An approximate epistemic uncertainty analysis approach in the presence

of epistemic and aleatory uncertainties

Eduard Hofera,*, Martina Kloosa, Bernard Krzykacz-Hausmanna,Jorg Peschkea, Martin Woltereckb,1

aGesellschaft fuer Anlagen- und Reaktorsicherheit (GRS), mbH Forschungsgelande, 85748 Garching, GermanybTechnische Universitat Munchen, Munich, Germany

Abstract

Epistemic uncertainty analysis is an essential feature of any model application subject to ‘state of knowledge’ uncertainties. Such analysis is

usually carried out on the basis of a Monte Carlo simulation sampling the epistemic variables and performing the corresponding model runs.

In situations, however, where aleatory uncertainties are also present in the model, an adequate treatment of both types of uncertainties

would require a two-stage nested Monte Carlo simulation, i.e. sampling the epistemic variables (‘outer loop’) and nested sampling of the

aleatory variables (‘inner loop’). It is clear that for complex and long running codes the computational effort to perform all the resulting

model runs may be prohibitive.

Therefore, an approach of an approximate epistemic uncertainty analysis is suggested which is based solely on two simple Monte Carlo

samples: (a) joint sampling of both, epistemic and aleatory variables simultaneously, (b) sampling of aleatory variables alone with the

epistemic variables held fixed at their reference values.

The applications of this approach to dynamic reliability analyses presented in this paper look quite promising and suggest that performing

such an approximate epistemic uncertainty analysis is preferable to the alternative of not performing any. q 2002 Elsevier Science Ltd. All

rights reserved.

Keywords: Epistemic uncertainty; Aleatory uncertainty; Monte Carlo simulation; Dynamic PSA; Dynamic reliability analysis

1. Introduction

The interaction of aleatory variables with the evolution

of a dynamic process is often studied through Monte Carlo

simulation using a computer model. To this end the aleatory

variables are sampled according to their random laws and

the corresponding model runs are performed. The results are

then summarized in form of empirical distribution functions

representing the aleatory uncertainty of the process out-

comes. From these distributions statistical estimates of the

probabilities for process states of interest may be obtained.

Often, however, the exact types of the random laws and

their distributional parameters as well as the relevance of

phenomena, the model formulations, the values of model

parameters and input data of the model application are not

known precisely and therefore subject to epistemic (‘lack-

of-knowledge’) uncertainty. These uncertainties are rep-

resented by subjective probability distributions which

quantify the respective states of knowledge. Consequently,

the process variables from the model are subject to both

epistemic and aleatory uncertainties.

An adequate treatment of both types of uncertainties in

this case is to quantify the influence of the epistemic

uncertainties on the statistical estimates of the process state

probabilities. To this end the natural straightforward

approach would be to repeat the aleatory Monte Carlo

simulation many times, each time with randomly selected

values from the subjective probability distributions of the

epistemic uncertainties. This is a two-stage nested Monte

Carlo simulation: sampling of values of the epistemic

variables (outer loop) and nested conditional sampling of

values of the aleatory variables (inner loop). Clearly, the

resulting number of model runs to be performed is nout £ nin

with nout and nin being the sample sizes of the epistemic

(‘outer’) and the aleatory (‘inner’) simulation loop,

respectively.

However, the computational model may frequently be

very complex and expensive to run such that even for

0951-8320/02/$ - see front matter q 2002 Elsevier Science Ltd. All rights reserved.

PII: S0 95 1 -8 32 0 (0 2) 00 0 56 -X

Reliability Engineering and System Safety 77 (2002) 229–238

www.elsevier.com/locate/ress

1 Pressent address: BMW AG, Munich, Germany.

* Corresponding author. Tel.: þ49-89-32004-373; fax: þ49-89-32004-

301.

E-mail address: hof@grs.de (E. Hofer).

moderate sample sizes like nin ¼ 100; and nout ¼ 100 the

resulting computational effort will be prohibitive. In such

situations the above procedure must be considered

impracticable.

The problem now is to find an appropriate method which

permits at least approximate epistemic uncertainty state-

ments but requires much less computational effort than the

full two-stage Monte Carlo simulation.

Later this problem received increased attention in the

context of probabilistic dynamics, particularly in Level 2

Probabilistic Safety Assessment (PSA), and it is of

relevance to the uncertainty analysis of the application of

dynamics models (thermal-hydraulic models etc.) in

conventional PSAs [1,2]. It is of general interest whenever

the separation of the two types of uncertainty is required [3].

In Refs. [4,5] procedures are suggested for a consideration

of epistemic uncertainties in probabilistic dynamics. Ref.

[4] investigates the use of first order Taylor series

expansions and of the so-called adjoint sensitivity method

for the analysis of the epistemic uncertainties. Ref. [5]

makes use of the fact that some epistemic uncertainties do

not modify the dynamics evolution of the system and can

therefore be taken into account without repetitions of the

processor time extensive computation of the process

dynamics. In Ref. [6] the nested Monte Carlo simulation

approach is used for separation of uncertainties while Ref.

[7] tries to separate uncertainties through a so-called

‘deconvolution’ approach.

In Ref. [24] an alternative method of an approximate

epistemic uncertainty analysis is suggested in a more

general context. It requires only one single-stage Monte

Carlo simulation where epistemic and aleatory uncertainties

are sampled simultaneously. The sample size in this

approach, however, should exceed at least the number of

the epistemic uncertainties. In this case even an approximate

epistemic sensitivity analysis can be performed.

In this paper an approach of an approximate epistemic

uncertainty analysis is suggested which is based on solely

two single-stage Monte Carlo samples and therefore

requires much less computational effort than a full two-

stage nested Monte Carlo simulation.

The main emphasis of the paper is to provide the

presentation and discussion of the methodology. It is

introduced in Section 2. In Section 3 the applicability of

the suggested approach is demonstrated with three repre-

sentative examples. Further details about these examples

may be found in the corresponding references.

2. An approximate epistemic uncertainty analysis

approach

2.1. Basic considerations

Being subject to both epistemic and aleatory uncertain-

ties, any scalar process variable or model outcome Y may be

represented as

Y ¼ hðU;VÞ

with, U ¼ set of all epistemic uncertainties (uncertain

parameters), V ¼ set of all aleatory uncertainties (stochastic

variables), h ¼ the computational model considered as a

deterministic function of both aleatory and epistemic

uncertainties U and V.

When holding the epistemic variables U fixed at a value

u, i.e. U ¼ u; the resulting output Y is a function of the

aleatory uncertainties V, solely. Consequently, its prob-

ability distribution, i.e. the conditional distribution of Y

given U ¼ u quantifies the corresponding (conditional)

aleatory uncertainty in Y. Its expected value E½Y lU ¼ u�;which only depends on u, may therefore be considered as a

representative scalar value for this distribution, i.e. it

represents the conditional aleatory uncertainty in Y given

U ¼ u: It is worthwhile mentioning here that it is mean-

ingful to use the expectation as a representative value of a

distribution. Many of the standard distribution character-

istics may be viewed as expectations of appropriately

chosen variables Y [24]. For example the value FY(y ) of a

distribution function of a random variable Y at the point y

may be represented as the expected value of the indicator

variable I{Y#y}.

The expression

E½YlU�

denotes the conditional expectation as function of the

epistemic uncertainties U, i.e. as a quantity subject to

epistemic uncertainty from U.

The principal aim of an epistemic uncertainty analysis of

results from models subject to both epistemic and aleatory

uncertainties is therefore to determine the subjective

probability distribution of the conditional expectation

E½YlU�:Obviously, this can only be done on the basis of estimates

from appropriate samples. The above mentioned two-stage

nested Monte Carlo simulation may, in principle, be used to

generate an appropriate sample but is prohibitive for

complex and time-extensive computer codes. Therefore,

an estimation or approximation of the first two central

moments (expectation and variance) of the distribution of

E½YlU�; i.e.

EðE½Y lU�Þ and varðE½YlU�Þ

seems useful from which, under appropriate distribution

assumptions, approximate uncertainty statements can be

derived, e.g. in form of statistical estimates of the 5 and 95%

quantiles of the subjective probability distribution of

E½YlU�:

2.2. Approximation of moments of the distribution of E½Y lU�

If an appropriate distribution assumption is made such

that the entire (epistemic) distribution of E½YlU� is

E. Hofer et al. / Reliability Engineering and System Safety 77 (2002) 229–238230

completely determined by its first two central moments (and

this is the case for almost all standard parametric

distributions), the objective of the approach is to estimate

the expected value EðE½YlU�Þ and the variance varðE½Y lU�Þ

of the conditional expectation E½YlU� from appropriate

samples. To this end the following well-known basic

relationships from probability theory are used [8,9]:

EðE½YlU�Þ ¼ EðYÞ varðE½Y lU�Þ ¼ varðYÞ2 Eðvar½YlU�Þ;

where, E(Y ) ¼ unconditional expectation of the outcome

Y ¼ hðU;VÞ; taken with respect to the joint epistemic and

aleatory uncertainties (U, V), var(Y ) ¼ unconditional

variance of the outcome Y ¼ hðU;VÞ; taken with respect

to the joint epistemic and aleatory uncertainties (U, V)),

(also called ‘total variance of Y’), Eðvar½Y lU�Þ ¼ expec-

tation (taken with respect to epistemic uncertainties U) of

the conditional variance var½YlU� of Y considered as a

function in U, (i.e. Eðvar½Y lU�Þ ¼Ð

var½Y lU ¼ u�fUðuÞdu).

Therefore, instead of the two quantities EðE½Y lU�Þ and

varðE½YlU�Þ we may now alternatively estimate/approxi-

mate the three quantities

EðYÞ; varðYÞ; and Eðvar½YlU�Þ

from appropriate samples.

2.2.1. Estimating E(Y ) and var(Y )

To generate a sample from which E(Y ) and var(Y ) can be

statistically estimated a simple Monte Carlo simulation is

performed where both epistemic and aleatory uncertainties

U and V are sampled simultaneously according to their joint

probability distribution. From the sample values

ðu1; v1Þ;…; ðun; vnÞ generated in this way the corresponding

sample values

y1 ¼ hðu1; v1Þ;…; yn ¼ hðun; vnÞ

of Y, the model outcome of interest, are computed.

The sample mean

�y ¼ 1=nX

i

yi

and the sample variance

s2 ¼ 1=ðn 2 1ÞX

i

ðyi 2 �yÞ2

from these values are then the desired statistical estimates of

E(Y ) and var(Y ).

2.2.2. Approximating E(var[YlU]) by var[YlU ¼ uref]

Since Eðvar½Y lU�Þ is the expected value of the function

var½Y lU� in the epistemic variables U, it seems reasonable to

take the value of this function at an appropriate point U ¼

u0 as an approximation to its mean, e.g. at U ¼ uref ; i.e. at

the reference or ‘best estimate’ value of the epistemic

variables, which in many cases is the expected value of its

distribution, i.e. uref ¼ EðUÞ: We therefore use as an

approximation:

Eðvar½YlU�Þ < var½YlU ¼ uref�;

with var½YlU ¼ uref� being the conditional variance of Y

with the epistemic variables U held fixed at their reference

values uref.

Since var½Y lU ¼ uref� is obviously not known, it must

statistically be estimated from appropriate sample values,

too. To generate an appropriate sample another simple

Monte Carlo simulation is performed where the epistemic

uncertainties U are held fixed at their reference values, i.e.

U ¼ uref while the aleatory uncertainties V are sampled

according to their conditional distribution given U ¼ uref :From the sample values ðuref ; v1Þ;…; ðuref ; vnÞ generated in

this way the corresponding sample values

y1 ¼ hðuref ; v1Þ;…; yn ¼ hðuref ; vnÞ

of Y, the model outcome of interest, are computed. As

before, the sample variance

s2 ¼ 1=ðn 2 1ÞX

i

ðyi 2 �yÞ2

from these values is then the desired statistical estimate of

varðYlU ¼ urefÞ and may, finally, be used as an approxi-

mation to the expected conditional variance Eðvar½Y lU�Þ:

2.2.3. More on estimates and assumptions

The quality of the above approximation is crucial since it

finally serves to obtain an estimate of varðE½Y lU�Þ via

varðE½YlU�Þ ¼ varðYÞ2 Eðvar½Y lU�Þ

< varðYÞ2 varðYlU ¼ urefÞ

Situations where the reference values U ¼ uref of important

epistemic uncertainties are extremes of the respective

probability distributions may not be very favorable for

this approach. In such extreme situations varðY lU ¼ urefÞ

may be so inadequate an approximation to Eðvar½Y lU�Þ that

the right hand side of the above relationship may even

become negative and therefore useless.

If uref ¼ EðUÞ then the following inequalities may

sometimes be useful to assess the quality of the above

approximation (Jensen’s inequality):

Eðvar½YlU�Þ # varðYlU ¼ urefÞ if varðY lU ¼ uÞ

is a convex function in u;

Eðvar½YlU�Þ $ varðYlU ¼ urefÞ if varðY lU ¼ uÞ

is a concave function in u;

Eðvar½YlU�Þ ¼ varðYlU ¼ urefÞ if varðY lU ¼ uÞ

is a linear function in u:

Additionally, in order to derive 5, 50 and 95% quantiles of

the probability distribution of E[YlU] from its first two

E. Hofer et al. / Reliability Engineering and System Safety 77 (2002) 229–238 231

central moments, a distribution assumption needs to be

made. If such distribution assumption cannot be made a

priori, we may alternatively apply the maximum entropy

principle to arrive at a distribution having the two

approximated central moments but otherwise having

maximum epistemic uncertainty associated with it. For

example, if no further information about this distribution is

available, then it will be the normal distribution with the

given mean m and the given standard deviation s.

If the direct approximation of Eðvar½YlU�Þ by varðYlU ¼

urefÞ does not seem very reliable, the following heuristic

modification of this approximation may be used.

Since Eðvar½YlU�Þ may be interpreted as the contribution

of the aleatory uncertainties to the total variance var(Y ) and

since, in many situations, it may often be immediately clear

which of the two types of uncertainties is dominant, we may

modify the above approximation heuristically as follows:

Clearly, all quantities appearing above are replaced by the

corresponding estimates from samples.

The information which of the two types of uncertainty is

dominating may, in case that it is not clear immediately, be

obtained via appropriate R 2-values from the available

samples without additional sampling effort [24].

As a cautionary remark it is worthwhile mentioning that

in all the applications considered in Section 3 the overall

variances were clearly dominated by the epistemic uncer-

tainties. Obviously, in such cases, the accuracy of the entire

approach is less sensitive to the accuracy of the above

approximation of Eðvar½YlU�Þ by varðYlU ¼ urefÞ:

3. Applications

In this section we present results from three practical

applications of the approximate epistemic uncertainty

analysis approach to dynamic reliability analysis. In the

first two of these applications the processor time require-

ments of the computational model were moderate such that

a complete uncertainty analysis with a full two stage nested

Monte Carlo simulation could also be performed. Thus, the

results of both the approximate and the complete uncertainty

analyses could directly be compared. The third application is

more demanding and is therefore presented in greater detail.

3.1. The ‘Hold-Up Tank’ problem

This problem is considered as a kind of standard test of

methods suggested for dynamic reliability analysis [10–13].

A modified version of this problem was selected to

demonstrate the applicability of the approximate uncer-

tainty analysis approach [14].

In this version the aleatory uncertainties were the times

of the unfavorable random changes of the states of the

system components (two pumps, one valve) and the

indicators of the success of reconditioning the operating

states. These aleatory uncertainties were quantified by one-

parametric random laws: Bernoulli distributions for the

indicators of the success of reconditioning and Exponential

distributions for the times of the state changes.

A total of nine distribution parameters of these random

laws, i.e. probabilities p or failure rates l, have been

considered as subject to epistemic uncertainty. Their state of

knowledge was expressed by appropriate subjective prob-

ability distributions (Beta distributions for probabilities and

Gamma distributions for failure rates) [14].

The aleatory uncertainties in this application were treated

by the so-called MCDET method [24], which, roughly

speaking, is a combination of random sampling of the values

of continuous aleatory uncertainties (i.e. the aleatory

transition times) with event tree analysis for the discrete

aleatory uncertainties (i.e. the discrete system states). In

many practical situations the sampling procedure of the

MCDET method turns out to be superior to the ordinary

random sampling of all aleatory uncertainties with the same

sample size n [24].

The two sampling procedures necessary for the approxi-

mate epistemic uncertainty analysis approach have been

performed: (1) sampling of both epistemic and aleatory

uncertainties simultaneously and (2) sampling of aleatory

uncertainties with epistemic uncertainties held fixed at their

reference values uref.

For the analysis of results two outcomes from the model

are considered: the events ‘dry-out’ and ‘overflow’. They

may formally be represented as indicator variables Y1 ¼ 1 if

dry-out is obtained and Y1 ¼ ø, otherwise, respectively, by

Y2 ¼ 1 if overflow is obtained and Y2 ¼ ø, otherwise.

Consequently,

pðdry-outÞ ¼ EðY1Þ pðoverflowÞ ¼ EðY2Þ;

which is a purely formal probabilistic representation in

terms of the joint distribution over the (U, V)-space of

epistemic and aleatory variables. In fact, however, we are

Eðvar½YlU�Þ ¼

minðvarðY lU ¼ urefÞ; 1=4 var YÞ if U dominates var Y

minðvarðY lU ¼ urefÞ; 3=4 var YÞ if V dominates var Y and varðY lU ¼ urefÞ . 1=2 var Y

1=2 var Y if V dominates var Y and varðY lU ¼ urefÞ # 1=2 var Y

minðvarðY lU ¼ urefÞ; 1=2 var YÞ if neither U nor V dominates and varðYlU ¼ urefÞ . 1=4 var Y

1=4 var Y if neither U nor V dominates and varðYlU ¼ urefÞ # 1=4 var Y

8>>>>>>><>>>>>>>:

E. Hofer et al. / Reliability Engineering and System Safety 77 (2002) 229–238232

interested in the subjective probability distributions of

pðdry-outlUÞ ¼ E½Y1lU� and pðoverflowlUÞ ¼ E½Y2lU�;

and we therefore estimate/approximate the expectations and

variances of them with the method presented in Section 2.

The sampling (1) of epistemic and aleatory uncertainties

simultaneously with sample size n ¼ 100 using the MCDET

method gave the estimates:

EðY1Þ ¼ pðdry-outÞ ¼ 4:2 £ 1023; varðY1Þ ¼ 6:6 £ 1025

EðY2Þ ¼ pðoverflowÞ ¼ 1:2 £ 1022; varðY2Þ ¼ 3:5 £ 1024

The sampling (2) of aleatory uncertainties with sample size

n ¼ 100 using the MCDET method and holding the

epistemic uncertainties fixed at their means

(i.e.uref ¼ EðUÞ) gave the estimates:

varðY1lU ¼ urefÞ ¼ 6:6 £ 1026

varðY2lU ¼ urefÞ ¼ 8:8 £ 1026

Finally, the approximate uncertainty analysis approach from

Section 2 gave the following estimates of mean and variance

of E½YilU� :

EðE½Y1lU�Þ ¼ Eðpðdry-outlUÞÞ ¼ pðdry-outÞ ¼ 4:2 £ 1023

varðE½Y1lU�Þ ¼ varðpðdry-outlUÞÞ ¼ 5:94 £ 1025

EðE½Y2lU�Þ ¼ EðpðoverflowlUÞÞ ¼ pðoverflowÞ ¼ 1:2 £ 1022

varðE½Y2lU�Þ ¼ varðpðoverflowlUÞÞ ¼ 3:41 £ 1024

To derive complete distributions for E½Y1lU� and E½Y2lU�

the assumption of a standard Beta distribution has been

made. This assumption seems reasonable since E½Y1lU� and

E½Y2lU�; as probabilities, range between 0 and 1. The two

distributional parameters a and b of the Beta distributions

have been computed via the moment matching method from

the above expectations and variances. The final results are:

E½Y1lU� , Betað0:2915; 69:125Þ

E½Y2lU� , Betað0:4052; 33:3621Þ:

Approximate uncertainty statements in form of 5, 50 and

95% quantiles of these distributions are shown in Table 1

These results may be compared to those obtained from the

complete uncertainty analysis with full two stage sampling,

also shown in Table 1.

It is worthwhile mentioning that the good agreement of

the approximate and complete uncertainty analyses has two

principal reasons: (1) the main contribution to the total

variance of Y comes from the epistemic uncertainties and

therefore, as mentioned above, the accuracy of the results is

less sensitive to the accuracy of the approximation of

Eðvar½YlU�Þ by varðY lU ¼ urefÞ and (2) the contribution to

the aleatory uncertainty from the discrete aleatory variables

is much greater then from the continuous aleatory variables,

which increases the accuracy of the sampling procedure

underlying the MCDET method used in this application

[24].

3.2. PSA contribution of a fire scenario

The above mentioned MCDET method was also applied

in combination with a deterministic fire dynamics model to

compute the PSA contribution of a cable fire scenario [25].

The scenario is defined by a fire starting in a cabinet with

electrical distribution boards and spreading over vertical to

horizontal cable trays. One of the aleatory uncertainties is

the system state of the fire detection system on demand. This

system may attain the states 0, 1, 2, 3, depending on how many

out of the three detectors are capable of detecting and reporting

the fire to the control room. Further aleatory uncertainties are

the reaction time of the fire detectors, the occurrence of

spurious signals in the control room due to the fire, the

temperature at which these signals occur, reaction time of

the operators, the chosen strategy for fire fighting, etc. [25].

Potentially important epistemic uncertainties were ident-

ified in the random laws of the aleatory uncertainties as well

as in the dynamics model, the model of countermeasures

and in a model that provides input from the cable fire.

Among the latter are flame spread velocities as well as

numbers, diameters and heat of combustion of the cables on

the vertical and horizontal trays, parameters of the

Table 1

Hold-up tank problem [14]: comparison of results from the approximate uncertainty analysis with results from a complete uncertainty analysis with full two

stage sampling

Quantiles of the probability distribution of From two stage sampling with

sample sizes

From the approximate analysis with two samples

(100 þ 100) and the assumption of a Beta distribution

50 £ 50 100 £ 100

P(‘dry-out’lU) 5% 0.0 0.0 2.9 £ 1027

50% 1.9 £ 1023 1.2 £ 1023 1.0 £ 1023

95% 2.3 £ 1022 2.2 £ 1022 2.1 £ 1022

P(‘overflow’lU) 5% 1.5 £ 1024 1.9 £ 1024 1.8 £ 1025

50% 3.2 £ 1023 4.6 £ 1023 4.7 £ 1023

95% 4.0 £ 1022 4.1 £ 1022 5.1 £ 1022

E. Hofer et al. / Reliability Engineering and System Safety 77 (2002) 229–238 233

temperature dependent effectiveness of fire fighting

materials, etc. [25].

The same approach as in the Hold-Up Tank example

considered before was also performed in this case:

MCDET method for sampling aleatory variables,

two simple sampling procedures for the approximate

approach; i.e. (1) joint sampling of aleatory and

epistemic uncertainties simultaneously, (2) sampling of

aleatory uncertainties with epistemic uncertainties held

fixed at their reference values.

For comparison of results the complete analysis with full

two stage sampling of epistemic/aleatory variables has

also been performed.

Three output variables have been selected for presen-

tation of results:

Y1 ¼ the time span over which the temperature in the hot

gas layer of compartment no. 1 is above 200 8C;

Y2 ¼ indicator of the event ‘the temperature in the hot

gas layer of compartment no. 1 exceeds 200 8C’;

Y3 ¼ indicator of the event ‘the temperature in the hot

gas layer of compartment no. 1 exceeds 200 8C for more

than 600 s’.

Consequently, the conditional expectations of interest

are:

E[Y1lU] ¼ conditional expectation of the probability

distribution of the time span over which the temperature

in the hot gas layer of compartment no. 1 is above

200 8C; given U,

E[Y2lU] ¼ conditional probability for the temperature in

the hot gas layer of compartment no. 1 to exceed 200 8C;

given U,

E[Y3lU] ¼ conditional probability for the temperature in

the hot gas layer of compartment no. 1 to exceed 200 8C

for more than 600 s, given U.

The distribution assumptions were: Lognormal for

E½Y1lU� and Beta for E½Y2lU� and for E½Y3lU�:The results of the approximate uncertainty analysis

approach along with results of the complete uncertainty

analysis from full two stage sampling are shown in Table 2.

As before, they are given in form of 5, 50 and 95% quantiles

of the subjective probability distribution of E½YilU�:The same observations with respect to the agreement of

the approximate and complete uncertainty analyses as in the

previous example hold in this case, too.

3.3. PSA-contribution from a common leakage in five

redundant fill level measurement devices

It is postulated that in a 1300 MW boiling water reactor a

maintenance error (with an expected frequency HME per

reactor year) leads to a leakage in the stand pipe of the fill

level measurement device (Fig. 1). This leakage leads to a

false level measurement: The measured level (LM) is higher

than the real level (LR) in the reactor pressure vessel.

It is further assumed that a common cause failure (caused

by the maintenance error) leads to a leakage in all five

redundant level measurement devices (with a conditional

probability PCCF). Combinations of too high fill level

signals can wrongly activate the overfill protection of the

reactor safety system and thus stop almost every source of

feedwater. This can lead to a dry-out of the reactor pressure

vessel and may result in a core melt accident (see Fig. 2:

Z4CD). To avoid core damage, the operators can initiate

pressure relief. If they do this in time, it leads to a refill of

the vessel (Z4ok). The time span tSCRAM.CD available for

correct diagnosis of the situation (tDiag) and for performing

the operator action (taction) is dependent on the values of the

Table 2

PSA-contribution from a cable fire scenario [14]: comparison of results from the approximate uncertainty analysis with results from a complete uncertainty

analysis with full two stage sampling

Quantiles of the probability

distribution of:

From two stage sampling with

sample size 100 £ 100

From the approximate analysis with

two samples (100 þ 100)

E½Y1lU� Lognormal distribution

5% 0 5.1 £ 101

50% 1.8 £ 101 2.6 £ 102

95% 1.37 £ 103 1.25 £ 103

E½Y2lU� Beta-distribution

5% 0 7.9 £ 1026

50% 3.8 £ 1021 5.8 £ 1021

95% 1 1

E½Y3lU� Beta-distribution

5% 0 6.0 £ 1027

50% 0 1.2 £ 1021

95% 1 9.9 £ 1021

E. Hofer et al. / Reliability Engineering and System Safety 77 (2002) 229–238234

aleatory uncertainties and on the corresponding evolution of

the process dynamics.

3.3.1. Aleatory and epistemic uncertainties

Since the leakage rates in the five redundancies can be

different, we get up to five different fill level signals

(LM1…5). These leakage rates and 10 other aleatory

uncertainties (see Table 3) influence the accident pro-

gression. In addition to the aleatory uncertainties epistemic

uncertainty is also quantified in the analysis (see Table 4). In

this example 41 epistemic uncertainties are considered.

They include uncertain model formulations and parameters

of the thermal-hydraulics model and of the human reliability

model.

3.3.2. Analysis

The expected frequency of the situation ZL,CCF, and its

epistemic uncertainty, is quantified by conventional event

tree technique (Fig. 2). Dynamic reliability analysis with

direct Monte Carlo simulation is used to quantify

E{PCDlU}; the expected value of the conditional probability

that the situation ZL,CCF leads to core damage. The method

for approximately quantifying the subjective probability

distribution of E{PCDlU}; with U denoting the vector of

epistemic uncertainties, is as explained in Section 2 above.

3.3.2.1. Plant simulator. For the dynamics calculation we

need a model of the system, including reactor physics,

thermal-hydraulics, control and safety systems etc. Since

Fig. 1. Leakage in all stand pipes.

Fig. 2. Dynamic reliability analysis (DRA) integrated into event tree diagram.

E. Hofer et al. / Reliability Engineering and System Safety 77 (2002) 229–238 235

the scenario involves complex actions of the control and

safety systems and since small changes in physical variables

can have significant influence on the system behavior, it is

necessary to employ a model which is as accurate as

possible [16]. Therefore a very detailed and well tested

plant-specific simulator is utilized, which is based on the

full-scale thermal-hydraulics code ATHLET [17] in con-

nection with the plant analyzer ATLAS [18]. This

simulation software is being developed by the Gesellschaft

fur Anlagen- und Reaktorsicherheit (GRS).

3.3.2.2. Simulation runs. With this plant simulator 100

dynamics runs (V-runs) are performed. In each run a sample

value is used for the aleatory uncertainties V_1 to V_14

according to their specified probability density function. For

each epistemic uncertainty U_1 to U_39 a best estimate

value is chosen; the vector of these values uBE is not varied

throughout the 100 V-runs.

The dynamics run ends when the cladding temperature

exceeds the core damage temperature U_9BE ¼ 1200 8C

(Z4) or when a refill of the reactor pressure vessel is

identified (Z3) (for details see [19]). In case of Z4 we

receive a finite value for the time span tSCRAM.CD as output;

for runs ending with state Z3 the value tSCRAM.CD is set to

infinity.

After that another 100 dynamics runs (V and U-runs) are

perfomed where both aleatory and epistemic uncertainties

are sampled simultaneously. The empirical distribution

function of tSCRAM.CD is shown in Fig. 3.

3.3.2.3. Human reliability analysis (HRA). The probability

that the operators do not find the correct diagnosis of the

situation (human error probability, HEP) within tDiag ¼

tSCRAM:CD 2 tAction is evaluated with three different human

reliability models: The THERP method [20], a model based

on simulator data from the LaSalle nuclear power plant [21],

and a model based on the French PHRA approach [22]. It is

not known, which of the three models describes reality best.

Therefore the choice of the HRA model is epistemic

uncertainty (U_40) with equal subjective probability

assigned to each model. Additionally, the HEP value resulting

from each model has an uncertainty range which is represented

by the uncertainty factor U_41. To avoid unreasonably high

or low HEP values, the range of possible HEP values is

limited by an upper and lower boundary (see Fig. 4).

3.3.2.4. Calculating E{PCD} and percentiles of the

subjective probability distribution. Using the method of

Section 2, the next step would be to determine the human

error probability (HEP, which equals PCD, see Fig. 2) with a

‘best estimate HRA model’, best estimate value of U_41 and

a randomly chosen value for V_15 for each tSCRAM.CD

obtained from the V-runs. From these 100 values for

PCD one could calculate an estimator for the variance of PCD

under the condition of the given vector of best estimate

values, Var{PCDluBE}: According to Section 2 we would

use it as an approximation to the expected value for the

variance of PCD : E{Var{PCDlU}} < Var{PCDluBE}:In addition, for each V and U-run one would randomly

choose one of the three HRA models (U_40), and a value for

U_41 to calculate PCD. These 100 values for PCD would

provide an estimate for E{PCD} and an estimate for the total

variance Var{PCD}:

Table 3

Aleatory uncertainties

V_1,…,V_5 Leakage rate 1,…,5

V_6 Time in fuel cycle

V_7 Reactor power at begin of transient

V_8 Water enthalpy in condensate storage (depends on season)

V_9,…,V_13 Measurement error fill level (statistical)

V_14 Measurement error pressure (statistical)

V_15 Operator action time taction

Table 4

Epistemic uncertainties

U_1 Correlation coefficient leakage rates V_1–V_5

U_2 Signal run time for scrama

U_3 Simulated time before start of transient

U_4 Heat loss via structuresa

U_5 K-95 for leakage rates V_1,…,V_5

U_6 Correlation power/time in fuel cycle

U_7 Injection time for control rodsa

U_8 Fluid injection rate of control rod purge system

and pump seal watera

U_9 Core damage temperature

U_10 Correction factor volume partitioning of separator

contr. vol.a

U_11 Correction factor for decay model

U_12 Fuel level for comparator signal

U_13–U_39 Correction factors for Heat transfer models,

evaporation modelsa

U_40 HRA-model (THERP, LaSalle or PHRA)

U_41 Uncertainty factor for HRA-model

a Parameter based on [15].

Fig. 3. Empirical distribution function of tSCRAM.CD; the remaining

cumulative probability is centered at ‘infinity’.

E. Hofer et al. / Reliability Engineering and System Safety 77 (2002) 229–238236

During the analysis it turned out that most of the total

epistemic uncertainty is due to the HRA. Furthermore, the

HRA does not require any significant computing time,

whereas each plant simulation requires several hours

computing time (the 200 simulation runs required a total

of 482 h processor time distributed over several DEC

ALPHA workstations). This led to the idea to perform 100

HRA analyses with each of the 100 values tSCRAM.CD

obtained from the V and U plant dynamics runs, based on

100 randomly selected values for U_40 and U_41. From

these 10,000 values we computed the estimates E{PCD} ¼

3:3 £ 1023 and dVarVar{PCD} ¼ 6:8 £ 1025:From each value tSCRAM.CD from the V-runs 100

values PCD are calculated, again based on 100 randomly

selected values for U_40 and U_41. Thus we obtain a

better estimator:

E{Var{PCDlU}} ¼ 1=100X

j

dVarVar{PCDluBE; u_40j; u_41j}

¼ 5:5 £ 1025

The three HRA models and the 20,000 values for PCD

(based on 200 values for tSCRAM.CD) are displayed in Fig. 4.

With these estimates the approximation from Section 2 isdVarVar{E{PCDlU}} < dVarVar{PCD} 2 E{Var{PCDlU}}: Assum-

ing a Lognormal subjective probability distribution for

E{PCDlU}; we find K95 < 4.3, where K95 denotes the ratio

between the 95% percentile and the 50% percentile of this

distribution. The results are illustrated in Fig. 5. Comparing

these results with other scenarios examined in most conven-

tional PSAs shows that the example scenario is a significant

contributor to the total risk of a nuclear power plant.

Fig. 4. Determining HEP from tDiag.

Fig. 5. Expected frequency per reactor year of the initiating event, branching probabilities of the event tree (see Fig. 2) and the total expected core damage

frequency with quantiles of their subjective probability distribution.

E. Hofer et al. / Reliability Engineering and System Safety 77 (2002) 229–238 237

3.3.3. Discussion of this example

The core damage frequency due to a complex transient in

a boiling water reactor has been estimated with moderate

computational effort. This has been accomplished by

integrating the dynamic reliability analysis (DRA) into the

conventional event tree method. It is not feasible to analyze

this scenario without DRA. The combined influence of the

epistemic uncertainties in the model of the dynamic

evolution of the plant behavior, in the HRA, and in other

probability estimates of the DRA could be quantified in an

integrated and approximate manner. It was not possible to

compare the results of this approximate analysis with those

of a full two-stage nested Monte Carlo approach as the latter

would have required about 2.8 years of CPU time.

4. Conclusions

It is well known and widely recognized that an epistemic

uncertainty analysis is an essential feature of any model

application and that it can easily be performed on the basis

of a Monte Carlo simulation with a moderate sample size

independent of the number of epistemic uncertainties

involved [23].

However, if aleatory uncertainties are also present and

must be taken into account by Monte Carlo simulation, too,

the computational effort to perform the appropriate two

stage nested sampling of epistemic and aleatory variables is

often not feasible.

The proposed approximate epistemic uncertainty anal-

ysis approach only needs two simple Monte Carlo

simulations and thus requires much less computational

effort.

The sample applications of this approach presented in

this paper look quite promising. Therefore, in many

situations, performing the suggested approximate epistemic

uncertainty analysis seems to be preferable to the alternative

of not performing any.

References

[1] US Nuclear Regulatory Commission, Regulatory guide 1.174.

Washington: Office of Nuclear Regulatory Research; 1998.

[2] Parry GW. The characterization of uncertainty in probabilistic risk

assessment of complex systems. Reliab Engng Syst Safety 1996;54:

119–26.

[3] Hofer E. When to separate uncertainties and when not to separate.

Reliab Engng Syst Safety 1996;54:113–8.

[4] Devooght J. Uncertainty analysis in dynamic reliability. In: Mosleh A,

Bari RA, editors. Proceedings of PSAM-4, Berlin: Springer; 1998.

[5] Labeau P-E. Monte Carlo treatment of uncertainties in dynamic

reliability. In: Mosleh A, Bari RA, editors. Proceedings of PSAM-4,

Berlin: Springer; 1998.

[6] Helton JC, et al. Uncertainty and sensitivity analysis results obtained

in the 1996 performance assessment for the waste isolation pilot plant.

SAND98-0365, Albuquerque: Sandia National Laboratories; 1998.

[7] Kampas FJ, Loughlin S. Deconvolution of variability and uncertainty

in the cassini safety analysis. In: Mosleh A, Bari RA, editors.

Proceedings of PSAM-4, Berlin: Springer; 1998.

[8] Parzen E. Stochastic processes. San Francisco: Holden Day; 1962.

[9] McKay MD, Beckman RJ, Moore LM, Picard RR. An alternative

view of sensitivity in the analysis of computer codes. Proceedings of

the American Statistical Association Section on Physical and

Engineering Sciences, Boston, MA: August 9–13, American

Statistical Association; 1992.

[10] Aldemir T. Utilization of the cell-to-cell mapping technique to

construct Markov failure models for process control systems. In:

Apostolakis G, editor. Probabilistic safety assessment and manage-

ment, vol. 2. New York: Elsevier; 1991.

[11] Siu N. Risk assessment for dynamic systems: an overview. Reliab

Engng Syst Safety 1994;43:43–73.

[12] Labeau P-E. Improved Monte Carlo simulation of generalized

unreliability in probabilistic dynamics. International Conference on

Nuclear Engineering, vol. 3. New York: ASME; 1996.

[13] Marseguerra M, Zio E. Monte Carlo approach to PSA for dynamic

process systems. Reliab Engng Syst Safety 1996;52:227–41.

[14] Hofer E, Kloos M, Peschke J. Methodenentwicklung zur simulativen

Behandlung der Stochastik in probabilistischen Sicherheitsanalysen

der Stufe 2. Garching: GRS-A-2786, Gesellschaft fur Anlagen- und

Reaktorsicherheit; 2001.

[15] Hofer E, Kloos M. Lessons learned from an uncertainty and sensitivity

analysis of a transient simulation for a PSA. Proceedings PSA’99,

ANS; 1999. p. 363–68.

[16] Woltereck M. A BWR transient as an application for dynamic PSA

with the thermal-hydraulic code ATHLET. In: Smidts C, Devooght J,

Labeau P-E, editors. International Workshop Series on Dynamic

Reliability: Future Directions, University of Maryland, USA: Center

of Reliability Engineering; 2000.

[17] Teschendorf V, Austregesilo H, Lerchl G. Methodology, status and

plans for development and assessment of the code ATHLET.

Proceedings of the OECD/CSNI Workshop on Transient Thermal-

Hydraulic and Neutron Code Requirements, Annapolis, USA; 5–8

November 1996.

[18] Beraha D, Pointner W, Voggenberger T. ATLAS: applications

experiences and further developments. Proceedings of the Second

CSNI Specialist Meeting on Simulators and Plant Analyzers, Espoo,

Finland; September 29–October 2 1997.

[19] Woltereck M. Dynamische Zuverlassigkeitsanalyse mit anlagenspe-

zifischen Storfallsimulatoren. VDI-Fortschrittsberichte Reihe 20,

Dusseldorf, Germany, VDI-Verlag; 2001.

[20] Swain AD, Guttmann HE. Handbook of human-reliability analysis

with emphasis on nuclear power plant applications. Washington:

NUREG/CR-1278, NRC; 1983.

[21] Weston L, Whiehead D, Graves N. Recovery actions in PRA risk

methods integration and evaluation program (RMMIEP). Washing-

ton: NUREG/CR-4834, SAND 87-0179, NRC; 1987.

[22] Etude Probabiliste de Surete d’une tranche du Centre de Production

Nucleaire de PALUEL (1300 MWe). Electricite de France; 1990.

[23] Hofer E. Sensitivity analysis in the context of uncertainty analysis for

computationally intensive models. Comput Phys Commun 1999;117:

21–34.

[24] Hofer E, Kloos M, Krzykacz B, Peschke J, Sonnenkalb M.

Methodenentwicklung zur simulativen Behandlung der Stochastik

in probabilistischen Sicherheitsanalysen der Stufe 2. Garching: GRS-

A-2997, Gesellschaft fur Anlagen- und Reaktorsicherheit; 2001.

[25] Heider C, Hofer E, Kloos M, Peschke J, Rowekamp M,

Turschmann M. Unsicherheitsanalysen zu einem Kabelbrandszenario

im Sicherheitsbehalter einer Konvoi Anlage. Technical report GRS-

A-2889, Gesellschaft fur Anlagen- und Reaktorsicherheit; November

2001.

E. Hofer et al. / Reliability Engineering and System Safety 77 (2002) 229–238238