A Hybrid Approach Combining Scenario Deduction and Type-2 Fuzzy Set-Based Bayesian Network for Failure Risk Assessment in Solar Tower Power Plants

Abstract

Under extreme operating conditions such as high temperatures, strong corrosion, and cyclic thermal shocks, key equipment in solar tower power plants (STPPs) is prone to severe accidents and results in significant losses. To systematically quantify potential failure risks and address the methodological gaps in existing research, this study proposes a risk assessment framework combining a novel scenario propagation model covering triggering factors, precursor events, accident scenarios, and response measures with an interval type-2 fuzzy set (IT2FS) Bayesian network. This framework establishes equipment failure evolution pathways and consequence evaluation criteria. To address data scarcity, the methodology integrates actual case data and expert elicitation to obtain assessment parameters. Specifically, an IT2FS-based similarity aggregation method quantifies expert opinions for prior probability estimation. Additionally, to reduce computational complexity and enhance reliability in conditional probability acquisition, the IT2FS-integrated best–worst method evaluates the relative importance of parent nodes, combined with a leakage-weighted summation algorithm to generate conditional probability tables. The model was applied to a western Chinese STPP and the results show the probabilities of receiver blockage, pipeline blockage, tank leakage, and heat exchanger blockage are 0.061, 0.059, 0.04, and 0.08, respectively. Under normal operating conditions, the occurrence rates of level II accident consequences for all four equipment types remain below 6%, with response measures demonstrating significant suppression effects on accidents. The research results provide critical decision-making support for risk management and mitigation strategies in STPPs.

1. Introduction

Concentrated solar power (CSP) technology, with its dual capabilities in electricity generation and thermal energy storage, has garnered significant attention in the global energy transition. By early 2024, the cumulative installed capacity of CSP reached 7550 MW [1], highlighting its commercialization potential. However, the prolonged operation of key equipment in solar tower power plants (STPPs) under extreme operating conditions such as high temperatures, strong corrosion, and cyclic thermal shocks has led to frequent catastrophic accidents globally (

Table 1. Some accidents at CSP plants.

NO.	Date	CSP Plant	Accident Type	Accident Cause	Consequence
1	1996.06	The Solar Two Project [3]	Cracking of absorber tube	Receiver blockage	Five months of downtime
2	2010.02	La Dehesa Solar Thermal Power Plant [4]	Molten salt splashing	Operational mistake	Six people injured
3	2015.01	Solana Solar Power Plant [4]	Two fires occurred within three months	Thermal energy storage system failure	Power plant shutdown
4	2016.05	Luanpah Tower 3 Solar Thermal Power Plant [4]	Fire	Improper mirror field focusing	Temporary shutdown of the power plant
5	2016.07	Gemasolar Solar Thermal Power Plant [4]	Molten salt tank leakage	Design issues of storage tank foundation	Repair costs exceeding EUR 9 million, leading to bankruptcy
6	2016.10	Crescent Dunes [4]	Small-scale tank leakage	Weld quality	USD 4 million electricity sales loss, bankruptcy
7	2023.05	Fenghe Molten Salt Thermal Energy Storage Project [5]	Bursting of high-temperature molten salt	Molten salt	1 fatality and 13 injuries
8	2024.11	Noor 150 MW [6]	Molten salt tank leakage	Operations and maintenance	USD 47 million electricity sales loss

). According to the National Renewable Energy Laboratory, over 200 equipment failure incidents have been documented in STPPs [2], resulting in substantial economic losses. Such incidents undermine system reliability and efficiency, posing a critical barrier to STPP large-scale deployment. Therefore, establishing a systematic risk assessment framework to precisely identify failure mechanisms and design targeted mitigation strategies is an urgent priority.

Current risk research in STPP predominantly focuses on elucidating localized failure mechanisms of equipment [7,8,9], yet lacks a holistic framework to model risk propagation chains, thereby obscuring the causal relationships between equipment failures and accident consequences. Traditional risk assessment methods—such as fault tree analysis [10], bow-tie analysis [11], and risk matrix [12]—widely adopted in mature industries like petrochemicals and nuclear power excel in identifying and quantifying failure factors. However, these methods exhibit significant limitations when applied to complex, tightly coupled systems like STPPs. In contrast, the scenario-response model, which presets risk evolution pathways (triggering factor—intermediate events—accident scenario), demonstrates unique potential in extrapolating risk propagation dynamics. For instance, in environmental emergency management, Wang et al. [13] reconstructed accident scenarios using four core elements: disaster-inducing factor, disaster-bearing factor, disaster situation, and emergency. Yuan et al. [14] developed a “pressure–state–response” model for oil and gas fire prediction, integrating historical accident databases with expert knowledge. Similarly, She et al. [15] modeled construction accidents through a “human behavior–hazard formative environments–emergency management–scenario state” framework. These studies achieved notable success in risk prediction.

While scenario-response approaches have proven effective across domains, existing frameworks suffer from a critical flaw: the implicit treatment of precursor events in risk propagation. In most industrial systems, accidents are preceded by observable precursors (e.g., abnormal equipment vibrations, false control signals, or increased operational errors), which manifest as intermediate markers between triggering factors and accident scenario. Conventional scenario deduction methods oversimplify risk propagation into single-step mappings (triggering factors–accident scenario), resulting in fragmented causal chains and reduced interpretability. To address this, the study extracts a four-stage scenario development framework—triggering factors, precursor events, accident scenarios, and response measures—from STPP accident case studies, enabling granular reconstruction of risk pathways and enhancing model transparency.

To enable quantitative risk assessment of potential failures, the transformation of scenario-based evolution models into Bayesian networks (BNs) presents significant parameter estimation challenges under data-scarce conditions [16]. However, in complex systems such as STPPs—characterized by limited accident data and highly coupled risk elements—two critical technical bottlenecks persist:

1. Prior probability acquisition: Reliance on expert elicitation for basic event probabilities introduces individual cognitive biases and group decision inconsistencies.

2. Conditional probability table (CPT) complexity: Exponential growth in parameter estimation demands for large-scale systems.

To overcome prior probability limitations, fuzzy set-BN hybrid methods have gained traction. Tang et al. [17] demonstrated the efficacy of triangular fuzzy number-BN models in water quality assessment. However, traditional fuzzy sets struggle to reconcile heterogeneous expert opinions in multi-stakeholder evaluations. Interval type-2 fuzzy sets (IT2FSs), with superior uncertainty-handling capabilities, offer a robust solution by delineating fuzzy boundaries and accommodating group cognitive diversity. Pioneering work by Yaşlı et al. [18] validated IT2FS-BN models in underground mining risk assessment, while Tang et al. [19] successfully quantified medical waste transport risks using this approach.

When constructing BNs, obtaining the CPTs is another challenge. If expert elicitation is used, it typically involves comparing the comparative significance of parent nodes to child nodes. Typical methods involve multi-criteria decision-making (MCDM) techniques, particularly the analytic hierarchy process (AHP) and the analytic network process (ANP), which employ pairwise comparison strategies. For instance, in risk assessment studies of oil gathering pipelines, Liu et al. [20] utilized AHP pairwise comparisons to derive the relative importance weights of risk factors, while in large-scale construction project management. Erol et al. [21] applied ANP to quantify the relative risk weights of project risk sources. Both methodologies demonstrated promising outcomes in addressing domain-specific challenges. However, when the number of parent nodes is large, such pairwise comparison methods can lead to the following issues: (1) It is prone to inconsistency in group decision-making, leading to significant information loss during the decision process; and (2) the computational burden becomes excessively high. To address these issues, Rezaei [22] introduced the best–worst method (BWM), which establishes a novel pairwise comparison framework. In the BWM, experts are required to conduct pairwise comparisons solely between the best (most ideal, most significant) criterion and all remaining criteria, and between all other criteria and the worst (least ideal, least significant) criterion. This maintains consistency in the judgments of experts at the consistency level [23]. From a computational perspective, if there are n nodes, AHP requires (n2-1)/2 comparisons, while BWM only requires 2n-3 comparisons. when the number of nodes is large, the BWM substantially decreases the required number of comparisons. While the BWM has demonstrated proven efficacy in classical decision-making contexts such as supply chain optimization [24] and sustainability risk quantification [25], its innovative adaptation to resolve computational bottlenecks in BN parameterization—specifically in deriving expert-calibrated relative importance weights for CPT construction.

Building upon prior research foundations, pioneered a hybrid methodology integrating scenario deduction with BN to assess potential failure risks in key STPP equipment. In order to effectively capture the fault evolution process of key equipment, the T (triggering factors)—P (precursors events)—S (accident scenarios)—R (response measures) model has been proposed, allowing the fault progression to be tracked and the accuracy of the reasoning process to be enhanced. Furthermore, both objective failure data and expert opinions have been combined, with IT2FS being employed to incorporate expert insights, thereby addressing the issue of insufficient sample data. To reduce the frequency of expert judgments and improve the consistency of the evaluations, an IT2FS-BWM has been introduced to derive the parameters for the Bayesian network analysis, further improving the precision of the risk assessment.

2. Preliminaries

This section provides a comprehensive introduction to the basic definitions and ideas of BN and IT2FSs, which serve as the theoretical foundation for this study and are indispensable in subsequent analysis and calculations.

2.1. Bayesian Network

BN was first introduced [26] quickly gained widespread attention. A notable advantage of BNs lies in its ability to simultaneously conduct forward causation and backward reason. The former is used for estimating the probabilities of child nodes, while the latter is employed to obtain probabilities, thereby deriving the probabilities of the parent nodes given the evidence. The subsequent Bayesian formula is crucial for BN analysis.

$$P(Y)={\displaystyle \sum _{i=1}^{n}P\left(X_i\right)}P\left(Y\left|X_i\right.\right)$$

(1)

$$P\left(X_i\left|Y\right.\right)={\displaystyle \frac{P(X_i)P\left(Y\left|X_i\right.\right)}{P(Y)}}$$

(2)

where P(X_i) denotes the prior probability of event X, P(Y) denotes the marginal probability of event Y, P(Y|X_i) indicates the conditional probability of Y assuming that X_i has occurred, P(X_i|Y) and donates the posterior probability of X assuming that Y has occurred.

2.2. Interval Type-2 Fuzzy Sets

In 1965, Zadeh [27] pioneered the concept of fuzzy sets to articulate the vagueness and uncertainty in experts’ interpretation of linguistic terms to describe semantic concepts. This can be quantified through a membership function μ, which ranges from 0 to 1, to measure the uncertainty in experts’ subjective assessments of the semantic concept x. However, to minimize subjective bias, it is common to integrate the opinions of multiple experts. For this purpose, Zadeh [28] further proposed type-2 fuzzy set (T2FS) in 1975 to handle this compound uncertainty. In the T2FS framework, an element x, as part of the universe of discourse X, not only includes its primary membership u but also introduces a secondary membership z, with z ranging from 0 to 1. To simplify complex calculations in practical operations, researchers typically set the secondary membership z of T2FSs to a constant 1, thereby simplifying the complex model parameters to expressions in two-dimensional space.

Definition 1. 

The T2FS $\tilde{A}$ is characterized by the type-2 membership function ${\mu }_{\tilde{A}}\left(x,u\right)$, i.e.,

$$\tilde{A}=\left\{\left(\left(x,u\right),\mu \left(x,u\right)\right)\left|\forall x\in X,\forall u\in Q_x\in [0,1]\right.\right\}$$

(3)

where ${\mu }_{\tilde{A}}\left(x,u\right)\in \left[0,1\right]$, x denotes primary variable, and u denotes the secondary variable of $\tilde{A}$ . $\tilde{A}$ is also equivalent to

$$\tilde{A}={\displaystyle {\int }_{x\in X}{\displaystyle {\int }_{u\in Q_x}{\mu }_{\tilde{A}}\left(x,u\right)}\left|\left(x,u\right)\right.}\cdots \cdots Q_x\in [0,1]$$

(4)

where $0\le Q_x\le 1$, $\forall x\in X$ and ${\displaystyle {\int }_{u\in Q_x}{\mu }_{\tilde{A}}\left(x,u\right)}\left|\left(x,u\right)\right.$ are the primary and secondary membership functions of x, respectively, and $\iint$ denotes the union over all admissible x and u.

Definition 2. 

Assuming ${\mu }_{\tilde{A}}\left(x,u\right)$ = 1, $\tilde{A}$ is called an IT2FS, and can be denoted as

$$\tilde{A}={\displaystyle {\int }_{x\in X}\left[{\displaystyle {\int }_{u\in Q_x}1\left|u\right.}\right]}\left|x\right.,\cdots \cdots Q_x\in [0,1]$$

(5)

where $\left[{\displaystyle {\int }_{u\in Q_x}1\left|u\right.}\right]\left|x\right.$ denotes the secondary membership function of x.

Definition 3. 

If $\tilde{A}$ is an interval type-2 fuzzy number (IT2FN), it can be represented as.

$$\tilde{A}=\left({\tilde{A}}^U,{\tilde{A}}^L\right)=\left(\left(a_1^U,a_2^U,a_3^U,a_4^U;H_1\left({\tilde{A}}^U\right),H_2\left({\tilde{A}}^U\right)\right),\left(a_1^L,a_2^L,a_3^L,a_4^L;H_1\left({\tilde{A}}^L\right),H_2\left({\tilde{A}}^L\right)\right)\right)$$

(6)

where ${\tilde{A}}^U$, ${\tilde{A}}^L$ represents the upper membership function (UMF) and the lower membership function (LMF) respectively, and the area between them constitutes the footprint of uncertainty (FOU) [29]. Figure 1 illustrates an exemplary of IT2FN.

Definition 4. 

FOU denotes the union of all primary memberships, so

$$FOU\left(\tilde{A}\right)={\cup }_{x\in X}{Q}_x$$

(7)

The UMF and LMF are two types of type-1 membership functions. The UMF and LMF represent ${\tilde{A}}^U$, ${\tilde{A}}^L$ are related to the upper bound and lower bound of $FOU\left(\tilde{A}\right)$, respectively, $\forall x\in X$. i.e., [30].

$${\tilde{A}}^U=\overline{FOU\left(\tilde{A}\right)},\forall x\in X$$

(8)

$${\tilde{A}}^L=\underset{¯}{FOU\left(\tilde{A}\right)},\forall x\in X$$

(9)

As shown in Equations (10) and (11), ${\overline{\mu }}_{\tilde{A}}(x)$ and ${\underset{¯}{\mu }}_{\tilde{A}}(x)$ [31] are used to represent the sums of UMF and LMF, respectively, ensuring that the definitions of UMF and LMF depend explicitly on the x.

$${\overline{\mu }}_{\tilde{A}}(x)=sup\left\{u\left|u\in [0,1],{\mu }_{\tilde{A}}(x,u)>0\right.\right\}$$

(10)

$${\underset{\_}{\mu }}_{\tilde{A}}(x)=inf\left\{u\left|u\in [0,1],{\mu }_{\tilde{A}}(x,u)>0\right.\right\}$$

(11)

Definition 5. 

Mendel [29] formulated a formulaic definition for the primary membership Q_x, which frequently appears in the definition of T2FSs, with the result as follows:

$$Q_x=\left\{(x,u):u\in [{\underset{\_}{\mu }}_{\tilde{A}}(x),{\overline{\mu }}_{\tilde{A}}(x)]\right\}$$

(12)

Definition 6. 

If there are two IT2FNs of ${\tilde{A}}_1$  and  ${\tilde{A}}_2$, let k be a positive real number:

$${\tilde{A}}_1=\left({\tilde{A}}_1^U,{\tilde{A}}_1^L\right)=\left(\left(a_{11}^U,a_{12}^U,a_{13}^U,a_{14}^U;H_1\left({\tilde{A}}_1^U\right),H_2\left({\tilde{A}}_1^U\right)\right),\left(a_{11}^L,a_{12}^L,a_{13}^L,a_{14}^L;H_1\left({\tilde{A}}_1^L\right),H_2\left({\tilde{A}}_1^L\right)\right)\right)$$

$${\tilde{A}}_2=\left({\tilde{A}}_2^U,{\tilde{A}}_2^L\right)=\left(\left(a_{21}^U,a_{22}^U,a_{23}^U,a_{24}^U;H_1\left({\tilde{A}}_2^U\right),H_2\left({\tilde{A}}_2^U\right)\right),\left(a_{21}^L,a_{22}^L,a_{23}^L,a_{24}^L;H_1\left({\tilde{A}}_2^L\right),H_2\left({\tilde{A}}_2^L\right)\right)\right)$$

The arithmetic operations of IT2FSs are as follows [32]:

(1)

Addition:

$$\begin{array}{l}{\tilde{A}}_1+{\tilde{A}}_2=\left(\left(a_{11}^U+a_{21}^U,a_{12}^U+a_{22}^U,a_{13}^U+a_{23}^U,a_{14}^U+a_{24}^U;\min \left(H_1\left({\tilde{A}}_1^U\right),H_1\left({\tilde{A}}_2^U\right)\right),\min \left(H_2\left({\tilde{A}}_1^U\right),H_2\left({\tilde{A}}_2^U\right)\right)\right),\right.\\ \left.\left(a_{11}^L+a_{21}^L,a_{12}^L+a_{22}^L,a_{13}^L+a_{23}^L,a_{14}^L+a_{24}^L;\min \left(H_1\left({\tilde{A}}_1^L\right),H_1\left({\tilde{A}}_2^L\right)\right),\min \left(H_2\left({\tilde{A}}_1^L\right),H_2\left({\tilde{A}}_2^L\right)\right)\right)\right)\end{array}$$

(13)

(2)

Subtraction:

$$\begin{array}{l}{\tilde{A}}_1-{\tilde{A}}_2=\left(\left(a_{11}^U-a_{24}^U,a_{12}^U-a_{23}^U,a_{13}^U-a_{22}^U,a_{14}^U-a_{21}^U;\min \left(H_1\left({\tilde{A}}_1^U\right),H_1\left({\tilde{A}}_2^U\right)\right),\min \left(H_2\left({\tilde{A}}_1^U\right),H_2\left({\tilde{A}}_2^U\right)\right)\right),\right.\\ \left.\left(a_{11}^L-a_{24}^L,a_{12}^L-a_{23}^L,a_{13}^L-a_{22}^L,a_{14}^L-a_{21}^L;\min \left(H_1\left({\tilde{A}}_1^L\right),H_1\left({\tilde{A}}_2^L\right)\right),\min \left(H_2\left({\tilde{A}}_1^L\right),H_2\left({\tilde{A}}_2^L\right)\right)\right)\right)\end{array}$$

(14)

(3)

Multiplication:

$$\begin{array}{l}{\tilde{A}}_1\times {\tilde{A}}_2=\left(\left(a_{11}^U\times a_{21}^U,a_{12}^U\times a_{22}^U,a_{13}^U\times a_{23}^U,a_{14}^U\times a_{24}^U;\min \left(H_1\left({\tilde{A}}_1^U\right),H_1\left({\tilde{A}}_2^U\right)\right),\min \left(H_2\left({\tilde{A}}_1^U\right),H_2\left({\tilde{A}}_2^U\right)\right)\right),\right.\\ \left.\left(a_{11}^L\times a_{21}^L,a_{12}^L\times a_{22}^L,a_{13}^L\times a_{23}^L,a_{14}^L\times a_{24}^L;\min \left(H_1\left({\tilde{A}}_1^L\right),H_1\left({\tilde{A}}_2^L\right)\right),\min \left(H_2\left({\tilde{A}}_1^L\right),H_2\left({\tilde{A}}_2^L\right)\right)\right)\right)\end{array}$$

(15)

(4)

Multiplication by crisp number:

$$k{\tilde{A}}_1=\left(\left(k{a}_{11}^U,k{a}_{12}^U,k{a}_{13}^U,k{a}_{14}^U;H_1\left({\tilde{A}}_1^U\right),H_2\left({\tilde{A}}_1^U\right)\right),\left(k{a}_{11}^L,k{a}_{12}^L,k{a}_{13}^L,k{a}_{14}^L;H_1\left({\tilde{A}}_1^L\right),H_2\left({\tilde{A}}_1^L\right)\right)\right)$$

(16)

3. Research Framework

The proposed framework of this study for assessing potential accident risk and consequences of equipment in STPPs is depicted in Figure 2 and includes three primary parts:

(1) Scenario deduction: The key elements closely associated with equipment incidents are identified and extracted from past accident cases, including triggering factors (T), precursor events (P), accident scenarios (S), and response measures (R). Based on these elements and potential accident pathways, a scenario deduction model is constructed to describe the accident evolution paths and consequences of the equipment in STPPs, forming the basic structure of the BN.

(2) Probability acquisition: To conduct probabilistic inference and quantitative study of equipment failure using the BN. The prior probabilities of basic nodes and the CPTs of child nodes must be determined. In this framework, the prior and conditional probabilities are obtained using the IT2FS-SAM and the IT2FS-BWM with the leaky-WSA, respectively.

(3) Risk assessment: The quantitative risk assessment model is constructed through the integration of the BN model with a consequence evaluation system. It is used to identify risk factors, estimate accident probabilities, analyze response measures, and comprehensively assess accident consequences.

4. Scenario Deduction

4.1. Analysis of Exemplary Accident Cases in CSPs

Combining the insights from the literature [2] and corporate operational experience [33], Table 1 presents several major accidents that have occurred in STPPs globally.

Based on the operational failure patterns of STPPs, we identify the primary threats to the normal operation of equipment in STPPs as follows [34]:

Direct equipment failures: This includes issues such as the cracking of receiver tubes, freezing and cracking of molten salt pipes, cracking at weld joints of salt tanks, and blockages or cracking of heat exchangers.

Indirect equipment failures: These involve failures such as damage to thermal insulation materials and valve malfunctions leading to leakage. Figure 3 illustrates common failure modes, such as cracks in the absorber tubes, insulation layer damage, and valve leakage.

In STPPs, equipment is highly integrated, and minor faults potentially escalate into major disasters. Different responses can lead to different failure pathways, ultimately resulting in varied accident consequences.

4.2. Identification of Critical Scenario States

To comprehensively describe the potential evolution paths of equipment accidents, a TPSR model for scenario deduction is proposed, as illustrated in Figure 4.

In this model, triggering factors (T) are the risk elements that can lead to accidents, including safety hazards associated with design, installation, operation, maintenance, medium, and environment [36]. These factors have the potential to trigger precursor events. Precursor events (P) are events triggered by triggering factors. when they occur, they are likely to lead to the occurrence of accident scenarios. Accident scenarios (S) represent the actual states in which accidents occur. Response measures (R) are protective strategies established within the system, designed to prevent and control accident. The TPSR model provides a structured approach to understanding and managing the potential evolution paths of equipment accidents in STPPs.

4.3. Analysis of Scenario Evolution Path

Based on accident case of Table 1 and scenario state classification, a TPSR based scenario deduction model can be constructed to describe the evolution paths of equipment failures. Figure 5 shows an exemplary evolution path of equipment accidents (as a part of a scenario deduction model).

As depicted in Figure 5, triggering factor I1 causes a precursor event P1. P1 subsequently leads to the accident scenario S1. If response measure R1 is timely and effective, the accident is mitigated and ended (End). However, if R1 fail to respond in time, S1 continues to occur. In such cases, S1 may interact with other triggering factors Ii, potentially causing additional precursor event Pi. Pi then directly causes accident Si. If response measure Ri effectively mitigate Si, the accident will terminate (End). Otherwise, the accident may escalate along a worsening trajectory, potentially resulting in system collapse Sn, and ultimately ending.

4.4. Determination of Bayesian Network from Scenario Deduction Model

To achieve an accurate understanding and analysis of equipment failures, triggering factors and response measures, the scenario deduction model needs to be further transformed into a BN model for quantitative assessment, Figure 6 shows the transformation process.

5. Probability Acquisition for the Nodes of BN

To implement probabilistic inference using BN, it is essential to acquire the prior probabilities of the basic nodes in the network and the CPTs of the child nodes. Here, the data of the basic nodes are obtained from historical data and expert elicitation. The CPTs are estimated by domain experts based on their expertise. Figure 7 shows the process for acquiring node probabilities in the BN. The details are described in the subsequent sections.

5.1. Forming an Expert Group

In order to conduct a quantitative study of specific failure scenarios in STPPs, expert opinion is employed to derive node probabilities for those nodes that are challenging to quantify. To reduce bias and discrepancies in individual expertise, a set of scoring criteria is utilized to evaluate the weight of each expert. These criteria take into account the expert’s job title, working years, educational level, age, and familiarity with the STPPs. Detailed evaluation criteria are presented in

Table 2. Weighting criteria with scores of each expert [37].

Category	Classification	Score
Job title	Senior Executive	10
	Professor	8
	Engineer	6
	Worker	4
	Student	2
Working years	≥30 years	10
	15–28 years	8
Working years	7–15 years	6
	3–7 years	4
	≤3 years	2
Education level	Doctor	10
	Master	8
	Bachelor	6
	Higher National Diploma	4
	School level	2
Age	≥50	8
	40–49	6
	30–39	4
	<30	2
Familiarity	Very familiar	10
	Quite familiar	8
	Moderately familiar	4
	Basic familiarity	2

.

5.2. Obtaining Prior Probabilities of Basic Nodes in BN

This subsection describes the methods used to obtain prior probabilities of basic nodes in BN. Two ways are used for this study: objective data and expert elicitation.

5.2.1. Objective Data

Objective data comes from two main sources: (1) for some nodes involving weather factors, their probability data can be computed through local weather records; (2) database built from lots of factory experiences, including details about failures.

5.2.2. Expert Opinions

The questionnaire approach is used to capture individual expert’s opinions on the likelihoods of the occurrences of basic nodes in the BN. The seven-level linguistic term set is utilized to aid in the expert judgment [38].

(1)

Aggregation of expert opinions

To address individual biases and enhance the integration of expert opinions, the SAM is employed to confirm both varied and unbiased of expert opinions, thereby improving the reliability of aggregation results. Additionally, to capture inherent uncertainty and vagueness in expert opinions, IT2FS are used for a more accurate representation of these uncertainties. Consequently, the paper adopts IT2FS to assess expert opinions and applies the improved SAM, called as IT2FS-SAM, to mitigate potential biases associated with personal differences. The process of the aggregation is as follows:

Step 1: If the opinions of the two experts are ${\tilde{A}}_i$ and ${\tilde{A}}_j$, respectively, their agreement degree (AD), the $AD\left({\tilde{A}}_i,{\tilde{A}}_j\right)$ can be calculated by the following:

$$AD\left({\tilde{A}}_i,{\tilde{A}}_j\right)={\displaystyle \frac{S_{\overline{A_i}\cap \overline{A_j}}+S_{\underset{¯}{A_i}\cap \underset{¯}{A_j}}}{S_{\overline{A_i}\cup \overline{A_j}}+S_{\underset{¯}{A_i}\cup \underset{¯}{A_j}}}}={\displaystyle \frac{S_{\overline{A_i}\cap \overline{A_j}}+S_{\underset{¯}{A_i}\cap \underset{¯}{A_j}}}{S_{\overline{A_i}}+S_{\overline{A_j}}-S_{\overline{A_i}\cup \overline{A_j}}+S_{\underset{¯}{A_i}}+S_{\underset{¯}{A_j}}-S_{\underset{¯}{A_i}\cup \underset{¯}{A_j}}}}$$

(17)

The similarity of two IT2FNs is calculated using area similarity measure functions, as follows:

$$S_{\overline{A}}={\displaystyle {\int }_x{\overline{\mu }}_{\tilde{A}}\left(x\right)dx}$$

(18)

$$S_{\underset{\_}{A}}={\displaystyle {\int }_x{\underset{\_}{\mu }}_{\tilde{A}}\left(x\right)dx}$$

(19)

where $S_{\overline{A}}$ and $S_{\underset{¯}{A}}$ represent the areas of the closed regions formed by the UMF and LMF with respect to the X-axis, respectively, and $S_{\overline{A_i}\cap \overline{A_j}}$ and $S_{\underset{¯}{A_i}\cap \underset{¯}{A_j}}$ represent the areas of the intersections of the two UMFs or the two LMFs.

If there are n experts, a similarity matrix (M) can be obtained using a similarity measure function:

$$M=\left[\begin{array}{cccccc}1& m_{12}& \cdots & m_{1j}& \cdots & m_{1n}\\ ⋮& ⋮& & ⋮& \ddots & ⋮\\ m_{i1}& m_{i2}& \cdots & m_{ij}& \cdots & m_{in}\\ ⋮& ⋮& & ⋮& \ddots & ⋮\\ m_{n1}& m_{n2}& \cdots & m_{nj}& \cdots & 1\end{array}\right]$$

(20)

where $m_{ij}=m\left({\tilde{R}}_i,{\tilde{R}}_j\right)$, if i ≠ j and $m_{ij}=1$, if i = j.

Step 2: Obtaining the weighted consensus degree (WAD) by incorporating expert weights, making it more reasonable.

$$WAD\left(E_i\right)={\displaystyle \frac{{{\displaystyle \sum }}_{\begin{array}{c}j=1\\ j\ne i\end{array}}^{n}w\left(E_j\right)\cdot m\left({\tilde{A}}_i,{\tilde{A}}_j\right)}{{{\displaystyle \sum }}_{\begin{array}{c}j=1\\ j\ne i\end{array}}^{n}w\left(E_j\right)}}$$

(21)

Step 3: Obtaining the relative agreement degree (RAD(E_i)) of expert E_i.

$$RAD\left(E_i\right)={\displaystyle \frac{WAD\left(E_i\right)}{{{\displaystyle \sum }}_{i=1}^{n}WAD\left(E_i\right)}}$$

(22)

Step 4: Calculating the consensus degree coefficient (CDC(E_i)).

$$CDC\left(E_i\right)=\beta \cdot w\left(E_i\right)+(1-\beta )\cdot RAD\left(E_i\right)$$

(23)

where β (0 ≤ β ≤ 1) denotes the impact of the AD of experts compared to the RAD. Generally, β is set to 0.5.

Step 5: Calculating the aggregated result $\tilde{A}$ of the IT2FNs of the experts’ opinions

$$\tilde{A}={\displaystyle \sum }_{i=1}^n\left(CDC\left(E_i\right)(\cdot ){\tilde{A}}_i\right)$$

(24)

(2)

Defuzzify the aggregated result

Once the aggregated result is obtained, it is crucial to determine the crisp value $Def\left(\tilde{A}\right)$ through the defuzzification process. The defuzzification formula suitable to IT2FNs is as follows [39].

$$Def\left(\tilde{A}\right)={\displaystyle \frac{1}{2}}\left({\displaystyle \frac{a_1^U+\left(1+H_1\left({\tilde{A}}^U\right)\right)\times a_2^U+\left(1+H_2\left({\tilde{A}}^U\right)\right)\times a_3^U+a_4^U}{4+H_1\left({\tilde{A}}^U\right)+H_2\left({\tilde{A}}^U\right)}}+{\displaystyle \frac{a_1^L+\left(1+H_1\left({\tilde{A}}^L\right)\right)\times a_2^L+\left(1+H_2\left({\tilde{A}}^L\right)\right)\times a_3^L+a_4^L}{4+H_1\left({\tilde{A}}^L\right)+H_2\left({\tilde{A}}^L\right)}}\right)$$

(25)

To conduct advanced quantitative analysis of the BN, this study utilizes Equations (26) and (27) to convert the crisp value into failure probability (FP) [40]. These refined formulas, specifically tailored for incidents in the petrochemical industry, adhere to a seven-level risk probability classification standard.

$$FP=\left\{\begin{array}{ll}{\displaystyle \frac{1}{{10}^Z}},& for Z\ne 0\\ 0,& for Z=0\end{array}\right.$$

(26)

and

$$Z=\left\{\begin{array}{c}-0.72\ln Def\left(\tilde{A}\right)+2.839,\hspace{1em}0\le Def\left(\tilde{A}\right)<0.2\\ \begin{array}{c}-{\displaystyle \frac{1}{3}}\times \left(\ln Def\left(\tilde{A}\right)-14\right),\hspace{1em}0.2\le Def\left(\tilde{A}\right)\le 0.8\end{array}\\ \left(\left(1-Def\left(\tilde{A}\right)\right)|Def\left(\tilde{A}\right)\right)\times 3.705,\hspace{1em}0.8<Def\left(\tilde{A}\right)\le 1\end{array}\right.$$

(27)

5.3. Obtaining the CPTs of Child Nodes in BN

To facilitate the acquisition of CPTs, the following procedures are implemented: First, the IT2FS-BWM is introduced to derive node weights, which are subsequently normalized by allocating weights to neglected nodes. Second, expert judgments are used to establish node probability distributions. Finally, the CPTs are derived utilizing the leaky-WSA.

5.3.1. Acquisition of Expert Opinions

In order to address the uncertainty and bias inherent in expert opinions, IT2FNs are utilized to express the comparative significance of every parent node in relation to its associated child nodes. A comprehensive description of the IT2FNs scale method for linguistic variables is presented in the literature [41]. The detailed classification criteria are illustrated in

Table 3. Linguistic terms and their corresponding IT2FNs.

Pairwise Linguistic Term	Crisp Number	Corresponding Comparison IT2FNs
Completely equal importance (CEI)	1	((1, 1,1, 1, 1, 1), (1, 1, 1, 1, 0.9, 0.9))
Weak importance (WI)	2	((1, 2, 2, 3; 1, 1), (1.5, 2, 2, 2.5; 0.9, 0.9))
Moderate importance (MI)	3	((2, 3, 3, 4; 1, 1), (2.5, 3, 3, 3.5; 0.9, 0.9))
Moderate plus importance (MPI)	4	((3, 4, 4, 5; 1, 1), (3.5, 4, 4, 4.5; 0.9, 0.9))
Strong importance (SI)	5	((4, 5, 5, 6; 1, 1), (4.5, 5, 5, 5.5; 0.9, 0.9))
Strong plus importance (SPI)	6	((5, 6, 6, 7; 1, 1), (5.5, 6, 6, 6.5; 0.9, 0.9))
Very strong importance (VSI)	7	((6, 7, 7, 8; 1, 1), (6.5, 7, 7, 7.5; 0.9, 0.9))
Extreme importance (EI)	8	((7, 8, 8, 9; 1, 1), (7.5, 8, 8, 8.5; 0.9, 0.9))
Extreme more importance (EMI)	9	((8, 9, 9, 10; 1, 1), (8.5, 9, 9, 9.5; 0.9, 0.9))

.

5.3.2. Obtaining the Relative Weights of Parent Nodes Using IT2FS-BWM

The BWM is designed to handle multiple criteria. It seeks to ascertain the significance weights of these criteria and rank alternatives through pairwise comparisons. The novel application of IT2FS-BWM for deriving weights of parent nodes obviously reduces the number of required data comparisons and enhances the consistency of these comparisons. The process is as follows:

Step 1: Identify a set of decision criteria, n. Criteria (CR1, CR2, …, CRn) are used for calculating the importance weights.

Step 2: Experts select the best and worst criteria from the set. The criterion with the strongest influence on the target factor is designated as the best criterion, while the criterion with the weakest influence is identified as the worst criterion.

Step 3: The best criterion is compared with the other criteria to form the judgment matrix A_B, similarly, comparisons of the other criteria relative to the worst criteria yield the judgment matrix A_W. In these matrices, $a_{Bj}$ indicates that the best criterion B is preferable to criterion j; $a_{jW}$ indicates that criterion j is preferable to the worst criterion W. The scoring scale ranges from 1 to 9, where 1 denotes equal importance between two criteria and 9 represents the highest level of preference between the criteria.

$$A_{Bn}={(a_{B1},a_{B2},\dots ,a_{Bn})}^T$$

(28)

$$A_{nW}={(a_{1W},a_{2W},\dots ,a_{nW})}^T$$

(29)

where $a_{BB}=1$ and $a_{WW}=1$.

Step 4: Optimal weights $({\omega }_1,{\omega }_2,\dots ,{\omega }_n)$ are derived in this step using the region center defuzzification method. Additionally, a constrained optimization model, as detailed by [42], was developed. Consistency ratios were also assessed.

$$\min \max \left\{\left|{\omega }_{BE}|{\omega }_{jE}-E_{BEj}\right|,\left|{\omega }_{jE}|{\omega }_{EW}-E_{jEW}\right|\right\}$$

$$s.t.\left\{\begin{array}{l}{\displaystyle \sum _{i=1}^{n}COA\left({\omega }_{jE}\right)=1}\\ {\omega }_{jE1}^U\le {\omega }_{jE1}^L,{\omega }_{jE4}^L\le {\omega }_{jE4}^U,\\ {\omega }_{jE1}^L\le {\omega }_{jE2}^L\le {\omega }_{jE3}^L\le {\omega }_{jE4}^L,\\ {\omega }_{jE1}^U\le {\omega }_{jE2}^U\le {\omega }_{jE3}^U\le {\omega }_{jE4}^U\\ {\omega }_{jE1}^U\ge 0,j=1,2,\dots ,N\end{array}\right.$$

(30)

where

$${\omega }_{BE}=\left({\omega }_{BE}^U,{\omega }_{BE}^L\right)=\left(\begin{array}{l}\left({\omega }_{BE1}^U,{\omega }_{BE2}^U,{\omega }_{BE3}^U,{\omega }_{BE4}^U;H_1\left({\omega }_{BE}^U\right),H_2\left({\omega }_{BE}^U\right)\right),\\ \left({\omega }_{BE1}^L,{\omega }_{BE2}^L,{\omega }_{BE3}^L,{\omega }_{BE4}^L;H_1\left({\omega }_{BE}^L\right),H_2\left({\omega }_{BE}^L\right)\right)\end{array}\right)$$

$${\omega }_{EW}=\left({\omega }_{EW}^U,{\omega }_{EW}^L\right)=\left(\begin{array}{l}\left({\omega }_{WE1}^U,{\omega }_{EW2}^U,{\omega }_{EW3}^U,{\omega }_{EW4}^U;H_1\left({\omega }_{WE}^U\right),H_2\left({\omega }_{WE}^U\right)\right),\\ \left({\omega }_{EW1}^L,{\omega }_{EW2}^L,{\omega }_{EW3}^L,{\omega }_{EW4}^L;H_1\left({\omega }_{EW}^L\right),H_2\left({\omega }_{EW}^L\right)\right)\end{array}\right)$$

$${\omega }_{jE}=\left({\omega }_{jE}^U,{\omega }_{jE}^L\right)=\left(\begin{array}{l}\left({\omega }_{jE1}^U,{\omega }_{jE2}^U,{\omega }_{jE3}^U,{\omega }_{jE4}^U;H_1\left({\omega }_{jE}^U\right),H_2\left({\omega }_{jE}^U\right)\right),\\ \left({\omega }_{jE1}^L,{\omega }_{jE2}^L,{\omega }_{jE3}^L,{\omega }_{jE4}^L;H_1\left({\omega }_{jE}^L\right),H_2\left({\omega }_{jE}^L\right)\right)\end{array}\right)$$

To ensure that only a single optimal solution is derived from Equation (30), by minimizing the maximum absolute deviation between $\left\{\left|{\omega }_{BE}\left|{\omega }_j-\right.E_{BEj}\right|\right\}$ and $\left\{\left|{\omega }_{jE}\left|{\omega }_{\mathrm{EW}}-\right.E_{jEW}\right|\right\}$. To solve the model, let the maximum absolute deviation be $\left[\left({\delta }^{*},{\delta }^{*},\delta {,}^{*}{\delta }^{*}\right),\left({\delta }^{*},{\delta }^{*},{\delta }^{*},{\delta }^{*}\right)\right]$; Subsequently, the equation can be transformed into the following programming model [43].

$$\begin{array}{l}\min \delta *\\ s.t.\left\{\begin{array}{l}\left|{\omega }_{BE1}^U-{\omega }_{j1}^U{\omega }_{BEj,1}^U\right|\le \delta *,\left|{\omega }_{BE2}^U-{\omega }_{j2}^U{\omega }_{BEj,2}^U\right|\le \delta *,\left|{\omega }_{BE3}^U-{\omega }_{j3}^U{\omega }_{BEj,3}^U\right|\le \delta *,\left|{\omega }_{BE4}^U-{\omega }_{j4}^U{\omega }_{BEj,4}^U\right|\le \delta *,\\ \left|{\omega }_{BE1}^L-{\omega }_{j1}^L{\omega }_{BEj,1}^L\right|\le \delta *,\left|{\omega }_{BE2}^L-{\omega }_{j2}^L{\omega }_{BEj,2}^L\right|\le \delta *,\left|{\omega }_{BE3}^L-{\omega }_{j3}^L{\omega }_{BEj,3}^L\right|\le \delta *,\left|{\omega }_{BE4}^L-{\omega }_{j4}^L{\omega }_{BEj,4}^L\right|\le \delta *,\\ \left|{\omega }_{j1}^U-{\omega }_{WE1}^U{\omega }_{jWE,1}^U\right|\le \delta *,\left|{\omega }_{j2}^U-{\omega }_{WE2}^U{\omega }_{jWE,2}^U\right|\le \delta *,\left|{\omega }_{j3}^U-{\omega }_{WE3}^U{\omega }_{jWE,3}^U\right|\le \delta *,\left|{\omega }_{j4}^U-{\omega }_{WE4}^U{\omega }_{jWE,4}^U\right|\le \delta *\\ \left|{\omega }_{j1}^L-{\omega }_{WE1}^L{\omega }_{jWE,1}^L\right|\le \delta *,\left|{\omega }_{j2}^L-{\omega }_{WE2}^L{\omega }_{jWE,2}^L\right|\le \delta *,\left|{\omega }_{j3}^L-{\omega }_{WE3}^L{\omega }_{jWE,3}^L\right|\le \delta *,\left|{\omega }_{j4}^L-{\omega }_{WE4}^L{\omega }_{jWE,4}^L\right|\le \delta *\\ {\displaystyle \sum _{j=1}^{N}COA\left({\omega }_{jE}\right)=1}\\ {\omega }_{jE1}^U\le {\omega }_{jE1}^L,{\omega }_{jE4}^L\le {\omega }_{jE4}^U\\ {\omega }_{jE1}^L\le {\omega }_{jE2}^L\le {\omega }_{jE3}^L\le {\omega }_{jE4}^L\\ {\omega }_{jE1}^U\le {\omega }_{jE2}^U\le {\omega }_{jE3}^U\le {\omega }_{jE4}^U\\ {\omega }_{jE1}^U\ge 0,j=1,2,\dots N\end{array}\right.\end{array}$$

(31)

5.3.3. Acquiring CPTs Utilizing the Leaky-Weighted Sum Algorithm

Expert elicitation for deriving CPTs in BNs may occasionally overlook certain factors affecting a child node. To address this issue, Das [44] introduced the weighted sum algorithm (WSA), which can reduce the amount of needed probability distributions. Baker [45] evaluated its simplicity and usability. Farsi et al. [46] applied the WSA to STPPs and analyzed the site selection for the power plants. Liu et al. [20] cleverly incorporated the notion of “leakage” into this WSA, accounting for uncertainties and latent flaws in BN model nodes, resulting in favorable assessments.

Initially, weight of the leaky node is calculated according to the views of various experts and their associated weights.

Following, a fresh weight normalization is implemented for both parent nodes and the leaky node, as shown in Equation (32);

$${\displaystyle \sum _{i=1}^n({\omega }_i+{\omega }_L)=1}$$

(32)

where ${\omega }_i$ denotes the weight of the i-th parent node; ${\omega }_L$ denotes the weight of the leaky node.

Additionally, the CPT of a set of compatible parent nodes can be obtained by the leaky-WSA, the calculation details are shown in Equation (33).

$$P\left(y^l\left|x_1^{S_1},x_2^{S_2},\dots x_n^{S_n}\right.\right)={\displaystyle \sum _{i=1}^n{\omega }_{i}P\left(y^l\left|\left\{Comp\left(X=x_i^{S_i}\right)\right\}\right.\right)}+{\omega }_{L}P\left(y^l\left|x_L^{S_i}\right.\right)$$

(33)

where x represents the parent node; y represents the child node; the number of states of child node is j; l = 0, 1, …, S_i (i = 1, 2, …, n) represents the states of the i-th parent node; and ω_i signifies the comparative weight of the parent node.

6. Accident Consequence Evaluation

6.1. Consequence Evaluation Criteria

Evaluation criteria for the consequences of equipment accidents have been established. The criteria include three evaluation indicators: direct economic losses (C1), casualties (C2), and equipment damage (C3). Based on “Regulations on the Reporting, Investigation, and Handling of Production Safety Accidents” (State Council Order No. 493) (2007) of the China, accident severity is categorized into general, major, heavy, and mega accidents. The categorization criteria for C1, C2, and C3 are shown in

Table 4. Assessment criteria of accident consequence.

Accident Severity	Direct Economic Losses (C1)	Casualties (C2)	Equipment Damage (C3)	Level
General accident	Economic ≤ RMB 10 million	Injured: 0 ≤ Person < 10 or death: 0 ≤ Person < 3	No repair required	I
Major accident	RMB 10 million ≤ Economic < RMB 50 million	Injured: 10 ≤ Person < 30 or death: 3 ≤ Person < 10	Shutdown and inspection	II
Heavy accident	RMB 50 million ≤ Economic < RMB 100 million	Injured: 30 ≤ Person < 100 or death: 10 ≤ Person < 30	Start backup	III
Mega accident	Economic ≥ RMB 100 million	Injured: Person ≥ 100 or death: Person ≥ 30	Prolonged shut-down	IV

.

6.2. Accident Consequence Evaluation Model

A consequence evaluation model has been developed by integrating the BN and the consequence evaluation criteria in Section 6.1. The model is shown in Figure 8, emphasizes the severity of consequences arising from critical scenarios, represented by directional lines, with causal relationships denoted by arrows.

7. Case Study

This section applied the proposed approach to evaluate the failure likelihoods and consequences of the equipment in a STPP situated in western China, specifically focusing on the receiver, the salt piping, the salt tanks, and the heat exchangers. Figure 9 illustrates the simplified process flow of the power plant.

7.1. Establishing the Scenario Deduction Model and Bayesian Network of the STPP

7.1.1. Scenario Deduction Model of the STPP

Based on the analysis of the failure scenario and evolutionary processes derived from relevant literature, operational experience, and expert consulting, the potential scenario evolution paths for accident risk evaluation of the equipment in the STPP was established, as shown in Figure 10. The symbols and eanings are detailed in

Table 5. Meanings of nodes denoting triggering factors in Figure 10.

Symbol	Triggering Factors
	Meaning	Node	Meaning	Node	Meaning
D	Design issues	D1	Failure of the control system	D2	Design of the receiver
		D3	Spot control	D4	Improper insulation design improper of the discontinuous areas
		D5	Improper design of the piping structure	D6	Excessive design of the measurement points
		D7	Improper design of the piping support	D8	Oversizing risk of the tank
		D9	Restricted of the thermal expansion	D10	Stress concentration
		D11	Incomplete standards of the salt tank design	D12	Improper structural design of the tank foundation
		D13	Tank foundation location issues	D14	Improper structural design of the heat exchanger
F	Installation issues	F1	Poor quality of the weld	F2	Flange of loosening at measurement point
O	Operation issues	O1	Incomplete salt drainage in the evening	O2	Insufficient molten salt flow rate
		O3	Insufficient preheating in the morning	O4	Large transient temperature fluctuations
		O5	Fatigue failure	O6	Delayed heating startup
		O7	Operating conditions not met for long-term	O8	Local overtemperature
		O9	Thermal stress	O10	Frequent start-stop
		O11	overpressure	O12	Thermal shock
M	Maintenance issues	M1	Lack of routine maintenance	M2	Measurement instrument fault
		M3	Damage of the insulation material	M4	Failure of the tank foundation heat dissipation system
L	Medium issues	L1	Molten salt corrosion	L2	Erosion of the molten salt
		L3	Impurities of the molten salt	L4	Degradation of the molten salt
V	Environment issues	V1	Intermittent cloud cover	V2	Extreme weather
V	Environment issues	V3	Combustible materials of the surrounding area

Note: XT-n: “X” denotes equipment, including receiver, salt piping, salt tank, heat exchanger; “T” denotes triggering factors, “n” represents serial number connected to precursor event. For example, AD-1, where “A” stands for receive, “D” denotes design issues, and “1” indicates it is connected to node A1.

,

Table 6. Meanings of nodes denoting precursor events in Figure 10.

Equipment	Precursor Events
	Node	Meaning	Node	Meaning
Receiver	A1	Freezing of the molten salt	A3	Cracking of the absorbing tubes
	A2	Accumulation of the impurities	A4	Fire hazard
Salt piping	P1	Freezing of the absorbing tubes	P3	Seals failure
	P2	Obstructed flow of the molten salt	P4	Fire hazard
Salt tank	T1	Tank cracking	T3	Fire hazard
	T2	Damage of the tank foundation	T4	Explosion hazard
Heat exchanger	E1	Freezing of the molten salt	E4	Cracking of heat exchanger tube bundles
	E2	Accumulation of the impurities	E5	Explosion hazard
	E3	Obstructed flow of the molten salt	E6	Fire hazard

,

Table 7. Meanings of nodes denoting accident scenarios in Figure 10.

Equipment	Accident Scenarios
	Node	Meaning	Node	Meaning
Receiver	AS1	Blockage of the receiver	AS3	Fire
	AS2	Leakage of the receiver
Salt piping	PS1	Blockage of the salt piping	PS3	Leakage of the salt piping
	PS2	Turbulence of the salt piping	PS4	Fire
Salt tank	TS1	Leakage of the salt tank	TS3	Fire
	TS2	Failure of the salt tank foundation	TS4	Explosion
Heat exchanger	ES1	Blockage of the heat exchanger	ES4	Explosion
	ES2	Turbulence of the heat exchanger	ES5	Fire
	ES3	Leakage of the heat exchanger

and

Table 8. Meanings of nodes denoting response measures in Figure 10.

Equipment	Response Measures
	Node	Meaning	Node	Meaning
Receiver	AR1	Response measures	AR11	Heliostats tracking
			AR12	Routine cleaning
	AR2		AR21	Measures of the leakage prevention
			AR22	Emergency shutdown
	AR3		AR31	Measures of the firefighting
Salt piping	PR1	Response measures	PR11	Measures of the heating trace
	PR2		PR21	Adjusting valve
	PR3		PR31	Start backup
			PR32	Measures of the leakage prevention
	PR4		PR41	Emergency shutdown
			PR42	Measures of the firefighting
Salt tank	TR1		TR11	Transfer of molten salt
			TR12	Emergency shutdown
	TR2		TR21	Prevention measures of leakage
	TR3		TR31	Measures of the freighting
			TR32	Emergency shutdown
	TR4		TR41	Set up isolation zone
Heat exchanger	ER1		ER11	Measures of the heating trace
			ER12	Routine cleaning
	ER2		ER21	Adjusting valve
	ER3		ER31	Prevention measures of leakage
			ER32	Emergency shutdown
	ER4		ER41	Set up isolation zone
	ER5		ER51	Measures of the firefighting

.

7.1.2. Description of Accident Scenario Evolution Path

According to the Figure 10, it can be seen that there are two types of accident evolution paths, as shown in Figure 11.

(1) Possible accident paths and consequences for the equipment itself

(a) Receiver: The precursor event A1 due to excessively low temperature or the A2 in the molten salt pose a significant risk of AS1. If AR11 is functioning, or if the AR12 is adequate, the accident may be terminated. If AR11 or AR12 fails to effectively control the accident, AS1 will prevent the molten salt flow in the receiver tube, causing the wall temperature of the affected tube to rise sharply, leading to A3 and AS2. If AR21 and AR22 are activated, the accident is terminated. However, if AS2 occurs, there may be an A4. When the leaked high-temperature molten salt comes into contact with surrounding flammable materials, AS3 may ignite. Subsequently, AR31 are activated, extinguishing the fire and ending the accident.

(b) Salt piping: The piping is susceptible to P1 due to excessive heat loss, which can lead to PS1. If PR11 is activated normally, the accident is terminated. If PR11 fails, P2 may occur, causing PS2. If PR21 is successfully operated, the accident is terminated. If PR21 is ineffective, it can lead to P3 at valves, flanges, etc., resulting in PS3. If PR31 and PR32 are promptly initiated, the PS3 will be terminated. However, if PS3 continues, it may pose a P4. When the molten salt comes into contact with surrounding flammable materials, PS4 may break out. With the effective response of PR41 and PR42, the accident is ultimately ended.

(c) Salt tank: Trigger factors may collectively lead to T1, resulting in TS1. If TR11 and TR12 are handled properly, the accident will be terminated. If not handled properly, the following two paths may occur: (i) The high-temperature molten salt continuously infiltrates the tank foundation, causing T2 and TS2. If TR21 is effective, the accident is terminated. (ii) The leaked molten salt meets surrounding flammable materials, and T3 may develop, leading to TS3. TR31 would address TS3 and terminate the accident. Conversely, if TR31 is ineffective, there is a risk of T4, potentially leading to TS4. By implementing TR41, the accident is ended.

(d) Heat exchanger: Similar to the receiver, ES1 can occur due to E1 or E2. If ER11 and ER12 are timely and effective, the accident is terminated. If ES1 is not addressed, it can lead to E3, causing ES2. If ER2 is effective, the accident is terminated. If ES2 cannot be effectively controlled, it may cause the frictional connection between the tubes and the tube sheet to loosen, leading to E4 and ES3. If the steam comes into contact with the high-temperature molten salt, it can pose E5 or E6. If not promptly addressed, ES4 or ES5 may occur. Ultimately, under the effective response of ER41 and ER51, the accident is ended.

(2) Impact of upstream equipment on downstream equipment

AS1 may induce P2 in the downstream salt piping. If P2 is not effectively mitigated, it poses a risk of T1, leading to TS1. TS1 can result in a disruption of the salt supply, which in turn can cause E3 in the heat exchanger. E3 can directly lead to the shutdown of the power generation system. Although such an accident path is rarely observed under normal operating conditions, it is still possible and should not be overlooked.

7.1.3. Determination of the Bayesian Network from Scenario Deduction Model

To quantitatively assess the potential risks of the equipment, the established scenario deduction model was converted into the BN model based on the rules mentioned in Section 4.4.

7.2. Establishing an Expert Group

Five experts working in the field of STPP, as well as the special equipment inspection industry, were invited to obtain the parameters of the BN. Details of the experts and their corresponding weights are presented in

Table 9. Weights of five experts and their personal information.

No.	Job Title	Working Years	Education Level	Familiarity	Weighted Values	Weighting Factor
E1	Senior executive	15–28	PhD	Quite familiar	36	0.273
E2	Professor	10–15	PhD	Very familiar	36	0.273
E3	Engineer	3–7	PhD	Moderately familiar	26	0.197
E4	Worker	<3	Bachelor	Very familiar	20	0.152
E5	Student	<3	Master	Moderately familiar	14	0.106

.

7.3. Acquiring the Prior Probabilities of the Basic Nodes

Due to the limited operational and maintenance data for STPPs, the prior probabilities for some nodes in the BN were derived from environmental data and the statistical incidence of actual events during operation, including accident frequencies. For other nodes, especially those involving large transient temperature fluctuations, the prior probabilities were obtained through expert elicitation.

7.3.1. Objective Data Collection

One year of weather data from the STPP was collected to determine the probabilities of intermittent cloud cover and extreme weather. Additionally, based on the recorded incident frequencies of the equipment from the literature [2], the prior probabilities for the corresponding nodes were calculated using the following formula. The results are shown in Appendix A.

$$Q(t)=1-e^{-\lambda t}$$

(34)

where Q(t) denotes the failure probability, λ represents the failure frequency, and t is the operational time.

7.3.2. Expert Elicitation

For the nodes lacking objective probability data, expert elicitation was used to quantify them. Here, we illustrate the probability acquisition process using large transient temperature fluctuations (AO4) as an example.

Table 10. Expert opinions on likelihood of node AO4.

Node	Expert	Judgment	IT2FNs
AO4	E1	M	((0.3, 0.5, 0.5, 0.7; 1, 1), (0.4, 0.5, 0.5, 0.6; 0.9, 0.9))
	E2	MH	((0.5, 0.7, 0.7, 0.9; 1, 1), (0.6, 0.7, 0.7, 0.8; 0.9, 0.9))
	E3	MH	((0.5, 0.7, 0.7, 0.9; 1, 1), (0.6, 0.7, 0.7, 0.8; 0.9, 0.9))
	E4	M	((0.3, 0.5, 0.5, 0.7; 1, 1), (0.4, 0.5, 0.5, 0.6; 0.9, 0.9))
	E5	M	((0.3, 0.5, 0.5, 0.7; 1, 1), (0.4, 0.5, 0.5, 0.6; 0.9, 0.9))

shows the linguistic terms and the corresponding IT2FNs obtained from a questionnaire administered to the five experts regarding the likelihood of the event (AO4).

Based on the information in Table 10, the IT2FS-SAM was used to calculate the probability of the AO4. First, using Equation (20) the similarity matrix (M) was obtained as.

$$M=\left[\begin{array}{ccccc}1& 0.0943& 0.0943& 1& 1\\ 0.0943& 1& 1& 0.0943& 0.0943\\ 0.0943& 1& 1& 0.0943& 0.0943\\ 1& 0.0943& 0.0943& 1& 1\\ 1& 0.0943& 0.0943& 1& 1\end{array}\right]$$

Then, the WAD of five experts were obtained by Equation (21):

WAD(E1) = 0.529, WAD(E2) = 0.227, WAD(E3) = 0.371, WAD(E4) = 0.596, WAD(E5) = 0.574.

Using Equation (22), the RAD were calculated as Equation (22):

RAD(E1) = 0.230, RAD(E2) = 0.099, RAD(E3) = 0.162, RAD(E4) = 0.260, RAD(E5) = 0.249.

Here, β = 0.5, the CDC were obtained by Equation (23):

CDC(E1) = 0.252, CDC(E2) = 0.186, CDC(E3) = 0.134, CDC(E4) = 0.206, CDC(E5) = 0.223.

Then, the AR was obtained with Equation (24).

AR = ((0.364, 0.564, 0.564, 0.764; 1, 1), (0.464, 0.564, 0.564, 0.664; 0.9, 0.9)).

After calculating AR, the crisp value was calculated by using Equation (25).

def (AR) = 0.564

Lastly, the FP of AO4 was calculated with Equation (26).

FP = 1.63 × 10⁻³

Using the above method, the prior probabilities for other basic nodes were computed, ultimately yielding the prior probabilities for entire basic nodes, as detailed in Appendix B.

7.4. Obtaining the CPTs of the Nodes

The IT2FS-BWM method was employed to obtain the CPTs for the child nodes in the BN. Here, node AO-1 in the receiver is taken as a case to explain the procedure of obtaining its CPT. AO-1 has four parent nodes: AO1 (incomplete salt drainage in the evening), AO2 (insufficient molten salt flow rate), AO3 (insufficient preheating in the morning), and AO4 (large transient temperature fluctuations).

7.4.1. Obtaining Experts’ Opinions

The expert panel compared the comparative significance of the parent nodes to the child node driven by their expertise and background. The comparison results are presented in

Table 11. Pairwise comparison for criteria by each expert.

Expert	Linguistic Vector	Criterion
		AO1	AO2	AO3	AO4
E1	Best (AO1)-to-others	CEI	VSI	SI	MPI
	Others-to-worst (AO2)	VSI	CEI	MI	MPI
E2	Best (AO1)-to-others	CEI	MI	SPI	MPI
	Others-to-worst (AO2)	SPI	CEI	WI	MI
E3	Best (AO1)-to-others	CEI	MI	WI	MPI
	Others-to-worst (AO4)	MPI	WI	MI	CEI
E4	Best (AO3)-to-others	WI	SPI	CEI	MI
	Others-to-worst (AO2)	SI	CEI	SPI	MPI
E5	Best (AO1)-to-others	CEI	VSI	WI	SI
	Others-to-worst (AO2)	VSI	CEI	MPI	MI

.

7.4.2. Obtaining the Weights of Parent Nodes Utilizing IT2FS-BWM

The relative importance values of AO1, AO2, AO3, and AO4 on AO-1 were computed according to each expert opinion. The detailed calculation procedure on expert E1 is as follows:

$$\begin{array}{l}\min \delta *\\ s.t\left\{\begin{array}{l}\left|{\omega }_{11}-6{\omega }_{21}\right|\le \delta *,\left|{\omega }_{12}-7{\omega }_{22}\right|\le \delta *,\left|{\omega }_{13}-7{\omega }_{23}\right|\le \delta *,\left|{\omega }_{14}-8{\omega }_{24}\right|\le \delta *,\\ \left|{\omega }_{11}-6.5{\omega }_{21}\right|\le \delta *,\left|{\omega }_{12}-7{\omega }_{22}\right|\le \delta *,\left|{\omega }_{13}-7{\omega }_{23}\right|\le \delta *,\left|{\omega }_{14}-7.5{\omega }_{24}\right|\le \delta *,\\ \left|{\omega }_{11}-4{\omega }_{31}\right|\le \delta *,\left|{\omega }_{12}-5{\omega }_{32}\right|\le \delta *,\left|{\omega }_{13}-5{\omega }_{33}\right|\le \delta *,\left|{\omega }_{14}-6{\omega }_{34}\right|\le \delta *,\\ \left|{\omega }_{11}-4.5{\omega }_{31}\right|\le \delta *,\left|{\omega }_{12}-5{\omega }_{32}\right|\le \delta *,\left|{\omega }_{13}-5{\omega }_{33}\right|\le \delta *,\left|{\omega }_{14}-5.5{\omega }_{34}\right|\le \delta *,\\ \left|{\omega }_{11}-3{\omega }_{41}\right|\le \delta *,\left|{\omega }_{12}-4{\omega }_{42}\right|\le \delta *,\left|{\omega }_{13}-4{\omega }_{43}\right|\le \delta *,\left|{\omega }_{14}-5{\omega }_{44}\right|\le \delta *,\\ \left|{\omega }_{11}-3.5{\omega }_{41}\right|\le \delta *,\left|{\omega }_{12}-4{\omega }_{42}\right|\le \delta *,\left|{\omega }_{13}-4{\omega }_{43}\right|\le \delta *,\left|{\omega }_{14}-4.5{\omega }_{44}\right|\le \delta *,\\ \left|{\omega }_{31}-2{\omega }_{21}\right|\le \delta *,\left|{\omega }_{32}-3{\omega }_{22}\right|\le \delta *,\left|{\omega }_{33}-3{\omega }_{23}\right|\le \delta *,\left|{\omega }_{34}-4{\omega }_{24}\right|\le \delta *,\\ \left|{\omega }_{31}-2.5{\omega }_{21}\right|\le \delta *,\left|{\omega }_{32}-3{\omega }_{22}\right|\le \delta *,\left|{\omega }_{33}-3{\omega }_{23}\right|\le \delta *,\left|{\omega }_{34}-3.5{\omega }_{24}\right|\le \delta *,\\ \left|{\omega }_{41}-3{\omega }_{21}\right|\le \delta *,\left|{\omega }_{42}-4{\omega }_{22}\right|\le \delta *,\left|{\omega }_{43}-4{\omega }_{23}\right|\le \delta *,\left|{\omega }_{44}-5{\omega }_{24}\right|\le \delta *,\\ \left|{\omega }_{41}-3.5{\omega }_{21}\right|\le \delta *,\left|{\omega }_{42}-4{\omega }_{22}\right|\le \delta *,\left|{\omega }_{43}-4{\omega }_{23}\right|\le \delta *,\left|{\omega }_{44}-4.5{\omega }_{24}\right|\le \delta *\\ {\displaystyle \sum _{j=1}^{4}COA\left({\omega }_{jE}\right)=1}\\ {\omega }_{jE1}^U\le {\omega }_{jE1}^L,{\omega }_{jE4}^L\le {\omega }_{jE4}^U\\ {\omega }_{jE1}^L\le {\omega }_{jE2}^L\le {\omega }_{jE3}^L\le {\omega }_{jE4}^L\\ {\omega }_{jE1}^U\le {\omega }_{jE2}^U\le {\omega }_{jE3}^U\le {\omega }_{jE4}^U\\ {\omega }_{jE1}^U\ge 0,j=1,2,3,4\end{array}\right.\end{array}$$

The ideal solution to the above system of simultaneous equations yields: ${\delta }^{*}$ = 0.01. Expert of E1 evaluation of the parent node weight:

W_AO1 (E1) = 0.336, W_AO2 (E1) = 0.162, W_AO3 (E1) = 0.225, W_AO4 (E1) = 0.276

Subsequently, the above calculation steps were repeated to determine the individual rating weights for the other four experts. Using Equation (25), the weighted relative importance values were calculated. The results are as follows:

W_AO1 = 0.311, W_AO2 = 0.128, W_AO3 = 0.443, W_AO4 = 0.119

7.4.3. Utilizing the Leaky-Weighted Sum Algorithm to Calculate the CPTs

Experts evaluate of the probability distribution for the parent nodes of the “AO-1” node are presented in

Table 12. Probability distribution over “AO-1” for parent nodes.

	s = y	s = n
P (AO-1 = y|comp = s) P (AO-1 = n|comp = s)	0.8736	0.296
	0.1274	0.705

and

Table 13. Probability distribution over “AO-1” for the leaky node.

	s = y	s = n
P (AO-1 = y|comp = s) P (AO-1 = n|comp = s)	0.7136	1.5789
	0.2864	0.8211

.

Based on the Equation (31), the CPT of the node AO-1 was obtained, refer to Appendix C.

8. Results and Discussion

This section analyzed and discussed the potential risks associated with common accidents of the equipment in the STPP using the established BN model.

8.1. Failure Probabilities of the Equipment in the STPP

Figure 12 shows the failure probabilities of the equipment under normal operating conditions. As shown in Figure 12a, the occurrence probability of AS1 (blockage of the receiver) is 0.06 due to the small diameter of the receiver pipes and their exposure to the harsh external environment. The probability of AS2 (leakage of the receiver) is 0.05. As shown in Figure 12b, the probability of PS1 (blockage of the salt piping) is only 0.06 because of the presence of insulation and heating measures. The subsequent events PS2 (turbulence of the salt piping), PS3 (leakage of the salt piping), and PS4 (fire) have occurrence probabilities of 0.05, 0.02, and 0.01, respectively. For the salt tank, the occurrence probability of TS1 (leakage of the salt tank) is 0.04, and the following TS2 (failure of the salt tank foundation), TS3 (fire), and TS4 (explosion) have probabilities of 0.02, 0.01, and 0.00, respectively (see Figure 12c). For the heat exchanger, the probabilities of ES1 (blockage of the heat exchanger), ES2 (turbulence of the heat exchanger), ES3 (leakage of the heat exchanger), ES4 (explosion), and ES5 (fire) are 0.08, 0.04, 0.02, 0.01, and 0.01, respectively (see Figure 12d).

Compared to the typical failure probability ranges in authoritative petrochemical handbooks (e.g., OREDA [47], API RP 581 [48]), which define pipeline, tank, and heat exchanger failures within the 10⁻³–10⁻²/year magnitude, this study’s BN-derived failure probabilities for molten salt piping, thermal storage tanks, and heat exchangers fall within the same order of magnitude (10⁻²/year) but exhibit slightly higher numerical values. This deviation is attributed to the extreme operational conditions unique to STPP. The alignment with industry benchmarks while reflecting domain-specific stressors underscores the model’s predictive validity and its capacity to capture STPP systems’ heightened risk profiles.

It can be found that the failure probabilities of the four types of equipment (receiver, salt piping, salt tank, and heat exchanger) remain relatively high under normal operating conditions. However, as fault propagation paths evolve, the accident occurrence probability gradually decreases across sequential stages. This aligns with the phased deployment of multi-level safety response mechanisms in existing power plant system designs. During initial failure phases, rapid isolation systems effectively block fault propagation paths. Such progressive protection strategies enable the probability of single equipment failures escalating into severe accident chains to exhibit an exponential decay trend.

8.2. Importance Analysis of Triggering Factors

This section employs a parameter sensitivity analysis based on BNs to quantitatively diagnose the triggering factors of key equipment. Taking the receiver (AS1) as a case study, AS1 is first defined as the target node, and the influence of different parent nodes on AS1 is evaluated through strength analysis (Figure 13). On this basis, the “derivatives” of each factor in the sensitivity tornado are further utilized to rank the importance of various triggering factors.

The results of the sensitivity analysis are summarized in Figure 14, which illustrates the relative importance of various triggering factors contributing to typical equipment failures in the STPP.

From Figure 14a, it is concluded that the primary factors leading to AS1 is AO3 (insufficient preheating in the morning), where low preheating temperature can cause molten salt to condense in the flow areas. AL3 (impurities of the molten salt) is also a significant factor, as corrosion products continuously detach and deposit in the receiver pipes. AO1 (incomplete salt drainage in the evening) leads to incomplete drainage of molten salt, which solidifies in the pipes and cause blockages.

As shown in Figure 14b, for PS1, PO1 (incomplete salt drainage in the evening) has the most severe impact. When the pipe temperature is low at night, residual molten salt that is not fully discharged can solidify and obstruct flow. PM3 (damage of the insulation material), which exposes the pipes to the environment, significantly increases heat loss. PO1 (delayed heating startup) is also noteworthy; if heat tracing measures are not promptly activated, the molten salt may solidify as the pipe temperature drops.

It can be seen in Figure 14c that TPH (poor quality of the weld) is identified as the primary cause of tank cracking, with welding defects leading to stress concentrations that significantly elevate the failure risk. Additionally, TOL (corrosion of the molten salt) accelerates the material cracking process. Temperature-induced TO9 (thermal stress) is another critical factor contributing to material cracking.

As shown in Figure 14d, EL2 (impurities of the molten salt), EO3 (insufficient preheating in the morning), and EO2 (insufficiency of molten salt flow rate) are the main three causes of heat exchanger failure. EL2 can accumulate in the heat exchanger, causing fouling. EO3 may cause temperature unevenness, adversely affecting the fluidity of the molten salt. And EO2 can hinder molten salt circulation and impede heat transfer, leading to localized supercondensation.

The results obtained from the aforementioned sensitivity analysis have been validated in the literature (e.g., salt piping PS1 [2,49], salt tank TS1 [50,51]). In response to the issues raised, propose the following methods: For AS1, incorporate heating systems around the receiver tubes to maintain the temperature of exposed sections. Regarding PS1, adjust pipeline gradient to 3–5° for gravity-driven salt evacuation. For TS1, enhance welding quality and eliminate post-weld residual stresses. Concerning ES1, schedule weekly cleaning cycles to maintain heat transfer efficiency.

Equipment failures are influenced not only by internal factors but can also by cascading effects from upstream equipment failures. Figure 15 illustrates the impact of upstream equipment incidents on downstream equipment and the importance ratios of self-impact factors for downstream equipment. The analysis indicates that external factors, particularly those affecting P2 (obstructed flow of the molten salt), have a significant influence that cannot be overlooked. Conversely, the influence of PS2 on T1 (tank cracking) is negligible and can be disregarded. Furthermore, the occurrence of TS1 in E3 (obstructed flow of the molten salt) leads to a substantial decrease in molten salt, resulting in insufficient supply to the heat exchanger.

In summary, the impact of external factors on equipment is significant and should not be ignored. Therefore, it is strongly recommended to implement isolation measures for equipment. Immediate isolation procedures should be initiated upon the occurrence of an upstream equipment incident to effectively prevent the spread of accidents, ensuring the safety and stable operation of the entire system.

8.3. Effectiveness Analysis of Response Measures

To investigate the effectiveness of various response measures in mitigating accidents, the precursor event (P) is set to true within the potential accident pathway of the equipment, specifically P (precursors) = T. This setup allows us to explore the impact on adjacent events when the precursor occurs. Different states of R (response measures) are then configured to evaluate their effectiveness. Figure 16 shows the extent of influence on relevant nodes under different states of response measures.

As shown in Figure 16a, when the precursor events (A1 and A2 = T) occur while the response measures remain unchanged, the probability of AS1 escalates from 0.06 to 0.39, and A3 concurrently rises from 0.04 to 0.14. Upon detecting molten salt condensation, the company swiftly implements countermeasures and strictly clean the interior of the receiver. Consequently, the probability of AS1 markedly diminishes from 0.39 to 0.22. However, A3 drops only from 0.14 to 0.09. The response measures exert a notable impact on AS1 but exhibit limited efficacy in preventing A3.

Similarly, as shown in Figure 16b, the probability of PS1 escalates from 0.05 to 0.26 and P2 concurrently rises from 0.07 to 0.21. During a rigorous inspection of heating measures’ integrity and upon the occurrence of PS1, if the response measure PR1 is fully activated (PR1 = T), the probability of PS1 will decrease from 0.26 to 0.11, and P2 will drop from 0.21 to 0.08. It is clear that PR1 has a significant restraining effect on both PS1 and P2.

As shown in Figure 16c, the probabilities of TS1, T2, and T3 increase from 0.03 to 0.34, 0.02 to 0.17, and 0.03 to 0.19, respectively. Conversely, if the company rigorously implements all leak prevention measures, accelerates the salt transfer process, and fully activates the response measure TR1 (TR1 = T), the probability decrease as follows: TS1 from 0.34 to 0.28, T2 from 0.17 to 0.11, and T3 from 0.19 to 0.05. It is evident that even with comprehensive response measures, the probability of TS1 remains significantly high. TS1 could potentially lead to T2 or T3, causing permanent damage to the storage tank.

Similarly, as shown in Figure 16d, the probabilities of ES1 and E3 rises from 0.06 to 0.29 and 0.05 to 0.24, respectively. However, when the company strictly adheres to standard operating procedures, promptly inspects and maintains the heating measures, thoroughly cleans various contaminants, and fully activates the response measures ER1 (ER1 = T), the probability of ES1 will decrease from 0.29 to 0.15, and that of E3 will drop from 0.24 to 0.09. It can be seen that the response measures obviously control ES1 and effectively manage E3.

The principle of ‘prevention being superior to cure’ must always be strictly followed in power plant accident prevention and control. First, design and installation should address key triggers to minimize defects and reduce incident likelihood. Secondly, during operation, operation and maintenance standards should be rigorous implemented. Subsequently, comprehensive hazard identification should be conducted, and critical safeguards should be established in key areas to effectively suppress incidents when they occur. Finally, measures should be taken to mitigate potential safety threats in the surroundings of the power plant to prevent the occurrence of external input accidents.

8.4. Prediction of Potential Accident Consequences

8.4.1. Effect of Normal Operating Conditions on Accident Consequences

Figure 17 presents the potential accident consequences for the equipment in the STPP under normal operating conditions. For C1 (direct economic losses), there is a probability of 98% that plant downtime will result in direct electricity sales losses of less than 1 million RMB. In 2% of cases, losses may range from 1 million to 10 million RMB. For C2 (casualties), there is a probability of 98% causing Level I consequence and a 2% chance of Level II consequence. As for C3 (equipment damage), it is estimated that 93% of incidents may require a shutdown, 6% might need a shutdown and inspection, and 1% could involve starting backup equipment.

8.4.2. Effect of Response Measures on Accident Consequences

Figure 18 shows the effect of response measures on accident consequences in the STPP. Figure 18a,b present the potential accident consequences with and without response measures, respectively. Clearly, response measures obviously reduce the probabilities of potential accidents. For C1, Level II consequence decreases from 22% to 3%, and Level III from 2% to zero. For C2, Level II consequence falls from 11% to 2%, and Level III is reduced from 2% to zero. For C3, Level II declines from 28% to 5%, Level III from 11% to 1%, and Level IV from 2% to 0%.

Figure 18c,d show the changes in accident consequences under precursor events, with response measures transiting from a general state to full activation. For C1, Level III consequence decreases from 6% to 1%, while Level II from 30% to 20%. For C2, Level III consequence reduces from 5% to 1%, and Level II from 14% to 10%. For C3, Level IV consequence declines from 10% to 3%, Level III from 25% to 9%, and Level II from 35% to 27%. The implemented measures effectively lower the severity of accident consequences, shifting consequence from higher to lower levels and preventing further progression towards more severe outcomes.

8.4.3. Effect of Accident Scenarios on Accident Consequences

To clarify the severe consequences caused by key equipment failures in STPPs, sets the accident scenario node to true to obtain the probability distribution of accident consequences. Figure 19 illustrates the hierarchical consequence distribution of a salt tank leakage accident (TS1). As shown in Figure 19, for C1, the proportions of Level II, III, and IV are 30%, 45%, and 9%, respectively; for C2, the proportions of Level II, III, and IV are 52%, 10%, and 0%, respectively; and for C3, the proportions of Level II, III, and IV are 8%, 19%, and 73%, respectively. Notably, compared with the average economic loss values of existing molten salt tank leakage cases in Table 1, the economic loss levels in this study are slightly higher. This discrepancy arises because industry-reported data typically include only a single dimension (either power sales loss or maintenance costs), whereas this study incorporates dual-dimensional data (both power sales loss and maintenance costs), yielding more rational results that validate the reliability of the model. Consequence severity distributions for failures of other equipment are provided in Appendix D.

9. Conclusions

This study presents an integrated method that combines scenario deduction with type-2 fuzzy sets-based BN to assess the potential failure risks of equipment in STPPs:

(1) A scenario deduction model has been developed, based on typical accident cases, which incorporates essential elements including triggering factors, precursor events, accident scenarios, and response measures. This model is designed to trace the causes of equipment failures and explore the possible evolution paths.

(2) Addressing the complexity introduced by a large number of nodes in the Bayesian network, an approach integrating both objective data and expert elicitation was employed to derive the necessary analysis parameters. To minimize subjectivity in expert opinions, the IT2FS-SAM was utilized to determine the prior probabilities of nodes. For consistent and simplified decision-making, the IT2FS-BWM is used to determine parent node weights, and the leaky-weighted sum algorithm is applied to optimize the CPTs.

(3) The proposed method was demonstrated through a case study of an STPP in western China, establishing a quantitative risk assessment model for four types of critical equipment: receiver, salt piping, salt tank, and heat exchanger. This model includes 16 typical accident scenarios, 41 triggering factors, 16 precursor events, and 21 response measures. By applying both forward causation and backward reasoning of BN, the failure probabilities of equipment, triggering factors, the effectiveness of response measures, and the potential consequences of accidents were analyzed.

Due to the limited operational data available from STPPs, this study partially relied on expert elicitation for data acquisition, which may introduce some degree of subjectivity. Future work will focus on updating the model parameters with additional operational data as it becomes available, thereby enhancing the accuracy of the assessment outcomes. This continuous improvement will provide stronger support for safety management in STPP operations.