The theoretical framework of the approach for dynamic reliability assessment of the DPCSNR was established by using DFTA, DBN, FM, and MC methods, and it is shown in Figure 2.

The DFT for the DPCSNR was established by using the DFTA method, and the steps were as follows:

Step 1Identify the factors influencing the DPCSNR failure.

The structure and function of the DPCSNR were investigated, and the factors influencing its failure were identified in terms of hardware, software, and human operations.

Step 2Identify the failure events resulting in the DPCSNR failure.

The failure events including failure causes, failure modes, and failure consequences of the DPCSNR were identified by using the failure mode and effect analysis method, and the failure causes, failure modes, and failure consequences were defined as the basic events, intermediate events, and top events in the DFT for the DPCSNR.

Step 3Characterize the dynamic interaction for the DPCSNR.

The dynamic and static logic gates were introduced to analyze the hardware–software–human interactive behavior for the DPCSNR, and the dynamic interaction for the DPCSNR was characterized. After the analyses, the introduced dynamic logic gates included the PAND gate, FDEP gate, and cold spare (CSP) gate in spare gates, and the introduced static logic gates included AND gate and OR gate.

By using the three aforementioned steps, the DFT for the DPCSNR was established, as shown in Figure 3, and the symbols and their descriptions in the figure are given in Table 1.

In the BN model, a node X _i is given, and it is conditionally independent of all the other nodes, except its parent and child nodes. For a two-state system with n nodes, its joint probability distribution can be determined from the following equation (Khakzad et al., 2017; Sundaramoorthy et al., 2021): P ( X 1 , X 2 , ⋯ , X n ) = ∏ i = 1 n P ( X i | P a ( X i ) ) , (1) where Pa ( X i ) represents the parent set of X _i and P ( X i | Pa ( X i ) ) is the conditional probability distribution.

The DBN is an extension of the static BN in time (Hearty et al., 2009; Khakzad, 2019). By combining the static BN with time information, the transition model between two neighboring time slices for the DBN model can be established as follows (Maldonado et al., 2019): P ( X t | X t − 1 ) = ∏ i = 1 N P ( X t , i | P a ( X t , i ) ) , (2) where X _t and X _t-1 represent the nodes at time slice t and t-1, respectively; X _t,i is the i-th node in time slice t; and Pa(X _t,i ) is its parent node set.

In the DBN model, the joint probability distribution of multiple time slices can be calculated from the following equation (Khakzad et al., 2016; Guo et al., 2021): P ( X 1 : T ) = ∏ i = 1 T ∏ i = 1 N P ( X t i | p a ( X t i ) ) , (3) where X 1 : T = { X 1 , X 2 , ⋯ , X T } .

Based on the established DFT and by using the DBN and FM methods, the DBN model for the dynamic reliability assessment of the DPCSNR was established, and the steps were as follows (Mamdikar et al., 2021):

Step 1Determine the nodes and CPT in the IDBN model.

Using the transformation strategy from the DFT to the DBN model, the basic events, intermediate events, and top events in the DFT for the DPCSNR were transformed as root nodes, intermediate nodes, and leaf nodes (Cai et al., 2013; Yazdi and Kabir, 2017), and the static logic gates and dynamic logic gates were transformed as CPT in the IDBN model (Liang et al., 2017).

Step 2Determine the prior probabilities for root nodes.

At the initial moment, t = 0, it can be assumed that hardware for the DPCSNR was completely reliable, which indicates that their prior probabilities were 0. By referring to the probabilistic safety analysis report for the NPP (U.S. Nuclear Regulatory Commission, 2017; Gertman et al., 2005), the prior probabilities of software failures and human failures were assumed to be 0.0001 and 0.1, respectively.

Step 3Determine the state transition probabilities for root nodes.

There is lack of failure rates of hardware for the DPCSNR. By referring to the probabilistic safety analysis report for the NPP (Durga Rao et al., 2009; U.S. Nuclear Regulatory Commission, 2017; Gertman et al., 2005), the operation and maintenance and reliability data for the DPCSNR, the expert experience, and the failure rates of hardware for the DPCSNR were determined, which were used to calculate the state transfer probabilities in the DBN model, as given in Table 2.

It was assumed that the hardware of the DPCSNR had two states including work (W) and failure (F); they were independent, and their failure probabilities followed the exponential distribution. The probability density for hardware failures can be calculated from the following equation (Oh and Lee, 2020): f ( t ) = τ e − τ t , (4) where τ denotes the failure probability.

The time interval between two neighboring time slices was set to 1 day (24 h). Taking the hardware failure of the MCU as an example, its state transition probabilities were calculated as follows: { P ( X ( t + 1 ) = W | X ( t ) = W ) = e − τ Δ t = 0.993064 , P ( X ( t + 1 ) = F | X ( t ) = W ) = 1 − e − τ Δ t = 0.006936 , P ( X ( t + 1 ) = F | X ( t ) = F ) = 1 , P ( X ( t + 1 ) = W | X ( t ) = F ) = 0 , (5)

Similarly, the state transition probabilities for other hardware were calculated.

Due to the complexity and uncertainty of software and human failures for the DPCSNR, it was assumed that their state transition probabilities were 0.

Step 4Characterize the causal relationship uncertainty.

The IDBN model transformed from the DFT cannot characterize the causal relationship uncertainty for the DPCSNR. The CPT in the IDBN model should be modified.

The senior experts on operation, maintenance, equipment management, reliability assessment, and probabilistic safety assessment for NPP were invited to participate in the assessment. They used their risk knowledge and experience and gave the assessment language for the causal relationship uncertainty. The triangular fuzzy number and trapezoidal fuzzy number were used to quantitatively present the assessment languages (Yazdi, 2020). The corresponding fuzzy number form and λ-cut set for the assessment language are given in Table 3.

In order to eliminate the subjective influence from expert judgments as much as possible, the collected fuzzy numbers were treated using the following equations (Deng et al., 2018; Yuan et al., 2021): I = f 1 λ ⊕ f 2 λ ⊕ ⋯ ⊕ f e − 1 λ ⊕ f e λ e , (6) μ L ( I ) = 1 2 [ ∑ λ = 0.1 1 m λ Δ λ + ∑ λ = 0 0.9 m λ Δ λ ] , (7) μ R ( I ) = 1 2 [ ∑ λ = 0.1 1 n λ Δ λ + ∑ λ = 0 0.9 n λ Δ λ ] , (8) P M = ( 1 − α ) μ L ( I ) + α μ R ( I ) , (9) where I denotes the average fuzzy number; e denotes the number of experts; f e λ denotes the corresponding fuzzy number for the e-th expert assessment language; μ L ( I ) and μ R ( I ) denote the integral value of the inverse function of the left and right membership functions, respectively; m λ and n λ denote the upper and lower bounds of the λ-cut set for the fuzzy number, respectively; λ = 0, 0.1, 0.2,…, 1 and Δλ = 0.1; P M denotes the modified conditional probability; and α denotes the optimistic coefficient. In this study, α = 0.

The assessment languages given by the invited experts were collected and transformed into the form of the corresponding fuzzy numbers in Table 3, then Eqs. 6–9 were applied to obtain the modified conditional probabilities. The CPT was further modified, as given in Table 4.

Through the four aforementioned steps, the DBN model for the dynamic reliability assessment of the DPCSNR was established as shown in Figure 4.

Previous studies show that the MC method is feasible in verifying the effectiveness of the DBN model (Lee and Choi, 2020). In this section, the MC method was used to simulate the DPCSNR reliability with MATLAB simulation software, and the steps were as follows (Abdo and Flaus, 2016):

1) Based on the failure probability distributions of root nodes (hardware) in the DBN model in Figure 4, their failure times were randomly generated. Then, the causal relationships between the nodes in the DBN model were used to judge whether the DPCSNR failed or not and to achieve its failure time.

Subsystem A, subsystem B, computer systems A and B, and the power supply system were set as module 1 (MOD1), module 2 (MOD2), module 3 (MOD3), and module 4 (MOD4), respectively. GeNIe software was used to conduct the forward reasoning, and the reliability curves for the DPCSNR and its four MODs were obtained, as shown in Figure 5.

Figure 5 shows that the hardware failure or damage to the DPCSNR would partially reduce the reliability of the DPCSNR. Therefore, periodic test and predictive maintenance should be carried out for the DPCSNR. To be conservative, it was assumed that the cycle for the periodic test and predictive maintenance was 60 days, which indicates that the hardware maintenance rate μ was 6.94 × 10⁻⁴. Under these conditions, Eq. 5 can be modified to the following equation: { P ( X ( t + 1 ) = W | X ( t ) = W ) = e − τ Δ t = 0.993064 , P ( X ( t + 1 ) = F | X ( t ) = W ) = 1 − e − τ Δ t = 0.006936 , P ( X ( t + 1 ) = F | X ( t ) = F ) = e − μ Δ t = 0.98347145 , P ( X ( t + 1 ) = W | X ( t ) = F ) = 1 − e − μ Δ t = 0.01652855. (10)

The reliability curve for the DPCSNR was further determined, as shown in Figure 6.

In response to the requirements of the operation technical specification for the DPCSNR, it is necessary to carry out the periodic test within the specified time to check whether the system and its components are available or not. Meanwhile, the predictive maintenance for the components, which have been determined to be invalid or have potential failure through the test, is conducted. Figure 6 indicates that through the periodic test and predictive maintenance, the hardware failure or damage can be effectively avoided, and the reliability of the DPCSNR was significantly improved.

GeNIe software was used to conduct the backward reasoning, and the sensitivity analysis results for the DPCSNR were obtained, as shown in Figure 7.

It can be seen from Figure 7 that the critical events leading to the DPCSNR failure were sorted as follows in terms of their impact degrees: computer system (A3 and B3) > ACU hardware (A1 and B1) > ACU software (A2 and B2) > MCU hardware (A4 and B4) > MCU software (A5 and B5) > other hardware programs (P1, S, P2, etc.). Thus, NPP should pay attention to the critical events, in turn, so as to ensure the safety and reliability of the DPCSNR.

The first dynamic characteristic of the DPCSNR is the dynamic interaction. As shown in Figure 3, the dynamic and static logic gates were introduced to characterize this dynamic interaction. The computer system in the DPCSNR is a special component. It contains a bus selector, processor, watchdog, RAM, and digital and analog signal processing software, and they interact with each other to realize the function of the computer system. The ACU hardware and its software interact, and MCU hardware interacts with the human operation. The ACF failure in subsystems is linked with ACU failure and computer system failure through the PAND gates. The subsystem failure is connected with the ACF failure and MCU failure through the SEQ gates. The sensor failure prior to main power failure or main power and cold spare power failures will result in the loss of power supply.

The second dynamic characteristic of the DPCSNR is the time dependence. A node in the DBN model at time slice t is affected not only by its parent node but also by its parent node or itself at time slice t-1, which is presented in the joint probability distribution function in Eq. 3 (Adumene et al., 2021). In the established DBN model, the nodes of hardware failures were defined as the dynamic nodes, as shown in Figure 4. The rates of hardware failures were used to calculate their state transition probabilities, as shown in Eq. 5, and the cycle of the periodic test and predictive maintenance was used to determine the maintenance rate so as to correct the state transition probabilities, as shown in Eq. 10. The lines with arrows represent the time dependencies between neighboring time slices.

The third dynamic characteristic of the DPCSNR is the causal relationship uncertainty. The analysis of the OR gate in Figure 3 shows that when an input event occurs, the corresponding output event still has a certain probability of not occurring. For example, when the MCU hardware failure or human error occurs, MCU failure still has a certain probability of not occurring. In order to reduce the causal relationship uncertainty for the DBN model, the FM method was used to modify the CPT, as given in Table 4.

The two reliability curves of the DPCSNR were obtained by using the DBN model and MC simulation (1 × 10⁵ times), respectively. Their relative error curve was drawn in the rectangular coordinate system, and the aforementioned results are shown in Figure 8. The figure indicated that the maximum relative error was only 1.08%, and the effectiveness of the DBN model was verified.