Probabilistic Safety Assessment andRisk Management

George Apostolakis
Head, Nuclear Risk Research Center, Tokyo
apostola@mit.edu
http://criepi.denken.or.jp/en/nrrc/index.html
Presented at theIAEA Technical Meeting on MUPSA
Vienna, Austria
October 7-10, 201911

Risk Management•“Deterministic” approach
Design basis accidents
Defense in Depth
Safety margins•

Risk-based approach–

What can go wrong? (thousands of accident sequences or
scenarios as opposed to the limited number of DBAs)–

How likely are these scenarios? (identify risk-dominantscenarios and manage them)–What are their consequences?

2

Risk-Informed Framework

Traditional“Deterministic”
Approach• Unquantified
probabilities•Design-basis accidents•Defense in depth andsafety margins•Can impose
unnecessary
regulatory burden•Incomplete

RiskInformedApproach•Combinationof traditionaland riskbased
approaches
through adeliberative
process

Risk-BasedApproach• Quantified
probabilities•Thousands ofaccident
sequences•Realistic•Incomplete

3Deliberative Decision Making
Options

TechnicalAnalysis

Decision
Criteria

one or more
techniques

Assumptions,
UncertaintiesandSensitivities

ResourceandSchedule
Constraints

Deliberation
OtherFactors

Stakeholder
Input

Decision &Implementation

NUREG-2150, A Proposed Risk Management Regulatory Framework4Risk-Informed Decision Making (1)•USNRCRIDM: Insights from PRA are considered with otherengineering insights in decision making.
Regulatory Guide 1.174 (1997) provides guidance.

•Industry
Ensure that the Safety Goals and applicable regulations
are met.
A PRA may reveal credible vulnerabilities to the utility
staff.

5

Early Applications (before RG 1.174)•Industry (1981)
Plant-specific PRAs provide insights.
A seismic initiated interaction of adjoining buildings
could lead to the collapse of the main control building. A
simple structural modification was implemented todamp the interaction between the two buildings.
The fire contribution to CDF was deemed to be too high.
A simple plant modification reduced this contribution.

•USNRC (1980s)
Generic regulations.
Two rules (ATWS and SBO) based on WASH-1400
findings and operational experience.

6

Risk-Informed Decision Making (2)•PRA insights are considered with other engineering
insights to inform decision making.
Key word: “considered”
The decision is based on judgment•What shapes this judgment?
The credibility and acceptability of PRA and otherengineering insights
Individual PRA results can be credible and acceptable•

Fire PRAs for power operations are used by theNRC and industry to make risk-informed decisions
This use indicates that FPRA is credible and realistic
enough for decision making
7

Safety Goals•

High-Level qualitative and quantitative objectives
for single units.

•Subsidiary goals for CDF and LERF.

•PRA Standards are developed.

8

ACRS Letter, April 2004 (1)• The Quantitative Health Objectives (QHOs) apply tothe site as a whole. The sum of the contributions
from each reactor on the site to acute and latent
fatalities should be bounded by the QHOs.
• The Committee has not reached consensus on theapproach that should be taken to determine the coredamage frequency (CDF) goal. Two views arepresented in the discussion below.

9ACRS Letter, April 2004 (2)• Option 1
The site goal (e.g., 10-4 per ry) is divided by the number ofunits at the site.
The risk from and the likelihood of a core damage accident
at all sites cannot be precisely equal. However, there is theexpectation that they be comparable.

• Option 2
CDF is an accident prevention goal and its value should bethe same for each reactor at every site.
Requiring each module to have a CDF value given by theoverall CDF goal divided by the number of modules
introduces a new Safety Goal concept, a site CDF. Such aconcept was never intended to be part of the Safety Goals.

1010

My View• The Qualitative and Quantitative Health Objectives
are a statement of the societal acceptability of NPPrisks.
• They should be met including all hazards at the site.
• CDF and LERF (or similar metrics) balance accident
prevention and mitigation for any given site
(defense-in-depth).
• LERF or any other metric of release should be a sitegoal.
• CDF should still be per reactor year.

1111

The IAEA MUPSA Methodology•

A significant step forward.

•As expected at this stage of development, furtherimprovements and refinements will occur.

•The methodology is not ready to be used in genericregulatory decision making.

12PRA Evolution•••••Reactor Safety Study, 1975: Establishes basicstructure
Zion/Indian Point PRAs, early 1980s: Externalevents are important
French studies, mid 1980s: LPSD risk is comparable
to that at power
Fukushima, 2011: Multi-unit issues are important
The current state of MUPSA methodology is at astage similar to that for single units in the 1970s
and early 1980s.

13Multi-Unit Risk Management: Industry
Initiating event

Unit 1
Unit 2
Units 1&2

2.56E-08
9.84E-08
1.87E-10

Fire in theturbinehall
7.65E-07
2.98E-06
6.46E-09

R2(“old”)

7.30E-03

8.44E-03

SLBO

CDF forUnits 1&2(“old”units)

IE
CD12 for seismic events

LOOP (SFTapproach)

LOOP (METapproach)

Seismicevents

1.13E-06
1.13E-06
1.68E-08

1.13E-06
1.13E-06
1.68E-08

1.58E-04
1.58E-04
1.32E-04

1.49E-02

1.49E-02

8.35E-01

Base caseSensitivitycase

1.32E-4

9.65E-5

From: IAEA, “MUPSA for New and Existing Reactor Facilities,” Vienna, 2019.

• The plant-specific numbers for seismic failure are high andexceed the safety goal for CDF.
• They should prompt plant management to explore further
these results and, possibly, take action.
14

My Numbers Concern

Unit 2

Units 1and 2(old)

Unit 3

Units 4

Units 3
Units 1,and 42, 3 and 4(new)Case Description

Unit 1

LOOP (SFT Method)
LOOP (MET Method)

1.17E-06 1.17E-06 3.64E-08 7.47E-07 7.47E-07 3.67E-09 8.02E-15
1.17E-06 1.17E-06 3.64E-08 7.47E-07 7.47E-07 3.67E-09 8.02E-15

From: P. Hlavac, “Results of quantifications of the MUPSA model,” presented at the Third Meeting on
Phase II – MUPSA Case Study Vienna International Centre, August 06 to 09, 2018.

• What does 10-15 mean?
• Age of the earth: 4.6x109 years• Low numbers are credible when supported bystatistics and acceptable models
Asteroids with diameter 3 miles strike the earth every 20
million years (5x10-8 per year)•This is not the case with PRA.
15

Analysts are concerned• NUREG 1150 (Peach Bottom): “Core damage
frequencies below 10-5 per ry should be viewed withcaution because of the remaining uncertainties in
PRA (e.g., events not considered).”• NEI 18-04 (LMP): “Event sequences with frequencies
less than 5×10-7/plant-year are retained in the PRA
results and used to confirm there are no cliff edge
effects. They may also be taken into account in theRIPB evaluation of defense-in-depth.”• The NuScale approach employs a 10-6 per year
threshold for identifying incredible core damage
events.
• French researchers: “practically eliminated”
16

Questions posed at RIC 2019
••

•

•

Should the USNRC Office of Nuclear Regulatory
Research establish a project to address PRA
limitations due to incompleteness, very low
frequencies, their meaning, and their regulatory
treatment?
Should we establish a de minimis frequency level
and how would it affect the regulations and thereporting of PRA results?
Today’s addition: Should the IAEA undertake asimilar initiative?
Note: de minimis, “lacking significance or importance: sominor as to merit disregard,” Merriam Webster Dictionary.
17