The Concept of Risk and Reactor Safety

Dr. George Apostolakis
Head, Nuclear Risk Research Center
apostola@mit.edu
NRRC Symposium, TokyoFebruary 8, 20181

Overview• The concepts of risk and residual risk
• Traditional (“deterministic”) approach to safety
Ø Defense in Depth• Probabilistic Risk Assessment (PRA)Ø Frequency of core damage
Ø Frequency of radioactive releases• Risk Management2

Risks in Society• Hazard: A source of danger
Ø Industrial facilities
Ø Activities, e.g., driving a car• Risk:The possibility that something bad orunpleasant (such as an injury or a loss)
will happen• Uncertainty is an integral part of risk
• Risk:Probability and adverse consequences

3

Safety vs. Residual Risk
• Safety is a continuum
Ø It is meaningless to call something safe or unsafe
without further explanation
Ø Claim: A plant is “safe” if it meets the regulations
Ø A very obscure statement• The proper way is to speak of the residual risk.
Ø Example: In Japan, 5 people die in transportation
accidents for every 100,000 residents every yearØ Therefore, the residual risk (frequency per year) is𝟓𝟓= 0.00005
𝟏𝟏𝟏𝟏𝟏𝟏,𝟎𝟎𝟎𝟎𝟎𝟎

a very small frequency• This residual risk is “accepted” or “tolerated” byJapanese society
4Why do we tolerate Residual Risks?
• Because each facility or activity provides benefits• For individual voluntary activities in which a person
feels in control the residual risk may be relatively
high (the risk in general aviation is about 1,000 times
greater than that in commercial aviation)• For industrial facilities, it is society through its
representatives, government and regulatory
agencies, that decides• Risk-Benefit tradeoffs are rarely quantitative; benefit
is much harder to quantify than risk5

Nuclear Power Plants• Undesirable potential consequencesØ Health effects
Ø Evacuation
Ø Land contamination• Commonly used potential consequencesØ Damage to the reactor core
Ø Release of various amounts of radioactivity• Accidents are very rare
Ø The uncertainties are large• Management of uncertainties has always been aconcern of the industry and regulators
6

Managing Uncertainty in Nuclear Safety (1)• Traditional “conservative” approachØ A bottom-up approachØ A limited number of potential accidents is consideredØ Uncertainty is not quantifiedØ Unquantified uncertainty is managed by conservatism via
defense in depth and safety margins• Defense-in-Depth is a safety philosophy that employs
successive compensatory measures to prevent accidents or
mitigate damage if a malfunction, accident, or naturally caused
event occurs at a nuclear facility.
• Safety Margin: The imposed stress on a component or
structure is maintained well below the onset of damage.

7

Defense in Depth• A philosophy for managing risk
• It ensures that safety will not be wholly dependent
on any single element of the design, construction,maintenance, or operation of a nuclear facility.
• The net effect of incorporating defense-in-depth into
design, construction, maintenance, and operation isthat the facility or system in question is moretolerant of failures and external challenges.

8Major Elements of Defense in Depth
Accident Prevention

Safety Systems

Containment
Accident Management

Emergency Plans

9

Pressurized Water Reactor

U.S. NRC website
10

Managing Uncertainty in Nuclear Safety (2)• Probabilistic Risk Assessment (PRA)Ø A top-down approachØ Thousands of potential accident sequences areinvestigatedØ Uncertainty is quantified and managed
Ø More realistic depiction of what can go wrong•

Probabilistic Risk Assessment (PRA) supports
Risk Management by answering the questions:ØØØ

What can go wrong? (thousands of accident sequencesor scenarios)
How likely are these scenarios?
What are their consequences?

11

PRA Model Overview
CDF
10-4/ry

LERF
10-5/ry

Level I

Level IICONTAINMENT
MODEL

PLANT
MODELResults

Results

Accident
sequencesleading tocoredamage

Containment
failureRelease ofradioactive
material

Recently proposed goal: The frequency of accidents leading tolong-term evacuation should be less than once in a million years.
12Contributions to Core Damage Frequency(CDF) for a Current U.S. Plant
Seq. 8 - Large LOCA
with Inadequate
Accumulator Injection
0%

Seq. 7 - Large LOCA
with Inadequate Safety
Injection
56%

Seq. 2 - Large LOCA
with Inadequate Hot Leg
Injection
2%
Seq. 3 - Large LOCA
with Inadequate SI Heat
Removal4%
Seq. 4 - Large LOCA
with Failure of ECCS
Recirculation2%

Seq. 6 - Large LOCA
with Inadequate
Containment Spray5%

Seq. 5 - Large LOCA
with Inadequate Cont.
Heat Removal withCFCs
31%

CDF = 1.46x10-5/yr (once every 68 thousand years)
D. True, Presentation at MIT, 201013

Can we benefit from both the Traditional
and the Probabilistic Approaches?
“A risk-informed approach to regulatory
decision-making represents a philosophy
whereby risk insights are considered
together with other factors to establish
requirements that better focus licensee andregulatory attention on design andoperational issues commensurate with theirimportance to public health and safety.”[Commission’s White Paper, U.S. NRC, 1999]

14

Comprehensive Risk Management

Strategic Plan of the Japanese Nuclear Industry
15

Concluding Remarks• The question of what is acceptable or tolerable risk
cannot be avoided.
• The residual risk metrics are a more rational way tocommunicate the degree of plant safety to thetechnical community and the public.
• Decision making regarding reactor safety issues
must be based on the totality of available
information, i.e., from both traditional andprobabilistic analyses.

16