Quantitative Risk Analysis of Disconnect Operations in a Marine Nuclear Power Platform Using Fuzzy Bayesian Network

Abstract

Marine nuclear power platforms can continuously supply electricity and fresh water for marine resource exploration and surrounding islands. China’s first marine nuclear power platform uses a soft yoke multi-joint connect mode as the mooring positioning device. When the marine nuclear power platform needs repair, maintenance, nuclear fuel replacement, or a different operation area, a mooring disconnect operation must be carried out. The traditional mooring disconnect process consists of four stages: cable limiting, yoke offloading, yoke dropping, and equipment recovery stages. The entire disconnect process is a high-risk nuclear-related operation that could result in a collision accident between the yoke and hull structure, resulting in nuclear fuel leaks and casualties. Therefore, it is necessary to evaluate the risk factors of the disconnect process and to assess the risk level together with the consequence of each risk. In this paper, a quantitative risk analysis of nuclear power platform disconnect operations is carried out based on a fuzzy Bayesian network approach for risk events in each stage of the disconnect operations. Based on the forward fuzzy Bayesian inference, the criticality of each risk event to the disconnect process is evaluated and compared. The main risk factors that may cause a disconnect accident are then determined based on the reverse Bayesian inference rule. The results indicate that human error is the most likely factor leading to the failure of the disconnect process, requiring strict control of personnel operation procedures during this process. The yoke colliding with the hull and stern antifriction chain-breaking are the most significant hazards caused by the disconnect failing. Thus, the distance between the yoke and hull, stern tug tensile force, and maintenance of the antifriction chain should receive particular attention.

1. Introduction

A Marine Nuclear Power Platform (MNPP) is an energy supply platform that employs nuclear energy as a primary energy source and can continuously provide electricity and fresh water for marine resource exploration and surrounding islands. The advantages of MNPPs include high power density, a high running cycle on a single charge, outstanding mobility, and cheap operating costs. It offers clear benefits in numerous energy security scenarios for island-building and maritime resource development [1,2]. An MNPP combines a small nuclear reactor with ship equipment by building a small nuclear reactor on a floating platform with a mooring system and employing submarine cables and flexible pipelines to provide electricity and freshwater resources. Hirdaris et al. (2014) [3] reviewed past and recent work in the area of marine nuclear propulsion, and the research found that understanding the technical risks and implications of implementing modern nuclear technology is an essential first step in the long-term process of developing knowledge and experience. Many countries have conducted research into MNPPs [4,5,6] in recent years, including the Massachusetts Institute of Technology (MIT) in the United States, where two nuclear power platform designs are in development to provide power ratings for different markets. The OFNP-300 is designed for 300 MW-class reactors, and the OFNP1100 is designed for 1100 MW-class power plants, both of which employ a cylindrical hull platform to house a nuclear reactor. Additionally, Russia’s KLT-40 entered service in 2020 in Pevek, a small remote town in northern Siberia. It has a draft of 5.56 m, a displacement of 21,500 t, and can provide continuous power for 40 years to a city of about 200,000 people. France’s Flexblue plant has been in development for many years, with a small modular reactor that is approximately 150 m long and 14 m in diameter. The plant is anchored a few kilometers from the coast in 50–100 m of water and has a 40-month operating cycle [7]. Gravina et al. (2013) [8] described a concept nuclear containership that can sustain an accident without catastrophic consequences as well as operate freely at sea without intervention from port states due to the mode of propulsion. Dedes et al. (2011) [9] presented an overview of current and future reactor technologies suitable for marine propulsion.

The first MNPP in China employs a ship-shaped floating hull and soft yoke single-point mooring system (SYMS) as its position-keeping network, as shown in Figure 1. During long-term operation at sea, the MNPP will need to be disconnected for repair, maintenance, nuclear fuel replacement, or to change the operation area according to demand [10]. Unlike land-based or fixed platform operations, the hull of an MNPP is floating and movable during the disconnection process. Furthermore, as the SYMS is a typical multi-joint connected system, the multi-body dynamics [11] make the disconnection operation a high-risk process. In the event of an accident during the disconnect operation, the mooring system may collide with the MNPP hull, resulting in nuclear fuel leakage and casualties. As the current disconnect operation of the SYMS often relies on human experience, it is important to quantitatively assess the risk factors and possible accidents during the disconnect process.

Risk assessment and reliability analysis are the most effective methods to prevent equipment accidents and develop mitigation measures. They are widely used in the research of failure probability reduction in the field of ocean engineering. Risk assessment and reliability analysis techniques mainly include qualitative analysis methods [12], such as hazard and operability (HAZOP), safe operation zone (SAFOP), job safety analysis (JSA), preliminary hazard analysis (PHA), etc.; semi-quantitative analysis methods, such as failure mode and effects analysis (FMEA) [13]; quantitative analysis methods, such as fault tree analysis (FTA), event tree analysis (ETA), reliability block diagram, Markov chain, Bayesian networks (BNs), etc. The above methods have been widely used in the field of floating liquefied natural gas (FLNG) and drilling operations and can provide a reference for the risk analysis of nuclear platform disconnect operations in this paper. Vanem et al. (2008) [14] adopted the FSA method and ETA to model five accident scenarios in FLNG loading and offloading operations, considering hazardous working conditions, such as collision, stranding, contact, fire, and explosion. They discovered that collision and stranding accounted for roughly 90% of the total risk of FLNG operations. Melani et al. (2014) [15] applied BNs based on the FSA method to simulate liquefied natural gas (LNG) leakage scenarios and presented some maintenance and operation recommendations based on the calculated risk results. Yeo et al. (2016) [16] developed a method using BNs to perform a dynamic safety analysis of the LNG. A dynamic safety analysis was conducted for the offloading process, and the results showed that collision was the most likely accident during the LNG offloading process. In terms of drilling operations, Abimbola et al. (2015) [17] mapped the bowtie model to BNs to perform a risk assessment of drilling operations with constant bottom-hole pressure and obtained the key safety factors for drilling technology and their pressure states for safe operations. Yin et al. (2020) [18] applied BNs to the offshore drilling process, where the blowout risk of the operation under drilling, completion, and workover was analyzed, and the main risk factors were identified as shallow gas and abnormally high pressure. Bijay et al. (2020) [19] obtained the real-time failure probability of safety barriers for BNs to create a dynamic environment for evaluating the dynamic risk of drilling operation processes. The above works indicate that BN analysis has become the dominant probabilistic inference technique for the risk analysis of offshore operations, mainly because BNs can model multi-state variables, common failure causes, and conditional dependencies. Moreover, BN quantitative risk analysis can be performed in two ways [20]. One is forward predictive analysis, where the probability of occurrence of any node in the network is calculated based on the root node’s prior probability and the conditional probability between each node. The other is the backward diagnostic analysis, where the posterior probability of any node is calculated given some observed evidence; that is, some nodes are instantiated to their acceptable values. However, the failure data in the above studies were obtained from historical databases, and the prior probabilities were calculated by classical probabilistic statistical methods. It remains difficult to perform quantitative risk analysis for operational systems that lack an accumulation of historical data. Therefore, some scholars have employed expert elicitation methods to calculate the fuzzy probabilities of events to obtain a database for risk analysis. For example, Guo et al. (2021) [21] proposed a new fuzzy BNs model to better deal with uncertain events in storage tank accidents.

The risk analysis of the disconnect process during the repair and maintenance of an MNPP is studied in this paper. A quantitative risk analysis model is then developed for the risk factors of each stage of the disconnect process. An analysis and evaluation of the risk factors of each failure in the disconnect operation are carried out, and the evolution process from cause to effect in the disconnect accident is clarified. This work provides support for risk decision-making in MNPP disconnect operations.

The remainder of this paper is organized as follows. The process of MNPP disconnect operations is briefly described in Section 2. Section 3 gives the risk assessment methodology used in this paper, and a case study to examine the risk assessment process for disconnect operations is discussed in Section 4. Section 5 presents the results and discussion of the case study, and the conclusions are presented in Section 6.

2. Disconnect Operation of MNPP

The disconnect operation of the MNPP is characterized as a complex process with a long construction period, high technical demands, and large engineering volume. Under the condition of the disconnect operation window, the process of disconnecting the positioning system of the MNPP includes:

(1) Hanging the lifting cable between the upper and lower pulleys of the left and right mooring legs; (2) Pre-laying the main mooring cable between the bow and the yoke joint; (3) Pre-laying the crossover cables between the bow and the left and right sides of the yoke, as shown in Figure 2a; (4) Stern tugging in the position shown in Figure 2b; (5) Yoke tank ballast liquid discharging, as shown in Figure 2c; (6) Lifting cable tightening and removal of the yoke bolts and mooring leg connecting flange; (7) Loosening of the lifting cable and backing up the nuclear power platform, as shown in Figure 2d,e; (8) Removal of all working cables and the towing of the nuclear power platform from the site by a stern tug, as shown in Figure 2f.

The key stages in the MNPP positioning system disconnect operation include: (a) cable limiting, (b) yoke offloading, (c) yoke dropping and (d) equipment recovery. The MNPP and its positioning systems are always floating in a difficult marine environment, with strict criteria for operational conditions and operators, which are completely different from conventional land-based or catenary platforms. There are potential accident risks throughout the process, which may lead to a collision between the soft yoke and the hull, nuclear fuel leakage, and personnel casualties. Therefore, it is crucial to evaluate the risk factors in different operation stages and assess the risk level of accidents at each stage.

3. Methodology

3.1. FMEA

Failure mode and effects analysis (FMEA) has been widely used in the risk and failure assessment of offshore platform operation procedures as a tool for equipment reliability risk analysis [22]. FMEA is a structured analysis technique that includes failure mode, failure effects, and failure hazard analyses. FMEA estimates the likelihood of each probability of failure mode occurrence and uses the risk priority number (RPN) to evaluate the hazards based on the system’s potential failure modes and their effect levels [20]. The related risk is directly proportional to the RPN value of a failure mode, which is typically determined by the following equation:

$$RPN=O\times S\times D$$

(1)

where O is the probability of failure, S is the severity, and D is the ease of failure detection.

The FMEA analysis table consists of the potential failure modes, causes, and effects of the system. Expert scholars, managers, and front-line staff were invited to evaluate the severity, occurrence, and detection rates in the form of questionnaires to determine the ranking of the risk order number in the failure modes.

3.2. Expert Elicitation and Fuzzy Failure Probability

For risk analysis of operations with a complete failure database (such as offshore drilling), statistical analysis can be performed to calculate the a priori probability of accidents for different risk factors. However, for operational processes that lack historical failure data (including disconnect operations), the risk judgment can only be obtained through questionnaires by domain experts based on their own experience and knowledge. Fuzzy failure probabilities are then used to quantify experts’ fuzzy opinions, forming a method based on expert elicitation and fuzzy failure probabilities. The expert’s opinion usually consists of “very low,” “low,” “medium,” “high,” and “very high” [23], and the center of the area (CoA) defuzzification technique is used to calculate the failure probability.

$\stackrel{\sim }{R}=(r_1,r_2,r_3,r_4)$ is a standard trapezoidal number with an affiliation function that is shown as Equation (2):

$${\mu }_{\stackrel{\sim }{R}}(x)=\left\{\begin{array}{ll}0& x<r_1\\ \frac{x-r_1}{r_2-r_1}& r_1\le x<r_2\\ 1& r_2\le x<r_3\\ \frac{x-r_4}{r_3-r_4}& r_3\le x<r_4\\ 0& x\ge r_4\end{array}\right.$$

(2)

The defuzzification process of the trapezoidal fuzzy number can be described as in Equation (3):

$$\mathrm{FPS}=\frac{{\displaystyle {\int }_{r_1}^{r_2}\frac{x-r_1}{r_2-r_1}xdx+{\displaystyle {\int }_{r_2}^{r_3}xdx+}{\displaystyle {\int }_{r_3}^{r_4}\frac{r_4-x}{r_4-r_3}xdx}}}{{\displaystyle {\int }_{r_1}^{r_2}\frac{x-r_1}{r_2-r_1}dx+{\displaystyle {\int }_{r_2}^{r_3}dx+}{\displaystyle {\int }_{r_3}^{r_4}\frac{r_4-x}{r_4-r_3}dx}}}=\frac{1}{3}\frac{{(r_4+r_3)}^2-r_4{r}_3-{(r_1+r_2)}^2+r_1{r}_2}{(r_4+r_3-r_1-r_2)}$$

(3)

where FPS is the fuzzy probability score, and Onisawa’s function [24] further converts the FPS into a fuzzy failure probability (FFP), as shown in Equation (4):

$$\mathrm{FFP}=\left\{\begin{array}{ll}\frac{1}{{10}^k}& if \mathrm{FPS}\ne 0\\ 0& if \mathrm{FPS}=0\end{array}\right.\hspace{1em}\hspace{1em}K={\left[\left(\frac{1-\mathrm{FPS}}{\mathrm{FPS}}\right)\right]}^{\frac{1}{3}}\times 2.301$$

(4)

where K is a constant and FFP is the event’s fuzzy failure probability.

In the present work, five related experts from the oil company, research institute and college as listed in

Table 1. Experts’ information.

NO.	Core Expertise	Service Time	Educational Level
Expert 1	Installation of the positioning system during operation	12	Master
Expert 2	Disconnect operations of the positioning system	15	Master
Expert 3	Risk assessment of MNPP operations	25	Doctor
Expert 4	Structure design and Numerical study of MNPP	32	Doctor
Expert 5	Dynamic analysis of the positioning system	27	Doctor

were invited to judge the severity, occurrence, detection rates and CPTs based on their experiences. The invited experts had the good educational levels and long service times in related areas for many years.

3.3. Bayesian Networks

In recent years, failure modeling and risk analysis of complex systems have both benefited from the use of BN analysis, which can handle multi-state variables, common failure causes, and conditional dependencies [25]. The BN is a directed acyclic graph made up of nodes, arcs, and conditional probability tables (CPT) [26], which can express causality relationships between random variables and quantify the causal relationships through conditional probabilities. The mathematical logic transition from one random variable to another is represented by the CPT, while the nodes represent the random variables, and directed arcs reflect the relationship of two connected nodes. BNs enable both forward probability prediction and backward fault diagnosis analysis.

There is a conditional dependence between random variables and chain rules. The joint probability distribution $\mathit{P}(\mathit{U})$ of a set of variables $\mathit{U}=\mathit{A}({\mathit{A}}_1,{\mathit{A}}_2,{\mathit{A}}_3,\dots ,{\mathit{A}}_n)$ in a Bayesian network can be described as Equation (5):

$$P(U)={\displaystyle \prod _{i=1}^{n}P(A_i\left|pa(A_i)\right.)}$$

(5)

where $\mathit{p}\mathit{a}({\mathit{A}}_{\mathit{i}})$ is the parent set of the variable ${\mathit{A}}_{\mathit{i}}$.

The prior probability of a variable can be updated using Bayesian theory to determine the variable’s posterior probability when a new observed variable or evidence variable E is obtained [27]. The prior probability and the posterior probability can also be considered as the cause and effect of a process.

$$P(U\left|E\right.)=\frac{P(U,E)}{P(E)}=\frac{P(U,E)}{{\displaystyle {\sum }_{U}P(U,E)}}$$

(6)

The denominator in Equation (6) is called the observation probability and is the sum of all conditional probabilities given as evidence E.

Bayesian networks contain two parts: the network structure and the network parameters. Among them, the network structure can be built using expert logic analysis capabilities and FT structures to map the FT to the BN and thus determine the correlation between nodes [28]. The specific mapping method is shown in Figure 3. The network structure must be finished before assigning probability values to each node. The prior probability and conditional probability table for each node corresponding to the risk factor are computed based on the expert evaluation and fuzzy failure probability in Section 3.2, and then the complete network is allocated.

4. Application of the Methodology in an MNPP Disconnect Operation: A Case Study

There are four stages in the MNPP disconnect operation process: (a). cable limiting, (b). yoke offloading, (c). yoke dropping, and (d). equipment recovery. In this paper, FMEA is used to conduct a semi-quantitative risk analysis of the four stages, including hazard identification and failure scenario analysis of the disconnect operation, and an FMEA result table is created. The high-risk operation stage is then further analyzed using BNs to realize the risk decision evaluation of the disconnect operations process and provide a foundation for developing relevant preventative measures. The overall framework structure of the MNPP disconnect operation risk analysis is shown in Figure 4.

4.1. FMEA Analysis in Each Operation Stage

The possible failure modes, causes, and effects of the disconnect operation process were made into FMEA worksheets. Experts, scholars, managers, and front-line staff were asked to evaluate the severity, occurrence, and detection rates based on the evaluation criteria through questionnaires, and the risk priority number of failure modes was finally determined. In this paper, the FMEA identified a total of 81 failure modes distributed in each specific step of the four stages of the disconnect operation (shown in

Table 2. Cable limiting stage.

Failure Occurrence Steps	Failure Mode	Severity (S)	Occurrence (O)	Detection (D)	NRPN
Stern tug in position	Stern antifriction chain is broken by excessive force	7	2	1	14
	Stern antifriction chain rusted and broken	7	4	1	28
	Trailer winch failure	4	3	3	36
Install and pre-tighten the lifting cable	Lifting cable disconnect	1	4	1	4
	Damage to pulley sets or other components	4	2	4	32
	Lift cable winch failure	5	1	1	5
Install and pre-tighten the main mooring cable	The main mooring cable disconnected	1	4	1	4
	Damage to pulley sets or other components	4	1	2	8
	The main mooring cable detached from the bollard	1	7	1	7
	Main mooring cable winch failure	5	1	1	5
Install and pre-tighten crossover cables	The crossover cable detached from the bollard	1	7	1	7
	Crossover cable winch failure	5	1	1	5
Installation of lifting cables	Lifting cable disconnects and injures people	5	1	1	5
	Person overboard	7	2	1	14
Installation of main mooring cable	The main mooring cable is detached and injured	5	1	1	5
	Person overboard	7	1	1	7
Installation of crossover cables	Person overboard	7	1	1	7

,

Table 3. Yoke offloading stage.

Failure Occurrence Steps	Failure Mode	Severity (S)	Occurrence (O)	Detection (D)	NRPN
Yoke Ballast Fluid Drain, Removal Bolt	The cable comes off the bollard	1	7	1	7
	Snap ring breakage	6	4	1	24
	Corrosion/force damage of cable posts	6	1	1	6
Yoke Ballast Fluid Drainage	Yoke blind damage	1	2	4	8
	Submersible pump failure	1	3	1	3
	Broken or leaking hoses	6	4	2	48
	Incomplete ballast fluid discharge	2	8	1	16
Pre-removal of some bolts	Lifting cable disconnect	1	5	1	5
	Lifting cable breakage by excessive force	5	2	1	10
	Damage to pulley sets or other components	4	1	2	8
	Bolt shear damage by force	5	6	1	30
	Bolt rust damage	5	1	1	5
Yoke Ballast Fluid Drainage	Lifting cable disconnects and injures people	5	1	1	5
	Person overboard	7	1	1	7
	Cable breakage injury	5	2	1	10
Removal of remaining bolts	Person overboard	7	2	1	14
	Improper use of tools	5	6	2	60
	Flange (bolt) detachment injury	5	3	1	15

,

Table 4. Yoke dropping stage.

Failure Occurrence Steps	Failure Mode	Severity (S)	Occurrence (O)	Detection (D)	NRPN
Drop yoke	Stern antifriction chain is broken by excessive force	7	2	1	14
	Stern antifriction chain rusted and broken	7	4	1	28
	Trailer winch failure	4	3	3	36
	Lifting cable disconnect	1	5	1	5
	Lifting cable breakage by excessive force	7	1	1	7
	Lift cable winch failure	6	2	1	12
	The main mooring cable detached from the bollard	1	7	1	7
	Snap ring breakage	6	4	1	24
	The main mooring cable broke under too much force	5	2	1	10
	Corrosion damage with cable posts	6	1	1	6
	With cable column force damage	8	1	1	8
	Main mooring cable winch failure	6	1	1	6
	Breakage of crossover cable by excessive force	4	1	1	4
	The crossover cable detached from the bollard	3	2	1	6
	Crossover cable winch failure	6	1	1	6
	Damage to pulley sets or other components	4	1	2	8
	Yoke collides with the hull	5	6	1	30
	Yoke imbalance	5	2	1	10
	Lifting cable disconnects and injures people	5	1	1	5
	Person overboard	7	1	1	7
	Lifting cable breaks and injures people	5	2	1	10
	The main mooring cable is detached and injured	5	3	1	15
	The main mooring cable broke and injured a person	5	1	1	5
	Crossover cable breaks and injures people	5	1	1	5
	Yoke falls and injures people	8	1	1	8
	Improper use of tools	5	6	2	60

and

Table 5. Equipment recovery stage.

Failure Occurrence Steps	Failure Mode	Severity (S)	Occurrence (O)	Detection (D)	NRPN
Temporary positioning	Stern antifriction chain is broken by excessive force	7	2	1	14
	Stern antifriction chain rusted and broken	7	4	1	28
	Trailer winch failure	4	3	3	36
	Lift cable winch failure	4	2	3	24
	Lifting cable breakage by excessive force	1	1	1	1
	Damage to pulley sets or other components	2	2	4	16
	Lifting cable can’t be disconnected	1	7	1	7
	The main mooring cable cannot be disconnected	1	5	1	5
	Crossed cables cannot be disconnected	1	5	1	5
	Damage to pulley sets or other components	2	2	4	16
	Mooring leg fixed cable decoupling	5	2	1	10
	Mooring leg fixed cable breakage	5	1	1	5
Recycling cable	Lifting cable disconnects and injures people	5	2	1	10
	The main mooring cable is detached and injured	5	1	1	5
	Person overboard	7	1	1	7
	Lifting cable breaks and injures people	5	1	1	5
	Mooring leg fixing cable release injury	5	1	1	5
	Mooring leg fixed cable breakage injury	5	1	1	5
	Improper use of tools	5	6	2	60
	Person overboard	7	1	1	7

). From the FMEA analysis table, it can be seen that the risk priority number of improper tool use is the highest (N_RPN = 60) throughout the operation, and winch failure is also a significant risk factor.

Figure 5 provides the results of the comparison between the risk factors and the number of high-risk factors for each operation stage. It can be seen that the total number of risk factors in the yoke dropping stage is 26, among which the number of high-risk factors (N_RPN ≥ 10) is 11. Thus, this stage has a complex operation process. Therefore, a targeted quantitative analysis of the yoke dropping step of the MNPP disconnect operation is required using the BN method.

4.2. BN Model for Yoke Disconnect Operation

4.2.1. BN Structure

Starting with the most undesirable event, the accident cause is analyzed downward, step by step. A risk factor transfer chain is built, and a risk fault tree structure diagram is prepared using the failure mode of the FMEA analysis table as the fundamental event in the FT analysis. The basic and intermediate events of the disconnect operation are shown in

Table 6. Basic events and numbers.

Factor Number	Risk Factors	Factor Number	Risk Factors
S1	Lifting cable disconnect	X3	Breakage of crossover cable under excessive force
S2	Crossover cable dislodged from the bollard	Z1	Stern antifriction chain is broken by excessive force
S3	The main mooring cable detached from the bollard	Z2	Stern antifriction chain rusted and broken
Y1	Trailer winch failure	E1	Yoke collides with the hull
Y2	Lift cable winch failure	E2	Yoke imbalance
Y3	Main mooring cable winch failure	G1	Lifting cable disconnects and injures people
Y4	Crossover cable winch failure	G2	The main mooring cable is detached and injured
M1	Snap ring breakage	A1	Lifting cable breaks and injures people
M2	Corrosion damage with cable posts	A2	The main mooring cable broke and injured a person
M3	With cable column force damage	A3	Crossover cable breaks and injures people
M4	Damage to pulley sets or other components	A4	Yoke falls and injures people
X1	Lifting cable breakage by excessive force	B1	Person overboard
X2	The main mooring cable broke under too much force	B2	Improper use of tools

and

Table 7. Intermediate events and numbers.

Factor Number	Intermediate Events	Factor Number	Intermediate Events
Z3	Installation error	R3	Operation error
Q1	Equipment failure	P1	Limit position failure
Q2	Structural strength failure	P2	Structural failure
Q3	Connection failure	P3	Hull damage
R1	Structural damage injury	P4	Personnel Injuries
R2	Structure detachment injury	T (top event)	Disconnect failure

. The fault tree and the mapped BN structures are shown in Figure 6 and Figure 7.

4.2.2. BN Parameters

After the structure of the BNs is determined, expert elicitation is required to assess the likelihood of the basic event. According to human memory, it is more appropriate for experts to score the number of fuzzy linguistic terms between 5 and 9. Seven fuzzy linguistic terms are selected for expert elicitation in this study, and detailed descriptions of the linguistic terms and the corresponding fuzzy numbers are shown in

Table 8. Fuzzy number sets of the scale.

Linguistic Terms	Fuzzy Numbers
Very Low (VL)	(0, 0, 0.1, 0.2)
Low (L)	(0.1, 0.2, 0.2, 0.3)
Mildly Low (ML)	(0.2, 0.3, 0.4, 0.5)
Medium (M)	(0.4, 0.5, 0.5, 0.6)
Mildly High (MH)	(0.5, 0.6, 0.7, 0.8)
High (H)	(0.7, 0.8, 0.8, 0.9)
Very High (VH)	(0.8, 0.9, 1, 1)

. Based on the experts’ knowledge and experience assessing the likelihood of root node and node conditional dependencies, the assessment results are defuzzified to obtain the FPS and finally converted to a fuzzy failure probability (FFP) using equation (4).

Table 9. A priori probabilities of risk factors.

Risk Factor Number	Description	Priori Probability (Pi)	Posterior Probability (Pp)	Ratio (Pp/Pi)
S1	Lifting cable disconnect	1.25 × 10−3	1.36 × 10−3	1.088
S2	Crossover cable dislodged from the bollard	1.63 × 10−3	1.82 × 10−3	1.117
S3	The main mooring cable detached from the bollard	1.56 × 10−3	1.71 × 10−3	1.096
Y1	Trailer winch failure	1.36 × 10−4	1.41 × 10−4	1.037
Y2	Lift cable winch failure	1.94 × 10−4	1.99 × 10−4	1.026
Y3	Main mooring cable winch failure	4.44 × 10−4	4.63 × 10−4	1.043
Y4	Crossover cable winch failure	1.38 × 10−4	1.42 × 10−4	1.029
M1	Snap ring breakage	1.94 × 10−4	2.06 × 10−4	1.062
M2	Corrosion damage with cable posts	1.06 × 10−3	1.32 × 10−3	1.245
M3	With cable column force damage	2.50 × 10−5	2.66 × 10−5	1.064
M4	Damage to pulley sets or other components	1.00 × 10−3	1.25 × 10−3	1.250
X1	Lifting cable breakage by excessive force	4.44 × 10−4	5.50 × 10−4	1.239
X2	The main mooring cable broke under too much force	8.13 × 10−5	9.51 × 10−5	1.170
X3	Breakage of crossover cable under excessive force	2.50 × 10−5	2.76 × 10−5	1.104
Z1	Stern antifriction chain broken by excessive force	1.38 × 10−4	2.08 × 10−4	1.507
Z2	Stern anti-friction chain rusted and broken	4.44 × 10−4	7.18 × 10−4	1.617
E1	Yoke collides with the hull	2.50 × 10−5	4.30 × 10−5	1.720
E2	Yoke imbalance	1.38 × 10−4	1.73 × 10−4	1.254
G1	Lifting cable disconnects and injures people	8.13 × 10−5	8.83 × 10−5	1.086
G2	The main mooring cable is detached and injured	2.50 × 10−5	2.56 × 10−5	1.024
A1	Lifting cable breaks and injures people	8.13 × 10−5	8.33 × 10−5	1.025
A2	The main mooring cable broke and injured a person	1.38 × 10−4	1.50 × 10−4	1.087
A3	Crossover cable breaks and injures people	8.13 × 10−5	8.33 × 10−5	1.025
A4	Yoke falls and injures people	2.50 × 10−5	2.53 × 10−5	1.012
B1	Person overboard	1.56 × 10−3	2.19 × 10−3	1.404
B2	Improper use of tools	2.19 × 10−3	3.10 × 10−3	1.416

shows the prior probabilities of the basic events.

4.2.3. BN Analysis

The BN model of the MNPP disconnect operation was constructed using GeNIe version 3.0 software (shown in Figure 8). The inference analysis of each risk of the disconnect process was carried out by assigning the prior probability and conditional probability of the nodes.

5. Results and Discussion

5.1. Risk Factor Sensitivity Analysis

The failure probability of each incident during the disconnect process can be calculated by propagating BNs forward. It can be seen that the probability of the top event (i.e., overall disconnect failure) occurring is 3.61 × 10⁻³. The failure probabilities of each intermediate event are given in

Table 10. Probability of occurrence of intermediate events.

Number	Description	Occurrence Probability	Posterior Probability	Number	Description	Occurrence Probability	Posterior Probability
Z3	Installation error	8.99 × 10−4	1.50 × 10−3	R3	Operation error	4.21 × 10−3	6.27 × 10−3
Q1	Equipment failure	3.14 × 10−4	4.42 × 10−4	P1	Limit position failure	1.10 × 10−3	2.31 × 10−3
Q2	Structural strength failure	1.05 × 10−3	1.72 × 10−3	P2	Structural Failure	1.27 × 10−3	2.53 × 10−3
Q3	Connection failure	5.30 × 10−4	7.60 × 10−4	P3	Hull damage	3.07 × 10−4	5.93 × 10−4
R1	Structural damage injury	3.02 × 10−4	3.94 × 10−4	P4	Personnel Injuries	3.23 × 10−3	6.05 × 10−3
R2	Structure detachment injury	2.74 × 10−4	3.59 × 10−4	T	Disconnect failure	3.61 × 10−3	------

. The probability of personnel damage is the largest among the parent nodes of the disconnected failure with 3.23 × 10⁻³, which is an important factor for disconnect failure. The probabilities of structural failure, limit failure, and hull damage are also listed in ascending order.

Starting from the top event and finishing with the maximum probability risk factor in the basic event as the most likely risk transfer path, we obtain the following risk chain: failure of disconnect (3.61 × 10⁻³) → damage to personnel (3.23 × 10⁻³) → operational error (4.21 × 10⁻³) → improper use of tools (2.19 × 10⁻³). It is vital to emphasize that a large majority of the disconnect failure is caused by personnel damage caused by improper tool use and operational errors. Therefore, in the process of disconnect operations, the risk chain of standardized tool use should be focused on, and improving operator safety awareness is an effective strategy for reducing risk. For the key risk chain, introducing safety barriers to prevent the transmission process of risk factors is also a feasible method.

To explore the sensitivity of disconnect failure to each risk factor, GeNIe software was used to calculate the probability change from $P(T\left|x_i=0\right.)$ to $P(T\left|x_i=100\%\right.)$. The results are shown in

Table 11. Probability table for sensitivity analysis of risk factors.

Risk Factor Number	Description	$\mathit{P}(\mathit{T}\left|{\mathit{x}}_{\mathit{i}}=0\right.)$	$\mathit{P}(\mathit{T}\left|{\mathit{x}}_{\mathit{i}}=100\%\right.)$	Ratio
S1	Lifting cable disconnect	3.57 × 10−3	3.92 × 10−3	1.098
S2	Crossover cable dislodged from the bollard	3.53 × 10−3	4.03 × 10−3	1.142
S3	Main mooring cable detached from the bollard	3.55 × 10−3	3.96 × 10−3	1.115
Y1	Trailer winch failure	3.61 × 10−3	3.71 × 10−3	1.028
Y2	Lift cable winch failure	3.61 × 10−3	3.73 × 10−3	1.033
Y3	Main mooring cable winch failure	3.60 × 10−3	3.77 × 10−3	1.047
Y4	Crossover cable winch failure	3.61 × 10−3	3.73 × 10−3	1.033
M1	Snap ring breakage	3.61 × 10−3	3.83 × 10−3	1.061
M2	Corrosion damage with cable posts	3.51 × 10−3	4.50 × 10−3	1.282
M3	With cable column force damage	3.61 × 10−3	3.84 × 10−3	1.064
M4	Damage to pulley sets or other components	3.51 × 10−3	4.51 × 10−3	1.285
X1	Lifting cable breakage by excessive force	3.57 × 10−3	4.48 × 10−3	1.255
X2	The main mooring cable broke under too much force	3.61 × 10−3	4.22 × 10−3	1.169
X3	Breakage of crossover cable under excessive force	3.61 × 10−3	3.99 × 10−3	1.105
Z1	Stern antifriction chain broken by excessive force	3.89 × 10−3	5.47 × 10−3	1.406
Z2	Stern antifriction chain rusted and broken	3.51 × 10−3	5.84 × 10−3	1.664
E1	Yoke collides with the hull	3.61 × 10−3	6.22 × 10−3	1.723
E2	Yoke imbalance	3.60 × 10−3	4.56 × 10−3	1.267
G1	Lifting cable disconnects and injures people	3.61 × 10−3	3.93 × 10−3	1.089
G2	The main mooring cable is detached and injured	3.61 × 10−3	3.70 × 10−3	1.025
A1	Lifting cable breaks and injures people	3.61 × 10−3	3.70 × 10−3	1.025
A2	The main mooring cable broke and injured a person	3.61 × 10−3	3.93 × 10−3	1.089
A3	Crossover cable breaks and injures people	3.61 × 10−3	3.70 × 10−3	1.025
A4	Yoke falls and injures people	3.61 × 10−3	3.65 × 10−3	1.011
B1	Person overboard	3.35 × 10−3	5.05 × 10−3	1.507
B2	Improper use of tools	3.19 × 10−3	5.12 × 10−3	1.605

and Figure 9. It can be observed that the risk of collision between the yoke and the hull is the most important influence among the risk factors in the top event of disconnect failure, and its probability of causing disconnect failure increases from 3.61 × 10⁻³ to 6.22 × 10⁻³. This is followed by events that include rusting of the stern antifriction chain, breaking of the stern antifriction chain under excessive force, improper use of tools, and person overboard.

Figure 10 shows the ratios of the risk factors $P(T\left|x_i=100\%\right.)/P(T\left|x_i=0\right.)$. According to the results, the three events with the highest ratios (in order) are the collision of the yoke with the hull (ratio = 1.723), the rusting and breaking of the stern antifriction chain (ratio = 1.664), and the improper use of tools (ratio = 1.605). Therefore, these three risk factors are the most sensitive factors in the occurrence of unhooking failure, and although their probability of occurrence is relatively small, their consequences are the most significant. As a result, monitoring facilities should be installed during the disconnect operation to measure the relative position change between the yoke and the hull, especially the dynamic distance change between the yoke and the hull during the dropping stage. This will strengthen the limiting attitude of the hull, provide warnings regarding the risk distance, and perform the backward operation of the hull in time to avoid collision with the yoke.

5.2. Risk Factor Updating Probability

The most likely explanation for the state of an event leading to an accident or a specific consequence can be found by updating the prior probabilities to obtain the posterior distribution. This process can identify the most critical events leading to disconnect failure so that preventive safety measures can be designed. The updated risk factor probabilities provide a more accurate estimation of the risk state.

The state of node T is set to be instantiated as 100%, which indicates that a disconnect failure event has occurred. Based on the BN structure in Figure 5, the posterior probabilities of other nodes under this evidence $P(x_i\left|T=100\%\right.)$ are calculated, and the results are shown in Table 9. It can be seen that the BN analysis has a slight increase in the posterior probability for each risk factor compared to the prior probability. Figure 11 gives a comparison graph of the difference between the prior probability and the posterior probability. The horizontal coordinate numbers in the graph correspond to each risk factor, the data points corresponding to each number are the prior probability and the posterior probability, respectively, and the distance between the data points shows the change in the risk probability. According to Figure 11, the most likely reason for the occurrence of disconnect failure is the improper use of tools, the probability of which increases from 2.19 × 10⁻³ to 3.10 × 10⁻³, followed by person overboard, both of which are risk factors belonging to the category of operational errors. As a result, improving employee safety management and tool usage training can help to prevent or reduce the likelihood of these two significant incidents.

Figure 12 provides the ratio of the posterior probability to the prior probability $P_p/P_i$ for each risk factor, and the risk factor with the higher ratio also contributes more to disconnect failure. The results in Figure 12 are more similar to the results in Figure 10, where the top five risk factors are the same. As can be seen from Table 10, the posterior probability of intermediate events increases significantly compared to the a priori probability, and the probability of operational failure increases the greatest from 4.21 × 10⁻³ to 6.27 × 10⁻³. As indicated, the human factor in the process of disconnect operations should be given more attention, and it is necessary to strengthen work management and training in this area to improve the reliability of personnel and prevent potential accidents in the process of operation.

5.3. Measures for Risk Factors

This section mainly focuses on the primary risk factors identified in Section 5.1 and Section 5.2 and proposes corresponding control measures based on the disconnect operation procedures and expert experience, as shown in

Table 12. Risk control measures for principal risk factors.

Risk Factors	Measures
Improper use of tools	(1) Check the quality of the tools used before the operation, and typically perform a good job of maintenance and repair; (2) Operate according to the scope of tool usage; (3) Operate step by step according to the process of utilizing tools; (4) Do a good job of supervision when complex tools are used.
Person overboard	(1) Strengthen the safety training of operators, enhance safety knowledge and awareness, familiar with operational skills; (2) Control the site operating environment, and warning signs at locations prone to falling into the water; (3) Strengthen the safety supervision and management of the work site; (4) Underwater life-saving equipment in place, ready to start rescue operations.
Yoke hull collision	(1) The cable and stern tug to the hull limit state to maintain dynamic stability; (2) Reduce the rate of yoke lowering; (3) The stern tug towing the hull to maintain a certain safety distance from the yoke.
Stern antifriction chain rusted and broken	(1) Test the corrosion and wear rate of the stern antifriction chain and evaluate whether it is available according to the design specification; (2) Do a good job of anticorrosion and antifriction maintenance of the stern antifriction chain and leave enough margin for wear and corrosion. (3) Select a spare anchor chain or cable for replacement.
Stern antifriction chain is broken by excessive force	(1) Monitor the force on the stern anti-friction chain and perform strength calibration; (2) Select a spare anchor chain or cable for replacement.

.

6. Conclusions

Nuclear power platforms are in long-term service in the offshore operating environment and require mooring system disconnect operations for maintenance, repair, and nuclear fuel replacement. It is important to ensure the safety of the platform, mooring, and personnel during the disconnect operation. A risk assessment method based on fuzzy probability BNs for each critical event in MNPP disconnect operations was proposed in this work. BNs were demonstrated as an effective tool for the failure risk analysis of MNPP disconnect operations, and the probability update and sensitivity analysis of risk factors could provide strong support for risk decision-making and preventive measures. In addition, the study provides a reference for the operational risk analysis of other offshore platforms.

1. According to the flow of the MNPP disconnect operation, the different stages of a disconnect operation were defined as cable limiting, yoke offloading, yoke dropping, and equipment recovery, and the operation steps of different operation stages were introduced. Each operational stage was analyzed using the FMEA method, and the yoke dropping process was identified as a high-risk operational stage based on the NRPN values.

2. Considering that the failure probability of risk factors in traditional risk analysis originates from historical statistics, this paper introduced expert evaluation and fuzzy probability methods to assess failure probability to overcome the lack of failure data. Fuzzy probability was used to describe the failure probability and uncertainty of each basic event in the process of the disconnect operation. An FT model of the disconnect operation was developed and mapped to the BNs, and the network parameters of the BNs were determined based on the fuzzy failure probability. Risk prediction and diagnostic analysis were then performed.

3. The process of a nuclear power platform disconnect operation was analyzed using BNs and expert elicitation methods. A risk analysis model for the disconnect operation was established, and control measures for the main risk factors were given. The results showed that human error, improper use of tools, person overboard, and collision between the yoke and hull were the primary causes for disconnect failure. Among them, the probability of human error was 4.21 × 10⁻³, which was the most likely factor leading to the failure of the disconnect process. A collision between the yoke and hull had the greatest impact on the disconnect failure, increasing the probability of failure by 1.723 times.