IEEJ：October 2016 © IEEJ2016

Risk-Informed Decision Making andNuclear Power

George Apostolakis
Head, Nuclear Risk Research Center
apostola@mit.edu
The Institute of Energy Economics, Japan
September 27, 201611

IEEJ：October 2016 © IEEJ2016

OutlineThis lecture will cover the following topics:
••
•
•
•
•

What is risk assessment?
Concept of residual risk
What is risk-informed decision making?
History of RIDM in the USA
Examples of RIDM and their impact
Related NRRC activities

2

IEEJ：October 2016 © IEEJ2016

The Concept of Risk
• The possibility that something bad or unpleasant(such as an injury or a loss) will happen (MerriamWebster dictionary)• For technological systems, risk assessment answers
the questions (Kaplan and Garrick, 1981)
 What can go wrong? (accident scenarios) How likely is it?
 What are the consequences?

• This risk triplet has been implemented in nuclear
power plant and space shuttle risk assessments
3

IEEJ：October 2016 © IEEJ2016

Residual Risk
• All activities and technological systems pose aresidual risk after all protective measures are taken• Examples of U.S. Annual Residual Risks
 Occupational: 40 deaths per 100,000 people (firefighters)
 Public Heart Disease: 271 deaths per 100,000 people All cancers: 200 deaths per 100,000 people Motor vehicles: 15 deaths per 100,000 people
From: Wilson & Crouch, Risk/Benefit Analysis, Harvard University Press, 2001.

• The Challenge: To manage residual risk and reduce
it to “acceptable” or “tolerable” levels
4

IEEJ：October 2016 © IEEJ2016“Acceptable” vs. “Tolerable” Risks
U.K. Health and Safety Executive
Increasing individual risks and societal concerns

UNACCEPTABLE REGIONTOLERABLE REGIONBROADLY ACCEPTABLE REGION

Risk cannot be justified
save in extraordinary
circumstances

Control measures must be
introduced for risk in thisregion to drive residual risk
towards the broadly
acceptable region

Level of residual risk
regarded as insignificant -further effort to reduce risk
not likely to be required

IEEJ：October 2016 © IEEJ2016

Pressurized Water Reactor

6

IEEJ：October 2016 © IEEJ2016

Risk Metrics for Nuclear Power Plants• Core damage frequency (CDF): The frequency perreactor year of accidents that cause severe fueldamage. CDF is the surrogate risk measure forindividual latent cancer fatality risk.
• Large early release frequency (LERF) : The
frequency per reactor year of a rapid, unmitigatedrelease of airborne fission products from thecontainment to the environment that occurs before
effective implementation of offsite emergency
response and protective actions, such that there is apotential for early health effects. LERF is thesurrogate risk measure for individual prompt fatalityrisk.
7

IEEJ：October 2016 © IEEJ2016

PRA Model Overview and Objectives
CDF
10-4/ry

Quantitative
HealthObjectives

LERF
10-5/ry

Level I

Level II

Level III

PLANT
MODEL

CONTAINMENT
MODEL

SITE/CONSEQUENCE
MODEL

Results

Results

Results

Accident
sequencesleading toplant damage
statesContainment
failure/release
sequences

Public healtheffects

Uncertainties

PLANT MODE
At-power Operation
Shutdown /Transition Evolutions

SCOPE
Internal Events
External Events

IEEJ：October 2016 © IEEJ2016

Contribution of Initiators to Core Damage
Frequency (CDF) for a U.S. Plant

CDF = 1.45E-5 / yr (mean value)

R. Turcotte presentation, MIT, 2008

IEEJ：October 2016 © IEEJ2016

The Traditional Approach to Regulation
Prior to Risk Assessment (1975)• Management of (unquantified at the time)
uncertainty was always a concern.
• Defense-in-depth and safety margins became
embedded in the regulations.
• “Defense-in-Depth is an element of the NRC’s safetyphilosophy that employs successive compensatory
measures to prevent accidents or mitigate damage if
a malfunction, accident, or naturally caused event
occurs at a nuclear facility.” [USNRC White Paper,February, 1999]

201510IEEJ：October 2016 © IEEJ2016

Major Elements of Defense in Depth

Accident Prevention

Safety Systems

Containment
Accident Management

Siting & Emergency Plans

201511IEEJ：October 2016 © IEEJ2016

Design Basis Accidents(Adequate Protection)• A DBA is a postulated accident that a facility isdesigned and built to withstand without exceeding
the offsite exposure guidelines of the NRC’s sitingregulation.
• They are stylized and very unlikely events.
• They protect against “unknown unknowns”.

2015

12

IEEJ：October 2016 © IEEJ2016

Problems with the Traditional Approach• There is no guidance as to how much defense indepth is sufficient• DBAs use qualitative approaches for ensuringsystem reliability (the single-failure criterion) whenmore modern quantitative approaches exist• DBAs use stylized considerations of humanperformance (e.g., operators are assumed to takeno action within, for example, 30 minutes of an
accident’s initiation)• DBAs do not reflect operating experience andmodern understanding• Industry-sponsored PRAs showed a variability inrisk of plants that were licensed under the same
regulations.
201513IEEJ：October 2016 © IEEJ2016

Point Estimates of CDF for U.S. Plants

From: NUREG-2201

14

IEEJ：October 2016 © IEEJ2016

Point Estimates of LERF for U.S. Plants

From: NUREG-2201

15

IEEJ：October 2016 © IEEJ2016

Reactor Safety Study Insights(WASH-1400; 1975)
Prior Beliefs:
1.
2.

Protect against large loss-of-coolant accident (LOCA)
Core damage frequency (CDF) is low (about once every
100 million years, 10-8 per reactor year)
Consequences of accidents would be disastrous

3.

Major Findings
1.
2.

Dominant contributors: Small LOCAs and Transients
CDF higher than earlier believed (best estimate: 5x10-5,once every 20,000 years; upper bound: 3x10-4 per reactor
year, once every 3,333 years)
Consequences significantly smaller
Support systems and operator actions very important

3.
4.

2015

16

IEEJ：October 2016 © IEEJ2016

Regulatory Decision Making• Regulatory decision making (like any decision) should
be based on the current state of knowledge and should
be documented (clear and reliable regulations) The current state of knowledge regarding design, operation,and regulation is key.
 PRAs do not “predict” the future; they evaluate and assess
future possibilities to inform the decision makers’ current
state of knowledge.
 Ignoring the results and insights from PRAs results indecisions not utilizing the complete state of knowledge.
2015

17

IEEJ：October 2016 © IEEJ2016

Evolution of the USNRC’s
Risk-Informed Regulatory System• 1980s:

New or revised regulatory requirements
based on PRA insights introduced• 1990s:

Risk-informed changes to a plant’s
licensing basis allowed• 2000s:
 Change to a risk-informed reactor oversight process Risk-informed alternative to comply with fire protection
requirements
 Regulation requiring PRAs for licensing new reactors

201518IEEJ：October 2016 © IEEJ2016

NRC Policy Statement on the USE of
PRA in Regulations (1995)• Deterministic approaches to regulation consider a limited setof challenges to safety and determine how those challenges
should be mitigated.
• A probabilistic approach to regulation enhances and extends
this traditional, deterministic approach, by:(1) Allowing consideration of a broader set of potential
challenges to safety,(2) Providing a logical means for prioritizing thesechallenges based on risk significance, and(3) Allowing consideration of a broader set of resources
to defend against these challenges.

2015

19

IEEJ：October 2016 © IEEJ2016

Risk-informed Regulation“A risk-informed approach to regulatory
decision-making represents a philosophy
whereby risk insights are considered
together with other factors to establish
requirements that better focus licensee andregulatory attention on design andoperational issues commensurate with theirimportance to public health and safety.”[Commission’s White Paper, USNRC, 1999]2015

20IEEJ：October 2016 © IEEJ2016

The Deliberation (NUREG-2150)
Options

TechnicalAnalysis

Decision
Criteria

one or more
techniques

Assumptions,
Uncertainties
andSensitivities

ResourceandSchedule
Constraints

Deliberation
Other
Factors

Stakeholder
Input

Decision &Implementation

Figure 3-2 Deliberations
2015

21

IEEJ：October 2016 © IEEJ2016

Risk-Informed Framework

Traditional“Deterministic”
Approach• Unquantified
probabilities•Design-basis accidents•Defense in depth•Can impose
unnecessary
regulatory burden•Incomplete
2015

RiskInformedApproach

Risk-BasedApproach•Combinationof traditionaland riskbased
approaches
through adeliberative
process• Quantified
probabilities•Thousands ofaccident
sequences•Realistic•Incomplete

22

IEEJ：October 2016 © IEEJ2016

A Success: Reactor Oversight Process• Motivation
 The previous inspection, assessment and enforcement
processesa.
b.
c.

Were not clearly focused on the most safety important
issuesConsisted of redundant actions and outputs
Were overly subjective with NRC action taken in a mannerthat was at times neither scrutable nor predictable.

 Commission’s motivation
a.

b.
c.

2016

Improve the objectivity of the oversight processes so that
subjective decisions and judgment were not central
process features
Improve the scrutability of these processes so that NRC
actions have a clear tie to licensee performance
Risk-inform the processes so that NRC and licensee
resources are focused on those aspects of performance
having the greatest impact on safe plant operation.
23

IEEJ：October 2016 © IEEJ2016

ROP: Challenges and Context• Challenges
••

•
•

2016

The large size of the program, in terms of both the number ofUSNRC staff (e.g., hundreds of affected staff) and the number oflicensed facilities affected (i.e., all licensed power reactors).
The development of performance indicators using plant data
(e.g., results of equipment tests translated into quantitative
estimates of system reliability) required the development ofmethods to collect the data, techniques for consistently andclearly displaying the results, and determining action“thresholds” (e.g., what action should be taken in response todecreasing performance).
The quality of the licensee PRAs varied considerably across theset of plants
This variability presented a significant challenge to USNRC as it
attempted to develop realistic and objective assessment toolsthat were not sensitive to this variability.

24

IEEJ：October 2016 © IEEJ2016

ROP: Regulatory Framework
Public Health and Safety
as a Result of Civilian
Nuclear Reactor Operation

NRC’s Overall
Safety Mission

Strategic
Performance
Areas

Cornerstones

Cross-cutting
IssuesData Sources

Reactor Safety

Initiating
EventsMitigating
Systems

Barrier
Integrity

Radiation Safety

Emergency
Preparedness

Human
PerformanceOccupational
Radiation
SafetySafety Conscious
Work Environment

PublicRadiation
Safety25

PhysicalProtection

Problem
Identification andResolution

Performance Indicators, NRC Inspections,
Other Information Sources

Safeguards

25

IEEJ：October 2016 © IEEJ2016

ROP: Implementation.
• Establishment of new training programs within USNRC to provide
information on PRA to inspectors and their management.
• Creation of a new category of inspector, the “senior reactor analyst,”
with expertise in both inspection processes and risk assessment.
• Development of a set of “standardized” plant analysis risk (SPAR)
models. This was judged to be necessary to compensate for thevariability of PRAs that had been developed and were being used byplant licensees.
• Inclusion of provisions (alternative approaches) for considering therisks from hazards not modeled realistically in the SPAR models, suchas fires. In some cases, the results of using these alternativeapproaches can become the focus of considerable discussion between
USNRC and licensees.

2016

26

IEEJ：October 2016 © IEEJ2016

ROP: Outcomes Very successful
 Improves the consistency and objectivity of the previous
process by using more objective measures of plant
performance Focuses NRC and licensee resources on those aspectsof performance that have the greatest impact on safe
plant operation
 Provides explicit guidance on the regulatory response toinspection findings
 Full implementation required considerable resources,
including data collection and evaluation, training, andagency risk expertise and models
 The benefits of the program, including the objectivity andpublic availability of plant evaluations, justified the costs
incurred.
201627

IEEJ：October 2016 © IEEJ2016

ROP: Take-Away• Implementation of a risk-informed reactor oversightprocess requires considerable development, testing,and communication among stakeholders early in theprocess, and an extensive infrastructure during use.
The objectivity and clarity of outcomes more thanjustifies the investment.
• Implementation of RIDM requires “Good” plantspecific PRAs.
• The NRRC is aiding Japanese utilities in developing“Good” PRAs.
2016

28

IEEJ：October 2016 © IEEJ2016

NRRC Mission and Vision
Mission Statement
To assist nuclear operators and nuclear industry tocontinually improve the safety of nuclear facilities bydeveloping and employing modern methods ofProbabilistic Risk Assessment (PRA), risk-informed
decision making and risk communication.
Vision Statement
To become an international center of excellence in PRA
methodology and risk management methods, thereby
gaining the trust of all the stakeholders.

29

IEEJ：October 2016 © IEEJ2016

NRRC Activities• Position paper for proper application of RIDM inJapan Establishment of RIDM Promotion Team Pilot projects for establishing “Good” PRAs: Ikata Unit 3,
Kashiwazaki-Kariwa Units 6 and 7• White paper on RIDM applications in the U.S.A.
 What was the motivation?
 How can Japan benefit from the U.S. experience?

• Research projects
 Human Reliability Analysis
 Seismic PRA
 SSHAC process for Ikata Unit 3 (Senior Seismic Hazard AnalysisCommittee)

 Fire PRA
 Volcano PRA
30

IEEJ：October 2016 © IEEJ2016

NRRC Organization<External Advisory Framework

Executive Advisor（Dr. Meserve）

TAC<Internal Organization Structure>

Dialogue with CEOHead（Dr. Apostolakis）
Advisor to theHead（Dr. Omoto）

Acting Head

Mr. John Stetkar
Mr. Amir Afzali
Dr. Nilesh Chokshi
Mr. Jean-Marc
Miraucourt
Prof. Akira Yamaguchi
Prof. Tsuyoshi Takada<Conferences>(including utilities and industry)

CNO Conference

TechnicalConference

Deputy Heads
Managing, external relations

Develop a strategic plan for
RIDM process to support
Utilities to implement theprocess.
Develop Good PRAs by
supporting the industry’s
pilot projects, etc.

ResearchFunction

Planning & Administrative teamSupport of R&D and its application(site application, standardization, etc)

NEW! Organized on July 1st 2016

RIDM Promotion Team

Risk Assessment Research Team

WG1: Risk Assessment

External Natural Event Research Team

WG2: External Natural Event

31

IEEJ：October 2016 © IEEJ2016

Summary• Decision making should be based on the current
state of knowledge
 PRA results are an essential part of this knowledge• PRAs provide metrics that facilitate communication
with the public• PRAs consider a broader set of potential challenges
to safety and prioritize these challenges based onrisk significance (we can’t do everything) Challenge: Would the NRA be willing to relax
requirements that are of low risk significance?

• RIDM allows more effective and efficient use ofresources, thus improving safety indirectly• NRRC is supporting the utilities to develop “Good”
PRAs
32

Contact :report@tky.ieej.or.jp