WASH-1400

The Reactor Safety Study

The Introduction of Risk Assessment to the 

Regulation of Nuclear Reactors

NUREG/KM-0010
Peach Bottom Nuclear Power Plant (shown on cover) was studied in WASH-1400.
WASH-1400

The Reactor Safety Study

The Introduction of Risk Assessment to the 

Regulation of Nuclear Reactors

Manuscript Completed: August 2016

Date Published: August 2016

Prepared by: Reynold Bartel

Office of Nuclear Reactor Regulation

NUREG/KM-0010

U.S. Nuclear Regulatory Commission v

Preface.......................................................................vii

Foreword .................................................................... ix

Acknowledgments ..................................................... xi

1. Introduction............................................................. 1

2. The Environment Leading to the Risk Assessment... 5

3. The Beginning of Quantification.......................... 11

4. Development of WASH-1400 Begins.................. 21

5. The Impact of WASH-1400.................................. 27

6. Three Mile Island.................................................. 35

7. After WASH-1400 and Three Mile Island............ 39

8. Conclusion ............................................................ 43

Contents
vi Protecting People and the Environment
U.S. Nuclear Regulatory Commission vii

This NUREG incorporates information from the 

November 9, 2015, presentation titled “WASH-1400 

and the Origins of Probabilistic Risk Assessment 

in the Nuclear Industry,” by Drs. Thomas Wellock 

and Robert Budnitz, at the U.S. Nuclear Regulatory 

Commission (NRC) Headquarters in Rockville, MD. 

Felix Gonzalez and Dr. Nathan Siu from the Office 

of Nuclear Regulatory Research and Christine Steger, 

a member of the knowledge management staff in the 

Office of the Chief Human Capital Officer, who had 

the vision to produce this program in support of the 

NRC’s Knowledge Management Program. A video 

of the lecture is available (Agencywide Documents 

Access and Management System (ADAMS) Accession 

No. ML15348A211). The intended audience for this 

NUREG is anyone who has an interest in either the 

technical topic or the history of the use of risk analysis 

tools at the NRC. The lecture on November 9 featured 

both historical knowledge from Dr. Wellock and primary 

source information from Dr. Budnitz, who participated 

in the review of WASH-1400 in the mid 1970s. For 

completeness, the preparer expanded on the material 

presented on November 9 to ensure sufficient context for 

readers who may not be familiar with the topic.

Preface
viii Protecting People and the Environment
U.S. Nuclear Regulatory Commission ix

Our responsibility at the U.S. Nuclear Regulatory 

Commission (NRC) is regulating nuclear power plants 

to ensure the safe and secure use of nuclear power and 

nuclear materials. Probabilistic risk assessment is one 

of our most powerful tools used in developing and 

implementing risk informed regulations. Ever since the 

publishing of WASH-1400, probabilistic risk assessment 

has grown to become a vital part of improving the NRC’s 

efforts in ensuring the safety of nuclear power plants.

WASH-1400 represented a watershed event for 

the development and use of risk assessment in the 

nuclear industry. The events documented in this 

booklet encapsulate the movements surrounding the 

development of WASH-1400, how WASH-1400 became 

a proof of concept for the application of risk assessment, 

and how risk assessment has influenced nuclear power 

plant safety regulation today.

William Dean

Director of the Office of Nuclear 

Reactor Regulation

Michael Weber

Director of the Office of Nuclear 

Regulatory Research

Foreword
x Protecting People and the Environment
U.S. Nuclear Regulatory Commission xi

I am grateful for the assistance on this NUREG from 

several NRC staff members, listed in no particular order: 

• Mr. Greg Casto—For allowing me the opportunity to 

work on this NUREG and also providing feedback on 

draft versions. 

• Mr. Dan Frumkin—For having the foresight for this 

project and providing guidance for design of this 

NUREG.

• Dr. Ray Gallucci—For providing knowledge on 

issues surrounding WASH-1400 and PRA. 

• Drs. Robert Budnitz, Nathan Siu, and Thomas 

Wellock—For their critical input and comments on 

this NUREG.

• Mr. Bill Dean—For providing his introduction and 

support for the development of this NUREG.

• Dr. Joshua Kaizer—For his knowledge of publishing 

processes within the NRC. 

• NRC Graphics Resources Staff, especially Mr. Eric 

Goss—For helping with the design and layout of this 

NUREG.

Reynold Bartel

2016 Summer College Intern, Florida State UniversityClass of 2017

Acknowledgments
xii Protecting People and the Environment

Dr. Thomas Wellock is the historian for the U.S. Nuclear 

Regulatory Commission (NRC). Trained as both an 

engineer and a historian, he writes scholarly histories 

of the regulation of commercial nuclear energy. Until 

2010, he was a Professor in the Department of History at 

Central Washington University in Ellensburg, WA. He is 

the author of two books, Critical Masses: Opposition to 

Nuclear Power in California, 1958–1978 and Preserving 

the Nation: The Conservation and Environmental 

Movements, 1870–2000. He has also written many 

articles on the history of nuclear power. His engineering 

experience includes work for General Dynamics 

Corporation as a reactor test engineer in the construction 

of Los Angeles and Trident class submarines.

Dr. Robert J. Budnitz has worked in the areas of 

nuclear reactor safety and radioactive waste for many 

years. He is on the scientific staff at the University of 

California Lawrence Berkeley National Laboratory, 

where he focuses on nuclear power safety security and 

radioactive waste management. From 2002 to 2007, 

at the University of California Lawrence Livermore 

National Laboratory, he served a 2-year special 

assignment in Washington to assist the Director of the 

Office of Civilian Radioactive Waste Management 

to develop a new Science & Technology Program. 

Before joining Lawrence Livermore in 2002, he ran a 

one-person consulting practice in California for over two 

decades. From 1978 to 1980, he was a senior official 

on the staff of the NRC, serving as Deputy Director 

and then Director of the Office of Nuclear Regulatory 

Research. In these roles, Dr. Budnitz was responsible 

for formulating and guiding the large NRC research 

program. From 1967 to 1978, he was at Lawrence 

Berkeley, including a stint as the laboratory’s Associate 

Director and Head of the Energy & Environmental 

Division.
U.S. Nuclear Regulatory Commission 1

Description of Probabilistic Risk Assessment

Probabilistic risk assessment (PRA) examines both the 

probability of an accident and its possible consequences. 

Today, PRA plays a major role in the U.S. Nuclear 

Regulatory Commission’s (NRC’s) regulatory process 

and in many initiatives that improve the agency’s 

effectiveness. The NRC combines both quantitative 

probabilities and qualitative engineering judgment 

in regulating activities. Quantitative and qualitative 

approaches are both part of what is called “riskinformed, performance-based regulation.”1

The NRC uses PRA tools to develop the quantified 

or numerical side of the risk-informed, performancebased regulation. WASH-1400, “Reactor Safety Study,” 

issued October 1975, was the first full-scope use of PRA 

techniques and contributed greatly to the development 

of the quantitative side of risk-informed, performancebased regulations. 

Risk quantification uses the risk triplet2 as a set of three 

questions that can be used to define “risk”: 

1.What can go wrong?

2.How likely is it? 

3.What are the consequences? 

By examining the proposed scenarios, analysts can 

identify safety vulnerabilities and determine where best 

to apply resources to address those vulnerabilities. 

1 See the staff requirements memorandum for SECY-98-

144, “White Paper on Risk-Informed and Performance-Based 

Regulation,” dated March 1, 1999, for a more detailed discussion 

of the current use of risk information at the NRC (Agencywide 

Documents Access and Management System (ADAMS) Accession 

No. ML003753601).

2 John Garrick and Stanley Kaplan first introduced the risk 

triplet concept in a 1981 article, “On the Quantitative Definition of 

Risk.”

1. Introduction
2 Protecting People and the Environment

Overview of Probabilistic Risk 

Assessment History

Government, industry, and academic visionaries have 

long thought it would be useful to have a quantitative, 

probabilistic representation of the risk associated with 

nuclear reactor safety. This approach would provide 

statistical frequencies estimating the probability of an 

accident occurring. The first U.S. regulator of the nuclear 

power industry, the Atomic Energy Commission (AEC), 

greeted early attempts at creating these representations 

with much skepticism. Nevertheless, the AEC launched 

WASH-1400 in 1972 under the leadership of Norm 

Rasmussen at the Massachusetts Institute of Technology 

(who had previously contracted with the AEC) and AEC 

member Saul Levine. A team of over 50 contractors 

and AEC staff worked over 3 years to produce a draft 

of WASH-1400 in 1974.3 After Congress transferred 

authority to regulate nuclear power plants from the 

AEC to the newly established NRC in 1974, 4 the NRC 

published the final report in October 1975. WASH-1400 

demonstrated that PRA could offer new, important, and 

actionable insights that benefit reactor safety.

The “P” in Probabilistic Risk Assessment

Putting the “P” in PRA—working out the probabilities 

of individual accident sequences and, from those, the 

overall probability of a major accident—was a goal 

that had long eluded nuclear experts and provided the 

motivation for developing WASH-1400. In the late 

1940s, the AEC and employees working on weapons 

production reactors were confident that they could make 

a realistic ballpark estimate of accident consequences. 

However, they recognized that methods to quantify 

accident sequence probabilities produced results that 

“...weren’t even... in the same solar system,” in Dr. 

3 “WASH” is short for Washington. The AEC used WASH as a 

prefix for its documents.

4 See the Energy Reorganization Act of 1974.

Norm Rasmussen 

(top) and Saul 

Levine (bottom) 

were instrumental in 

the development of 

WASH-1400
U.S. Nuclear Regulatory Commission 3

Wellock’s words. This challenge of creating realistic 

probability estimates with reasonable margins of error 

led to models focused on probabilities and in turn 

WASH-1400.
4 Protecting People and the Environment

Events associated with PRA Since 1947Published	

WASH-740	 1965	Update	

1957	

Hanford 

Reactor Safety 

Questioned 

WASH-740 

Published 

WAS

H-740 

Publis

hed 

1965	

Update of 

WASH-740 Published	 1965	Update	 WASH-740	

1975	

WASH-1400 

Published Published	 1965	Update	 WASH-740	

1990	

NUREG-1150 

Published 

Published	 1965	Update	 WASH-740	

1947	

Reactor 

Safeguard 

Committee 

Formed 

Published	 1965	Update	 WASH-740	

1953	

Evaluation of 

Probability of Disaster Memo Published	

Fault Tree 1965	Update	 WASH-740	

Development 

for the Nuclear 

Industry 

Published	 1965	Update	 WASH-740	

1970	

Congress and Public Build 

Anti-Nuclear 

Attitudes 

Published	 1965	Update	 WASH-740	

1979	

TMI Accident 

1995	

NRC PRA Policy Statement 

Endorsing Use of PRA 

Regulatory 

Guide 1.174 

Published 

1998	
U.S. Nuclear Regulatory Commission 5

Licensees and the AEC Preferred 

Deterministic Design

Early designers of nuclear reactors could not assure 

reactor safety through a quantitative, probabilistic 

approach, and the AEC instead relied on “deterministic” 

design safety where probabilities were estimated 

qualitatively through engineering judgment. 

Deterministic design relied on design-basis accidents—

originally called maximum credible accidents—to 

ensure plant safety. A reactor designer postulated a 

number of “credible” plant events that could lead to 

reactor fuel damage and a major release of radiation. 

As Dr. Budnitz explained, “A design-basis accident is 

not an accident at all...[it is] an initiator for an event.”5

For instance, a loss of offsite power is a design-basis 

accident, because it is considered a credible initiator 

of an event that could lead to a series of events with 

significant consequences. By contrast, a meteor striking 

the plant was possible but not considered a credible 

initiator. The AEC required plant designers to consider 

loss of power and many other credible accidents to 

“determine” what safety features their design needed. 

In lieu of any risk assessment, deterministic designs 

aimed at making the probability of a catastrophic event 

“incredible.” 

5 An initiator (e.g., a spark) causes an event (e.g., a fire) that 

leads to an accident (e.g., release of radiation).

2. The Environment Leading to 

the Risk Assessment

The AEC logo
6 Protecting People and the Environment

The following are examples of the design-basis accidents listed 

in Chapter 15 of NUREG-0800, “Standard Review Plan for the 

Review of Safety Analysis Reports for Nuclear Power Plants: 

LWR Edition”:

• major rupture of reactor coolant boundary

• control rod ejection from the reactor

• major rupture of secondary system boundary

• stoppage of major pump within the reactor coolant system

Reactor Safeguards Committee

The deterministic approach dominated the thinking 

of the earliest reactor safety reviews done after World 

War II. At this time, the Argonne National Laboratory, 

a government nuclear research laboratory, wanted to 

create a nuclear test facility and debated whether to 

locate it in Chicago or in the desolate fields of Idaho. 

Brookhaven National Laboratory, another government 

research laboratory located on Long Island, also planned 

to build a reactor in the late 1940s, which raised many 

questions about reactor safety. In 1947, the AEC 

established the Reactor Safeguards Committee (RSGC) 

to review the design safety of these proposed reactors.

RSGC was the AEC’s advisory group of independent 

technical experts that evaluated technical health 

and safety aspects of reactor hazards. In 1953, the 

Committee was renamed the Advisory Committee on 

Reactor Safeguards (ACRS). Congress later established 

ACRS as a statutory Federal advisory committee (see 

“ACRS History” on the NRC Web site). 
U.S. Nuclear Regulatory Commission 7

The Hanford Problem

Shortly after RSGC was formed, its members began to 

worry about the Hanford nuclear weapons production 

reactors. At the time, the AEC regulated these reactors. 

The Hanford reactors had developed safety problems 

not anticipated in the plant’s emergency shutdown 

capabilities. RSGC considered the Hanford reactors the 

least safe of all AEC reactors. During this time, physicist 

Edward Teller led RSGC with a conservative approach 

to reactor safety. Teller and his committee proposed a 

plant isolation formula that stated:

Exclusion Area (miles)=.01√Plant Power(kW)

(As an application of this rule, the 250 megawatt 

(2.5x105 kilowatt) Hanford B reactor required an 

8-kilometer (5-mile) exclusion area.)

Hanford Reactor B 

located on the Hanford 

Reservation
8 Protecting People and the Environment

The formula, as one AEC veteran recalled, was “very 

conservative and, for reactors now operating, very 

unrealistic.” RSGC argued that ignorance made such 

conservatism necessary: “In our present state of 

knowledge, we cannot possibly recommend settlement 

of population closer to a pile [reactor] than this distance.”

This equation quickly became unworkable, even for the 

heavily isolated Hanford Reservation. RSGC realized 

that it would need to find a better solution than simple 

isolation and began to pressure Hanford’s contractor, 

General Electric (GE),6 to find this solution. 

6 The Federal Government controlled the Hanford site, but 

contractors operated the site. Although the DuPont Company had 

constructed the site, at the time this concern was raised, GE had 

assumed site management.

Hanford reactors with 

exclusion area (solid 

circular lines) radially 

applied to reactors 

(shaded gray boxes) 

exceeding Hanford 

borders (stair-stepped 

solid lines)
U.S. Nuclear Regulatory Commission 9

The Search for Reassurance

Once the Hanford reactors were found to exceed the 

RSGC exclusion area formula, RSGC looked to other 

engineering solutions for reassurance of plant safety. 

RSGC asked GE to create “foolproof” safety devices, 

but GE never found such devices. Both parties were 

in a stalemate regarding the operation of the Hanford 

reactors. The Hanford reactors were essential because of 

their production of plutonium during the Cold War, but 

RSGC still needed some assurance of safety. 
10 Protecting People and the Environment
U.S. Nuclear Regulatory Commission 11

The First Attempt at a Probabilistic 

Approach

In 1953, GE Hanford’s statistics director submitted a 

memorandum titled “The Evaluation of Probability 

of Disaster.” The director proposed a probabilistic 

plan for safety assurance. The memorandum talked 

about a “chain of events” that was the culmination of 

small malfunctions and mistakes that would lead to a 

disaster. The memorandum reasoned that all the events 

in the chain leading to a disaster could be examined 

individually. After these results were evaluated, they 

would be combined to obtain the probability of an event. 

Result of the GE-Led Research

Eight months after submitting the memorandum, GE 

realized that it could not obtain realistic representations 

of accident probabilities. GE had difficulty imagining 

all the possible paths to failure, and the formatting of 

the failure data used did not interface well with the 

statistical approach used for generating the probabilities. 

The collaboration between technical staff at GE also 

presented a problem—the statisticians did not know the 

reactors, and the engineers did not know the statistics. 

The time line on the next page summarizes the key 

events related to PRA.

3.	The Beginning of Quantification

The “Evaluation 

of Probability 

of Disaster” 

memorandum heading
12 Protecting People and the Environment

GE Finds Inspiration

Even though GE initially failed at generating 

probabilities related to reactor accidents, it continued 

to develop a better understanding of the probabilities 

for components and systems to fail. GE hoped that it 

could eventually put all the pieces together and create a 

comprehensive probabilistic model. 

Despite these efforts, in 1964, GE staff admitted that 

its considerable efforts to create a failure model were 

unsuccessful. Nevertheless, the company remained 

a primary pursuer of reliability performance and 

probability statistics. In the late 1960s, GE began 

to advocate in political arenas for greater vigor in 

pursuing probabilistic methods for civilian reactor safety 

regulation. GE and other nuclear industry firms became 

interested in fault trees, which had been recently used 

in the Minuteman missile development program. Fault 

trees “are clearly something that develops out of the 

aerospace, airlines industry,” as Dr. Wellock stated in 

his presentation. The use of fault trees in other industries 

generated much interest in developing the approach and 

applying it to specific problems in the nuclear industry.
U.S. Nuclear Regulatory Commission 13

Fault Trees

In the 1960s, the nuclear industry began applying 

fault trees to solve engineering problems arising from 

earthquakes. The AEC began funding studies to improve 

data collection and fault tree methodology. Fault trees 

used Boolean logic which encompassed the probability, 

priority, and criteria of each individual event to find 

the probability of some final event. General fault tree 

knowledge and Boolean logic concepts are shown below.

Basic fault tree 

concepts

Boolean logic is a form of algebra that focuses on true/false 

events to show the occurrence of an end event.

Example: If a final event requires event “A” to be true (T) with 

no more than one event (“B” or “C”) from the “Or” gate being 

false (F), a logic table would look like the following:

Event A Event B Event C Final Event

F T or F T or F F

T F F F

T F T T

T T F T

T T T F
14 Protecting People and the Environment

A fault tree from John Garrick’s PhD dissertation.
U.S. Nuclear Regulatory Commission 15

While the fault tree approach was becoming popular, 

John Garrick completed his Ph.D. dissertation at the 

University of California Los Angeles based on his work 

for the AEC contractor, Holmes & Narver. He developed 

a fairly sophisticated fault tree approach specifically for 

a nuclear reactor. Dr. Garrick’s fault tree is an example 

of the state of the art beginning to move forward with 

the development of methodologies that GE did not 

have in the 1950s. An example of Garrick’s fault trees 

(on page 18) shows what Dr. Wellock called “a fairly 

sophisticated fault tree approach for that time.”

Fault Tree Usage in Other Industries

Other early industry applications of fault trees resulted in 

frustration similar to that experienced by the nuclear industry. The 

National Aeronautics and Space Administration (NASA) adopted 

fault tree technology in the 1960s. NASA’s effort suffered the 

same fate as that of the nuclear industry—its fault trees had 

numbers with major uncertainties, which left looming questions 

on fault tree applicability. NASA eventually began to back away 

from fault tree use around the time the nuclear industry started to 

incorporate the methodology. This timing gave antinuclear critics 

what they considered to be a compelling argument against the 

validity of the statistics in nuclear safety reports.

The AEC’s Skepticism on Risk

Even as the AEC supported research to improve 

quantitative approaches to reliability and risk 

assessments, its regulatory staff was reluctant to accept 

the idea that probability analysis had matured enough 

to evaluate quantitative risk for reactors. For example, 

Stephen H. Hanauer, an AEC technical advisor, wrote a 

letter that indicated his doubts about the techniques used 

to find probabilities:

We at the AEC have not yet arrived at the point where 

probability analysis techniques give adequate assurance 

that failure modes are indeed considered adequate. 

That probabilistic models for severe accidents that 

correspond to actual failures will occur as predicted, 

Stephen H. Hanauer

John Garrick
16 Protecting People and the Environment

and that we are also skeptical that adequate failure rate 

data are available for prediction.

Hanauer’s letter expressed a common sentiment shared 

by regulators about probabilistic work during its infancy 

and was particularly striking because, as Dr. Wellock 

observed, “He was one of the leading intellectual lights 

on the regulatory side in the 1960s and early 1970s.”

WASH-740—An Early Risk Effort

The regulatory staff’s skepticism about risk assessment 

came from hard experience. Its early studies, such 

as WASH-740, “Theoretical Possibilities and 

Consequences of Major Accidents in Large Nuclear 

Power Plants,” issued March 1957, had produced 

more frustration than useful information. Also known 

as “The Brookhaven Report,” WASH-740 was the 

first substantial report on the consequences of a major 

accident at civilian reactors. It produced alarmingly high 

consequences for a worst-case accident scenario, but it 

was unable to put the accident in context with realistic 

probability estimates since there was no methodology 

to do so. In the report, the AEC confessed that the best 

it could provide were engineering estimates of accident 

probabilities based on expert judgment. Dr. Wellock 

noted that the authors of WASH-740 admitted “that they 

had talked to some experts who absolutely refused to 

give a number because it would give credence to the 

whole idea that you could come up with a number.” 

Such probabilities, these experts believed, were 

“unknowable.” WASH-740 provided fodder for nuclear 

critics, but no reassurance. Overturning its results 

became a longstanding goal of nuclear power advocates.
U.S. Nuclear Regulatory Commission 17

The 1965 Update of WASH-740

In 1964, the U.S. Congress called on Frank Pittman 

(the head of reactor research for the AEC) regarding 

the WASH-740 report. The Joint Committee on Atomic 

Energy (JCAE) asked Pittman if it was time to revise 

WASH-740. Pittman explained that there was still 

not enough research to produce a different result. 

Any update to the report would have to use the same 

methods and data, but with larger reactors, the results 

might show even larger consequences than the original 

report. JCAE was not satisfied. Two months after the 

congressional hearing, a JCAE member reasoned that 

new containment buildings and safety systems added 

to new reactors would produce a favorable answer in 

an update. However, the AEC update quickly proved 

Pittman right. Consequences were much worse. Stuck 

with a report containing bad news, the AEC considered 

using probabilities to put the consequence estimates in 

context. 

Another Attempt at a Probabilistic 

Approach

In an attempt to fix the 1965 update, the AEC contracted 

with Research Planning Corporation in California 

to create realistic probability estimates for a severe 

reactor accident. The results were disappointing. While 

Research Planning’s calculations were good, they 

were underestimates. Research Planning estimated the 

probability of a catastrophic accident to be between 

10-8 to 10-16 occurrences per year. If the 10-6 estimate 

were true, that would mean a reactor might operate 

700,000 times longer than the currently assumed age 

of the universe before experiencing a major accident. 

The numbers were impossibly optimistic, and the error 

band was distressingly large. As Dr. Wellock recalled, 

“the AEC wisely looked at this and recognized that 

probabilities were not going to solve [the problems 

with] this report.” At this time, the AEC understood that 
18 Protecting People and the Environment

the large error in the obtained probabilities could be 

attributed to the uncertainty in estimating common-cause 

accidents.7

The 1965 Update to WASH-740 Goes 

Unpublished

The AEC decided not to publish the 1965 update given 

its flaws and potential public relations impact. The AEC 

reported back to JCAE and explained that its preliminary 

work showed that the consequences grew larger because 

of the increase in new plants’ power production. The 

results of the 1965 report once again left the AEC 

uneasy about using probabilities for the assurance of 

reactor safety. 

The Antinuclear Movement

By the late 1960s, the AEC was coming under increased 

criticism from the antinuclear movement. At the local 

level, opposition to new plant construction began to 

build. Nationally, critics questioned whether a key safety 

system, the emergency core cooling system, would 

work as designed, which led to a contentious 1972 

rulemaking hearing on its safety.8 Two prominent AEC 

scientists who worked at Lawrence Livermore National 

Laboratory, Dr. John Gofman and Dr. Arthur R. Tamplin, 

raised another safety concern. These scientists claimed 

that low-level radioactive emissions had greater health 

effects than the AEC admitted. The AEC also came 

under scrutiny by other Federal agencies, such as the 

7 A common-cause (or common-mode) accident is an incidence 

involving multiple failures that are not statistically independent. 

An example of a common-cause failure would be a pair of pumps 

that failed because both were incorrectly maintained. If the pumps 

both failed for the same reason, the failures would not constitute 

independent occurrences.

8 See NUREG/BR-0175, “A Short History of Nuclear 

Regulation, 1946–2009,” Rev. 2, dated October 31, 2010, by J. 

Samuel Walker and Thomas R. Wellock, ADAMS Accession No. 

ML102980443, beginning on page 31, “The Problem of Core 

Meltdown.”
U.S. Nuclear Regulatory Commission 19

Senator Gravel

U.S. Environmental Protection Agency. In 1970, the 

National Environmental Policy Act led the AEC down 

the path of having to estimate the impact of reactor 

incidents on the environment.

Congress and the Antinuclear Movement

As the antinuclear movement percolated, a similar 

sentiment began to find its way into Congress. Alaskan 

Senator Mike Gravel criticized the AEC for testing 

thermonuclear devices on Amchitka Island in the 

Aleutian Islands chain. Senator Gravel quickly began 

criticizing atomic energy and became closely associated 

with the antinuclear movement. As Dr. Wellock pointed 

out, “He was already critical along those lines [about 

the thermonuclear device testing]. Picking up criticism 

of atomic energy wasn’t that hard for him.” Senator 

Gravel’s criticism quickly turned into skepticism when 

in 1970 he asked the AEC to show him the 1965 WASH740 update. Senator Gravel’s request put the AEC in a 

precarious position because of the problems with the 

WASH-740 update and the AEC’s subsequent refusal to 

release the report to antinuclear activists.
20 Protecting People and the Environment

Events Associated with WASH-1400

1977	

1975	

WASH-1400

Published 

Lewis 

Committee is 

formed to review 

WASH-1400 

1979	

NRC Commission 

rescinds its 

endorsement of the 

WASH-1400 

executive summary 

Antinuclear 1970	

movement 

grows to the 

local and 

national level 

1972	

Rasmussen 

recruited to lead 

WASH-1400 

study 

1978	

Lewis Committee 

criticizes 

WASH-1400 

while also praising 

PRA 
U.S. Nuclear Regulatory Commission 21

Senator Gravel Forces a New Study

Despite Senator Gravel’s lack of seniority in Congress, 

the AEC realized that his request to see the 1965 update 

must be answered. Dr. Wellock noted, “This is before the 

age of FOIA,9 but you don’t easily say no to a senator, 

even though in this case he was just a junior senator.” 

The AEC refused to release the report, but it committed 

to developing a new study. Interest in a new study soon 

spread to other members of Congress with pronuclear 

leanings. In 1972, AEC member Saul Levine accepted 

a temporary assignment with JCAE. Levine quickly 

read the mood of the Joint Committee, which was now 

vulnerable to challenges to its authority over nuclear 

power from the growing environmental movement. 

Levine suggested that JCAE take charge of the issue by 

requesting that the AEC launch a new study that laid out 

its safety approach and dealt with accident consequences 

and probabilities. 

Levine Lays the Groundwork

Levine’s recommendation came a few months after 

the AEC had already decided it would launch a new 

study. JCAE liked what Levine proposed, and this gave 

impetus to the AEC regulatory staff to launch a study on 

a much larger scale than any previous effort. 

The AEC Begins Recruiting

To provide the study with some independence, the AEC 

looked outside the agency for an expert to lead it, but 

progress lagged throughout 1971. In early 1972, Stephen 

Hanauer recruited Norman C. Rasmussen, a nuclear 

9 The Freedom of Information Act (FOIA) is a Federal statute 

that allows individuals to request access to Federal agency 

records.

4. Development of WASH-1400 

Begins
22 Protecting People and the Environment

Dixy Lee Ray with her 

two dogs 

engineering professor at MIT. Hanauer and Rasmussen 

laid out the basic components of the study, which 

included the traditional accident consequence estimates 

of previous studies, but also added probability estimates 

derived from fault trees. Because of questions regarding 

data sufficiency, Rasmussen warned Hanauer that there 

might be a significant lack of accuracy in their results. 

Hanauer noted that they might have to learn by trying, a 

common kind of thinking in 1972. 

WASH-1400 Development and Initial 

Findings

As Dr. Budnitz stated in the lecture, the goal of the 

WASH-1400 team was “to identify every single accident 

sequence that matters and...its probability” and “work 

out the consequences...being core damage or some 

release into the containment or some release from the 

containment...offsite.”

The safety community did not think that such an 

analysis was possible. It had no confidence that all 

the probabilities could be worked out, because it 

thought supporting data were lacking. Despite this 

doubt, the WASH-1400 analysis group still managed 

to demonstrate that an accident safety analysis was 

possible. The analysis group compared nuclear reactor 

safety with other disasters such as earthquakes, 

hurricanes, tornadoes, and airline accidents.

By 1974, Dixy Lee Ray, then Chairman of the AEC, 

went before Congress to provide the first estimates 

from WASH-1400. Ray attempted to put the estimates 

in a positive, understandable light by using easily 

understood comparisons to other very unlikely events. 

She compared the likelihood of a major accident 

with that of drawing four of a kind in draw poker, 

twice. The use of these clever comparisons continued 

throughout the review and into the current era as a way 

to help the public grasp the safety of nuclear power 
U.S. Nuclear Regulatory Commission 23

plants. However, some criticized these comparisons as 

inappropriate given the large uncertainties in the WASH1400 probability estimates compared to the far more 

certain probabilities of poker hands, airplane crashes, 

and lighting strikes.

The next two pages show graphs from the executive 

summary of WASH-1400.

WASH-1400 results 

comparing nuclear 

power plants and 

man-made events 
24 Protecting People and the Environment

Realism in WASH-1400

The analysis group attempted to use realistic 

frequencies, failure modes, and human error rates in 

WASH-1400. In the airborne analysis, Robert Ritzman 

and Richard Denning at Battelle Columbus Laboratories 

used a realistic understanding of chemistry, physics of 

aerosols, and airborne contaminants in containment. 

The offsite dose analysis led by Ian Wall attempted to 

use realistic analysis of radiological dispersion in the 

environment, realistic settling velocities, and realistic 

uptakes in the human body.

Dr. Budnitz offered his insight on the realism in 

WASH-1400:

They did everything they could to make [WASH-1400]

as realistic as they could. In retrospect they did a pretty 

WASH-1400 results 

comparing nuclear 

power plants and 

natural events 
U.S. Nuclear Regulatory Commission 25

good job, although in some places they had a lot of 

judgment [errors] and didn’t get it all right...but it was 

intended to be, and in retrospect was, realistic.

Antinuclear Attitudes after WASH-1400

Accusations of a pronuclear bias at the NRC had also 

been commonly directed at the AEC. Congress abolished 

the AEC in 1974 because of the agency’s conflicting 

promotional and regulatory duties and formed the 

NRC to handle the regulatory issues that were essential 

to protecting public health and safety. Despite the 

formation of the NRC in 1975, antinuclear attitudes 

persisted after the release of WASH-1400. A common 

sentiment in the antinuclear community was that WASH1400 was written with the intention of being pronuclear. 

Later criticism from a review group called the “Lewis 

Committee” would back up these claims. 

Dr. Budnitz summarized the Lewis Committee findings 

on WASH-1400:

...[The Lewis Committee] also was very blunt about 

how although the methods were terrific [in WASH1400] and the insights were important, the executive 

summary was way overstating what you could get from 

this. Crucially, they studied only two reactors...Way 

overstated it...Also [the Lewis Committee] also said 

that although they struggled to estimate uncertainties in 

the study, they had underestimated them by a good deal.

Initial Regulatory Application of 

WASH-1400

After his effort to garner support for the creation of 

WASH-1400, Saul Levine quickly used the report to 

analyze the regulations in place in 1975. Levine noted 

that there were discrepancies in the current regulations, 

with some aspects being overly stringent and others 

being inadequate, such as reactor outage requirements.
26 Protecting People and the Environment
U.S. Nuclear Regulatory Commission 27

The Lewis Committee

By 1976, Saul Levine had become the Director of 

Research for the NRC. With his knowledge of WASH1400, Levine attempted to launch studies aimed at 

remedying the inadequacies in the report by collecting 

more information and performing more experiments. 

At this time, the NRC’s Office of Nuclear Regulatory 

Research had considerable freedom to decide what 

research projects to undertake, which allowed Levine to 

pursue research related to WASH-1400.

On March 14, 1977, U.S. Representative Morris Udall, 

Chairman of the Committee on Interior and Insular 

Affairs of the U.S. House of Representatives, conducted 

hearings on the final WASH-1400 report. Representative 

Udall communicated to the NRC Chairman that there 

was “widespread belief” that WASH-1400 “was 

presented in a manner which created a misleading 

impression of the certainty and comprehensiveness of 

its conclusions.” Representative Udall asked that an 

independent group develop a new summary to correct 

this impression. 

On April 4, 1977, a letter from the NRC Chairman 

Marcus Rowden to Representative Udall redirected 

Udall’s request from the development of a new 

summary to a technical peer review. To this end, the 

NRC assembled a panel of seven experts to review 

WASH-1400. The group became known as the “Lewis 

Committee” and the report as the “Lewis report.” The 

experts spent a year on the report and “basically heard 

from everybody,” as Dr. Budnitz, a member of the 

group, recalled. The group focused on understanding 

WASH-1400 and its applicability to nuclear power plant 

regulation, as well as scrutinizing the models used. 

5. The Impact of WASH-1400
28 Protecting People and the Environment

The Lewis Report 

In September 1978, the Risk Assessment Review 

Group, chaired by Hal Lewis, a professor of physics at 

the University of California, Santa Barbara, published 

its review of WASH-1400 in NUREG/CR-0400, “Risk 

Assessment Review Group Report to the U.S. Nuclear 

Regulatory Commission.” The Committee’s charter 

stated the following:

The Review Group will provide an advice and 

information final report of the Reactor Safety Study, 

WASH-1400.... This advice and information will assist 

the Commission in establishing policy regarding the 

use of risk assessment in the regulatory process, in 

improving the basis for the use of such assessments. It 

will also clarify the achievements and limitations of the 

Reactor Safety Study.

The highly technical review by the Lewis Committee 

strongly endorsed the use of PRA methods in regulation 

in its review, “Risk Assessment Review Group Report to 

the U. S. Nuclear Regulatory Commission,” page VII:

WASH-1400 was largely successful in at least three 

ways: in making the study of reactor safety more 

rational, in establishing the topology of many accident 

sequences, and in delineating procedures through which 

quantitative estimates of the risk can be derived for 

those sequences for which a data base exists.

The Lewis Committee praised the usefulness of fault 

trees. However, while praising WASH-1400, the 

Committee also criticized the overly optimistic executive 

summary, which overstated the implications of the main 

report. 
U.S. Nuclear Regulatory Commission 29

The issues the Lewis Committee found in WASH-1400 

included the following:

• The accuracy of the weather (dispersion) model was 

suspect.

• Unrealistic evacuation schemes were overly 

optimistic and could have led to a favorably lower 

fatality rate. 

• Earthquakes, fires, and human error were not 

considered appropriately when determining overall 

risk.

• Accidents were considered only for the case of the 

plant running at full power. 

Crucially, the Lewis report also noted the significance of 

the findings in WASH-1400 and how certain regulations 

were inadequately researched related to “transients, 

small loss of coolant accidents and human errors” 

(NUREG/CR-0400, page viii). Dr. Budnitz recounted 

that the WASH-1400 analysis group “identified for the 

first time...that small [loss-of-coolant accidents] were 

really much more important than people had thought.” 

This finding about small loss-of-coolant accidents 

(LOCAs) would be important in investigations of the 

Three Mile Island accident. 

Dr. Budnitz commented on the completeness of the 

WASH-1400 study:

If you look back now 40 years later, there are not 

important [accident sequences] that [WASH-1400]

didn’t capture. They worked out the frequency of 

every one of those using [fault tree] techniques. The 

frequencies are more or less right.... When you look 

back at the places where they didn’t get it right [it 

was] because there weren’t enough data or not enough 

experiments.... It’s a tour de force, a major intellectual 

accomplishment.
30 Protecting People and the Environment

Results of the Lewis Report 

After the Lewis report spelled out the deficiencies in 

WASH-1400, the Commission began to second guess 

its initial acceptance of the report. One particularly 

important point that Dr. Lewis made to the Commission, 

in a NRC Commission briefing in early 1979, was 

that the uncertainties in the report were so large that “I 

can’t say anything [about civilian reactors] that would 

be useful. I can’t learn anything from WASH-1400 

that would help me on it.” Because of the increasingly 

negative atmosphere surrounding WASH-1400 and its 

executive summary, the Commission, as Dr. Budnitz 

put it, “bailed” on its total acceptance of the WASH1400 report in January 1979. However, although the 

Commission rescinded its endorsement of the report’s 

executive summary, its policy statement noted that 

WASH-1400 offered important insights. 

The Commission’s statement on WASH-1400 included 

the following: 

• The executive summary does not adequately indicate 

the full extent of the consequences of reactor 

accidents and does not sufficiently emphasize the 

uncertainties involved in the calculations of their 

probability.

• The peer review process was inadequate.

• Absolute values of risks should not be used 

uncritically.

In response to the Commission’s statement, press 

coverage featured headlines such as those in January 

20th, 1979 editions of The Washington Post, “‘75 

Report on Reactor Safety Is Called Unreliable by NRC,” 

and The New York Times, “Nuclear Agency Revokes 

Support for Safety Study.” Despite the Commission 

and the public discrediting PRA use, Saul Levine 

began efforts to fill in the gaps in WASH-1400. The 

Commission’s criticism of WASH-1400 led to the Office 
U.S. Nuclear Regulatory Commission 31

of Nuclear Regulatory Research launching more studies 

to remedy the inadequacies of the report. Because of the 

Three Mile Island incident, most of the studies began 

just 2 months after the Commission’s decision to rescind 

its endorsement of WASH-1400. 

Earthquake accident research began in the Seismic 

Safety Margins Research Program at Lawrence 

Livermore National Laboratory, which developed 

the methodology for seismic PRA. A study of human 

reliability and error rates and a fire PRA study began at 

Sandia National Laboratories. 

In addition to all the new studies, analysts began using 

computers to collect and study the data needed to make 

more accurate models. 

Industry stakeholders, represented by the Electric Power 

Research Institute, launched a study on human reliability 

analysis. The Germans also launched a study like 

WASH-1400 at the Biblis Nuclear Plant, under Adolf 

Birkhofer called “German Risk Study for Nuclear Power 

Plants.” The Biblis study used techniques similar to 

those used in WASH-1400 and found similar results. 

Balance in WASH-1400

WASH-1400 identified sequences, such as small 

LOCAs, that continue to be considered important. 

Another important sequence identified was a loss of 

offsite power and station blackout. It would take the 

NRC until 1988 to promulgate a rule, Title 10 of the 

Code of Federal Regulations (10 CFR) 50.63, “Loss 

of All Alternating Current Power,” to address station 

blackout.

WASH-1400 also identified some sequences as less 

important to risk than previously considered. For 

example, large LOCAs, the ultimate in design-basis 

accidents, were not as important as people had thought. 
32 Protecting People and the Environment

Another example of balance is that WASH-1400 

estimated the frequency of an accident to be higher 

than previously expected, but the consequences of most 

accidents to be smaller than many people had thought. 

Dr. Budnitz noted that “The antinuclear people thought 

[WASH-1400] couldn’t possibly be right because they 

had been telling themselves that every core damage 

accident was going to contaminate an area the size of 

the State of Pennsylvania [due to the WASH-740 update 

report by Brookhaven National Laboratory].” 
U.S. Nuclear Regulatory Commission 33
34 Protecting People and the Environment

Three-Mile Island Accident Timeline

March 24, 1979

Operator 

Actions 

Mechanical 

 Failures 

Secondary-loop 

coolant pump 

failure 

Emergency 

reactor 

shutdown 

Operators are 

unaware of backup 

pump failure due to 

ambiguous control 

indication 

Coolant	ven*lated	

from	PORV	is	

exhausted	outside	

containment	

Successful 

Actions 

Secondaryloop coolant 

filtration 

system fails 

6:30	AM	

Site	emergency	

declared	

4:05	AM	

4:00	AM	

4:10	AM	

Pressurizer relief 

valve opens due 

to pressure from 

heat produced by 

residual decay 

Automatic 

back-up 

pumps fail to 

operate 

Operator controls 

indicate relief valve 

closed 

4:45	AM	

Back up pump 

failure 

corrected 

Relief valve fails to 

close after core 

depressurization- 

 reactor coolant is 

exhausted inside 

containment 

5:00	AM	Operators ignore 

alarms relating to 

containment 

temperature 

Pressure drops 

while relief valve 

remains open, 

core coolant 

boils Core coolant pumps 

are shut down 

Core coolant 

pumps begin 

to vibrate 

due to steam 

formation 

5:13

AM	

Temperatures 

rise, fuel bundles 

begin to melt 
U.S. Nuclear Regulatory Commission 35

Background 

On March 28, 1979, an accident occurred at the Unit 

2 reactor at the Three Mile Island Nuclear Generating 

Station (TMI) in Dauphin County, PA. TMI Unit 

2 partially melted down because of a small LOCA 

resulting from a combination of human factors and 

mechanical failure. While the incident did not result in a 

significant offsite dose to the public, the accident at TMI 

Unit 2 represented a major turning point for the nuclear 

industry in the United States and internationally.

Loss-of-Coolant Accident 

One major accident of concern in nuclear power plant 

safety is a LOCA. In a general sense, a LOCA is 

any accident where the liquid used to cool a reactor 

core is lost. At TMI Unit 2, the regular equipment 

used to recirculate and pump water through the 

secondary cooling system failed, which was an 

initiating event for the plant’s eventual LOCA. After 

the coolant recirculating equipment failed, auxiliary 

pumps were brought on line in lieu of the properly 

working equipment. The auxiliary pumps did not 

function because of problems with an unauthorized 

6. Three Mile Island

Three Mile Island
36 Protecting People and the Environment

maintenance procedure. The next fail-safe in place was a 

pilotoperated relief valve designed to vent excess steam 

being produced inside the reactor because of the lack 

of a cool water supply. This valve properly actuated 

initially and relieved the vessel of pressure, but it did not 

properly reset into a closed position. 

Operator Actions and Human Reliability 

Analysis 

Operator error and poor instrumentation design did 

not alert reactor employees of a malfunctioning 

pilotoperated relief valve (a valve located at the top 

of the pressurizer). The malfunction allowed the relief 

valve to remain open while coolant was lost. After a 

series of further errors caused by the ambiguous control 

panel indications, the reactor core fuel began to melt. 

With the reactor’s pilot-operated relief valve still open, 

radioactive gasses were vented and eventually escaped 

into the containment building. The operators took further 

action once they realized the valve malfunction. The 

role of human error in the TMI Unit 2 accident would 

motivate future studies of human reliability and error 

risk analysis. 

WASH-1400 and Loss-of-Coolant 

Accidents 

One of the findings of WASH-1400 that would anticipate 

the events at TMI was the importance of small-break 

LOCAs compared to that of large-break LOCAs. Before 

WASH-1400, much of the effort to ensure reactor safety 

focused on large-break LOCAs. In a large-break LOCA, 

a large amount of coolant is promptly lost from the 

reactor, which creates a low pressure inside the reactor 

vessel and associated piping. Automatic safety systems 

can deal with large-break LOCAs by using low-pressure, 

high-volume pumps to keep water covering and cooling 

the reactor core. In a small-break LOCA, coolant is 
U.S. Nuclear Regulatory Commission 37

lost at a lower rate than in a large-break LOCA, but the 

reactor vessel still maintains high pressures. Operators 

can deal with small-break LOCAs by using highpressure, low-volume pumps to cover and cool the 

reactor core. 

WASH-1400 and Three Mile Island

The accident at TMI is an example of a small-break 

LOCA. While WASH-1400 did not predict the exact 

accident sequence that occurred at TMI, it did correctly 

identify that a small-break LOCA could initiate 

core damage. Although the TMI accident involved a 

pressurized-water reactor, it is not the same type of 

reactor analyzed in WASH-1400. The report analyzed 

Surry Nuclear Power Station, which had a Westinghouse 

reactor, whereas TMI had a Babcock & Wilcox design. 

While Surry and TMI both had pressurized-water 

reactors, the accident sequences cannot be directly 

compared because of the difference in design of the 

steam generators.

The WASH-1400 PRA for Surry did not identify a 

sequence in which the operators turned off the pumps 

that they needed because an operator misread a meter. 

The big-picture failures were similar, but WASH-1400 

did not identify the specific failure sequence at TMI. 

However, WASH-1400 did predict that severe core 

damage would be contained. The controlled releases 

from the containment building to reduce pressure did 

let out some radiation from TMI, but melted fuel did 

not escape the reactor vessel, which could have created 

a much more severe situation. In this way, WASH1400 did prove prescient concerning the TMI accident 

outcome. The follow page identifies key events related 

to the TMI accident.
38 Protecting People and the Environment
U.S. Nuclear Regulatory Commission 39

Regulations after Three Mile Island

Shortly after the TMI accident, the nuclear industry 

launched a study called “The Industry Degraded Core 

Rulemaking” (IDCOR) in 1981 with the goal of better 

understanding severe accident phenomenology. By 

1984, IDCOR came to three primary conclusions in an 

effort to prevent rulemaking for severe accidents:

1.The probabilities of severe nuclear accidents 

occurring are extremely low.

2.The fission product source terms—quantities and 

types of radioactive material released in the event 

of severe accidents—are likely to be much less than 

previous studies had calculated.

3.The risks and consequences to the public of severe 

nuclear accidents are significantly less than those 

predicted by previous studies and much smaller 

than the risk levels incorporated in the NRC interim 

safety goals.

The IDCOR program was an early adoption of PRA by 

the nuclear industry and concurred with WASH-1400 on 

the safety of nuclear power plants.

Additional Probabilistic Risk Assessment 

Efforts 

WASH-1400 studied only “internal” events at full plant 

power. Subsequently, industry and NRC studies began 

to include external events, as well as risks associated 

with plants running at conditions other than full power. 

PRA related to fire has been of much interest. On March 

22, 1975, a fire at the Browns Ferry Nuclear Power 

Plant fundamentally changed how the NRC dealt with 

fire protection at U.S. nuclear power plants. By the 

7. After WASH-1400 and Three 

Mile Island
40 Protecting People and the Environment

time firefighters extinguished the fire, it had burned 

for 7 hours. More than 1,600 electrical cables were 

affected, 628 of which were important to plant safety. 

The fire damaged cables for power, control systems, 

and instrumentation, which affected reactor safety 

systems. The fire damaged so many cables that operators 

could not monitor the plant normally and had to make 

emergency repairs on the systems needed to shut the 

reactor down safely.

As a result of the fire at Browns Ferry, fire PRAs were 

initiated through academic institutions, commercially, 

and via NRC sponsorship. In fact, the first fire PRA 

evaluation was incorporated into Appendix XI to 

WASH-1400, estimating the likelihood of core damage 

from a fire like that at Browns Ferry. Fire PRA methods, 

including computer codes to simulate fire progression 

and damage, were developed. Today, fire PRA under 

National Fire Protection Association Standard 805, 

“Performance Based Standard for Fire Protection 

for Light Water Reactor Electric Generating Plants,” 

includes the use of analytical tools to evaluate fire safety 

equipment located within a fire area, as well as post-fire 

operating procedures.

Browns Ferry reactor 

building after the fire
U.S. Nuclear Regulatory Commission 41

Other efforts to understand external events include the 

research related to seismic and external flood PRAs 

(internal floods have been part of the internal events 

PRA process from the early days). The Fukushima 

Daiichi Nuclear Power Plant suffered major damage in 

2011 as the result of a 9.0 magnitude earthquake and 

consequential tsunami. Following the earthquake, the 

plant followed emergency procedures, and emergency 

power was available to cool the reactor cores, which 

were operating at the time of the earthquake. It was 

not until the subsequent tsunami hit that emergency 

alternating current power and vital reactor systems 

began to fail. The unusually large tsunami led to the 

eventual core melts in three of the operating reactors. 

The NRC analyzed events like these, which were caused 

by a seismic and flooding event, in NUREG-1150, 

“Severe Accident Risks: An Assessment for Five U.S. 

Nuclear Power Plants,” issued December 1990.

Fukushima reactors 

after the tsunami 
42 Protecting People and the Environment

External flooding events have also threatened nuclear 

power plants in the United States. One of the most 

notable incidents occurred in 2011 at the Fort Calhoun 

Station, sited along the Missouri river. These cases 

highlight the need to understand the risk associated with 

external flooding and nuclear power plants.

Fort Calhoun flooding 

event
U.S. Nuclear Regulatory Commission 43

8. Conclusion

Probabilistic Risk Assessment Today and 

in the Future 

The data recorded for over half a century of operating 

nuclear power plants have increased the use and 

accuracy of PRA. NUREG-1150 followed the efforts of 

WASH-1400 by using over 15 years of new data from 

research and nuclear power plant operation. The results 

were similar to those in WASH-1400, but they showed 

that plants were safer than found in the original WASH1400 analysis. 

The NRC issued a policy statement (60 FR 42622, 

August 16, 1995) that supported risk-informed initiatives 

by stating the following:

The use of PRA technology should be increased in all 

regulatory matters to the extent supported by the state 

of the art in PRA methods and data, and in a manner 

that complements the NRC’s deterministic approach 

and supports the NRC’s traditional defense-in-depth 

philosophy.

In 1998, the NRC published Regulatory Guide 1.174, 

“An Approach for Using Probabilistic Risk Assessment 

in Risk-Informed Decisions on Plant-Specific Changes 

to the Licensing Basis.” In 2004, the NRC published 

Regulatory Guide 1.200, “An Approach for Determining 

the Technical Adequacy of Probabilistic Risk 

Assessment Results for Risk-Informed Activities.” Both 

of these regulatory guides were crucial for the adoption 

of PRA seen in current regulations.10

10 For more information on current PRA initiatives and recent 

history, see “Probabilistic Risk Assessment and Regulatory 

Decisionmaking: Some Frequently Asked Questions,” issued 

March 2016 (ADAMS Accession No. ML16061A559) and NRC 

Web page “History of the NRC’s Risk-Informed Regulatory 

Programs.”
44 Protecting People and the Environment

The NRC also proposed Recommendation 1 in NUREG2150, “A Proposed Risk Management Regulatory 

Framework,” issued April 2012, which would formally 

adopt a risk-managed regulatory framework; however, 

the NRC has taken no policy action to implement this 

recommendation. Dr. Budnitz noted, “There is a lot still 

in front of us [regarding PRA] and we have the methods, 

we have the knowledge and we have the people inside 

the agency.”

Some areas related to nuclear power plant safety (such as 

high-level waste) have seen heavy use of risk assessment 

since the 1970s, whereas other areas are still evolving. 

The transition to a risk-informed regulatory framework 

is expected to be incremental. Many of the present 

regulations are based on deterministic and prescriptive 

requirements that cannot be quickly replaced. Therefore, 

the current requirements will have to be maintained 

while risk-informed or performance-based regulations, 

or both, are being developed and implemented. Although 

the traditional deterministic approach to regulation has 

succeeded in ensuring no undue risk to public health and 

safety in the use of nuclear materials, opportunities for 

improvement exist. 

Final Remarks 

Since WASH-1400, PRA has evolved into a 

sophisticated tool used in policy and regulation 

for nuclear power plants. Many other government 

and industry studies have contributed to a better 

understanding of the risks associated with nuclear power 

plants. Current efforts to create seismic, fire, flooding, 

and human reliability risk models can be traced back 

to WASH-1400 and other early attempts at calculating 

risks. PRA use in the current era helps create an 

environment of safe nuclear power plants.



NUREG/KM-0010

August 2016