A Cause Analysis Model of Nuclear Accidents in Marine Nuclear Power Plants Based on the Perspective of a Socio-Technical System

Abstract

Marine nuclear power plants (MNPPs) represent items of forward-looking high-end engineering equipment combining nuclear power and ocean engineering, with unique advantages and broad application prospects. When a nuclear accident occurs, it causes considerable economic losses and casualties. The traditional accident analysis of nuclear power plants only considers the failure of a single system or component, without considering the coupling between the system and the operator, the environment, and other factors. In this study, the cause mechanism of nuclear accidents in MNPPs is analyzed from the perspective of a social technology system. The causal analysis model is constructed by using the internal core causal analysis (e.g., technical control) and external stimulation causal analysis (e.g., social intervention) of accidents, after which the mechanism of the coupled evolution of each influencing factor is analyzed. A Bayesian network inference model is used to quantify the coupling relationship between the factors that affect the deterioration of nuclear accidents. The results show that the main influencing factors are pump failure, valve failure, insufficient response time, poor psychological state, unfavorable sea conditions, unfavorable offshore operating environments, communication failure, inappropriate organizational procedures, inadequate research and design institutions, inadequate regulatory agencies, and inadequate policies. These 12 factors have a high degree of causality and are the main factors influencing the deterioration of the small break loss of coolant accident (SBLOCA). In addition, the causal chain that is most likely to influence the development of SBLOCA into a severe accident is obtained. This provides a theoretical basis for preventing the occurrence of marine nuclear power accidents.

1. Introduction

At present, the application of marine nuclear power equipment in the field of national defense is mainly reflected in nuclear-powered submarines, nuclear-powered aircraft carriers, and nuclear-powered cruisers. In terms of the number and development strength of nuclear-powered ships, the United States and Russia lead the world. In 1954, the United States’ “Nautilus” nuclear-powered submarine service opened the first marine nuclear power application. There are more than 300 nuclear-powered submarines in the world, with more than 160 in service, mostly using small pressurized water reactor technology [1]. There are 12 nuclear-powered aircraft carriers in the world, all using small pressurized water reactor technology. The development of marine nuclear power equipment in the civil field is mainly manifested in three application scenarios: nuclear merchant ship, nuclear icebreaker, and floating nuclear power plant at sea. In the 1950s, the United States, the Soviet Union, Japan, and Germany began to study civilian nuclear-powered ships. In 1957, the world’s first nuclear-powered icebreaker “Lenin”, built by the Soviet Union, was launched, and in 1959, the world’s first nuclear-powered merchant ship “Savannah”, built by the United States, was launched, which opened the prelude to the peaceful application of civil marine nuclear power equipment [2]. With the continuous development of nuclear energy [3,4,5] technology, marine nuclear power plant [6] technology has received more extensive attention and rapid development in the world. The International Atomic Energy Agency and the United States Nuclear Regulatory Commission have consistently stated their belief that the safety goal of a nuclear accident is not to eliminate risks, but to control risks [7,8]. Controlling risks means eliminating or reducing the possibility of risk events through various measures and methods, or reducing the losses caused by risk events when they occur. However, the large structure, complex operating conditions, and harsh working environment of marine nuclear power plants (MNPPs) make the probability of nuclear accidents higher than that seen in land-based nuclear reactors. The operating conditions of MNPPs are even more severe than those of land-based nuclear power plants, and their remoteness from their bases makes it easy for them to become isolated or inaccessible for timely rescue, thus enlarging the scope of the hazards and aggravating the radiological impacts of nuclear accidents. Therefore, the government and the public are paying increasing attention to the safety of MNPPs in the event of a nuclear accident.

The Three Mile Island nuclear leak accident [9] did not cause any casualties, but it caused huge economic losses and public panic. A large amount of radioactive material was released in the Chernobyl nuclear accident [10], resulting in the immediate death of 31 people. Over the next 15 years, an estimated 60–80 people died from radiation exposure and 134 developed severe radiation illness. The Fukushima nuclear accident [11] had long-term effects on the environment and public health, forcing the evacuation of large numbers of residents. As of February 2018, 159 cases of cancer have been diagnosed among residents of Fukushima Prefecture, with 34 suspected cases of cancer. The hazards of nuclear accidents and their consequences are enormous, and the related research of nuclear accidents is of great significance to prevent the occurrence of nuclear accidents and formulate emergency strategies. Kwag et al. applied an improved probabilistic safety assessment (PSA) methodology, which is a PSA framework based on Bayesian networks with fault trees, combined with additional on-site observations and vulnerability assessment under severe accident conditions [12]. Silva et al. used the three-level PSA method to calculate the cost and analyze the consequences of a single severe accident, carried out sensitivity analysis to determine the cost-sensitive parameters of a severe accident, and showed the cost of a single severe accident as an indicator to evaluate the consequences of a severe accident [13]. Mohsendokht et al. proposed a new severe accident management framework to deal with the risk of radionuclide release into the environment in order to reduce the impact of severe accidents on the early release of radioactive substances in the VVER-1000 nuclear reactor [14]. Xuefeng et al. studied the hydrogen risk and hydrogen control system of the loss of coolant accident of a marine reactor, analyzed the hydrogen production rate and steam release rate, and simulated the two-dimensional flow field and the transport and distribution of hydrogen in the tank [15]. Ouyang et al. conducted the atmospheric radioactive diffusion caused by severe accidents in MNPPs, established a simulation model of the atmospheric diffusion of radionuclides over the ocean, and studied the effects of seawater absorption on the atmospheric diffusion of radionuclides at different heights [16]. Zhang [17] and Wang [18,19] et al. conducted source term analysis on the severe accidents of large break loss of coolant accident in MNPPs combined with ship power failure, as well as steam generator heat transfer tube damage combined with ship power failure, focusing on the release and migration rules of radionuclides. It provides data support for emergency decision-making of nuclear accident consequences.

Currently, scholars both domestically and internationally are actively carrying out research on safety technology to limit nuclear accidents. Thus, the nuclear industrial system has been transformed into a complex social engineering system via the continuous progress of technology, which brings new challenges into the analysis of nuclear accidents [20]. The event chain model and the epidemiological model have been unsuccessful in describing the performance characteristics of these complex systems, so a model based on system theory has emerged. The system model considers accidents as being generated by the interaction of several factors such as operators, organizational management, technology, and the environment [21]. Alternatively, the whole complex system is also subject to the interaction of internal and external factors at the same time, resulting in the system being disturbed by hazardous or unstable environments. At this point, even small deviations may lead to accidents [22,23,24]. Zarei et al. proposed a hybrid dynamic model combining human factors and classification systems, intuitionistic fuzzy set theory, and Bayesian networks, which showed that poor occupational safety training, failure to implement risk management principles, and neglecting to report unsafe conditions were the main causes of accidents [25]. Zarei et al. proposed a fuzzy Bayesian network method to deal with uncertainty factors effectively, which mainly utilizes expert heuristics and fuzzy theories to calculate probabilities, and employs the same reasoning algorithm as the traditional Bayesian network approach to predictive analysis and updating probabilities [26]. Zarei et al. established a classification method of factors affecting the overall performance based on the design of socio-technical systems, and adopted a new interval-valued spherical fuzzy set and the best differential method to quantify the importance of performance [27]. Tan et al. combined fault tree and event sequence diagram research methods to simulate the progression of an abnormal event at gas collection stations, predicted the occurrence probability of the consequences of the abnormal event based on the accident causal chain theory, and used the inference capability of Bayesian networks to update the failure probability of the basic event [28]. Mahmudah et al. focused on socio-economic factors and used a combination of Fuzzy Analytic Hierarchy Process (AHP) and Fuzzy VIKOR research methods to prioritize the top ten standard factors and find the most suitable location for nuclear power plants [29]. Based on the accident model and process of the system theory, Ceylan et al. adopted the Bayesian network (BN) modeling method to conduct a comprehensive safety analysis of the water fog system of the oil cargo ship, and obtained the dynamic structure composed of complex elements [30]. Oettingen et al. used the Monte Carlo research method to conduct critical analysis of the Louis Slotin nuclear accident, and established a numerical model and the influence of system components on the critical state. The critical state method was applied to the mass function of tungsten carbide reflector [31,32]. Antonello et al. conducted a qualitative analysis of hazard based on system theory accident models and process principles, and studied the dynamic behavior of accident scenarios through modeling and simulation [33]. Therefore, the above research recognizes that the causes of accidents in complex systems cannot be attributed exclusively to fundamental defects, undetermined factors, or failure modes.

In the basic engineering techniques applied in safe and reliable engineering, the safety analysis and evaluation of accidents rely heavily on oversimplified assumptions, ignoring the inherent variability and uncertainty in complex systems. Leveson proposed a new approach to safety based on modern system thinking and system theory, which is more suitable for the complex, social–technical, software-intensive world of today [34]. In complex social–technical systems, it is necessary to effectively learn from past events or accidents while maintaining risk management at a stable level throughout the system’s entire lifecycle [35,36]. To ensure successful risk management, it is necessary to use a holistic strategy and an integrated approach that includes technical, managerial, social, organizational, political, and environmental factors [37]. The main purpose of these studies is to understand the complex interdependencies between human, technical, and organizational factors in the system. The specific goal is to identify variability in daily operations and assess its potential impact on system safety. Qualitative and quantitative risk analysis plays an important role in complex social–technical systems, especially in solving the qualitative problems of system analysis methods [38,39]. The proposed method uses quantitative values to more realistically represent the high safety of the system [40]. The Bayesian network is a graphical model that represents the dependency relationship between variables. It can help elucidate the complex causal relationship through reasoning and be used to carry out quantitative analysis.

This paper takes a hypothetical nuclear accident at an MNPP as the research object, seeking to clarify the cause of the accident. Traditional accident-modeling methods are not sufficient to analyze accidents that occur in complex environments such as socio-technical systems, because accidents are not the result of individual component failure or human error. Therefore, we need a more systematic approach to investigation and accident modeling. There is a need to consider the entire socio-technical system and focus on considering both the social and technical aspects of the system. When simulating accidents, it is necessary to consider the social structure and social interaction processes, the cultural environment, the individual characteristics of people, such as their abilities and motivations, as well as the engineering design and technical aspects of the system. The nuclear accident causation mechanism model for MNPPs is constructed from both social intervention and technical control aspects, and the Bayesian network research method is used for the qualitative analysis and quantitative solution of the accident causation model. We sought to improve the accuracy of accident prediction and identify the weak link of accident occurrence, as well as advance the theoretical knowledge on and practical implementation of nuclear safety management in socio-technical systems. All this provides a theoretical framework for understanding the complex socio-technical systems of MNPPs.

2. Theories

2.1. Socio-Technical System Theory

The socio-technical system theory suggests that a social system is a system of humans participating as the main subjects, such as government departments, organizations, and social groups, and their interaction jointly promotes the progress of the social system. The technical system is a complex system composed of several subsystems, such as technical equipment, working environment, etc., and their interaction jointly promotes the development of the technical system. The socio-technical system is an organic whole that achieves specific functions through the combination of technical and social systems. The changes of any factors in the system may lead to accidents, and its characteristics are shown in Figure 1 below.

Once an accident occurs in a socio-technical system, it brings serious adverse effects to society. Therefore, analyzing nuclear accidents from the perspective of socio-technical systems can reveal a large number of unknown factors caused by new technologies and new pathways of accident occurrence. Accidents caused by digital systems or software can be prevented and new types of hazards brought about by scientific progress and social development can be addressed. This also allows designers to analyze all potential states of the system to reduce the direct or indirect damage caused by advanced science, and to deal with new types of errors such as abnormal interactions between humans and machines.

A marine nuclear power plant (MNPP) is a typical socio-technical system. As a technical system, the MNPP can fulfill the function of offshore nuclear power generation or desalination through the use of technologies such as small reactors. Meanwhile, as a social system, the MNPP forms close connections with society through organization. An MNPP is the result of the joint action of the technical system and the social system. To ensure the safe operation of the MNPP at sea, it is necessary to ensure that there is no deviation between technical and social systems, and only in this way can the MNPP be protected from nuclear accidents. This paper analyzes the nuclear accident causation model in marine nuclear power plants from four perspectives: holistic, hierarchical, dynamic, and feedback, as shown in Figure 2.

2.2. Nuclear Accident and Bayesian Network Theory

(1)

Nuclear accident

A nuclear accident is an unforeseen event at a large nuclear facility that may result in radiological damage to people inside the plant. In serious cases, radioactive material leaks outside the plant, contaminating the surrounding environment and causing a hazard to public health. A small break loss of coolant accident (SBLOCA) is caused by a small break in the reactor coolant system pipeline or connected components, resulting in a coolant loss rate that exceeds the normal replenishment capacity of the coolant supply system. After the SBLOCA occurs, the regulator pressure and water level continue to decrease, and the make-up water system is put into the main coolant system as required. If the regulator pressure water and level stop dropping after replenishing water, it means that the break is small, the break flow is lower than the replenishment flow rate, and the existing power operation can be maintained. If the make-up water system input fails, or if the regulator pressure and water level continue to drop after the make-up water system is input due to a large breach, it may lead to severe accidents.

(2)

Bayesian network theory

A nuclear accident at an MNPP is analyzed from the perspective of a socio-technical system, but the deterministic relationship between the two factors affecting the occurrence of a nuclear accident is not very clear. The probability of a nuclear accident is uncertain, and Bayesian theorem is a result of probability theory that is related to conditional probability of its random variable and marginal distribution. Applying Bayesian probability to nuclear accidents is feasible because it allows us to represent posterior probabilities in terms of prior probabilities, conditional probabilities, and evidence. Therefore, this study analyzes and quantitatively solves the uncertainty based on a Bayesian network research method. Therefore, in this study, uncertainty analysis is conducted and a quantitative solution based on the Bayesian network research method is developed. A Bayesian network is a probabilistic graphical model based on the principles of Bayes’ theorem and graph theory that models causality and uncertainty among variables by representing conditional probability distributions among them.

The model consists of a directed acyclic graph (DAG) and conditional probability table (CPT). The DAG refers to the structure of a network, which offers a qualitative analysis of Bayesian network, and consists of a set of points, V, representing random variables, and a set of directed edges, E, connecting nodes, expressed as G = <V and E>. The random variable nodes can be divided into three types, namely, the target node, intermediate node, and evidence node. CPT refers to parameter learning, which entails the quantitative analysis of a Bayesian network and is used to represent the connection strength between nodes.

The inference calculation for accident causation models is based on a priori probabilities and conditional probabilities. The probability calculation process for Bayesian network inference is as follows.

The joint probability is shown in Equation (1) below:

$$\mathrm{P}=\left\{{\mathrm{X}}_1,{\mathrm{X}}_2,{\mathrm{X}}_3,\cdots ,{\mathrm{X}}_{\mathrm{n}}\right\}$$

(1)

$$\mathrm{P}\left(\mathrm{U}\right)=\mathrm{P}\left({\mathrm{X}}_1,{\mathrm{X}}_2,{\mathrm{X}}_3,\cdots ,{\mathrm{X}}_{\mathrm{n}}\right)={\prod }_{\mathrm{i}=1}^{\mathrm{n}}\mathrm{P}\left({\mathrm{X}}_{\mathrm{i}}|\mathrm{P}{\mathrm{a}}_{\mathrm{i}}\right)$$

(2)

where P is the set of parent nodes of X.

The edge probability of X is shown in Equation (3):

$$\mathrm{P}\left({\mathrm{X}}_{\mathrm{i}}\right)={\sum }_{\mathrm{e}\mathrm{x}\mathrm{c}\mathrm{e}\mathrm{p}\mathrm{t}}\mathrm{P}\left(\mathrm{U}\right)$$

(3)

Bayesian networks are mainly used for the basic probability of certain events occurring under the condition of giving a point of evidence. That is, if the evidence θ is known, it is represented by the following equation.

$$\mathrm{P}\left(\mathrm{U}/\mathsf{\theta }\right)={\displaystyle \frac{\mathrm{P}\left(\mathrm{U},\mathsf{\theta }\right)}{\mathrm{P}\left(\mathsf{\theta }\right)}}={\displaystyle \frac{\mathrm{P}\left(\mathrm{U},\mathsf{\theta }\right)}{\sum _{\mathrm{U}}\mathrm{P}\left(\mathrm{U},\mathsf{\theta }\right)}}$$

(4)

3. Methods

3.1. Characteristics Analysis of Marine Reactor Nuclear Accidents

According to the International Nuclear Event Scale (INES), nuclear accidents are categorized into seven levels, ranging from level one to level seven, with a gradual increase in radiological consequences and severity. However, the MNPPs are mostly integrated small pressurized water reactors, and their nuclear accident classification has not yet been clearly defined. The space of the reactor compartment of the MNPP is narrow, and the equipment is dense. When a nuclear accident occurs, the main impacting factors are the correct judgment and intervention of the operators. The classification of nuclear accidents in MNPPs can draw on the classification of marine ship accidents, especially for ships carrying nuclear power plants. Yang et al. [41] graded MNPPs from three points of view: radioactive safety, defense in depth, and power output of nuclear power plants. From the radioactive safety analysis of nuclear accidents, MNPP nuclear accidents are divided into seven levels according to the specific radiation dose, while nuclear power plant accident levels are not defined by specific values. Nuclear accidents in MNPPs are categorized into four levels from power output, and into three levels from depth defense. Nuclear power plants, on the other hand, do not have a clearly defined accident level in these two areas, as shown in

Table 1. Classification of nuclear accidents in MNPPs.

Level	Radioactive Safety	Power Output	Defense in Depth
1	The radiation monitoring system in the cabin for a staff whose dose exceeded the dose constraint value.	In non-emergency situations, the power supply of the whole ship cannot be fully guaranteed, and the output power of the turbine generator cannot meet the emergency power demand of the whole ship	A few issues with the safety components, but defense in depth remains effective
2	① A member of the public was exposed to a dose exceeding 10 mSv. ② The radiation monitoring system in the cabin of a staff whose dose exceeded the legal annual limit. ③ The measured value of one parameter exceeds its intervention value. ④ The exposure dose of one member of the public exceeds the legal limit.	After the MNPP loses some power in emergency, the remaining power output capacity can meet the needs of the task.	The safety measures apparently failed, but there were no real consequences.
3	① Individuals experienced non-fatal deterministic effects. ② The effective dose to one staff exceeded 10 times the legal annual systemic dose limit.	In case of emergency, the power output capacity cannot meet the needs of the task, but the output power of the turbogenerator can meet the emergency power demand of the whole MNPP.	An accident on MNPP in which all safety measures are rendered ineffective.
4	The release of radioactive material from the core of a fatal deterministic effect on an individual exceeds 0.1% of the total amount.	The power output capacity of the MNPP is completely lost in an emergency.
5	The equivalent of 131I with a radioactive release exceeding 1014Bq
6	The equivalent of 131I with a radioactive release exceeding 1015Bq
7	The equivalent of 131I with a radioactive release exceeding 1016Bq

.

3.2. Analysis of the Cause Mechanism of Marine Reactor Nuclear Accidents

3.2.1. Internal Core Cause Analysis: Technical Control

(1)

Factors of a nuclear technology system

Analyses of a nuclear technology system used for marine reactors have concluded that the factors affecting the safety of a nuclear technology system can be divided into three categories, as follows: instrumentation and control systems, passive safety facilities, and frontline operators. The operator of the main control cabin of the marine reactor can apprehend the real-time status by operating the instrumentation and control systems. When there is an abnormality in the system, an alarm will be issued through sound and light alarm devices, and passive safety facilities will be put into use based on physical principles. The operators observe the status information of the reactor system through the instrumentation and control system, formulate emergency measures, and then take corresponding control measures. Therefore, a relationship model of the influencing factors of the nuclear technology system has been established, as shown in Figure 3.

(2)

Ship factors

Marine reactors are far away from land, and the mechanisms impacting the internal core and affecting nuclear accidents can be analyzed from two aspects, namely, marine environmental factors and ship equipment factors. In terms of marine environmental factors, the safety and stability of MNPPs under complex marine environmental conditions such as ship collision, grounding, swaying, helicopter crash, lifting and dropping objects, external projectiles, and other loads are considered. It is also necessary to consider the influence of the marine environment on the corrosion of a steel structure and a nuclear power system in both operation and material exchange mode. In terms of ship equipment factors, a marine reactor cannot operate normally due to the local deformation of ship platforms and equipment, and the wave fluctuation reaching its limit state. In addition to the limit state of ship equipment, which can cause accidents, the fatigue of the ship structure under repetitive loading can also induce accidents. Both marine environmental factors and ship equipment factors directly or indirectly affect the safety of marine reactors. Therefore, the impacts of the ship platform and the marine environment on nuclear technology systems should be fully considered, and the nuclear safety of a marine reactor should be considered from an overall perspective. The relationship model of ship-influencing factors is shown in Figure 4.

(3)

Crew factors

The personnel of a marine reactor mainly include nuclear power staff, ship operators, and other personnel. Errors in judgment and operating procedures during the completion of tasks can lead to nuclear accidents in marine reactors. Moreover, as the marine reactor is far away from land for a long time, the crew on board not only have to be away from home for a long time, but also have to endure the changes in climate in different shipping areas. Therefore, the physical and psychological states of the crew on board directly affect the safety of the marine reactor. At the same time, the fatigue and inattention of the crew on board will increase the occurrence of unsafe behaviors, leading to an increase in nuclear accidents or potential safety incidents in marine reactors. The relationship model of the crew-influencing factors is shown in Figure 5.

To sum up, there are interactions among nuclear technology system factors, ship factors, and crew factors during the operation of small reactors. When a deviation occurs in one party, the overall safety will be affected, that is, there will be nuclear technology system errors, abnormal changes in ship factors, crew information transmission errors, and other abnormal situations. Further, when the control measures fail, the system will appear abnormal, and a nuclear accident may even occur. Therefore, the influence of the nuclear technology system and the ship and crew deviation states comprise the internal causative factors of nuclear accidents. The internal core cause mechanisms of nuclear accidents in marine reactors are shown in Figure 6.

3.2.2. External Core Cause Analysis: Social Interventions

(1)

Intervention factors by government departments and other sectors

Governments, organizations, and societies all carry social attributes. Many factors in the social system can affect their behavior, causing deviations in their behavior and potentially leading to accidents in the technical system. The regulatory authorities for marine reactors mainly include the National Nuclear Safety Administration, the Maritime Safety Administration, and the State Oceanic Administration, along with other departments. In a complex socio-technical system such as a marine reactor, any small element can lead to the collapse of the whole system. Therefore, the interventionist roles of government departments and other departments can directly and effectively affect the external conditions of marine reactors, playing an indispensable role in ensuring safe operation. A relationship model of intervention factors provided by government and other departments is shown in Figure 7.

(2)

Organizational factors

The organizational factors that affect the external core causative mechanisms of nuclear accidents are divided into five aspects, as follows: organizational culture, organizational communication, organizational decision-making, organizational training, and organizational procedures. Organizational culture in the context of a marine reactor is a concept informed by the interaction of people, technology, and an organization, and is an effective means of control. The organizational culture is used to improve the perception of the organization held by the staff of the ship reactor, and thus to increase the sense of responsibility of the staff. Organizing communication can not only quickly improve work efficiency, but also helps to better identify work defects and safety problems so as to avoid accidents. Organizational decision-making can point the way for organizations in the event of a nuclear accident at a marine reactor, allowing shipboard staff to make the right decisions in stressful situations. This can involve organizing training to strengthen the cognition of the shipboard staff, improve their ability to respond to changes, and ensure the safe and effective operation of the marine reactor. In complex socio-technical systems, it is through the regulation of organizational procedures that shipboard staff are made more able to follow the rules, allowing them to more effectively correct mistakes before they occur and prevent the occurrence of catastrophic consequences. A relationship model for the organizational factors is shown in Figure 8.

(3)

Social factors

The nuclear technology system changes with the changing needs of society. In order to adapt to the social environment, the nuclear technology system is constantly updated and improved to better serve society. However, political, economic, cultural, and other social factors interfere with the nuclear technology system in seeking to minimize the negative effects of nuclear technology. Social factors coordinate and constrain the nuclear technology system to avoid nuclear accidents in a marine reactor. A relationship model of social factors is shown in Figure 9.

Social interventions are the initial constraints on technological control, and they have varying degrees of impact on marine reactors. Any problem in any link may become an important source of nuclear accidents. Thus, factors such as government departments, organizations, and society, which intervene in the development of technology and in the behavior of individuals, in the interests of society as a whole or for other purposes, collectively form the external core causative mechanism of nuclear accidents, as shown in Figure 10.

3.2.3. Construction of the Causal Analysis Model of Nuclear Accidents

The Tavistock Institute has established a general socio-technical system model based on the perspectives of both a social system and a technical system [42]. On the basis of this theoretical model, the causal analysis model of nuclear accidents in marine reactors is constructed based on the characteristics of the MNPP, as shown in Figure 11.

The model reveals the causal mechanism of nuclear accidents in a marine reactor caused by internal and external core causal factors. The government departments intervene in social factors by means of regulation, legislation, and authorization. The research and design institutions control organizational factors through regulation, technical reviews, and safety regulations. Organizational factors act on individual factors to influence individual behavior. In addition, changes in the environmental boundaries and working conditions of the organization are caused by organizational factors. These changes work together on the nuclear technology system, making it dissimilate and resulting in the failure of technology and equipment. The results indicate that a nuclear accident in a marine reactor is caused by the joint action of internal and external core factors that break through the defense barrier. Governmental, social, and organizational factors act as “triggers” for changes in the crew, the nuclear technology system, and the ship’s environment. These can especially lead to operator mistakes, resulting in operational behavior mistakes. The aggregation of these human–mechanical variable failures, coupled with the failure of the defense-in-depth capability, results in a nuclear accident.

4. Case Study

4.1. Accident Hypothesis

It is here imagined that an SBLOCA occurs in the marine reactor, and the location of the break is in the cold pipe section of the pressurizer, with an equivalent diameter of 10 mm. Coolant is continuously lost after the SBLOCA, causing the pressure and water level of the pressurizer to drop continuously. The water level of the make-up water system also drops to a certain value. The process of dealing with the accident is as follows: determine the location of the break, isolate the break, trigger the low-pressure protection emergency shutdown, put the standby power supply into operation, put the high-pressure safety injection system and residual heat removal system into use successively, followed by secondary circuit auxiliary engine steam consumption, and the low-pressure safety injection system is finally put into operation.

4.2. Construction of Accident Model

We are here assuming that the operator failed to isolate the damaged loop, the low-pressure safety injection system failed, and the reactor core could not be cooled, causing the accident to deteriorate into a severe condition, preventing other passive safety facilities from being put into normal operation. Therefore, the safety injection system can ensure that the reactor core is flooded without severe accidents such as melting. The working logic of the injection system is shown in Figure 12.

According to the logical block diagram of the safety injection system, there is not only a safety injection water source and a safety injection pump, but there are also a variety of valves, which involve different parts operated in different stages of the process. The failure of the injection water source or control valve will affect the normal operation of the entire injection system. Therefore, the possible causes of failure in a low-pressure safety injection system are shown in

Table 2. Failure causes of low-pressure safety injection system.

Serial Number	Abnormal Phenomenon	Reason for Failure
1	Operational failure	Pump 2 fails to start, Valves 2, 3, and 4 have malfunctioned
2	Water source 1 has malfunctioned	Water source l startup failure
3	Injection failure	Valves 7 and 8 have malfunctioned

below.

The failure factor relationship model of a low-pressure safety injection system is shown in Figure 13. The symbol “√” in pictures 13~16 indicates that the probability value has been input during modeling, which also reflects the correctness of the model.

Considering the specificity of the maritime environment, it was determined that, when responding to an SBLOCA, there are factors that are influenced by the incident scenario, in addition to the inherent characteristics of the personnel themselves. The internal inherent factors include psychological state, physiological state, and quality and ability. The factors influencing the accident scenario are analyzed from three aspects, as follows: response time, ship environment, and team communication. Therefore, the causal model of the internal inherent factors and accident scenario factors affecting the operator’s failure to successfully isolate the broken loop is shown in Figure 14.

Government intervention, as well as organizational and social factors, affects the technical system and crew as external interference factors in nuclear accidents. With the numerous adjustments of internal factors, the external factors need to be changed in order to better constrain the internal factors. If the external factors do not intervene properly, the structure of the internal factors will be disorganized, leading to a nuclear accident. Therefore, a causal model of the external intervening factors affecting the occurrence of small break accidents is shown in Figure 15.

The internal and external core factors affecting the development of an SBLOCA into a severe accident are risk-identified, and the variables of each node of the Bayesian network are determined according to the interaction relationship between technical control and social intervention influencing factors. The causal model of the SBLOCA in a marine reactor is shown in Figure 16.

4.3. Determination of the State Probability of Node Variables

The nuclear accident causation model of the marine reactor is quantitatively analyzed according to the judgment results of twelve experts. The twelve experts include four different levels of relevant staff, namely five designers related to China Shipbuilding Industry Corporation, two members of the relevant subject matter team of the Nuclear Power Institute of China, three staff of nuclear power plant operation and maintenance, and two chief engineers of a naval base. The evaluations of experts are subjective to some extent. To ensure the objectivity and scientificity of the results, the state probabilities of the node variables are expressed in the form of fuzzy numbers, and then this state probability is fuzzy-transformed into the exact probability of each node variable. The degree of influence of the node variables corresponds to the corresponding triangular fuzzy numbers, as shown in

Table 3. Influence degree semantics of node variables and corresponding triangular fuzzy number.

Level	Semantic Value	Probability Value
1	Very low impact	(0, 0, 0.1)
2	Low impact	(0, 0.1, 0.3)
3	Relatively low impact	(0.1, 0.3, 0.5)
4	Moderate impact	(0.3, 0.5, 0.7)
5	Relatively high impact	(0.5, 0.7, 0.9)
6	High impact	(0.7, 0.9, 1.0)
7	Very high impact	(0.9, 1.0, 1.0)

.

According to the nuclear accident cause model for the case of a marine reactor, built as shown in Figure 16, a state correspondence table of node variables is established, as shown in

Table 4. Correspondence table of node variables.

Node Variables	State
	State = “0”	State = “1”	State = “2”
Low-pressure safety injection system	Ineffective	Effective
Water pump 2	Ineffective	Effective
Valve 2, 3, 4	Malfunctioning	Good
Valve 7, 8	Malfunctioning	Good
Source of water 1	Ineffective	Effective
Operator	Inappropriate	Acceptable
Psychology	Relatively poor	General	Good
Pressure	Relatively low	General	Very high
Attention	Inadequate	General	Adequate
Nervous emotions	Relatively low	General	Very high
Attitude	Inappropriate	Acceptable	Appropriate
Quality and ability	Inappropriate	Acceptable	Appropriate
Experience	Inadequate	General	Adequate
Technique	Inadequate	General	Adequate
Knowledge	Inadequate	General	Adequate
Response time	Inadequate	More urgent	Adequate
Physiology	Relatively poor	General	Good
Malaise	Good	Serious
Fatigue	Good	Serious
Team communication	Inadequate	General	Adequate
Effectiveness of information exchange (EIE)	Ineffective	More effective	Very effective
Team collaboration	Inappropriate	Acceptable	Appropriate
Ship environment	Unfavorable	Acceptable	Favorable
Offshore operating environment (OOE)	Gentle	Severe
Cabin environment	Unfavorable	Acceptable	Favorable
External sea conditions (ESC)	Gentle	Severe
Organizational procedures	Inappropriate	Acceptable	Appropriate
Organizational training	Inadequate	General	Adequate
Organizational communication	Inappropriate	Acceptable	Appropriate
Organizational decision-making	Inappropriate	Acceptable	Appropriate
Research and design institutions	Inadequate	General	Adequate
Regulatory agencies	Inadequate	General	Adequate
Authorization	Inadequate	General	Adequate
Policy	Inadequate	General	Adequate

.

After averaging, de-fuzzing, and normalizing the state probability values of each node variable, the state probability of the influence degree of node variables is obtained, as shown in Figure 17, Figure 18, Figure 19 and Figure 20.

According to the state probability table of node variables determined by experts’ experience and the input model of the coupling effects of causative factors, a bar probability chart of nuclear accidents in marine reactors is shown in Figure 21. Each factor in the study defines three states, “state 0” is represented by orange, “state 1” is represented by blue, “state 2” is represented by green, and the following length indicates the state probability.

4.4. Bayesian Network Reasoning

(1)

Reverse inference

The inverse inference of a Bayesian network is used inversely to infer the probability distribution of each node variable through the relationship between each, under the assumption that the consequential event must occur. It is assumed that in the SBLOCA, there is an operator error in the process, taking the form of a failure to isolate the damaged loop, and the low-pressure safety injection system failed to be successfully put into operation. Backward calculation is performed, and the posterior probability of each node variable is obtained, as shown in Figure 22.

The posterior probability of each node variable changes compared to the a priori probability when an operator error occurs and the low-pressure safety injection system fails. A comparison between the prior probability and posterior probability of each node variable is shown in Figure 23. The prior probability is always lower than the posterior probability, indicating an increase in the estimated probability of the original events when new information is obtained, which reflects the revision and updating of the original beliefs with the new information.

The percentage change in the a priori probability of each node variable compared to the posterior probability is shown in Figure 24. In the event of an SBLOCA, the nuclear technology system factors most likely to worsen the accident are pump failure and valve failure. The most likely crew factors are inadequate response time and poor psychological conditions. The most likely ship factors are unfavorable sea conditions and an unfavorable marine operating environment. The most likely organizational factors are inappropriate organizational communication as well as inappropriate organizational procedures. The most likely governmental and societal factors are inadequate research and design organizations, inadequate regulatory agencies, and inadequate policies. The greater the variability in node variables, the greater the impact on the low-pressure safety injection system and operator. Therefore, in order to deal with the SBLOCA and to avoid the worsening of accidents, it is important to focus on the impacts of as many aspects as possible of the above influencing factors.

(2)

Analysis of the chain structure of the accident cause

The probability of influence of each node variable on the process of the SBLOCA is obtained by use of the backward reasoning method. According to the coupling of causal factors and the percentage changes of the prior probability and posterior probability of each node variable, it can be seen that in a case of the failure of the low-pressure safety injection system and operator error, the most likely accident-causative chain is obtained by using Bayesian network reasoning. Combining the results of backward reasoning and the accident causal chain analysis, it is shown that an inadequate policy of response to the occurrence of an SBLOCA can lead to a deviation in the research and design organization, resulting in pump failure. The low-pressure safety injection system failed due to unfavorable external sea conditions. At the same time, inadequate supervision is caused by the lack of implementation of monitoring and inspection systems. In the case of inappropriate organizational communication, and due to insufficient response times, operator errors were caused, and eventually the SBLOCA worsened and developed into a severe accident (Figure 25).

5. Conclusions

In this study, an analytical model of the causes of nuclear accidents in MNPPs from the perspective of socio-technical systems is constructed to analyze the mechanism of the coupling evolution of each influencing factor. Based on the case of the SBLOCA, the causal factors affecting the deterioration of the accident are quantitatively analyzed using a Bayesian network. The causal factors and accident causal chains that are most likely to affect the deterioration of the accident are derived, providing a new perspective for the prevention of nuclear accidents. The main conclusions are as follows:

(1) The internal and external core causes of nuclear accidents are analyzed from the perspective of the coupling of socio-technical systems, and the objective laws of the evolution of nuclear accidents in marine reactors are obtained.

(2) The causes of nuclear accidents in marine reactors are identified from the points of view of technical control and social intervention, and the factors affecting the occurrence of nuclear accidents are obtained—nuclear technology system factors, crew factors, ship factors, government and other departments’ intervention factors, organizational factors, and social factors.

(3) According to the nuclear accident causation analysis model, a Bayesian network analysis method is used to quantify the coupling between the factors affecting the deterioration of the nuclear accidents. The results show that the main influencing factors include the following: pump failure, valve failure, insufficient response time, poor psychological state, unfavorable sea conditions, unfavorable offshore operating environment, communication failure, inappropriate organizational procedures, inadequate research and design institutions, inadequate regulatory agencies, and inadequate policies. These 12 factors show a high degree of causation, representing the main factor affecting the deterioration of the SBLOCA.

(4) According to the reverse inference of Bayesian networks, when the operator makes a mistake, the low-pressure safety injection system fails to be successfully put into operation, and the probability of pump 2 failure increases from 0.85 to 0.91. In other words, it can be concluded by forward reasoning that the increase in the failure probability of pump 2 will greatly increase the occurrence of severe nuclear accidents.

(5) The inference function of a Bayesian network is utilized to analyze the structure of the accident causal chain in the model. The causal chain that is most likely to induce the development of an SBLOCA into a severe accident is derived. The two nodes of insufficient response time and inadequate research and design institutions have the greatest variability, which are the important factors causing the development of marine reactors into severe accidents. Therefore, emergency measures to extend the response time and improve and optimize the research institutions are developed. However, the secondary factors such as the regulatory agencies, organizational communication, and the state of the pump also need to take appropriate emergency measures, which provide a strong basis for preventing nuclear accidents from occurring at the source.

6. Future Work

The data resulting from the expert assessment are subject to more uncertainty even after fuzzification. A learning mechanism for expert preferences is implemented to better inspire experts to form correct preferences.