Risk-Informed Decision Making at
Nuclear Power Plants

George Apostolakis
Head, Nuclear Risk Research Center
apostola@mit.edu
Presented at
Tohoku University
November 3, 2018
2015

1

1

Outline••

Hazards, risks and benefits
Uncertainties in nuclear safetyTraditional regulations
Risk-informed regulations• U.S. NRC Safety Goals (1986)• U.S. NRC Policy Statement on PRA (1995)• Examples of RIDM applications
 Extension of AOT
 ROP
 Piping inspections• Challenges for Japan• NRRC activities• Concluding remarks
2015

2

Risks in Society• Hazard: A source of danger
 Industrial facilities
 Activities, e.g., driving a car• Risk:The possibility that something bad or
unpleasant (such as an injury or a loss)
will happen• Uncertainty is an integral part of risk
• Risk:Probability and (not times) adverse
consequences
20153

Safety vs. Residual Risk
• Residual risk
 Example: In Japan, 5 people die in transportation
accidents for every 100,000 residents every year Therefore, the individual residual risk of death is𝟓𝟓= 0.00005
𝟏𝟏𝟏𝟏𝟏𝟏,𝟎𝟎𝟎𝟎𝟎𝟎

per year, a very small frequency• This residual risk is “accepted” or “tolerated” by
Japanese society• Safety is a continuum
 It is meaningless to call something safe or unsafe
 Claim: A plant is “safe” if it meets the regulations
 We should not “continuously improve safety.” Weshould continuously manage the residual risk.
20154Why do we tolerate Residual Risks?
• Because each facility or activity provides benefits• For individual voluntary activities in which a person
feels in control the residual risk may be relatively
high (the risk in general aviation is about 1,000 times
greater than that in commercial aviation)• For industrial facilities, it is society through its
representatives that decides; public input isimportant• Risk-Benefit tradeoffs are rarely quantitative; benefit
is much harder to quantify than risk
2015

5

Managing Uncertainty in Nuclear Safety (1)• Traditional “conservative” approach A bottom-up approach A limited number of potential design-basis accidents is
considered Uncertainty is not quantified Unquantified uncertainty is managed by conservatism via
defense in depth and safety margins• Defense-in-Depth is a safety philosophy that employs
successive compensatory measures to prevent accidents or
mitigate damage if a malfunction, accident, or naturally caused
event occurs at a nuclear facility.
• It is a protection against the unknown unknowns.

2015

6

Major Elements of Defense in Depth

Accident Prevention

Safety Systems

Containment
Accident Management

Emergency Plans

2015

7

Incompleteness of Traditional
Regulations• Small (not large) LOCAs and transients dominate
risk (NRC’s Reactor Safety Study).
• The significance of support systems and humanperformance had not been appreciated (NRC’s
Reactor Safety Study).
• Station Blackout could be a significant risk
contributor (before the rule).
• Earthquakes and fires usually dominate risk
(industry-sponsored Zion and Indian Point PRAs).
• PRAs should be plant specific.
• Plants licensed under the same rules havedifferent core damage frequencies.
88External Influence for Change• Regulatory agencies are, by their nature,conservative.
• Major changes usually require an externalintervention.
 Senator Pastore’s letter to the U.S. Atomic Energy
Commission (1971) “The members suggested that a comprehensive
assessment of the safety aspects of nuclear reactors
be made with the intent of setting down for theindustry and public a clear-cut summary of what thefacts are in this matter.” Outcome: The Reactor Safety Study (1974)

3

9

Managing Uncertainty in Nuclear Safety (2)• Probabilistic Risk Assessment
 A top-down approach Thousands of potential accident sequences areinvestigated Uncertainty is quantified and managed
 More realistic depiction of what can go wrong•

Probabilistic Risk Assessment (PRA) supports
Risk Management by answering the questions:



2015

What can go wrong? (thousands of accident sequences
or scenarios)
How likely are these scenarios? (frequencies per year)
What are their consequences?
10Additional Problems with the Traditional
Approach• There is no guidance as to how much defense indepth is sufficient• Qualitative approaches are used to ensure system
reliability (the single-failure criterion) when more
modern quantitative approaches exist• Human performance is stylized (e.g., operators are
assumed to take no action within, for example, 30
minutes of an accident’s initiation)• Difficult to reflect operating experience andmodern understanding• Industry-sponsored PRAs showed a variability inrisk of plants that were licensed under the same
regulations.
2015

11

PRA Model Overview

Level I

Level II

Level III

PLANT
MODEL

CONTAINMENT
MODEL

SITE/CONSEQUENCE
MODEL

Results

Results

Results

Accident
sequencesleading toplantdamagestatesContainment
failure/release
sequences

Public healtheffects

Uncertainties

PLANT MODE
At-power Operation
Shutdown / Transition
Evolutions

SCOPE
Internal Events
External Events

12
11

Contributions to Core Damage
Frequency for a U.S. BWR(NUREG-1150, 1990)• Total

9.7x10-5 per year

• Internal Events

4.5x10-6 per year

 Station Blackout ATWS

2.2x10-6 per year
1.9x10-6 per year

• External Events
 Seismic (LLNL*) Fires•

7.7x10-5 per year
2.0x10-5 per year

Note: Deemed to be conservative today.
2015

13

Quantitative Health Objectives (QHOs)(USNRC, August, 1986)• Early and latent cancer mortality risks to an individual living
near the plant should not exceed 0.1 percent of the
background accident or cancer mortality risk, approximately
5x10-7/year for early death and2 x10-6/year for death from cancer.


The prompt fatality goal applies to an average individual living in the region
between the site boundary and 1 mile beyond this boundary.
The latent cancer fatality goal applies to an average individual living in theregion between the site boundary and 10 miles beyond this boundary.

14

PRA Model Overview andSubsidiary Objectives
CDF
10-4/ry

LERF
10-5/ry

QHOs

Level I

Level II

Level III

PLANT
MODEL

CONTAINMENT
MODEL

SITE/CONSEQUENCE
MODEL

Results

Results

Results

Accident
sequencesleading toplantdamagestatesContainment
failure/release
sequences

Public healtheffects

Uncertainties

PLANT MODE
At-power Operation
Shutdown / Transition
Evolutions

SCOPE
Internal Events
External Events

15
14

PRA Policy Statement (USNRC1995)• The use of PRA should be increased to theextent supported by the state of the art
and data and in a manner thatcomplements the defense-in-depth
philosophy• PRA should be used to reduce
unnecessary conservatisms associatedwith current regulatory requirements

15

16

Risk-informed Regulation“A risk-informed approach to regulatory decisionmaking represents a philosophy whereby risk
insights are considered together with other factors
to establish requirements that better focus licensee
and regulatory attention on design and operational
issues commensurate with their importance topublic health and safety.”[USNRC Commission’s White Paper, USNRC, 1999]17

Deliberation
Define appropriate regulatory controls andoversight to meet risk management goal related
to risk-informed and performance-based
defense in depth

Decision Criteria

Legal Requirements

Resource Implications

Stakeholder Views
Technical analysis

Uncertainties andSensitivities

An organized process of characterizing riskthat includes both qualitative andquantitative components(including factors for“unknown unknowns”)

PRA

PA

Complex Facility
Infrequent events

ISA

Qualitative

Traditional
Engineering Analyses

Simpler Facility
More frequent events

Figure B-4 Technical Analysis Techniques & Deliberation

NUREG-2150, A Proposed Risk Management Regulatory Framework
32

18

Risk-Informed Framework

Traditional“Deterministic”
Approach• Unquantified
probabilities•Design-basis accidents•Defense in depth andsafety margins•Can impose
unnecessary
regulatory burden•Incomplete

RiskInformed
Approach•Combinationof traditionaland riskbased
approaches
through adeliberative
process
19

Risk-BasedApproach• Quantified
probabilities•Thousands ofaccident
sequences•Realistic•Incomplete

Risk-Informed Changes to the
Licensing Basis (RG 1.174; 1998)
Comply with
Regulations

Maintain
Defense-inDepth
Philosophy

Maintain
SafetyMargins

Integrated
Decision Making
Risk Decrease,
Neutral, or Small
Increase

Monitor
Performance
20

∆CDF

Risk-Informed Changes to the Licensing Basis(RG 1.174)
Region I- No changes
Region II- Small Changes- Track Cumulative Impacts
Region III- Very Small Changes- More flexibility with respect toBaseline- Track Cumulative Impacts

Region I

10-5
Region II
10-6
Region III

10-5

10-4

CDF

Acceptance Guidelines for Core Damage Frequency
21
19

Important Note
“The analysis will be subject to increased technicalreview and management attention as indicated by
the darkness of the shading of the figure. In thecontext of the integrated decision-making, theboundaries between regions should not beinterpreted as being definitive; the numerical values
associated with defining the regions in the figure
are to be interpreted as indicative values only.”
Regulatory Guide 1.174

22
20

Example: 1-out-of-2 System

1 2 2
1
Q = λ T + λτ + λ CCF T + γ 0 γ 1
32
λstandby failure rate

T

Surveillance Test IntervalτAllowed Outage Time

λ CCF

common-cause failure rate

γ0

unconditional human error rate

γ1

conditional human error rate

∆CDF and ∆ LERF can be calculated from the
PRA.
23
21

South Texas Project Experience• AOTs extended from 3 days to 14 days for
emergency AC power and 7 days for Essential
Cooling Water and Essential Chilled Water systems.
• Actual experience:Less than 5 days.

• Confidence building.

22

A Success: Reactor Oversight Process• Motivation
 The previous inspection, assessment and enforcement
processesa.
b.
c.

Were not clearly focused on the most safety important
issuesConsisted of redundant actions and outputs
Were overly subjective with NRC action taken in a mannerthat was at times neither scrutable nor predictable.

 Commission’s motivation
a.

b.
c.

2016

Improve the objectivity of the oversight processes so that
subjective decisions and judgment were not central
process features
Improve the scrutability of these processes so that NRC
actions have a clear tie to licensee performance
Risk-inform the processes so that NRC and licensee
resources are focused on those aspects of performance
having the greatest impact on safe plant operation.
25

ROP: Challenges and Context• Challenges
•

•

•
•

2016

The large size of the program, in terms of both the number of
USNRC staff (e.g., hundreds of affected staff) and the number oflicensed facilities affected (i.e., all licensed power reactors).
The development of performance indicators using plant data
(e.g., results of equipment tests translated into quantitative
estimates of system reliability) required the development ofmethods to collect the data, techniques for consistently andclearly displaying the results, and determining action“thresholds” (e.g., what action should be taken in response to
decreasing performance).
The quality of the licensee PRAs varied considerably across theset of plants
This variability presented a significant challenge to USNRC as it
attempted to develop realistic and objective assessment toolsthat were not sensitive to this variability.

26

ROP: Outcomes Very successful
 Improves the consistency and objectivity of the previous
process by using more objective measures of plant
performance Focuses NRC and licensee resources on those aspectsof performance that have the greatest impact on safe
plant operation
 Provides explicit guidance on the regulatory response toinspection findings
 Full implementation required considerable resources,
including data collection and evaluation, training, andagency risk expertise and models
 The benefits of the program, including the objectivity andpublic availability of plant evaluations, justified the costs
incurred.
2016

27

ROP: Take-Away• Implementation of a risk-informed reactor oversightprocess requires considerable development, testing,and communication among stakeholders early in theprocess, and an extensive infrastructure during use.
The objectivity and clarity of outcomes more thanjustifies the investment.
• Implementation of RIDM requires “Good” plantspecific PRAs.
• The NRRC is aiding Japanese utilities in developing“Good” PRAs.
2016

28

ASME Boiler and Pressure Vessel Code (BPVC)
Section XI• Class 1 components include piping and components whose failure
would prevent orderly reactor shutdown and cause a loss of coolant
in excess of normal makeup capability.
• Class 2 components include safety system components of thefollowing: residual heat removal system, reactor containment heatremoval systems, emergency core cooling system including injection
and recirculation portions, air cleanup systems used to reduceradioactivity within the reactor containment, containment hydrogen
control system and portions of the steam and feedwater systems.
• Class 3 components include portions of the reactor auxiliary
systems that provide boric acid, emergency feedwater system,
portions of components and process cooling systems (electricaland/or compressed air) that cool other safety systems including the
spent pool cooling system, on-site emergency power supply andauxiliary systems.
29
27

ASME BPVC Section XI Requirements• Class 1 piping systems: 25% welds examined every 10year interval• Class 2 piping systems: 7.5% welds examined every 10year interval• Class 3 piping systems: Only pressure test for leakage
every 10-year interval• The selection of inspections is primarily based on "high(design) stress/high (design) fatigue" weld locations.

30
28

Risk Evaluation Matrix

DEGRADATION CATEGORY(Pipe Rupture Potential)(Conditional) CONSEQUENCE CATEGORY(Safety Significance)
NONE

LOW

MEDIUM

HIGH

HIGH

LOW
(Cat. 7)

MEDIUM(Cat. 5)

HIGH
(Cat. 3)

HIGH
(Cat. 1)MEDIUM

LOW(Cat. 7)

LOW
(Cat. 6)MEDIUM(Cat. 5)

HIGH
(Cat. 2)LOW

LOW(Cat. 7)

LOW
(Cat. 7)

LOW
(Cat. 6)MEDIUM(Cat. 4)31
29

Benefits of RI ISI: Number of Inspections
Before and After for Plant X
140# of Inspections

120
100
80
60

Front Face is # of RI-ISI Inspections
Rear Face is # of Section XI Inspections

40
20
0
HPSI

RCS

LPSI

CVCS

CSS

System

MSS

MFW

EFW

SWS
32

30

Benefits of RI ISI: Cost and Man-Rem Savings$2,500,000

90

84.0

80

$2,034,900
70
60$851,900$1,500,000
50
40$1,000,000
30$613,000$1,183,000

20$196,000$500,000

8.1$417,000$0100BeforeAfterClass 1 Insp.Costs

BeforeClass 2/3 Insp.Costs

After
Man-REM

33
31

Man-REM

Inspection Costs$2,000,000

Challenges in Japan
 An increased understanding of the value and use ofrisk concepts and risk management language
 Development of a cadre of risk analysts, both in theindustry and the regulator
 Need to focus on effective means of risk
communication to the public Need to develop quantitative safety goals
 A long-term commitment from both the regulator
and industry would be required for implementation

33

34

NRRC Mission Statement

To assist nuclear operators and nuclear industry tocontinually improve the safety of nuclear facilities bydeveloping and employing modern methods ofProbabilistic Risk Assessment(PRA), risk-informed
decision making and risk communication.

2015

35

Risk-Informed Decision-Making

From: Strategic and Action Plans for the Implementation of Risk
Information Utilization at Nuclear Power Plants, February 8, 2018.

36

PRA Quality• A plant-specific PRA is the essential element for
RIDM and the ROP.
• Such a PRA is a complex combination of logic
models, experimental and statistical evidence, andjudgment.
• The uncertainties for some initiators may be verylarge (however, they are not quantified in the“deterministic” system).
• An exhaustive review was performed for theindustry-sponsored Zion/Indian Point PRAs by
Sandia National Laboratories on behalf of the NRC.
• This review was unique and very resource intensive.
• A practical solution was needed.
37

Assuring PRA Quality in the U.S.
• U.S. scientific societies (ASME and ANS) issued
standards.
• The NRC issued reports and regulatory guides
endorsing the standards (with exceptions, as
appropriate).
• NEI issued guidance on peer reviews.
• NRC and ACRS staff observed several peer reviews.
• NRC approved the NEI peer review process.
• Compliance with these documents has eased the
NRC’s burden regarding PRA reviews.
• The NRC receives a PRA summary but staff may
review as much of the industry’s PRA as they wish.
38

Japanese Industry’s Efforts on PRA Quality• Improving the infrastructure (NRRC) Guides on HRA, Fire PRA, Data Collection
 Models for external events, including the SSHAC process Multi-unit PRA• NRRC’s Technical Advisory Committee (TAC) highlevel review of Ikata 3 PRA
 Expanding the list of Initiating Events, e.g., adding loss of
instrument air system
 Improving plant-specific data collection• International expert reviews following the ASME/ANS
standards and the NEI process Ikata 3: Torri, Lin, Fleming (U.S.), Boneham (U.K.)
 KK 7: Chapman, Wachowiak (U.S.), Nusbaumer (Switzerland)• NRA staff are welcome to observe these meetings,
the resulting actions, and relevant documents
39

NRRC Training Courses

１．PRA and risk information utilization course

For beginners
Preparing for implementation in FY2018

２．Risk professional course (supported by EPRI)

Mainly L1 internal events PRA
For utility’s PRA practitioners and regulatory staff
Started in FY2018

３．Risk information utilization course

 For decision makers (NPP managers)
 Preparing for a trial offering in FY2018.

40

Final Remarks• RIDM is the rational way to proceed both for theindustry and regulators• PRAs should be plant-specific• We need to move from a regulatory-complianceculture to a risk-informed culture• The ROP and the industry’s strategic and actionplans are significant steps forward• PRA quality is improved by issuing standards,
regulatory guidance, and implementing peer reviews• RIDM is an inherently subjective process requiring
substantial training• The deliberative process for establishing safety
goals should start soon41