Nuclear Safety
NEA/CSNI/R(2019)16
March 2021
www.oecd-nea.org

Status of Site-Level(Including Multi-Unit)
Probabilistic Safety
Assessment Developments

Nuclear Energy Agency

NEA/CSNI/R(2019)16
Unclassified

English text only
1 mars 2021

NUCLEAR ENERGY AGENCYCOMMITTEE ON THE SAFETY OF NUCLEAR INSTALLATIONS

Status of Site-Level (Including Multi-Unit) Probabilistic Safety Assessment
Developments

This document is available in PDF format only.

JT03471864
OFDE

This document, as well as any data and map included herein, are without prejudice to the status of or sovereignty over any territory,
to the delimitation of international frontiers and boundaries and to the name of any territory, city or area.

2 | NEA/CSNI/R(2019)16

ORGANISATION FOR ECONOMIC CO-OPERATION AND DEVELOPMENTThe OECD is a unique forum where the governments of 37 democracies work together to address the economic,
social and environmental challenges of globalisation. The OECD is also at the forefront of efforts to understandand to help governments respond to new developments and concerns, such as corporate governance, theinformation economy and the challenges of an ageing population. The Organisation provides a setting where
governments can compare policy experiences, seek answers to common problems, identify good practice and work
to co-ordinate domestic and international policies.
The OECD member countries are: Australia, Austria, Belgium, Canada, Chile, Colombia, the Czech Republic,
Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Israel, Italy, Japan, Korea,
Latvia, Lithuania, Luxembourg, Mexico, the Netherlands, New Zealand, Norway, Poland, Portugal, the Slovak
Republic, Slovenia, Spain, Sweden, Switzerland, Turkey, the United Kingdom and the United States. The
European Commission takes part in the work of the OECD.
OECD Publishing disseminates widely the results of the Organisation’s statistics gathering and research on
economic, social and environmental issues, as well as the conventions, guidelines and standards agreed by its
members.

NUCLEAR ENERGY AGENCYThe OECD Nuclear Energy Agency (NEA) was established on 1 February 1958. Current NEA
membership consists of 34 countries: Argentina, Australia, Austria, Belgium, Bulgaria, Canada, the Czech
Republic, Denmark, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Japan, Korea,
Luxembourg, Mexico, the Netherlands, Norway, Poland, Portugal, Romania, Russia, the Slovak Republic,
Slovenia, Spain, Sweden, Switzerland, Turkey, the United Kingdom and the United States. The European
Commission and the International Atomic Energy Agency also take part in the work of the Agency.
The mission of the NEA is:– to assist its member countries in maintaining and further developing, through international co-operation, thescientific, technological and legal bases required for a safe, environmentally sound and economical use of
nuclear energy for peaceful purposes;– to provide authoritative assessments and to forge common understandings on key issues as input togovernment decisions on nuclear energy policy and to broader OECD analyses in areas such as energy andthe sustainable development of low-carbon economies.
Specific areas of competence of the NEA include the safety and regulation of nuclear activities, radioactive
waste management and decommissioning, radiological protection, nuclear science, economic and technicalanalyses of the nuclear fuel cycle, nuclear law and liability, and public information. The NEA Data Bank provides
nuclear data and computer program services for participating countries.
This document, as well as any data and map included herein, are without prejudice to the status of or sovereignty over any territory, to thedelimitation of international frontiers and boundaries and to the name of any territory, city or area.
Corrigenda to OECD publications may be found online at: www.oecd.org/about/publishing/corrigenda.htm.
© OECD 2021

You can copy, download or print OECD content for your own use, and you can include excerpts from OECD publications, databases and multimedia products in yourown documents, presentations, blogs, websites and teaching materials, provided that suitable acknowledgement of the OECD as source and copyright owner is given.
All requests for public or commercial use and translation rights should be submitted to neapub@oecd-nea.org. Requests for permission to photocopy portions of thismaterial for public or commercial use shall be addressed directly to the Copyright Clearance Center (CCC) at info@copyright.com or the Centre français d'exploitation
du droit de copie (CFC) contact@cfcopies.com.

NEA/CSNI/R(2019)16 │3

The Committee on the Safety of Nuclear Installations
The Committee on the Safety of Nuclear Installations (CSNI) is responsible for the
Nuclear Energy Agency (NEA) programmes and activities that support maintaining andadvancing the scientific and technical knowledge base of the safety of nuclear
installations.
The Committee constitutes a forum for the exchange of technical information and forcollaboration between organisations, which can contribute, from their respective
backgrounds in research, development and engineering, to its activities. It has regard to
the exchange of information between member countries and safety R&D programmes ofvarious sizes in order to keep all member countries involved in and abreast ofdevelopments in technical safety matters.
The Committee reviews the state of knowledge on important topics of nuclear safety
science and techniques and of safety assessments, and ensures that operating experienceis appropriately accounted for in its activities. It initiates and conducts programmes
identified by these reviews and assessments in order to confirm safety, overcome
discrepancies, develop improvements and reach consensus on technical issues ofcommon interest. It promotes the co-ordination of work in different member countries
that serve to maintain and enhance competence in nuclear safety matters, including theestablishment of joint undertakings (e.g. joint research and data projects), and assists inthe feedback of the results to participating organisations. The Committee ensures thatvaluable end-products of the technical reviews and analyses are provided to members ina timely manner, and made publicly available when appropriate, to support broader
nuclear safety.
The Committee focuses primarily on the safety aspects of existing power reactors, othernuclear installations and new power reactors; it also considers the safety implications ofscientific and technical developments of future reactor technologies and designs.
Further, the scope for the Committee includes human and organisational research
activities and technical developments that affect nuclear safety.

4 | NEA/CSNI/R(2019)16

Foreword
The main objective of the Working Group on Risk Assessment (WGRISK) of theOrganisation for Economic Co-operation and Development (OECD) Nuclear Energy
Agency (NEA) Committee on the Safety of Nuclear Installations (CSNI) is to advancethe understanding of probabilistic safety assessments (PSA) and enhance PSA utilisation
for: improving the safety of nuclear installations; improving the design and operation of
nuclear installations; and increasing regulatory effectiveness through risk-informed
approaches. Due to its disciplined, integrated and systematic approach, PSA isconsidered as a necessary complement to traditional deterministic safety analysis.
The mission of WGRISK is accomplished through several activities to exchange
PSA-related information among member countries.
Interest in the evaluation of site-level risk, which integrates the various risk contributions
from different radiological sources, hazard groups and plant operating states (including
risk contributions from concurrent accidents involving multiple co-located radiologicalsources), has grown since the March 2011 Fukushima Daiichi nuclear power plant
accident. In June 2015, the CSNI approved a WGRISK activity to collect information
on whether and how member countries are addressing challenges and developments ofsite-level PSA, and on actual or intended uses and applications of site-level PSA.
The core task group for the WGRISK activity on the status of site-level PSA
developments was comprised of representatives from the following countries: Canada,
the Czech Republic, France, Germany, the United Kingdom and the United States. The
individuals listed in the table below represented their respective organisations andcountries as members of the core task group that was responsible for: project planning;
administration of project surveys, questionnaires and a workshop; and development of
this final report. The NEA wishes to thank these experts, who provided valuable timeand considerable knowledge towards this activity.
Name
Yolande Akl (Phase 1 Task
Leader)Michael Xu
Smain Yalaoui
Jaroslav Holy

Organisation
Canadian Nuclear Safety Commission(CNSC)Country
CanadaÚstav Jaderného Výzkumu (UJV) Rež

Gabriel Georgescu

Institut de Radioprotection et de Sûreté
Nucléaire (IRSN)
Gesellschaft für Anlagen- undReaktorsicherheit (GRS)
Office for Nuclear Regulation (ONR)

Czech
Republic
FranceMarina Röwekamp (Phase 2
Task Leader)
Joshua Gordon
Daniel Hudson
Nathan Siu

Nuclear Regulatory Commission (NRC)

Germany
UnitedKingdom
United States

The NEA administrator responsible for this WGRISK activity was Andrew White.

NEA/CSNI/R(2019)16 │5

Table of contents

Abbreviations and acronyms....................................................................................................... 6
Executive summary ...................................................................................................................... 7
Background ................................................................................................................................. 7
Objectives ................................................................................................................................... 7
Task approach ............................................................................................................................. 7
Conclusions and recommendations ............................................................................................ 8
1. Introduction ............................................................................................................................ 10
1.1. Background ........................................................................................................................ 10
1.2. Objectives .......................................................................................................................... 121.3. Targeted audience .............................................................................................................. 121.4. Report structure ................................................................................................................. 12
2. Task approach ........................................................................................................................ 15
2.1. Phase 1: Survey and questionnaires on site-level PSA developments ............................... 15
2.2. Phase 2: International Workshop on the Status of Site-Level PSA Developments ........... 16
3. Task findings ........................................................................................................................... 18
3.1. Site-based risk metrics and safety goals ............................................................................ 18
3.2. Risk aggregation ................................................................................................................ 20
3.3. Modelling of multi-source interactions or dependencies ................................................... 21
3.4. Key technical challenges ................................................................................................... 23
4. Conclusions and recommendations....................................................................................... 27
4.1. General conclusions ........................................................................................................... 27
4.2. Recommendations to the WGRISK ................................................................................... 28
4.3. Recommendations to the CSNI and the CNRA ................................................................. 29
5. References ............................................................................................................................... 30

6 | NEA/CSNI/R(2019)16

Abbreviations and acronyms
CAPS

CSNI Activity Proposal Sheet (NEA)

CCF

Common cause failure

CDF

Core damage frequency

CNRA

Committee on Nuclear Regulatory Activities (NEA)

CNSC

Canadian Nuclear Safety Commission

CSNI

Committee on the Safety of Nuclear Installations (NEA)EC

European Community

FIRE

Fire Incidents Records Exchange (NEA)

GRS

Gesellschaft für Anlagen- und Reaktorsicherheit (Germany)

HRA

Human reliability analysis

IAEA

International Atomic Energy Agency

LERF

Large early release frequency

LRF

Large release frequency

MUPSA

Multi-unit probabilistic safety assessment

NEA

Nuclear Energy Agency

NPP

Nuclear power plantOECD

Organisation for Economic Co-operation and Development

PRA

Probabilistic risk assessment

PSA

Probabilistic safety assessment

SFP

Spent fuel pool

WGOEWorking Group on Operating Experience (NEA)WGRISK

Working Group on Risk Assessment (NEA)NEA/CSNI/R(2019)16 │7

Executive summary
Background
The main objective of the Working Group on Risk Assessment (WGRISK) of theOrganisation for Economic Co-operation and Development (OECD) Nuclear Energy
Agency (NEA) Committee on the Safety of Nuclear Installations (CSNI) is to advancethe understanding of Probabilistic Safety Assessments (PSA) and to enhance PSA
utilisation for improving the safety of nuclear installations in the design and operation
as well as increasing regulatory effectiveness through risk-informed approaches. Due toits disciplined, integrated and systematic approach, PSA is considered as a necessary
complement to traditional deterministic safety analysis.
Two important lessons learnt from the March 2011 Fukushima Daiichi nuclear power
plant (NPP) accident were: 1) there can be significant interactions between multiple colocated radiological sources (e.g. reactor units, spent fuel pools or dry fuel storage
facilities) on a shared NPP site in response to concurrent or consequential initiators; and2) the timing of concurrent accident sequences involving multiple site radiologicalsources can challenge shared structures, systems and components, and resources
available for severe accident management and emergency response.
Since this accident, the international nuclear safety community has been exploring
whether the traditional single-unit PSA approach is sufficient for assessing theradiological risk associated with accident scenarios for multi-unit sites and if there is aneed for an integrated multi-unit PSA (MUPSA) or site-level PSA approach that includes
consideration of concurrent accidents involving co-located radiological sources(hereafter named “multi-source accidents”). The international nuclear community has
since made significant efforts to enhance the simulation and assessment of such multisource accident scenarios.

Objectives
In June 2015, the CSNI approved a WGRISK activity on the status of site-level PSA
developments, whose objective was to collect information on how member countries are
addressing challenges and developments of site-level PSA and actual or intended uses
and applications of site-level PSA. .

Task approach
The WGRISK activity on the status of site-level (including multi-unit) PSA
developments was completed in two phases. Phase 1 included a preliminary survey andfollow-up questionnaires to obtain information about ongoing and future site-level PSA
activities in WGRISK member countries. This preliminary survey was used to identify
and prioritise three focus areas related to challenges in site-level PSA that were ofcommon interest to member countries: 1) risk aggregation; 2) modelling of multi-source(including multi-unit) interactions or dependencies; and 3) site-based risk metrics andsafety goals. Follow-up questionnaires were then developed and administered to member

8 | NEA/CSNI/R(2019)16
countries to identify and obtain more detailed information about specific technicalchallenges within each focus area. Findings from these focus area questionnaires thenprovided the technical basis for the second phase.
Phase 2 consisted primarily of a three-day workshop. The purposes of the workshop
were to:•support the assessment of the current state of site-level PSA methods, models,data and analytical tools;•

support the evaluation of site-level PSA studies;•share methods, good practices and experiences among member countries on sitelevel PSA;•

identify new potential topics for further WGRISK activities related to site-level
PSA.

Conclusions and recommendations•

Following analysis of the key findings from both phases, the core task group forthis WGRISK activity arrived at the following general conclusions with respect
to Site-Level PSA developments. The need to assess and manage integrated site
risk (and multi-unit risk in particular) has been reinforced as a major topic by theinternational community. Some countries are developing or implementing
statutes (or the equivalent of a statute for that country) or regulations that requiresite-level PSA, multi-source PSA or MUPSA. Many countries and internationalorganisations have initiated research and development activities, and a numberof these activities are intended to be completed within the next few years.

•

Integrated site risk assessment and management requires the consideration ofchallenges in many areas. Areas of particular interest to WGRISK member
country participants include: risk aggregation – the aggregation of contributions
to risk from various risk contributors (e.g. radiological sources, hazards,
different configurations or modes of operation); modelling of multi-source
interactions and dependencies; and site-based risk metrics and safety goals.

•

There is general agreement on the key challenges. However, member countries
and international organisations currently have differing views regarding the bestway(s) to address these challenges. Thus, while much progress has been made in
developing site-level and multi-unit PSAs since the initiation of the WGRISK
activity, the state of practice continues to evolve and there is not yet consensus
on approaches for addressing these key challenges.

•

As with any complex problem with many potential solutions, various approaches
to developing site-level PSA models are possible and are being explored. In
particular, member countries are exploring the relative advantages anddisadvantages of two fundamental approaches: 1) development of a single,
integrated site-level PSA; and 2) logically combining important accident
scenarios from “improved” single-source PSA models.

•This WGRISK activity has provided a useful forum for member countries to:
exchange information on key activities; identify and prioritise topics of interest;and exchange views on best approaches for handling technical challenges. Basedon feedback provided by workshop participants, it is expected that participatingNEA/CSNI/R(2019)16 │9member countries that are currently performing site-level PSAs will benefit fromthis activity.
Recognising that several site-level PSA activities are underway within member countries
and international organisations, the WGRISK should consider a future task aimed atsharing the results and lessons learnt from these activities. In addition, the CSNI and theCommittee on Nuclear Regulatory Activities should: consider sponsoring further joint
working group or data project activities concerning lessons from operating experience;
more generally, continue to support efforts to increase interactions between the
WGRISK and relevant NEA working groups and projects; and encourage and facilitate
co-operation with the International Atomic Energy Agency on related projects to address
the challenges of site-level PSA and MUPSA and associated risk-informed decisionmaking.

10 | NEA/CSNI/R(2019)16

1. Introduction
1.1. Background
The main objective of the Working Group on Risk Assessment (WGRISK) of theOrganisation for Economic Co-operation and Development (OECD) Nuclear Energy
Agency (NEA) Committee on the Safety of Nuclear Installations (CSNI) is to advancethe probabilistic safety assessment (PSA) 1 understanding and to enhance its utilisation
for improving the safety of nuclear installations. Due to its disciplined, integrated andsystematic approach, PSA is meanwhile considered as a necessary complement totraditional deterministic safety analysis. To accomplish this mission, the WGRISK
carries out a number of activities to exchange PSA-related information between member
countries.
The accidents at Three Mile Island and Chernobyl seemed to support a focus on
accidents involving individual reactor units that prevailed in the deterministic andprobabilistic safety communities. Two important lessons learnt from the March 2011
Fukushima Daiichi nuclear power plant (NPP) accident were (National ResearchCouncil, 2014; Miller et al., 2011; INPO, 2011; IAEA, 2015):•

There can be significant interactions between multiple co-located radiologicalsources (e.g. reactor units, spent fuel pools [SFPs] or dry fuel storage facilities)
on a shared NPP site in response to concurrent or consequential initiators.

•

The timing of concurrent accident sequences involving multiple site radiologicalsources may challenge shared systems and resources available for severe
accident management and emergency response.

The international PSA community has long recognised the potential for concurrent
accidents involving multiple co-located radiological sources at shared nuclear
installations (hereafter “multi-source accidents”). However, since the accident at the
Fukushima Daiichi NPP, there has been increasing interest among the international
nuclear community (see CNSC, 2015) in exploring the extent to which:

1.
2.

•

The traditional single-unit PSA approach is sufficient for assessing the total
radiological risk to the public from NPP sites comprised of multiple co-locatedradiological sources; and identifying and characterising significant contributors
to total site risk in support of site risk management.

•

There is a need for an integrated multi-unit PSA (MUPSA) 2 or site-level PSA
approach that considers the potential for concurrent accidents involving multiple
co-located radiological sources.

In this report, probabilistic risk assessment and probabilistic safety assessment are usedsynonymously.
Strictly speaking, MUPSA can be viewed as applying only to PSA that addresses reactor
units. However, to be consistent with usage in previous workshops and publications, this

NEA/CSNI/R(2019)16 │11•

The international nuclear community has made significant efforts to enhance thesimulation and assessment of such multi-source accidents. A brief summary ofnotable and relevant efforts is given below.

In January 2014, Canadian nuclear utilities under the CANDU Owners Group Inc. hosted
the “International Workshop on Whole-Site Characterization” in Toronto, Canada. This
workshop focused on site-level safety goals and holistic approaches to risk assessment.
In May 2014, the Canadian Nuclear Safety Commission (CNSC) published REGDOC2.4.2 (CNSC, 2014), Probabilistic Safety Assessment (PSA) for Nuclear Power Plants,
which superseded Regulatory Standard S-294 (same title) to reflect PSA lessons learnt
from the Fukushima Daiichi accident, including an explicit requirement to consider the
potential for multi-source accidents.
In November 2014, the CNSC hosted the International Workshop on Multi-Unit
Probabilistic Safety Assessment in Ottawa, Canada. The objectives of this workshop
were to share experience and knowledge related to:•the development and application of MUPSA;•

the definition and selection of site-level risk metrics for multi-unit NPP sites;•

the development of site-level safety goals and their role in the licensing process;•the assessment of accident management and offsite consequences for multi-unit
NPP sites;•

the development of multi-unit severe accident progression research programmes;•

the challenges in MUPSA and issues requiring further investigation.

Findings from the workshop (CNSC, 2015) served as one of the primary inputs andmotivations for the WGRISK activity on the status of site-level PSA developments thatis documented in this report.
Since then, several international activities related to one or more aspects of MUPSA orsite-level PSA have been undertaken in parallel with this WGRISK activity. Examples
of such international activities in which WGRISK members participated or that thisWGRISK activity otherwise benefited from include:•an International Atomic Energy Agency (IAEA) project on development andapplication of a safety goal framework for nuclear installations;•an IAEA project to develop a methodology for aggregating risk contributions
from various radiological sources, hazard groups and operating states tocharacterise an overall risk profile;•an IAEA project to develop and evaluate a methodology and guidelines for
performing a Level 1 MUPSA, with limited treatment of Level 2 issues;•

an IAEA project to address considerations in performing integrated riskinformed decision making;report sometimes uses the term to refer to site-level PSA (i.e. PSA that addresses all
potentially important radiological sources on site).

12 | NEA/CSNI/R(2019)16
the Advanced Safety Assessment Methodologies: Extended PSA(ASAMPSA_E) project that led to development of a methodology for modelling
multi-unit aspects in case of occurrences of specific external hazards.

•

1.2. Objectives
In June 2015, the CSNI approved a WGRISK activity on the status of site-level PSA
developments. 3 The main objective was to collect information on how challenges anddevelopments of site-level PSA, as well as on the actual and intended uses andapplications of site-level PSA, are being addressed by member countries. The task also
developed recommendations for follow-on activities.
The task involved the collection of information on:•

how member countries address multi-unit and/or multi-source issues in PSA of
NPP sites that contain multiple radioactive sources;•

challenges and developments of site-level PSA;•

actual and intended uses and applications of site-level PSA.

The task was performed in two phases:•

Phase 1 (led by Canada): This phase used surveys and questionnaires to collectinformation from participating countries regarding their practices on site-level
PSA developments, and the specific areas of high interest pertaining to this topic.
The results from this phase served as the technical basis for the CSNI site-level
PSA workshop performed in Phase 2.

•

Phase 2 (led by Germany): This phase consisted of a CSNI/WGRISK workshop
on site-level PSA. The workshop expanded on the three focus areas identified
during Phase 1: 1) risk aggregation; 4 2) multi-unit (multi-source) interactions or
dependencies; and 3) risk metrics and safety goals.

1.3. Targeted audience
The targeted audience for this report includes a broad spectrum of individuals andentities across the international nuclear community that have an interest in theassessment of risks attributable to potential concurrent accidents involving one or moreco-located radiological sources at shared nuclear installations.

1.4. Report structureThis report is comprised of four chapters and supported by three annexes.

3.
4.

•

Chapter 2 summarises the approaches used in each of the two phases to achieve
the task objectives.

•

Chapter 3 summarises the key findings for each of the three focus areas that wereidentified in Phase 1: 1) risk aggregation; 2) modelling of multi-source

The approved CSNI Activity Proposal Sheet for this WGRISK activity is provided in
Annex A.
The term “risk aggregation” can be defined in many ways. In this report, the term represents
the aggregation of contributions to risk from various risk contributors (e.g. radiologicalsources, hazards, different configurations or modes of operation).

NEA/CSNI/R(2019)16 │13(including multi-unit) interactions or dependencies; and 3) site-based risk
metrics and safety goals. In addition, it summarises some of the key technicalchallenges that were highlighted across both phases.
•

Chapter 4 summarises general conclusions and provides recommendations forfurther activities that follow from these conclusions.

•Annex A 5 provides the Phase 1 survey and responses from participating
countries. Other than changing the formatting to be consistent with the rest of
the report and correcting obvious typographical errors, the detailed responses
that were submitted have been preserved in their entirety. These detailed survey
responses are intended to serve as a direct source of information for the benefitof readers.

•Annex B 6 provides the Phase 2 workshop materials: the workshop agenda; thelist of participants, including their name, country and organisation; andsubmitted papers and presentations.

5.

Annex A can be found in the document NEA/CSNI/R(2019)16/ADD.

6.

Annex B can be found in the document NEA/CSNI/R(2019)16/ADD.

NEA/CSNI/R(2019)16 │15

2. Task approach
The Working Group on Risk Assessment (WGRISK) activity on the status of site-levelprobabilistic safety assessment (PSA) developments was completed in two phases. This
chapter summarises the approaches used in each phase to collect information on how
member countries are addressing challenges and developments of site-level PSA; andthe actual or intended uses and applications of site-level PSA.

2.1. Phase 1: Survey and questionnaires on site-level PSA developments
The Canadian Nuclear Safety Commission served as the lead organisation for Phase 1.
This phase included an initial survey and follow-up questionnaires that wereadministered to obtain information about ongoing and future site-level PSA activities in
WGRISK member countries. The initial survey was then used to identify three focus
areas related to challenges in site-level PSA that were of common interest to member
countries:•

risk aggregation;•modelling of multi-source (including multi-unit) 7 interactions or dependencies;•

site-based risk metrics and safety goals.

Follow-up questionnaires were then developed for each of these focus areas and sent by
email to member countries to identify and obtain more detailed information about
specific technical challenges within each focus area. Findings from these focus area
questionnaires then provided the technical basis for Phase 2, which is outlined in
Section 2.2.

2.1.1. Focus Area 1: Risk aggregation
The objective of this questionnaire was to collect information from participating
countries regarding the challenges related to risk aggregation methods at the unit andsite level, considering the different degrees of uncertainty and PSA heterogeneity forvarious hazards. In addition, a questionnaire served for identifying risk aggregation
practices for comparison against the safety goals established for each participating
member country.

2.2.2. Focus Area 2: Modelling of multi-source interactions or dependencies
The objective of this questionnaire was to collect information from participating
countries regarding current practices and considerations, treatments and modelling ofmulti-source interactions for site-level PSA. A questionnaire was developed andadministered to collect information on: the identification and classification of multisource dependencies; the modelling site-level response for initiating events affecting thewhole site; the modelling site-level response to a single-unit (source) event (accident);
7.

Hereafter, it is assumed that the term “multi-source” encompasses the term “multi-unit”
and that site-level PSA includes MUPSA.

16 | NEA/CSNI/R(2019)16
consideration of different plant operating states in the site-level PSA; human reliability
analysis modelling for the site-level PSA; interactions in the Level 2 PSA, such as severe
accident modelling and simulation for a multi-unit plant; interactions between reactor
core and SFP or other significant radiological sources on site; common cause failures(CCFs) modelling across units for the whole-site PSA; and uncertainty analysis for thesite-level PSA.

2.2.3. Focus Area 3: Site-based risk metrics and safety goals
The objective of this questionnaire was to collect information from participating
countries regarding the definition and regulatory application of probabilistic safety
goals, and to investigate the extent to which the currently defined safety goals areapplicable to the site level.
Annex A 8 provides the Phase 1 survey materials and responses from participating
countries. Other than changing the formatting to be consistent with the rest of the reportand correcting obvious typographical errors, the detailed responses that respondents
submitted have been preserved in their entirety. These detailed survey responses areintended to serve as a direct source of information for the benefit of readers.

2.2. Phase 2: Workshop on the Status of Site-Level PSA Developments
GRS (Germany) served as the lead organisation for Phase 2 of the task. This phaseconsisted primarily of a three-day workshop that GRS hosted in Munich, Germany in
July 2018. A total of 40 individuals from 13 WGRISK member countries, the Nuclear
Energy Agency (NEA), and the International Atomic Energy Agency (IAEA)
participated in the workshop. The purposes of the workshop were to:•support the assessment of the current state of site-level PSA methods, models,data and analytical tools;•

support the evaluation of site-level PSA studies;•share methods, good practices and experiences among member countries on sitelevel PSA;•

identify new potential topics for further activities related to site-level PSA.

The workshop was designed to be an extension of Phase 1 that enabled more in-depth
exploration and discussion of the focus areas identified in Phase 1. Therefore, theworkshop was organised into three sessions that generally aligned with each of the threefocus areas (with an expansion of the risk aggregation session to include papers andpresentations that more broadly address site-level PSA developments):•

Session 1: Safety goals and risk metrics;•

Session 2: Site-level PSA developments and risk aggregation;•

Session 3: Multi-unit (and multi-source) interactions or dependencies.

The workshop design also benefited from previous WGRISK work relevant to site-level
PSA, including past activities on external hazards and round table discussions during

8.

Annex A can be found in the document NEA/CSNI/R(2019)16/ADD.

NEA/CSNI/R(2019)16 │17

WGRISK annual meetings supporting the latest (post-Fukushima) WGRISK report on
the use and development of PSA.
Immediately following the workshop, members of the task group met for a day toformulate key messages and a draft outline for the task report.
Annex B 9 provides the Phase 2 workshop materials: the workshop agenda; the list ofparticipants, including their name, country and organisation; and submitted papers andpresentations.

9.

Annex B can be found in the document NEA/CSNI/R(2019)16/ADD.

18 | NEA/CSNI/R(2019)16

3. Task findings
This chapter summarises the key findings for each of the three focus areas: 1) site-basedrisk metrics and safety goals; 2) risk aggregation; and 3) modelling of multi-source
interactions or dependencies. In addition, it also summarises some of the key technicalchallenges that were highlighted across both phases. The intent of this chapter is toprovide an integrated perspective on the findings from the overall activity, without
necessarily distinguishing between Phase 1 and Phase 2, unless there was a clear
evolution in thinking from Phase 1 to Phase 2 that is worth highlighting for the reader.

3.1. Site-based risk metrics and safety goals
The objective of the focus area on site-based risk metrics and safety goals was to: collectinformation from participating member countries regarding the definition and regulatory
application of probabilistic safety goals; and investigate the extent to which currently
defined safety goals are applicable to the site-level. Key findings for this focus area aresummarised below.

3.1.1. Qualitative safety goals
Not all countries have a formal statutory definition for qualitative safety goals. Many
countries reference the International Nuclear Safety Advisory Group (INSAG) general
nuclear safety objective as a qualitative safety goal, with some countries (e.g. Canada,
the Czech Republic, France and India) indicating that INSAG-12 (INSAG, 1999) forms
the basis for their safety goals. Per INSAG-12 (INSAG, 1999), the general nuclear safety
objective is:
To protect individuals, society and the environment by establishing and maintaining in
nuclear power plants an effective defence against radiological hazard.
In some countries, this general nuclear safety objective is also supplemented byqualitative safety goals for individual risk and societal risk.
Some countries have introduced the concept of “practical elimination” in their regulatory
framework. This concept is used such that accident conditions leading to large or early
releases are either physically impossible or extremely unlikely with high confidence.
Two countries (France and Germany) indicated that the application of the practicalelimination concept is based on the layers of defence-in-depth. In addition, Canada andthe Netherlands stated that practical elimination is only used for new construction plants,
while Finland and Hungary apply the concept to both existing and new plants. Finally,
Korea and the United States stated that practical elimination is not used within theirregulatory frameworks.

3.1.2. Quantitative safety goals or numerical objectives
Some countries (e.g. the Netherlands and the United States) have defined quantitative
objectives for so-called surrogate risk metrics related to Level 1 and Level 2 PSA end
states that are generally based on quantitative safety goals or numerical objectives/targets

NEA/CSNI/R(2019)16 │19

related to the risk of radiological health effects, including deterministic effects(e.g. prompt fatalities) and stochastic effects (e.g. latent cancer fatalities). In principle,
such surrogate risk metrics are used when a full-scope Level 3 PSA is not available.
Examples of surrogate risk metrics include:•

Level 1 PSA: core damage frequency (CDF), fuel damage frequency;•

Level 2 PSA: large early release frequency (LERF), large release frequency(LRF).

The numerical values associated with the safety goals are, in general, consistent with
INSAG-12 (INSAG, 1999), where the CDF limits range is 1 E-04 to 1 E-05/year; andthe L(E)RF range is 1 E-06 to 1 E-05/year. These numerical values of the safety goals
limits are generally used as indicators that are applied for design and operation
improvements, and as a target or goal that the level of safety aims to achieve, but not as
strict regulatory limits. However, Finland applies a strict regulatory limit of 5 E-07/year
for LRF to new reactor designs.
In addition, the scope of numerical objectives/targets varies by country. For example,
the United Kingdom applies qualitative and quantitative safety goals for normal plant
operation, design-basis fault sequences, individual risks, accident frequencies andsocietal risks. The quantitative goals are expressed as so-called basic safety levels orbasic safety objectives.

3.1.3. Site-based versus unit-based safety goals and risk metrics
Most countries only have qualitative safety goals and numerical objectives/targets forindividual reactor units and, for now, do not plan to change their safety goals to address
integrated site or multi-unit risk considerations. However, some countries are interested
in following developments from countries that are considering changes. For example,
public and governmental interest have spurred development of site-based or multi-unit
safety goals in Canada and Korea.
The typical Level 1 PSA risk metrics (e.g. CDF) are only applicable to some reactor
facilities. For example, CDF may not apply to other reactor facilities (e.g. hightemperature gas-cooled reactors and does not apply to non-reactor radiological sources(e.g. SFPs, dry fuel storage facilities or radioactive waste management facilities).
Therefore, CDF is not readily suitable for use in site-level risk characterisation. Somecountries (e.g. the Czech Republic, Finland and Germany) are applying alternative risk
metrics (e.g. fuel damage frequency) that consider all sources of radioactivity. In
addition, there is no international consensus on a quantitative definition of what
constitutes a large release for calculating the LRF risk metric for Level 2 PSA. Only a
few countries (Canada, Finland, Korea, Sweden, Switzerland and the United Kingdom)
have opted to specify the releases in absolute quantities to characterise a large release(e.g. Finland, Korea and Sweden reference any release greater than 100 TBq of Cs-137).

3.1.4. Regulatory application of safety goals
All participants recognised that the form and practice of site-level PSA depends on theintended use and will be affected by their country’s safety goals. Participants expressed
different member country points of view regarding the comparison of PSA results
against numerical objectives and/or targets. For some countries (e.g. the United
Kingdom), this practice is discouraged. However, for most countries, such comparisons(with appropriate limitations and caveats) are an integral part of their risk-informed
regulatory processes. In most countries, safety goals are not used as strict regulatory

20 | NEA/CSNI/R(2019)16
limits (see Section 3.1.2 for an exception). Instead, they are used as indicators for riskinformed design and operational improvements, or as targets or goals that countries aim
to achieve for the level of NPP safety.
A common trend is that if the damage or release frequencies exceed the safety goal limits
or targets (as applicable), appropriate measures are either encouraged or enforced
dependent on member country regulatory requirements to make adequate provisions for
reducing the risk.

3.2. Risk aggregation
The objective of the focus area on risk aggregation was to collect information fromparticipating member countries regarding: challenges related to risk aggregation
methods at the unit and site level, considering the different degrees of uncertainty and
PSA heterogeneity for various hazards; and risk aggregation practices for comparison
against the safety goals established for each member country.
Consistent with the framework established by the International Atomic Energy Agency(IAEA) risk aggregation project, risk aggregation at the site level encompasses
aggregating the contributions to integrated site risk from:•various radiological sources on the site (e.g. reactor units, SFPs, dry fuel storage
facilities);•

various hazard groups, including internal and external hazards (both natural andhuman-induced);•various operating states of the site, considering the joint operating states of theradiological sources on the site during a defined operating cycle.

Key findings for the focus area on risk aggregation are summarised below. Key technicalchallenges pertaining to risk aggregation are described in Section 3.4.

3.2.1. Risk aggregation and PSA limitations
While practices vary across countries, there is increasing interest in assessing andunderstanding the total aggregated risk from accidents involving all major radiologicalsources at a nuclear installation. Participants generally agreed that it is important toacknowledge that PSA is one, but not the only, technique for characterising risk and that
PSA does not address all potential risk contributors (e.g. deliberate malevolent acts likesabotage or terrorism). Site-level PSA is not necessarily a complete assessment ofintegrated site risk. This difference provides some of the motivation for a risk-informed
approach to decision-making. Participants generally agreed that, in addition tocombining quantitative risk contributions, risk aggregation should also consider
integrating qualitative risk insights to develop an overall picture of the risk profile for anuclear installation.

3.2.2. Alternative approaches to risk aggregation
In the context of site-level PSA, whether and how the risks attributed to various
radiological sources, hazards and operating states are aggregated will depend on thespecific decisions to be informed by the PSA. There are many potential ways toaggregate risk results. Aggregation methods vary from simple addition of the risk
contributions from individual radiological sources, hazard groups and plant operatingstates to development of an integrated PSA model that quantifies the total aggregatedNEA/CSNI/R(2019)16 │21

risk from all modelled risk contributors. The approach that is used can influence theresults and insights that are obtained, including the assessed relative importance of risk
contributors. For example, aggregation across an entire site can identify potentially
important scenarios overlooked by aggregation across a subset of units on the site.
Alternatively, more detailed aggregation schemes (e.g. those that consider timing as wellas other source-term characteristics) may be needed. Such schemes might be developed
working backward from a site-level PSA that includes offsite radiological consequence
analyses (i.e. an integrated site Level 3 PSA).

3.2.3. Accounting for different degrees of realism
There are technical concerns regarding different degrees of realism across the analysesof different risk contributors, particularly with respect to different hazard groups.
Alternative solutions to these concerns included presenting disaggregated or both
disaggregated and aggregated results; or estimating and adjusting for the degree of bias
or systematic error associated with different analyses.

3.2.4. Risk aggregation and operating experience
Participants agreed that leveraging operating experience is important. It is important toensure that the PSA community attempts to address potentially important issues
uncovered by real-world events. For example, multi-site events, sometimes regional inscope, were raised as an issue illustrated by operating experience. Participants noted thatthe international PSA community could try to be proactive in addressing this issue.

3.3. Modelling of multi-source interactions or dependencies
The objective of the focus area on multi-source interactions or dependencies was tocollect information from participating member countries regarding current practices andconsiderations for treatment and modelling of multi-source dependencies for site-level
PSA.
Such multi-source dependencies can include:•

structures, systems and components that are shared between co-locatedradiological sources (e.g. external power, pumping station, common buildings,
shared support systems);•

shared reserve resources between co-located radiological sources (e.g. water,fuel, etc.);•site mitigation provisions (e.g. an emergency diesel generator for the site thatcan only be used by one unit at a time);•

connections between co-located radiological sources (e.g. connections that allow
for the possibility of using systems from co-located radiological sources);•

potential for inter-unit common cause failure (CCF) events due to use of identicalcomponents or identical maintenance in co-located radiological sources on asite);•

correlations in fragilities for structures, systems and components in co-locatedradiological sources for external hazards (e.g. seismic, flooding, high wind,aircraft crash);•dependencies arising from physical location (e.g. proximity);22 | NEA/CSNI/R(2019)16•

dependencies arising from human and organisational factors.

In this context, it is important to note countries have already conducted or are in theprocess of developing multi-unit or whole-site PSAs (e.g. Canada, the Czech Republic,
France, Germany, Hungary, Korea, the United States Integrated Site Level 3 PSA).
Other countries (Finland, India, Japan, Sweden) are at various stages of developing a
multi-unit PSA methodology.
Key findings for the focus area on modelling of multi-source interactions or
dependencies are summarised below. Key technical challenges pertaining to themodelling of multi-source interactions or dependencies are described in Section 3.4.

3.1.1. Schemes for classifying inter-source dependencies
There is general agreement regarding the types of dependencies that could be importantin site-level PSA. Different organisational schemes are being used to describe andclassify inter-source dependencies, but these schemes differ in detail rather thanfundamental structure. All the schemes address dependencies observed in multi-unit
accidents and incidents, including dependencies due to limited resources (e.g. water,
power, staffing) and those associated with cascading effects (e.g. radiation release froma damaged unit inhibiting activities at a co-located, yet undamaged, unit). Moregenerally, it was recognised that operating experience is a valuable source of information
for identifying and analysing dependencies.
Participants were specifically asked about whether the existing IAEA scheme forclassifying intra-unit dependencies appears to be adequate for classifying inter-source
dependencies or whether a new scheme is needed. Most countries clearly indicated thatthe four types of dependencies identified in IAEA SSG-3 (IAEA, 2010) 10 is adequate,
especially at a high level. However, many of these countries also stated that a more refinedclassification scheme could enhance the identification of potential inter-source
dependencies by focusing the analyst’s thinking on more specific types of potential
inter-unit dependencies. In addition, a few countries indicated that the IAEA
classification scheme is insufficient and proposed several new classification schemes toclearly identify the initiating event dependencies, inter-unit phenomenologicaldependencies, and human or organisational dependencies. Finally, many countries
agreed that a list of generic inter-source dependencies and corresponding treatment
methods should be made in a systematic approach to facilitate the development of sitelevel PSA.

3.3.2. Consideration of different hazard groups, initiating events and operatingstatesThe potential impact and relative importance of inter-source dependencies can vary by
hazard group, initiating event and operating state for the site (although the distinction
between different operating states may matter more for some initiating events than forothers). Several countries indicated that the diversity of the sites will pose a challenge inthe development of a site-level PSA due to the large number of possible combinationsof radiological sources, hazard groups, initiating events and operating states. Most
participating member countries are applying a site-level focus on common cause
10. IAEA SSG-3 (IAEA, 2010) defines four types of dependency that have traditionally beenused to classify intra-unit dependencies in single-unit PSA: 1) functional dependencies; 2)
physical dependencies (spatial dependencies); 3) human interaction dependencies;and 4) component failure dependencies.

NEA/CSNI/R(2019)16 │23

initiating events that simultaneously challenge all sources or units on the site
(e.g. seismic events; site-wide flooding, loss of shared electrical grid or loss of a sharedultimate heat sink), while some countries are also considering consequential or cascading
initiating events (e.g. consequential internal fires, internal floods or loss of offsite
power).

3.3.3. Human and organisational factors
Although there was general agreement on the potential importance of organisational
factors as a source of dependency between units, there were different, strongly heldviews on the appropriate treatment of these factors. For example, regarding theobservation that different units could be sharing the same procedures, some participants
indicated that this sharing should be accommodated using some form of dependency
factor, while others argued that an appropriate human reliability analysis (HRA) should
account explicitly for the procedures being used, and that the associated human actions
are conditionally independent. Participants generally agreed that further work is needed
to define what is meant by organisational factors or dependencies in the context of PSA(including site-level PSA) and to determine which aspects should appropriately bemodelled within PSA.
More broadly, most countries indicated that the HRA methodology will need to be
updated at varying degrees to accommodate multi-unit impacts. In particular, there aresome common challenges with regard to considering extreme conditions, prioritisationand limitation of resources, and stress level in site-level HRA. Another identified
challenge was that procedures predominantly focus on single-unit actions.

3.3.4. Uncertainty analysis for site-level PSA
Although many countries have not yet considered uncertainty analysis for site-level
PSA, most countries do believe that the degree of uncertainty will be increased in a sitelevel PSA and it is important to address these uncertainties. It was highlighted that arandom sampling method to assess parametric uncertainty only represents a small partof the integrated PSA uncertainty (i.e. uncertainty associated with the model andcompleteness are also important).
The increased uncertainty may be because of human dependencies, inadequate treatment
of inter-unit dependencies (component failure dependencies, time-dependent effects andorganisational dependencies), or simplified (modelling) assumptions (e.g. a simple
aggregation approach to estimate the risk for the whole site, simplified assumptions onunit responses to initiating events).
Several participants indicated that a list of generic sources of uncertainties may help
analysts conduct whole-site PSA.

3.4. Key technical challenges
The November 2014 International Workshop on Multi-Unit Probabilistic Safety
Assessment resulted in the identification of several technical issues and challenges
associated with expanding the scope of PSA to include the contribution to risk frommulti-source accident scenarios. These technical issues and challenges were organised
into the following technical areas (CNSC, 2015):•

MUPSA infrastructure;•

selection of initiating events;

24 | NEA/CSNI/R(2019)16•

accident sequence modelling;•

accident sequence quantification and site-based risk metrics;•

accident progression and source-term characterisation;•

evaluation of radiological consequences;•site-based safety goals, risk integration and interpretation.

While the international PSA community has made progress in addressing many of thetechnical issues and challenges that were identified at this workshop, results and insightsfrom this WGRISK activity indicate that most of these technical issues and challenges
are still relevant today to some degree. Some of the key technical challenges that werehighlighted across both phases of this activity are summarised below.

3.4.1. Site-level PSA infrastructure
Although there are several ongoing site-level PSA projects, there is limited experienceand guidance for performing such studies. A notable example includes an ongoing IAEA
project to develop and evaluate a methodology and guidelines for performing a Level 1
MUPSA, with limited treatment of Level 2 issues.
There is still a need to revisit and reanalyse international operating experience for lessons
to be learnt from significant events and accidents for site-level insights. In addition, thisWGRISK activity indicates that the international PSA community is beginning toconsider another technical challenge on how to address multi-site risk arising frompotential large-scale events that can impact multiple NPP sites within a region. Theinternational PSA community could move forward this issue by examining international
operating experience.

3.4.2. Identification of inter-source dependencies
Section 3.3.1 addressed schemes for classifying inter-source dependencies. A thoroughsearch for and characterisation of site-specific inter-source dependencies is essential for
performing probabilistic modelling of accident sequences affecting more than one majorsite radiological source. Systematic approaches are needed to perform such a search forand characterisation of site-specific multi-source dependencies. These approaches may
go beyond the traditional approaches used for single-unit PSA, where only intra-unit
dependencies are usually identified. Moreover, the results of this task may be difficult touse as the number of potential inter-source dependencies increases with the number ofpossible combinations of radiological sources, hazard groups, initiating events andoperating states to consider. Grouping, screening and iterative approaches may therefore
be necessary to obtain representative, yet manageable, information for site-level PSA
developments.

3.4.3. Selection of initiating events
Systematic approaches are also needed to identify and characterise the initiating events
that can challenge multiple radiological sources on the site. Many of the initiating events
considered in single-unit PSAs may be applicable for site-level PSA, but the site context
may modify their characterisation (e.g. origin of occurrence, frequency, impact on
affected radiological sources, etc.). In addition, the grouping of initiating events for PSA
modelling may be different for site-level PSA. Moreover, a systematic approach may

NEA/CSNI/R(2019)16 │25

lead to the identification of new initiating events that were not yet considered(e.g. transients induced by an accident in a co-located unit).

3.4.4. Accident sequence modelling
The modelling of accident sequences for site-level PSA may be the most important
technical challenge. One issue is that there is a lack of deterministic safety analyses ofmulti-unit accidents to support MUPSA. However, the development of MUPSA may
help identify more precisely the need for such supporting analyses. Other issues relate
to specific modelling approaches for PSA for multiple units. Some specific issues thatshould be addressed include:•

Modelling of dynamic accident progression in each radiological source, since it
may be affected by the progression of a concurrent accident in a co-locatedsource.

•Modelling of inter-unit CCF and causal dependencies, including functional,
human, organisational and spatial dependencies. In this context, the treatment oflarger groups of components (large common cause component group size) seems
to be a challenge.

•

Modelling of additional mitigative measures (e.g. fixed and/or mobile equipment
to be used in case of emergencies), which may have been implemented in
response to the Fukushima Daiichi accident.

•

Modelling of adverse, cascading impacts of an accident involving an individual
unit on co-located units, thus creating additional multi-unit accident sequences.

•

Modelling of the timing, magnitude and effects of concurrent releases fromdifferent units.

Challenges related to data and quantification include:•

Quantification of CCF: There is a need to delineate CCF models and supporting
data analysis to address inter-unit and intra-unit CCF events.

•

Quantification of human error probabilities in site-level PSA context: There is aneed to improve HRA models and analyses to address performance-shaping
factors unique to multi-source accidents, including the need to consider how
operator actions may be adversely affected by multi-unit interactions orradiological contamination of the site.

Based on the intended uses and selected risk metrics, the resulting PSA models may needto consider new end states involving multi-source accidents and interactions, including
the effects of causally related, correlated and uncorrelated (but simultaneously
occurring) hazards. Limitations of static PSA modelling approaches may require a reevaluation using dynamic PSA approaches. In addition, site-level PSA may require theuse of mission times beyond the traditional 24 or 72 hours.
Fundamental single-source PSA technical issues also apply within the context of sitelevel PSA. Although most participants who are performing site-level PSA indicated thatthey do not intend to address these issues, participants agreed that it is important toacknowledge that some of these fundamental issues may be more important in thecontext of site-level PSA than in traditional single-source PSA. Some current issues insingle-unit PSA modelling that will likely be compounded in site-level PSA include:•

large numbers of accident scenarios;

26 | NEA/CSNI/R(2019)16•

impacts of using conservative assumptions to differing degrees for different PSA
scope elements (e.g. radiological sources, hazards including hazard
combinations or operating states) and at different PSA levels on the ability todevelop realistic PSA results;•

treatment of human actions during implementation of severe accident
management guidelines and prioritisation of emergency response measures inLevel 2 PSA.

3.4.5. Quantification of accident sequence frequencies and interpretation of
results
Due to the possible number of combinations of radiological sources and operating states,
particularly for sites with more than two reactor units, a site-level PSA model can belarge, complex and difficult to quantify. A common theme that emerged in this WGRISK
activity is that some simplifications or approximations are being made to manage thescope and complexity of the problem. Some of these simplifications are made to address
limitations in available analytical tools. There appear to be opportunities to improveupon the capabilities of available tools to overcome these limitations.
Section 3.2 summarised the key findings for the focus area on risk aggregation. Thissection highlights key technical challenges pertaining to risk aggregation. Ultimately,
whether the risks attributed to various radiological sources, hazards and operating statesshould be aggregated will depend on the specific decisions to be informed by a site-level
PSA. Key risk aggregation challenges include:•

how to account for differing levels of conservatism and uncertainty in the resultsfrom different PSA elements that are to be aggregated;•

whether it is appropriate to aggregate results for different radiological sources atthe level of fuel damage or whether it is only appropriate to do so at the level ofradiological release;•

how to aggregate importance measure results to identify significant risk
contributors.

NEA/CSNI/R(2019)16 | 27

4. Conclusions and recommendations
Building on its analysis of the key findings documented in Chapter 3, the core task groupfor this Working Group on Risk Assessment (WGRISK) activity developed general
conclusions with respect to site-level probabilistic safety assessment (PSA) developments.
This chapter summarises these general conclusions and provides recommendations forfurther WGRISK activities that could follow from them.

4.1. General conclusions•

The WGRISK task on site level PSA, performed in two phases (via a member
country survey and a workshop), has resulted in the following conclusions. The
need to assess and manage integrated site risk (and multi-unit risk in particular) has
been reinforced as a major topic of interest for the international community. Somecountries are developing or implementing statutes (or the equivalent of a statute),
regulations that require site-level PSA, multi-source PSA or multi-unit probabilistic
safety assessment. Many countries and international organisations have initiatedresearch and development activities, and a number of these activities should becompleted within the next few years.

•

Integrated site risk assessment and management requires the consideration ofchallenges in many areas. Topics of particular interest to WGRISK member country
participants include: risk aggregation – the aggregation of contributions to risk fromvarious risk contributors (e.g. radiological sources, hazards, different
configurations or modes of operation); modelling of multi-source interactions anddependencies; and site-based risk metrics and safety goals.

•

For the time being, site-level PSA is not advanced enough to perform evaluationsof the various approaches for modelling a whole site within PSA. However, the
WGRISK site-level PSA task has identified the current challenges to developing
approaches.

•

There is general agreement as to the nature of key challenges. However, member
countries and international organisations currently have differing views regarding
the best way(s) to address these challenges. Thus, while much progress has been
made in developing site-level and multi-unit PSAs since the initiation of thisactivity, the state of practice continues to evolve and there is no consensus foraddressing the key challenges.

•

As with any complex problem with many potential solutions, various approaches
to developing site-level PSA models are possible and are being explored. In
particular, member countries are exploring the relative advantages anddisadvantages of two fundamental approaches to developing a site-level PSA
model:

28 | NEA/CSNI/R(2019)16
o Development of a single, integrated site-level PSA. This approach can help
provide assurance that important multi-source accident scenarios are notmissed. However, due to the large number of potential combinations ofradiological sources, hazard groups and plant-operating states, it presents a
difficult problem that does not leverage results and insights from available
single-source PSA models and could therefore focus resources on issues that
may not be important to integrated site risk.
o Logically combining important accident scenarios from “improved” singlesource PSA models. The first step of this approach is to assess, for the risk
related to a single radiological source, the impact of the other sources of the siteby considering the negative effects (shared systems used by another source,
limited resources, increased human error probabilities) and possibly positiveeffects (mutual backup). This “improved” single-source PSA would thus beable to identify important multi-source effects from the perspective of
individual radiological sources. The second step of this approach is to then
combine important accident scenarios from the “improved” single-source PSAs
to construct a site-level PSA model that can be used to quantify integrated siterisk. This approach can help prioritise efforts by focusing attention on accident
scenarios that are significant contributors to accident risk involving individual
radiological sources, but presents some challenges with respect to ensuringpotential multi-source accident scenarios are not missed.
•

This WGRISK activity has provided a useful forum for member countries toexchange information on key activities; identify and prioritise topic areas ofinterest; and exchange views on best approaches for handling technical challenges.
Based on feedback provided by workshop participants, it is expected thatparticipating member countries that are currently performing site-level PSAs will
benefit from this activity.

4.2. Recommendations to the WGRISK
Recognising that several site-level PSA activities are underway within member countries
and international organisations, the WGRISK should consider a future task aimed atsharing the results and lessons learnt from these activities. Such a task should be coordinated with other international organisations that are active in this area (notably theInternational Atomic Energy Agency [IAEA]). In addition, co-ordination with other NEA
working groups and ongoing NEA joint projects would also likely provide usefulperspectives.
Examples of other NEA working groups to co-ordinate with include:•

the Working Group on Analysis and Management of Accidents;•

the Working Group on External Events;•

the Working Group on Human and Organisational Factors;•

the Working Group on Integrity and Ageing of Components and Structures;•

the Working Group on Operating Experience (WGOE);•

the Working Group on the Safety of Advanced Reactors.

Examples of ongoing NEA projects to co-ordinate with could include:NEA/CSNI/R(2019)16 | 29•

the benchmark Study of the Accident at the Fukushima Daiichi Nuclear Power
Station;•joint database projects:o the International Common-cause failure Data Exchange;o the Fire Incidents Records Exchange;o the Component Operational Experience, Degradation and Ageing Programme.

4.3. Recommendations to the CSNI and the CNRA
Many of the results and insights of this and related site-level PSA activities have been
derived from lessons learnt from the March 2011 Fukushima Daiichi nuclear power plant(NPP) accident as well as from other multi-unit operational incidents. This reinforces thevalue of operating experience information to PSA.
PSA also provides a useful perspective on operating experience, as indicated by accident
precursor analysis programmes in several member countries, as well as by the past WGOE
activity on precursors to the Fukushima Daiichi NPP accident (NEA, 2014).
The Committee on the Safety of Nuclear Installations (CSNI) and the Committee on
Nuclear Regulatory Activities (CNRA) should: consider sponsoring further joint working
group or database project activities concerning lessons from major operational incidents;
more generally, continue to support efforts to increase interactions between the WGRISK
and the WGOE, and other relevant NEA working groups and projects; and encourage andfacilitate co-operation with the IAEA on related projects to address the challenges of sitelevel PSA and associated risk-informed decision-making.

30 | NEA/CSNI/R(2019)16

5. References
CNSC (2015), Summary Report of the International Workshop on Multi-Unit Probabilistic Safety
Assessment, Canadian Nuclear Safety Commission, Ottawa, Ontario.
CNSC (2014), Probabilistic Safety Assessment (PSA) for Nuclear Power Plants, REGDOC-2.4.2,
Canadian Nuclear Safety Commission, Ottawa, Ontario, https://nuclearsafety.gc.ca/pubs_catalogue/u
ploads/REGDOC-2-4-2-Probabilistic-Safety-Assessment-NPP-eng.pdf.
IAEA (2015), The Fukushima Daiichi Accident: Report by the Director General, International Atomic
Energy Agency, Vienna, www-pub.iaea.org/MTCD/Publications/PDF/Pub1710-ReportByTheDGWeb.pdf.
IAEA (2010), Development and Application of Level 1 Probabilistic Safety Assessment for Nuclear Power
Plants, Specific Safety Guide, SSG-3, STI/PUB/1430, International Atomic Energy Agency, Vienna,
www-pub.iaea.org/MTCD/Publications/PDF/Pub1430_web.pdf.
IAEA (1999), Basic Safety Principles for Nuclear Power Plants 75-INSAG-3 Rev. 1, INSAG-12,
International Atomic Energy Agency, Vienna, www-pub.iaea.org/MTCD/Publications/PDF/
P082_scr.pdf.
INPO (2011), “Special report on the nuclear accident at the Fukushima Daiichi Nuclear Power Station”,
Institute of Nuclear Power Operations, Atlanta, GA, https://hps.org/documents/INPO_Fukushima_Sp
ecial_Report.pdf.
Miller, C. et al. (2011), Recommendations for Enhancing Reactor Safety in the 21st Century: The
Near-Term Task Force Review of Insights from the Fukushima Daiichi Accident, US Nuclear
Regulatory Commission, Washington, DC, www.nrc.gov/docs/ML1125/ML112510271.pdf.
National Research Council (2014), Lessons Learned from the Fukushima Nuclear Accident for Improving
Safety of US Nuclear Plants, The National Academies Press, Washington, DC, DOI: 10.17226/18294.
NEA (2014), “Report on Fukushima Daiichi NPP Precursor Events”, Working Group on Operating
Experience(WGOE),
OECD
Publishing,Paris,
www.oecd-nea.org/nsd/docs/2014/
cnra-r2014-1.pdf.