parallel with their line of reasoning and activities in progress, including partial information about the problem solution. The goal is to allow the operator to decide when the interrupt signal endorses an authorization for a change (or not) in the attention focus.

7The concepts presented above were used to develop the system to help nuclear power plant operators in the diagnosis of NPP accidents.

2 System for Accident Diagnosis

8The system consists of event identification modules, based on ANNs, and a fuzzy system, that informs confidence degree of the event identification made by ANNs (Costa et al. 2011).

2.1 ANNs for event identification

9For the event identification, we use the multi-type ANN jump model. The system explores the excellent performance of multilayer ANNs with a backpropagation training algorithm (Haykin, S., 1999). In a jump-type multilayer ANNs, a neuron, in any layer of the network, is connected to all other neurons of the other layers (there is no feedback). The signal flowed through the network is propagated "forward", from left to right, going through all the layers. The "backpropagation" method results in a synapses update rule in which the "error signal", indicates the error from one neuron and propagates it back (neuron by neuron) through the network. To identify an event type we use a modular structure called Independent Identification Module (IIM), as shown in Figure 1. Each IIM is composed by four Basic Neural Modules (BNM) that is formed by one ANN. Each BNM is responsible to identify a type of event. Each BNM uses NPP variables as input signals and deliver two outputs: A indicates the event for which the module is responsible (trained to identify), and B indicates all other events.

10Thus, it was necessary that the ANN of each BNM were trained with two sets of standards, a set representing the class A events and another set representing the class B events. The BNM output is 1 if the inputs corresponds to a class A event and 0 for class B. The final event identification structure is composed by a set of IIM modules. The total number of modules in the system is chosen according to the number of events we want identify.

Figure 1. The Independent Identification Module (IIM) formed by four basic neuron modules (BNM) with A and B outputs.

2.2 Fuzzy System to Calculate the Event Confidence Degree

11To increase the network robustness to deal with the noisy background of the operation in actual situations, we need to train the ANNs with a larger set of patterns. This is done by adding noise patterns to the ideal event/accident patterns. During the training phase we force that the ANNs recognize these new patterns as belonging to their original classes (no noise situations). The outputs of ANNs in response to input patterns that represent the same event with noise should float around the no-noise discrete expected value. Therefore, to measure how noise influences the identification we compare the continuous values presented at the output of the network (with noise) to the discrete values that represent each event (without noise). This procedure determines the event deviation (Dev), which is defined by the difference between the expected value and the output value of the ANN. The Dev value is used as the input for the fuzzy module (Figure 2) that calculates the confidence degree of the event identification.

12To make the comparison between the outputs of the BNMs, we define the input linguistic variable Module_Event, to test the relevance degree of the current event in the BMN, and the linguistic variables Event_1, Event_2 and Event_3 to test the relevance of the same event in the other BMNs of the same IIM. As output variable, we define the linguistic variable Confidence_Degree. A set of fuzzy logic rules is used to provide the heuristic base for calculation of confidence degree. These rules are empirical, based on logic of plant functioning in each accident situation.

Figure 2. Fuzzy system to provide the confidence level of the event identification. Each BNM is specialized in one type of event.

3 Results and Discussion

13The system was tested in the PWR simulator of the Human System Interface Laboratory of the Nuclear Engineering Institute. Four plant conditions has been trained by the NNs: the Normal plant condition, and the accidents LOCA (loss of coolant accident), SGTR (Steam Generator Tube Rupture), MFW (main feedwater malfunction). Another accident type, the turbine trip (TRIPTUR), an automatic shutdown of the turbine, was not trained by the NNs and remain as the unknown accident. The input variables chosen were those that most contribute to each accident characterization such as: flow and temperature in hot leg (the output of the reactor vessel), cold leg temperature (input if the reactor vessel), level in the steam generator, wide range indication of the level in the steam generator, narrow range indication of the pressure in the steam generator, feed water flow rate of steam in the pressurizer, narrow range temperature margin of the coolant, pressure of the pressurizer.

14The ANNs were trained for identification of the LOCA, MFW and STGR with the power plant operating at 100 % power. The TRIPTUR accident was not trained. We use 6848 patterns during the NNs training. The system was tested with several levels of noise (1 %, 15 % and 20 %).

15The system presented correct event identification, even in situations of high uncertainty at the input (simulated by the 15 % noise level added in the input). In all situations, the correct accident was identified correctly after 15s (more than 50 % of certainty). Based on that information, an operator may quickly direct (15 seconds after the start of the event) his/her attention to the most likely event, even in a noisy background, reducing his/her information search field. Therefore, an operator has more time to test and validate his/her action options, resulting in a faster and more effective way to cope with the events.

16The system was able to identify the TRIPTUR accident, as an unknown accident (this accident was not trained), indicating that the system presents an adequate response for an event that did not belong to the training scope of neural modules.

17The system was able to successfully handle the transition from the NORMAL condition for the accident condition, identifying the LOCA accident in 2s and the other accidents in 6s. This rapid accident identification, directing operators’ attention to the most probable situations, can improve the operators’ dynamic failure management during accidents, because during such moments (beginning of accidents) dozens of alarms occur simultaneously competing for the operators’ attention and pointing to different plant systems and situations. An early and reliable indication about what is happen in the plant, provided by the diagnostic system, will facilitate operators’ choices and direct their course of actions during these important moments of the plant operation.

18In the transition from NORMAL condition to the TRIPTUR accident, the system in the first few seconds tries to classify this event as an accident pertaining to the identification module training set. After 6s, the system shows that this possibility is close to zero. Even in a situation of unknown event, the system indicate signs of possible abnormalities in the plant (4.5 % LOCA, 6,9 % SGTR, different from the 0 % indication expected in the normal condition). These weak abnormalities indications may be enough to alert operators that something unusual (and different from the accidents that the system can identify) is already be happening in the plant.

19An important feature of the system is its independence from a signal that indicates the beginning of the accident, such as the REACTOR TRIP (automatic reactor shutdown) event as occur in most event identification systems. The process to identify accidents independent from initiator signals improves the response time of the system and has been achieved due to the robustness of the system in relation to noise, allowing the system to distinguish between a noisy condition of normality and a condition outside the normal operation range.

4 Conclusions

20We present an operator support system which aims to direct the attention of the operators during the diagnosis of accidents in nuclear power plants using techniques and concepts of Artificial Intelligence, particularly Artificial Neural Networks and Fuzzy Logic. The system objective is to help the operator during the assessment of accidents, indicating in advance and in a reliably way what type of accident may be occurring in the plant, and allowing the operators to direct their attention, narrowing the information search field in the noisy background of the operation during accident situations in nuclear power plants. Focusing their attention in the most likely event contributes to reducing the cognitive overload of the operators during accident diagnosis, increasing their availability for the execution of appropriate corrective actions to bring the plant to a safe operating condition. The results obtained indicated that the jump type ANN, with backpropagation training is able to quickly diagnose the accidents that have been postulated for a PWR nuclear reactor, even with addition of noise that simulates the noisy background of actual operation. The system developed in the LABIHS-IEN simulator. Preliminary evaluation shows that the proposed method for event identification was able to provide reliable results allowing a rapid and accurate identification of accidents, and can be easily implemented in a real nuclear power plant, towards the addition of more identification accidents modules.


21The authors gratefully acknowledge the support of National Advice of Scientific and Technological Development (CNPq) and of Rio de Janeiro Research Support Foundation (FAPERJ).



Bourrier, M. (1999). Le nucléaire à l’épreuve de l’organizsation. Paris: puf.

Carvalho, P. V. R., Vidal, M. C., Carvalho, E. F. (2007) Nuclear power plant communications in normative and actual practice. Human Factors in Ergonomics and Manufacturing, 17, 43-78.

Costa, R. G., Mol A. C., Carvalho P. V. R., Lapa C. M. (2011). An efficient Neuro-Fuzzy approach to nuclear power plant transient identification. Annals of Nuclear Energy, Article in press.

Haykin, S. (1999). Neural Networks a Comprehensive Foundation. Englewood Cliffs: Prentice Hall.

Hollnagel, E. (2009). The ETTO principle. London: Ashgate.

Vidal M.C.R., Carvalho P.V.R., Santos M. S., Santos I.J.L. (2009). Collective work and resilience of complex systems. Journal of Loss Prevention in the Process Industries, 22 (4), 516-527.

Woods, D. D. (1995). The Alarm Problem and Direct Attention in Dynamic Fault Management, Ergonomics, 38(11), 2371-2393.

Woods D. D. (2006). Essential characteristics of resilience for organizations. In: Hollnagel E. , Woods D. D., Leveson N., editors. Resilience engineering: concepts and precepts. Aldershot, UK: Ashgate; 2006.

Table des illustrations

Légende Figure 1. The Independent Identification Module (IIM) formed by four basic neuron modules (BNM) with A and B outputs.
Fichier image/jpeg, 72k
Légende Figure 2. Fuzzy system to provide the confidence level of the event identification. Each BNM is specialized in one type of event.
Fichier image/jpeg, 85k


Nuclear Engineering Institute, R. Helio de Almeida 75, Rio de Janeiro, Brazil

Nuclear Engineering Institute, R. Helio de Almeida 75, Rio de Janeiro, Brazil

Nuclear Engineering Institute, R. Helio de Almeida 75, Rio de Janeiro, Brazil

© Presses des Mines, 2011

Conditions d’utilisation :