The paper deals with the presentation of the Reliability Evaluation of Passive Safety System (REPAS) methodology developed by University of Pisa. The general objective of the REPAS is to characterize in an analytical way the performance of a passive system in order to increase the confidence toward its operation and to compare the performances of active and passive systems and the performances of different passive systems. The REPAS can be used in the design of the passive safety systems to assess their goodness and to optimize their costs. It may also provide numerical values that can be used in more complex safety assessment studies and it can be seen as a support to Probabilistic Safety Analysis studies. With regard to this, some examples in the application of the methodology are reported in the paper. A best-estimate thermal-hydraulic code, RELAP5, has been used to support the analyses and to model the selected systems. Probability distributions have been assigned to the uncertain input parameters through engineering judgment. Monte Carlo method has been used to propagate uncertainties and Wilks' formula has been taken into account to select sample size. Failure criterions are defined in terms of nonfulfillment of the defined design targets.

Passive systems deserve a special attention within the nuclear technology owing to their potential to increase the safety level of the power plants and to reduce the cost for the energy production. The intensive use of passive systems in the new nuclear technology needs a robust assessment of their reliability. The passive safety systems for their nature, because their functioning depends only on natural physical laws and not on an external source of supplied energy, are more reliable than the active ones. Nevertheless the passive systems may fail their mission as consequence of components failure, deviation of physical phenomena, boundary and initial conditions.

The extensive use of passive safety systems, mainly in advanced reactors design, makes necessary to deeply study the approach to their reliability assessment. This implies not only the consideration of mechanical components, evaluated through classical risk assessment tools (e.g., Failure Mode and Effects Analysis (FMEA), FTA, Hazard Operational Analysis (HAZOP), etc.), but also the consideration of the associated TH phenomena in terms of the deviation from expected system behavior due to “alterations” in the environmental conditions.

In the present paper an overview of the REPAS methodology is reported with its application and its effectiveness is briefly shown. It is also shown how it can be used to support the design of the passive systems.

The reliability evaluation of passive system needs a suitable methodology aiming to determine the passive system reliability function, which is the failure probability of the physical principle upon which the system operation is relying [

A pioneering activity aimed to evaluate the reliability of passive systems was proposed in mid-1990s within the framework of bilateral contacts between CEA and ENEA. In 2000 this issue was studied by the University of Pisa (UNIPI) [

The methodology was embedded in the Reliability Methods for Passive Safety (RMPS) methodology, developed within the framework of a project called RMPS functions, under the European 5th Framework program [

Actually the methodology is in the setting up phase for an absolute evaluation of the reliability of passive safety system function.

It is important to give the following definition to understand the proposed issue

Is the known bias (or difference) between a code prediction and the actual (measured) transient performance of a real facility.

Analysis

Analysis

The REPAS methodology can be subdivided in the following main steps ([

characterization of design/operational status of the system (identification of relevant parameters connected with the TH phenomenon: design and critical parameters),

definition of nominal values, range of variation and assigned probability distributions to design and critical parameters,

deterministic (based on engineering judgment) and statistic (e.g., through Monte Carlo procedure) selection of system status,

definition of failure criteria for the system performance (starting from the knowledge of the system mission and the identification of the accident scenario and allowing the definition of design targets for passive system); the failure criteria are established as single targets (e.g., the system shall deliver a specific quantity of liquid within a fixed time) or as a function of time targets or integral values over a mission time (e.g., the system shall reject at least a mean value of thermal power all along the system actuation); in some cases, it can be better to define a global Failure Criterion (FC) of the complete system instead of a specific criterion concerning the passive system; for instance, the FC can be based on the maximal clad temperature during a specified period; in this case, it is necessary to model the complete system and not only the passive system,

detailed code modeling; once the system mission, accident scenario, and FC are established, a system model has to be developed by means of a best-estimate TH code (e.g., RELAP5),

direct Monte Carlo simulation applied to TH code; it involves the propagation of the uncertain selected parameters through the considered TH code obtaining a model response (i.e., output variable) which allows, by means of statistic methods, to estimate the probability of failure of the passive function,

sensitivity analysis,

quantitative reliability evaluation.

The REPAS methodology has been applied to three NC systems. The three systems are

a prototypical integrated system: the related analysis can be considered as an exercise scope calculation;

the scaled Isolation Condenser (IC) of a Simplified Boiling Water Reactor (SBWR) [

the TTL-1 experimental apparatus [

In the first case the analyzed system is a typical “pool heat removal system.” The heat source, the steam generator and the primary recirculation loop, are contained inside the Reactor Pressure Vessel [

The simplified layout of this prototypical reactor is shown in Figure

Passive pool heat removal system for a prototypical integrated system.

The second analyzed system is the IC, which is part of the SBWR design. A sketch of the system is given in Figure

Standard IC of an SBWR.

The third analyzed system, the TTL-1 experimental apparatus [

Sketch of TTL-1 loop.

In the following subsections are reported the application steps of the methodology above briefly described. In particular is deeply described the application and the results obtained of the REPAS methodology to a pool heat removal system of a prototypical integrated system (case a) while for the other two systems (cases b and c) are outlined only the main outcomes of the application (see Section

The first step is the characterization of the system, in particular the identification of relevant parameters connected with the TH phenomenon. The relevant parameters are defined design and critical parameters.

are mainly related to the nominal system configuration, for example, nominal power, pressure, level, and may include also geometrical parameters.

are physical quantities that may affect the mission of the passive system like presence of noncondensable gas in an NC system.

In Tables

Design parameters case a.

Design parameter ID | Description |
---|---|

OP | Nominal Power |

SD | SRAM delay |

DF | Decay power factor |

P1 | Reactor nominal pressure |

SP | SCRAM: pressure set point |

P2 | PHRS: pressure set point |

L1 | RPV: dome water level |

M | PCS: mass flow rate |

T1 | PHRS: valves opening time |

PT | PHRS: pool temperature |

TT | PHRS: tube thickness |

Critical parameters case a.

Critical parameter ID | Description |
---|---|

C2 | Heat Losses piping |

W1 | PHRS tube thickness |

HL | RPV dome heat losses |

F | PHRS friction |

Psp | Safety valves: pressure set point |

The knowledge of the system missions and failure modes allows evaluating the failure criteria. The accident scenario considered is a loss of the ultimate heat sink with the hypothesis of loss of all safety systems involved, no feed and bleed strategy is taken into account, and so forth Considering that transient, the system mission is to remove the decay heat reducing the pressure in the primary system.

The design FC defined for the transient sequence is the opening of the safety valves during any stage of the transient. To characterize the passive system behavior (or passive system performance) three Transient Performance Indicators (TPI) are defined. In particular they have to indicate how far the system is from the opening condition of the passive safety valve of the condenser system.

In terms of the system mission two design targets can be defined: long-term (e.g., hot shutdown condition) and short-term (e.g., primary overpressure) design target. The failure of the system is reached when passive safety valves are open.

The TPIs defined are

RELAP5 mod 3.3 input deck has been developed to perform the TH analyses. The model involves the Primary System and the pool for the removal of decay heat (see Figure

Simplified RELAP 5 nodalization for case a.

The primary circuit has been set up by modeling the most relevant components: Reactor Pressure Vessel (RPV), Steam Generator (SG), Down-Comer (DC), Core, Lower Plenum (LP) and Upper Plenum (UP).

The passive heat removal nodalization includes steam line and return line, condensers, and the pool.

In order to simulate properly the natural circulation inside the pool, a detailed model has been adopted with specific feature coming from engineering judgments and user experience (e.g., by pass line, slice nodalization).

The purpose of direct Monte Carlo simulation is to assess the propagation of the uncertain parameters through the TH code in order to obtain a model response (set of code run). In particular it consists in sampling the identified parameters, running, for each obtained sample, the system model computer code and estimating the characteristics of the output variables. This method was used to evaluate the failure probability _{f}

In the following subsections the main steps of direct Monte Carlo simulation (i.e., sampling and best—estimate code run) are outlined, describing the used procedures and the results obtained. Also best estimate code run results are reported based on deterministic selection of input cases coming from engineering judgment and sensitivity analysis outcomes.

Simple Random Sampling (SRS) method was adopted to obtain the parameters samples. The method generates randomly all values of parameter sample from their defined distribution.

The parameter samples, through SRS, are obtained considering the following three main steps.

to draw the value of the truncated cumulative distribution function by sampling a uniform distribution

to obtain the correspondent value (

to feed this probability into the inverse of the cumulative distribution function in order to obtain the parameter sample (

Cumulative function is

Inverse of

Cumulative function is

Inverse of

The tool used to analyze the sampling results is the cobweb plot. The parameter samples are represented as points in vertical lines. Each set of inputs can be seen as a vector where its elements represent one sample value for each parameter. In the plot shown in Figure

From the plot it can be seen that some parameters were not sampled in their full range (blank regions); this outcome led to the necessity of generating additional deterministic cases in order to add completeness to the study.

Cobweb plots of normalized parameters range.

The stochastic selection has been made sampling the defined design and critical parameters (Tables

A hundred samples were obtained for each parameter implying the same number of code runs. The input set was built as follows

The number of code runs (and then the number of samples for each parameter) was calculated by means of Wilks’ formula [

Wilks’ formula gives the proper number of independent observations of the random output

Based on the hypothesis that nothing is known about the output distribution function-

The number of independent observations of the output variable (i.e., number of code runs) for the two-sided tolerance interval is calculated by the following equation:

The tolerance interval

According to this, the number of codes runs obtained (

The selected sample size, 100 samples, satisfies, the 95%/99% criteria (probability content = 95%, confidence level = 99%) for one-sided tolerance interval.

The deterministic selected cases have been made in order to add completeness to the analysis, additionally ten cases where added, based on engineering judgment, five “a priori” to evaluate parameters combinations not achieved by the stochastic selection (blank region of cobweb plot) and five “a posteriori” considering as feedback the results obtained from sensitivity analysis.

The main outcomes, obtained by Direct Monte Carlo simulation, are linked to the design FC selected for the passive system. B-E code runs of the associated input vector are shown; in particular are reported the follows.

the pressure trend:

short term (Figures

a long term (Figure

the power exchange ratio (power exchanged across the condensers tubes and core power) long term (Figure

Pressure behavior—normalized scale—Short-term (stochastic selected and nominal case).

Power ratio evolution—long-term behavior (stochastic selected and nominal case).

Pressure evolution—normalized scale—Long-term (a priori deterministic selected cases).

Transient performance indicator—1 result (long term).

Transient performance indicator—2 results (long term).

Transient performance indicator—3 results (long term).

Sensitivity analysis to identify the worst system condition.

Sensitivity analysis can provide additional criteria in order to perform a further screening of the uncertain parameters. In this case, since the number of relevant parameters selected is reasonably low, the sensitivity analysis will be used just to determine those parameters that affect mostly the condenser system behavior.

As it can be observed (Figure

The Standardized Regression Coefficients (SRCs) technique [

The technique is based on the hypothesis of a linear relationship between response and input parameters.

For the use of the SRC technique it is supposed that the response

The SRCs are given by is

The SRCs quantify the effect of varying each input variable from its mean value by a fixed fraction of its variance (maintaining all other variables at their expected values).

The SRC values are reported in Figure

Standardized regression coefficients for the defined performance indicator.

A preliminary qualitative reliability assessment is made by means of a so-called response surface calculation [

Several code runs were done without obtaining failure cases, showing that the use of Monte Carlo is limited to estimate rare events probabilities. This allows estimating a conservative boundary of the failure probability by means of equation used to evaluate the number of code runs necessary to set

Considering

The same can be achieved by the application of Wilks’ formula [

The result obtained shows the highly reliability of the investigated passive safety system.

A lay-out modification (see Figure

to analyze the methodology and the model developed,

to evaluate the long term transient,

to give support to the system design adding another judgment criterion

to add completeness to the sensitivity analysis.

Lay-out modification: scope calculation.

In particular the length of the connection lines between the condenser pool and the reactor was reduced of about 3 meters.

One of the results of reducing the piping line of the safety system is the condensers tubes flooding after the system is demanded. This is due to the fact that the liquid column height is mainly affected by the overall friction across the safety system circuit.

The change proposed affects only the nonrelevant distributed frictions; thus, the return line equivalent liquid level is approximately sustained at original system values, which derives in the mentioned piping line flooding.

The liquid present into the piping affects the heat transfer reducing the power exchanged across the condensers. The relevance of this effect can be seen through the comparison between the power ratio values obtained for the original and modified systems (Figure

Power ratio comparison between the original and the modified system.

From the simulations results (Figure

Transient performance indicators results comparison between original and modified system.

In the following are reported the main results of the REPAS application to the following systems:

a scaled IC of an SBWR (case b) [

TTL-1 experimental apparatus (case c) [

In particular in the following, according to Section

The system was modeled (Figure

Design parameters case b.

Design parameter ID | Description | UNIT | Nominal value | Range | Discrete initial value |
---|---|---|---|---|---|

P1 | RPV Pressure | MPa | 7 | 0.2–9 | 0.2 1 3 7 10 |

L1 | RPV collapse level | M | 8.7 | 5–12 | 5 7 8.7 10 12 |

L3 | POOL level | M | 4.3 | 2–5 | 2 4.3 5 |

Tp (0) | POOL initial temperature | K | 303 | 280–368 | 280 303 368 |

— | System geometry layout | — | — | Not assigned | — |

Critical parameters case b.

Critical parameter ID | Description | Unit | Nominal value | Range | Discrete initial value |
---|---|---|---|---|---|

X1 | RPV Non-condensable fraction | — | 0 | 0-1 | 0 0.01 0.1 0.2 0.5 0.8 1 |

X2 | Non-condensable fraction at the inlet of IC piping | — | 0 | 0-1 | 0 0.01 0.1 0.2 0.5 0.8 1 |

Inclination of the IC piping on the suction side | deg | 0 | 0–10 | 0 1 5 10 | |

C2 | Heat Losses piping –IC suction | kW | 5 | 0–100 | 0 5 20 100 |

L2 (0) | Initial condition liquid level –IC tubes, inner side | % | 100 | 0–100 | 0 50 100 |

UL | Undetected leakage | m^{2} | 0 | 0–10 | 0 1 |

POV | Partially opened valve in the IC discharge line | % | 100 | 1–100 | 1 10 50 100 |

Design and critical parameters case c.

Parameter ID | Description | Unit | Nominal value | Range | Discrete initial value | |
---|---|---|---|---|---|---|

and associated probabilities | ||||||

LP | Linear power of electrically heated rod | W/m | 30 | 0–30 | — | |

P1 | Initial Pressure of the loop | bar | 5 | 1–10 | 1 3 5 8 10 | |

T2 | Temperature of the SS fluid at the cooler inlet | K | 303 | 295–350 | 295 303 325 350 | |

HL1 | Heat losses from the test section (TS). % of TS power | % | 0.2 | 0–4.5 | 0.0 0.2 1.0 4.5 | |

HL2 | Heat losses from the loop w/o (TS). % of TS power | % | 3 | 0–20 | 0.0 3 10 20 | |

L1 | Total length of the loop | m | 21 | 12–34 | 12 21 28 34 | |

LV | Loop volume (change of the pre-heater tank) | m^{3} | 0.09 | 0.07–0.2 | 0.07 0.09 0.12 0.2 | |

PV | Volume of PRZ | m^{3} | 0.06 | 0.03–0.12 | 0.03 0.06 0.09 0.12 | |

PN | Noding of the PRZ | — | N | N1-N2 | N1 N N2 | |

PP | Position of the PRZ | Upstream the cooler (U) | — | U | U–D | U D |

Downstream the cooler (D) | ||||||

K1 | Local pressure drop coefficient (K) at the inlet of the TS | — | 0.2 | 0–1.2 | 0.0 0.2 0.4 1.2 | |

K2 | K factor at the outlets of the TS | — | 0.6 | 0-1 | 0.0 0.6 0.8 1.2 | |

TK | Sum of the K factors, w/o TS inlet and outlet | — | 7.5 | 3–25 | 3 7.5 15 25 | |

EI | Electrical Insulation in the heater | AL_{2}O_{3} (A) | — | A | A-B | A B |

Boron nitride (B) | ||||||

CIT | Thickness of cooler tubes | mm | 2 | 1–3 | 1 2 3 | |

CT | Cooler tubes | — | Cu | Cu–SS | Cu SS | |

E2 | Equivalent diameter of secondary side of the cooler | mm | 10 | 7–20 | 7 10 20 | |

E1 | TS Equivalent diameter (coolant passage) | mm | 8 | 5–12 | 5 7 8 12 | |

AR | Ratio of Heater heat transfer area to cooler heat transfer area | — | 0.18 | 0.05–0.37 | 0.05 0.12 0.18 0.37 | |

PD | Axial power distribution | Uniform (U) | — | U | C–S | C U S |

Cosine (C) | ||||||

Semi cosine (S) | ||||||

CO | Orientation of the cooler | Vertical (V) | — | H | I–V | I H V |

Horizontal (H) | ||||||

Inclined (I) | ||||||

MF2 | Secondary side mass flow rate | Kg/s | 1.2 | 0.4–1.8 | 0.4 1.2 0.8 1.8 | |

P2 | Secondary side pressure | bar | 1 | 1–10 | 1 5 10 | |

LS | Presence of U-pipe or loop seal in the cold part of the loop | — | No | Yes-No | Y N | |

D1 | Riser diameter | mm | 25 | 25–100 | 25 50 75 100 | |

D2 | Down comer diameter | mm | 25 | 25–75 | 25 50 75 | |

PC | PRZ Connection | Direct (D) | — | S | D–S | S D |

Surge Line (S) | ||||||

G1 | Non-condensable gas mass fraction at the inlet of cooler piping | — | 0 | 0–1 | 0.0 0.05 0.2 0.5 0.8 | |

G2 | Non-condensable gas mass fraction inside the TS | — | 0 | 0–1 | 0.0 0.05 0.3 0.5 0.8 | |

UL | Undetected leakage | Kg/s | 0 | 0–1 | 0.0 0.1 | |

RELAP5 nodalization of IC of an SBWR case b.

For the analysis were chosen 6 system status selected deterministically and 69 system status selected probabilistically (for each of two probability distribution) discrete and continuous (Figures

(a) Reference system performance: power exchanged through the IC. (b) Time trends related to the ensemble of 75 code runs (6 deterministic status and 69 probabilistic status—discrete probability distribution): power exchanged trough the IC. (c) Time thrends related to the ensemble of 75 code runs (6 deterministic status and 69 probabilistic status—continuous probability distribution): power exchanged through the IC.

Characterization of system status on the basis of the probability. Six system status (1 to 6 in the figure) is deterministically derived and sixty-nine (7 to 75 in the figure) are statistically derived assuming a discrete probability distribution.

Characterization of system status on the basis of the probability. Six system status (1 to 6 in the figure) is deterministically derived and sixty-nine (7 to 75 in the figure) are statistically derived assuming a continuous probability distribution.

The FC considered was

the thermal power exchanged across the IC (

mass flow rate at the IC inlet (

“ref” related to the code calculation for the reference or nominal system configuration.

Indicators of system performance are

time during the calculation when the FC is verified, failure time

ratio between the failure time and the time of calculation. where

In this case the curves of merit (Figure

Curves of merit: probability for the performance indicator “IC power integral ratio” (discrete probability distribution).

The system was modeled (Figure

RELAP 5 nodalization TTL-1 apparatus case c.

Time trends related to the ensemble of 137 code runs ([

The FC is expressed as

The system PIs to evaluate the Thermal Hydraulic Reliability (TH-R) are

integral value over a mission time,

ratio

The deterministic and statistic selection of system scenarios was done by means of Monte Carlo procedure. Four ways are pursued to arrive at four definitions for the TH-R of the TTL-1 loop, respectively, adopting the following.

The “figure of merit” approach proposed by [

The “cumulative probability” approach suggested by [

The R1 single-valued reliability definition is

Probability distribution for the performance indicator: integral power ratio exchanged in the cooler.

Comparison between thermal hydraulic reliability for two different systems: IC-SBWR (two-phase NC system) and TTL 1.

The R2 single-valued reliability definition is

Selected system performance indicator related to individual probability intervals.

Case ID | Probability | Accepted Run | Failed Run | |
---|---|---|---|---|

Reference | 4.25E-06 | □ | — | 1 |

1 | 1.21E-07 | □ | * | 0.785 |

2 | 1.18E-06 | □ | — | 1.004 |

3 | 1.31E-07 | □ | — | 0.97 |

4 | 3.69E-07 | □ | — | 0.953 |

5 | 3.69E-07 | □ | * | 0.782 |

6 | 3.08E-07 | □ | — | 1.02 |

7 | 7.39E-07 | □ | — | 0.996 |

8 | 7.84E-07 | □ | — | 1 |

9 | 3.27E-07 | □ | — | 0.99 |

10 | 7.84E-07 | □ | — | 0.995 |

11 | 5.31E-07 | □ | — | 1 |

12 | 7.50E-07 | □ | — | 1 |

13 | 9.62E-07 | □ | — | 1 |

14 | 1.60E-06 | □ | — | 1 |

15 | 1.39E-06 | □ | — | 1 |

16 | 7.50E-07 | □ | — | 1.007 |

17 | 1.96E-06 | □ | — | 1 |

18 | 7.50E-07 | □ | — | 1 |

19 | 3.03E-07 | □ | — | 0.99 |

20 | 3.86E-07 | □ | — | 0.995 |

21 | 7.72E-07 | □ | — | 1 |

22 | 3.54E-07 | □ | — | 1 |

23 | 3.54E-07 | □ | — | 0.9 |

24 | 6.54E-07 | □ | — | 1 |

25 | 1.77E-06 | □ | — | 1 |

26 | 1.31E-06 | □ | — | 1 |

27 | 1.42E-06 | □ | — | 1 |

28 | 1.06E-06 | □ | — | 0.98 |

29 | 3.86E-07 | □ | — | 0.91 |

30 | 1.16E-06 | □ | — | 0.95 |

31 | 1.06E-06 | □ | — | 0.98 |

32 | 7.32E-08 | □ | — | 1 |

33 | 7.32E-08 | □ | — | 1 |

34 | 5.88E-07 | □ | * | 0.77 |

35 | 1.87E-07 | □ | — | 0.97 |

36 | 7.79E-08 | □ | * | 0.4 |

37 | 1.08E-14 | □ | * | 0.26 |

38 | 9.39E-11 | □ | — | 0.9 |

39 | 4.48E-11 | □ | — | 1.007 |

40 | 4.59E-12 | □ | — | 0. 83 |

41 | 1.66E-10 | □ | — | 0.93 |

42 | 6.65E-14 | □ | — | 0.8 |

43 | 6.66E-10 | □ | — | 0.94 |

44 | 1.16E-09 | □ | — | 0.94 |

45 | 2.54E-14 | □ | — | 1 |

46 | 4.64E-14 | □ | * | 0.62 |

47 | 2.02E-12 | □ | * | 0.67 |

The TH-R definition in Figure

Sensitivity analyses identify the main contributors to the passive system performance. The SRC technique, see the above section, was used. The SRC values are reported in Figure

Standardized regression coefficients for the defined performance indicator:

The assessment of the reliability of passive systems is a crucial issue to be solved for their extensive use in future NPPs.

Several physical parameters affect significantly the behavior of a passive system and their values at the time of operation are “a priori” uncertain: thus, there is the need to consider a multitude of scenarios of system response. This gives back the reliability assessment nonmanageable, the bottleneck being the need to simulate several system behaviors with time-consuming mechanistic computer codes.

To overcome these difficulties, it is necessary to identify those parameters which are most relevant to the system response and limit the probabilistic analysis to them. The REPAS procedure can be applied:

to evaluate the acceptability of a passive system,

to compare two different passive systems having the same mission; moreover the methodology is still in assessment phase (by means of a suitable “experimental tests”) for absolute reliability evaluation,

to evaluate the performances of an active and a passive system on a common basis,

to supplement deterministic criteria and analyses (e.g., TH) in the design process considering the reliability of accident prevention and mitigation functions,

to optimize the design of a passive safety system,

to assess the economical impact in the design change.

REPAS method is described in Section

REPAS method is described and three applications related to a pool heat removal system of a prototypical integrated system, a scaled IC of an SBWR and TTL 1 experimental apparatus, were presented.

The methodology is tested on examples of T-H passive systems.

Identification and quantification of the sources of uncertainties and determination of the important variables are done. The sources of Uncertainties are identified and they are mainly in the following:

approximations in modeling of the process physics;

approximations in modeling of the system geometry;

the input variables.

The engineering judgment plays an important role in the REPAS and in the identification of source of uncertainty by means of selecting the range of uncertainty, the probability density function, and so forth.

The analysis of the results and the use of the system performance indicator (PI or TPI) allowed the achievement of the system performance evaluation. The relevant results are summarized in the above sections for all the three investigated cases. The sensitivity analysis has been completed by adopting the Standardized Regression Coefficients technique (SRCs).

Areas for further development and improvement of the procedure have been identified. They are summarized as follows.

Absolute reliability evaluation is needed by means of a tailored experimental tests.

More rigorous and systematic basis is necessary to select the parameters that characterize the system status (e.g., a complete Expert Judgment procedure).