Safety Risk Metrics

George Apostolakis
Head, Nuclear Risk Research Center, Japan
Professor Emeritus, MIT
Former Commissioner
U.S. Nuclear Regulatory Commission

apostola@mit.edu
Presented at the Workshop on
The Quantification of the Likelihood of an Attack
November 9-11, 2020

11

PRA Model Overview
Level I

Level II

Level III

PLANT
MODEL

CONTAINMENT
MODEL

SITE/CONSEQUENCE
MODEL

Accident
Initiators
Results
Accident
sequencesleading toplantdamagestatesResults

Results

Containment
failure/release
sequences

Public healtheffects

PLANT MODE
At-power Operation
Shutdown / Transition
Evolutions

2SCOPEInternal Events
External Events

History and Questions•

The first PRA was NRC-sponsored and was issuedin 1975.

•The industry started doing PRAs in the late 70s.

•Very low frequencies were reported, e.g., 10-5 perreactor year.

•Are these numbers tolerable (“acceptable”)?

•How can they be used in decision making?

3

U.S. Nuclear Regulatory Commission(August, 1986)
Quantitative Health Objective (QHOs)

Early and latent cancer mortality
risks to an individual living near
the plant should not exceed 0.1
percent of the background
accident or cancer mortality risk,approximately 5 x 10-7/year forearly death and 2 x 10-6/year for
death from cancer.
•The prompt fatality goal applies to an average individual living in theregion between the site boundary and 1 mile beyond this boundary.
•The latent cancer fatality goal applies to an average individual living in theregion between the site boundary and 10 miles beyond this boundary.
4

PRA Model Overview and Subsidiary
Objectives
CDF
10-4/ry

LERF
10-5/ry

QHOs

Level I

Level II

Level III

PLANT
MODEL

CONTAINMENT
MODEL

SITE/CONSEQUENCE
MODEL

ResultsResults

Results

Accident
sequencesleading toplantdamagestatesContainment
failure/release
sequences

Public healtheffects

Uncertainties

PLANT MODE
At-power Operation
Shutdown / Transition
Evolutions
5SCOPEInternal Events
External Events

Decision Making• Risk-informed decision making (RIDM):
PRA results are one input to a subjective decision-making
process that includes elements of traditional engineering
approaches such as defense in depth.
NRC Regulatory Guide 1.174.

• The subsidiary goals (CDF and LERF) are usedroutinely in RIDM.

6My View on QHOs•••••••For many years, the QHOs were applied to singleunits.
Fukushima demonstrated that multi-unit accidents
are important.
Should the QHOs continue to apply to single units?
My answer: No. They should apply to the sites.
Is security separate?
My answer: No. The QHOs should include the risk
contribution of malicious acts.
The QHOs can be viewed as a contract between thenuclear enterprise and society. We cannot revise
them every time we find new failure modes.
7

Malicious Attacks
Level I

Level II

Level III

PLANT
MODEL

CONTAINMENTMODELSITE/CONSEQUENCE
MODEL

Accident
Initiators
Results
Accident
sequencesleading toplantdamagestatesResults

Results

Containment
failure/release
sequences

Public healtheffects

Malicious Attack

8

Our Challenge•

How can malicious acts be incorporated in thestructure of the PRA?

•What are their probabilities?

•In a traditional PRA, the probabilities are theproduct of evidence and expert judgment.

•Can we use the same approach in security?

•If so, what is the evidence and who are the experts?

9