Probabilistic Risk Assessment 

and Regulatory Decisionmaking:

Some Frequently Asked Questions 

Office of Nuclear Regulatory Research

NUREG-2201

Probabilistic Risk Assessment 

and Regulatory Decisionmaking:

Some Frequently Asked Questions

Manuscript Completed: April 2016

Date Published: September 2016

Prepared by: 

Nathan Siu

Martin Stutzke

Suzanne Dennis

Donald Harrison

Office of Nuclear Regulatory Research

NUREG-2201

 

iii

ABSTRACT

Probabilistic risk assessment (PRA) is an important decision-support tool at the U.S. Nuclear 

Regulatory Commission. The availability of experiential data for accidents, including those at the 

Fukushima Dai-ichi nuclear power plant, raises natural questions regarding the need for and 

utility of PRA, which is, at heart, a systems modeling-based analytical approach. This report 

addresses these questions using the format of frequently asked questions (FAQs). The FAQs 

are organized into four topic categories: regulatory decisionmaking, PRA basics, core damage 

frequency state of knowledge, and large early release frequency state of knowledge. For each 

FAQ, the report provides both a brief answer and a supplementary discussion elaborating on 

that answer. The report also includes two appendices, which provide additional technical details 

on quantifying uncertainty and updating data based on experience.

v

CONTENTS

ABSTRACT ................................................................................................................... iii

CONTENTS .................................................................................................................... v

LIST OF FIGURES........................................................................................................ vii

LIST OF TABLES ......................................................................................................... vii

FOREWORD.................................................................................................................. ix

ACKNOWLEDGMENTS ................................................................................................. x

ACRONYMS AND ABBREVIATIONS........................................................................... xi

1. INTRODUCTION........................................................................................................ 1

2. REGULATORY DECISIONMAKING ......................................................................... 3

R1. What information does the NRC use in regulatory decisionmaking?............................ 4

R2. What is the NRC’s definition of the term “risk”? ........................................................... 4

R3. What is the relation between safety and risk?.............................................................. 5

R4. What are the NRC’s safety goals?............................................................................... 6

R5. What is the relationship of surrogate risk measures to the safety goals?..................... 6

R6. What is the NRC’s philosophy regarding the use of risk information? .......................... 7

R7. What is the NRC’s policy regarding the use of PRA?................................................... 8

R8. Where does the NRC use PRA in regulatory decisionmaking?.................................... 8

Regulations and Guidance .......................................................................................... 9

Licensing, Decommissioning, and Certification.......................................................... 11

Oversight................................................................................................................... 11

Operational Experience ............................................................................................. 12

Decision Support ....................................................................................................... 12

R9. Why does the NRC use PRA in regulatory decisionmaking? ..................................... 13

R10. If nuclear power plant accident statistics are available, is there a need for PRA? ...... 15

3. PRA BASICS ........................................................................................................... 17

B1. What is PRA?............................................................................................................ 18

B2. Do PRAs predict the future?...................................................................................... 19

B3. If a PRA quantifies likelihoods in terms of probabilities, what are frequencies? ......... 19

B4. What is the meaning of the percentiles for CDF reported by some PRAs? ................ 20

B5. In situations in which the CDF is highly uncertain, is the mean CDF a 

meaningful quantity for regulatory decisionmaking? .................................................. 21

B6. What are aleatory and epistemic uncertainties and why do we distinguish 

between the two? ...................................................................................................... 22

B7. What is the most valuable output of a PRA?.............................................................. 23

B8. Are PRAs supposed to be conservative?................................................................... 24

B9. Is PRA a mature analysis technology? ...................................................................... 24

B10. How are PRAs updated to reflect operational experience and other 

new information? ....................................................................................................... 26

B11. What is the current international status of nuclear power plant PRAs and 

risk-informed decisionmaking? .................................................................................. 27

B12. Is PRA limited to event tree/fault tree analysis?......................................................... 28

4. CDF—CURRENT STATE OF KNOWLEDGE ......................................................... 29

C1. What is core damage?............................................................................................... 30

C2. What do global statistics tell us about core damage frequency (CDF)? ..................... 31
vi

C3. What are U.S. PRA studies telling us about mean CDF for operating plants?............ 35

C4. Are PRA estimates for CDF “better” than global statistical estimates?....................... 37

C5. What is ∆CDF? How is it used in regulatory decisionmaking? ................................... 38

C6. What does our current state of knowledge regarding CDF tell us about the 

probability of a future core damage accident anywhere in the United States? ........... 39

C7. How large are the uncertainties in CDF? ................................................................... 40

5. LERF—CURRENT STATE OF KNOWLEDGE ....................................................... 43

L1. What is a large early release? ................................................................................... 44

L2. What do accident statistics tell us about large early release frequency (LERF)? ....... 45

L3. What have past U.S. PRA studies told us about LERF for operating plants?............. 46

6. CONCLUSION ......................................................................................................... 49

7. REFERENCES......................................................................................................... 51

APPENDIX A: THEORETICAL FRAMEWORK FOR PRA TREATMENT 

OF UNCERTAINTIES ....................................................................... A-1

A.1 Introduction ..............................................................................................................A-1

A.2 Mathematical Definition of Event Frequency.............................................................A-1

A.3 Additional Topics ......................................................................................................A-4

A.3.1 Implications of Poisson Model for Event Timing .............................................A-4

A.3.2 Treatment of Single Accident Sequences.......................................................A-7

A.3.3 Treatment of Multiple Accident Sequences ....................................................A-8

A.4 Aleatory and Epistemic Uncertainties .....................................................................A-10

APPENDIX B: BAYESIAN ESTIMATION OF CDF AND LERF ................................ B-1

B.1 Introduction ..............................................................................................................B-1

B.2 Bayes’ Theorem .......................................................................................................B-1

B.3 Non-Informative Prior Distributions for λ ...................................................................B-2

B.4 Posterior Distribution for λ ........................................................................................B-3

B.5 Posterior Distributions for CDF and LERF ................................................................B-4
vii

LIST OF FIGURES

Figure 2-1 The regulatory decisionmaking process (NRC, 2012a) ............................................. 4

Figure 2-2 Risk-informed, integrated decisionmaking (NRC, 1998b)......................................... 7

Figure 2-3 NRC’s regulatory activities ....................................................................................... 9

Figure 3-1 Illustrative probability density functions for CDF (adapted from Garrick, 2014)...... 21

Figure 3-2 Example CDF distribution with key characteristics ................................................. 22

Figure 4-1 Uncertainty band about Cochran (2012) estimate .................................................. 34

Figure 4-2 Statistical estimate for CDF (U.S. plants only)........................................................ 34

Figure 4-3 Distribution of recent point estimates for total CDF, U.S. plants (Sources: LAR 

submittals and SAMA analyses) ............................................................................ 35

Figure 4-4 Comparison of recent and past estimates for total CDF, U.S. plants (Sources: 

IPE, IPEEE, LAR, and SAMA analyses) ................................................................ 37

Figure 4-5 Acceptance guidelines for CDF from RG 1.174 (NRC, 2011a)............................... 38

Figure 4-6 Uncertainties in CDF from some past full-scope PRAs........................................... 41

Figure 5-1 Uncertainty band about point estimate for LERF (world reactors) .......................... 46

Figure 5-2 Distribution of recent point estimates for total LERF, U.S. plants (from LAR 

submittals) ............................................................................................................. 47

Figure 5-3 Comparison of LAR and IPE estimates for total LERF, U.S. plants (internal 

events only) (IPE results from NUREG-1560)........................................................ 48

Figure A-1 Effect of increasing λT on event occurrences .......................................................A-3

Figure A-2 Effect of increasing λ on cumulative distribution for first occurrence time..............A-5

Figure A-3 Probability density functions for T1........................................................................A-6

Figure A-4 Example time trace for a Poisson process............................................................A-6

Figure A-5 Example event tree..............................................................................................A-9

Figure A-6 Equivalent state-transition diagram for example ...................................................A-9

Figure A-7 Reduction in epistemic uncertainty with increased data......................................A-11

Figure A-8 Representation of aleatory and epistemic uncertainties in event 

occurrence time ..................................................................................................A-12

Figure B-1 Uncertainty band about Cochran (2012) estimate.................................................B-4

Figure B-2 Statistical estimate for CDF (U.S. plants only) ......................................................B-5

Figure B-3 Uncertainty band about point estimate for LERF (world reactors).........................B-5

Figure B-4 Statistical estimate for LERF (U.S. plants only).....................................................B-6

LIST OF TABLES

Table 3-1 Indicators of Stages of Technical Maturity (adapted from Cornell, 1981)................ 26

Table 4-1 Example Definitions of Core Damage and Core Melt ............................................. 30

Table 4-2 Some Recent Statistical Point Estimates of CDF.................................................... 32

Table 5-1 Estimated Release Amounts and Timing for Major Nuclear Power 

Plant Accidents...................................................................................................... 45

Table B-1 Non-Informative Prior Distribution Parameter Values............................................B-3

Table B-2 Parameter Values Used in Bayesian Estimates of CDF and LERF .......................B-4

ix

FOREWORD

The U.S. Nuclear Regulatory Commission (NRC) has had a long history of using probabilistic 

risk assessment (PRA) models and results in support of its regulatory processes and decisions. 

In the late 1970s, shortly after the completion of the seminal Reactor Safety Study 

(WASH-1400), the NRC staff was using insights from probabilistic analyses in its consideration 

of such diverse topics as the likelihood of loss-of-coolant accidents, the reliability of direct 

current power supplies, and the effectiveness of alternate containment designs. By the early 

1980s, the NRC staff was considering risk arguments in support of licensee requests to extend 

equipment outage times. In 1985, the Commission used information from licensee-sponsored 

PRAs to inform its decision to allow continued operation of the Indian Point power plants. 

In 1995, the Commission formally adopted its PRA Policy Statement, which promoted the use of 

PRA technology in the NRC’s activities. Consistent with this policy statement, the NRC 

developed and implemented numerous risk-informed programs, (i.e., programs that use risk 

information as one input for regulatory decisionmaking). Currently, the NRC is continuing to 

explore opportunities for expanding its risk-informed activities.

In 2011, following the Fukushima Dai-ichi reactor accidents, some critics raised concerns 

regarding the realism of the PRAs that provide the technical information needed in the NRC’s 

risk-informed programs. Two principal complaints raised were (1) PRA-based estimates of the 

likelihood of major accidents were significantly smaller than simple statistical estimates based 

on international events (notably the accidents at Three Mile Island, Chernobyl, and Fukushima), 

and (2) PRAs did not predict the accident scenario experienced at Fukushima. In 2013, 

concerned that the first complaint was based on an oversimplified analysis and that the second 

reflected a lack of understanding of the nature of PRA models, NRC Commissioner 

George Apostolakis 1 initiated a project to address these complaints. Recognizing that direct 

rebuttals without background information concerning both regulatory decisionmaking and PRA 

would likely not be effective for a broad audience, he directed the project team 2 to develop 

some “frequently asked questions” (FAQs) and participated actively in the development 

process. In March 2014, he presented a speech at the NRC’s Regulatory Information 

Conference (RIC) based on the project results to date.3

This report provides the FAQs developed by Commissioner Apostolakis and his team, some of 

which have been updated to reflect the authors’ perspectives and the NRC staff comments, as 

well as a few additional FAQs. The FAQs are not necessarily the “last word” on the topics 

addressed. In some cases, they provide the authors’ views on current topics whose resolution 

is still evolving. Furthermore, as with all FAQs, the FAQs in this report do not provide detailed 

discussions of the topics, nor does the list of FAQs completely cover all topics of potential 

interest. The FAQs do provide concise, broadly oriented discussions for each topic and 

references for further investigation.

This report should be useful to PRA analysts (experienced as well as novice), decisionmakers, 

and staff members curious about some of the fundamental concepts behind PRA and 

risk-informed decisionmaking.

 1 The Honorable George Apostolakis served as an NRC Commissioner from March 29, 2010, through 

June 30, 2014. 2 The project team members were Nathan Siu, Nanette Gilles, and Belkys Sosa. The project was also aided by 

several NRC staff, acknowledged in this report. 3 Apostolakis, G.E., “Global statistics vs. PRA results: which should we use?” Regulatory Information Conference 

(RIC) 2014, March 11–13, 2014.
x

ACKNOWLEDGMENTS

The authors gratefully acknowledge the project vision and early guidance from Commissioner 

G. Apostolakis, the information provided by J. Circle, D. Coe, K. Coyne, D. Dube, F. Ferrante, 

S. Laur, D. Marksberry, F. Schoefer, A. Szabo, M. Tobin, T. Wellock, and S.-M. Wong, and the 

helpful comments provided by staff reviewers.
xi

ACRONYMS AND ABBREVIATIONS

ACRS Advisory Committee on Reactor Safeguards

ADAMS Agencywide Documents Access and Management System

ASP Accident Sequence Precursor

ANS American Nuclear Society

ASLB Atomic Safety and Licensing Board

ASME American Society of Mechanical Engineers

Bq becquerel(s)

BWR boiling water reactor

CCF Common Cause Failure

CCDP conditional core damage probability

CDF core damage frequency

CFR Code of Federal Regulations

Ci curie(s)

Cs-137 cesium-137

CSNI Committee on the Safety of Nuclear Installations

EPRI Electric Power Research Institute

ESREL European Safety and Reliability Conference

FAQ frequently asked question

GAO General Accounting Office

hr hour

I-131 iodine-131

IAEA International Atomic Energy Agency

ICOSSAR International Conference on Structural Safety & Reliability

IEEE Institute of Electrical and Electronics Engineers

INES International Nuclear and Radiological Event Scale

IPE individual plant examination

IPEEE individual plant examination(s) of external events

JANTI Japan Nuclear Technology Institute

LAR license amendment request

LERF large early release frequency

LP&S low power and shutdown

MAAP Modular Accident Analysis Program

MCi megacurie(s)

MELCOR Methods for Estimation of Leakages and Consequences of Releases

MSPI Mitigating Systems Performance Index

MWe megawatt(s) electric
xii

NEA Nuclear Energy Agency

NFPA National Fire Protection Association

NOED Notice of Enforcement Discretion

NPP nuclear power plant

NRC U.S. Nuclear Regulatory Commission

NRR NRC Office of Nuclear Reactor Regulation

OECD Organisation for Economic Co-operation and Development

PRA probabilistic risk assessment

PSA probabilistic safety assessment

PSAM probabilistic safety assessment and management

PTC PTC, Inc. (formerly Parametric Technology Corporation)

PTS pressurized thermal shock

PWR pressurized-water reactor

QHO quantitative health objective

R&D research and development

RES NRC Office of Nuclear Regulatory Research

RG regulatory guide

RIC Regulatory Information Conference

RISC risk-informed safety class

ROP Reactor Oversight Process

RY reactor-year(s)

SAMA severe accident mitigation alternative

SAMDA severe accident mitigation design alternative

SBO station blackout

SOARCA State-of-the-Art Reactor Consequence Analyses

SPAR Standardized Plant Analysis Risk

SSCs structures, systems, and components

TBq terabecquerel(s)

TEPCO Tokyo Electric Power Company

TMI Three Mile Island

TMI-2 Three Mile Island Unit 2

WGOE Working Group on Operating Experience

yr year
1

1. INTRODUCTION

A regulatory decisionmaker charged with ensuring the safe operation of U.S. nuclear power 

plants is often confronted with problems in which decisions have to be made based on what

is currently known about the risks associated with different decision alternatives. For major 

decisions, the available information is usually both complex and subject to large uncertainties. 

These uncertainties arise, in part, because the decision problem usually requires consideration 

of rare events for which significant empirical data are lacking. Uncertainties also arise because 

of the diversity of the regulated facilities.

Probabilistic risk assessment (PRA) is an important decision-support tool at the U.S. Nuclear 

Regulatory Commission (NRC).

1 Following the March 11, 2011, Fukushima Dai-ichi reactor 

accidents, there have been a number of published estimates on the frequency of major reactor 

accidents based on global experience. The availability of experiential data for accidents raises 

natural questions regarding the need for and utility of PRA, which is, at heart, a systems 

modeling-based analytical approach. In this report, these questions are addressed via the 

format of frequently asked questions (FAQs).

The FAQs in this report are organized into four topic categories: regulatory decisionmaking, 

PRA basics, core damage frequency (CDF) state of knowledge, and large early release 

frequency (LERF) state of knowledge. For each FAQ, the report provides both a brief answer 

and supplementary discussion elaborating on that answer. The report also includes 

two appendices, which provide additional technical details on key topics.

 1 As discussed later in this report, NRC uses PRA results in a risk-informed decisionmaking framework. In particular, 

PRA results are not the sole basis for NRC decisionmaking.

3

2. REGULATORY DECISIONMAKING

At the U.S. Nuclear Regulatory Commission (NRC), probabilistic risk assessment (PRA) is used 

as a decision-support tool. Before delving into the details of PRA, it is important to discuss the 

decisionmaking context for PRA. This section provides the following frequently asked questions 

(FAQs) addressing the reasons PRAs are used at the NRC.

R1. What information does the NRC use in regulatory decisionmaking?

R2. What is the NRC’s definition of the term “risk”?

R3. What is the relation between safety and risk?

R4. What are the NRC’s safety goals?

R5. What is the relationship of surrogate risk measures to the safety goals?

R6. What is the NRC’s philosophy regarding the use of risk information?

R7. What is the NRC’s policy regarding the use of PRA?

R8. Where does the NRC use PRA in regulatory decisionmaking?

R9. Why does the NRC use PRA in regulatory decisionmaking?

R10. If nuclear power plant accident statistics are available, is there a need for PRA?
4

R1. What information does the NRC use in regulatory decisionmaking?

NRC decisionmakers need evaluations of options that typically cover a broad range of technical 

and nontechnical factors. The technical evaluation needs to appropriately incorporate the 

current state of knowledge regarding the risk associated with each decision option.

As with any decisionmaking process, nuclear regulatory decisionmaking requires the clear 

identification of decision options and the evaluation of these options. For major decisions, the 

evaluation typically involves the consideration of a broad variety of technical and nontechnical 

decision factors in an open, deliberative process as described in NUREG-2150 (NRC, 2012a)

and reproduced in Figure 2-1.

Figure 2-1 The regulatory decisionmaking process (NRC, 2012a)

Regarding technical factors, an important aspect of the NRC’s decisionmaking is that it 

proactively deals with possible but not-yet-experienced events. The management of the risk 1

associated with such events, whether done using implicit considerations of risk (as is the case 

with prescriptive, conservative approaches with built-in but unquantified safety margins) or using 

explicit considerations of risk (as in risk-informed approaches), needs to be based on what is 

currently known about these events (including their likelihood, potential consequences, and 

causative factors). In some cases, the events of interest are rare (i.e., empirical data are sparse 

or even nonexistent), and the always-present need to address uncertainty, whether because of

the diversity of the licensed population or to limitations in the technical community’s state of

knowledge, becomes even more important.

R2. What is the NRC’s definition of the term “risk”?

The risk associated with a facility or operation is the combined set of answers to 

three questions: “What can go wrong?” “How likely is it?” and “What are the consequences?”

The dictionary includes several definitions of the term “risk.” The “risk triplet” in the answer 

above was first articulated by Kaplan and Garrick (1981); the NRC has used it ever since 

(e.g., NRC, 1998a, 2013c). The risk triplet highlights the importance of qualitative outputs from a 

risk assessment, most importantly the descriptions of accident sequences (the answer to the 

question “What can go wrong?”). It also differentiates high-probability, low-consequence events 

 1 See FAQ R2 for further discussion of the term “risk.”
5

from low-probability, high-consequence events. Both of these features are often important in 

managing risk.

It should be recognized that, even within the PRA community (and in some NRC documents), 

risk is commonly characterized as the product of probability and consequence.2 This definition, 

which long predates the Kaplan and Garrick triplet definition, has the virtue of enabling simple 

comparisons with numerical safety goals. However, it does not provide the full breadth of 

information coming from the triplet definition.

FAQ R6 addresses the NRC’s philosophy regarding the use of risk information in 

regulatory decisionmaking.

R3. What is the relation between safety and risk?

In general, an activity is perceived to be safe if its perceived risks are judged to be acceptable. 

Quantitative risk estimates provide an important measure of nuclear power plant safety, but do 

not embody the full range of considerations that enter into the NRC’s judgments regarding 

reasonable assurance of adequate protection.

The term “safety” has different connotations to different people. Then-NRC Chairman 

S. Jackson provides an NRC perspective on the relation between safety and risk:

As commonly understood, safety means freedom from exposure to danger, or 

protection from harm. In a practical sense, an activity is deemed to be safe if the 

perceived risks are judged to be acceptable. The Atomic Energy Act of 1954, as 

amended, establishes “adequate protection” as the standard of safety on which 

NRC regulation is based. In the context of NRC regulation, safety means 

avoiding undue risk or, stated another way, providing reasonable assurance of 

adequate protection for the public in connection with the use of source, byproduct 

and special nuclear materials. (NRC, 1997a)

SECY-99-246 further expands on this relationship, emphasizing that risk is one of a number of 

different indicators of safety:

Quantitative (absolute) risk estimates serve as an important measure of plant 

safety, but do not embody the full range of considerations that enter into the 

judgment regarding adequate protection. The judgment regarding adequate 

protection derives from a more diverse set of considerations, such as acceptable 

design, construction, operation, maintenance, modification, and quality 

assurance measures, together with compliance with NRC requirements 

including, license conditions, orders, and regulations. (NRC, 1999)

FAQ R4 describes the NRC’s safety goals, which employ both qualitative and 

quantitative representations of risk.

 2 More precisely, this definition considers the sum of the probability-consequence products for all scenarios 

considered. This sum is the expected (i.e., average) value of the “risk” as defined by the triplet definition.
6

R4. What are the NRC’s safety goals?

The NRC’s safety goals broadly define an acceptable level of radiological risk. As a result, the 

safety goals partially address a fundamental regulatory concern: How safe is safe enough?

The safety goals, which are provided in the NRC’s Safety Goal Policy Statement (NRC, 1986),

broadly define an acceptable level of radiological risk. The NRC has defined two qualitative 

safety goals which are supported by two quantitative objectives. These two supporting 

objectives are based on the principle that nuclear risks should not be a significant addition to 

other societal risks. The qualitative safety goals are:

• Individual members of the public should be provided a level of protection from the 

consequences of nuclear power plant (NPP) operation such that individuals bear no 

significant additional risk to life and health.

• Societal risks to life and health from NPP operation should be comparable to or less than 

the risks of generating electricity by viable competing technologies and should not be a 

significant addition to other societal risks.

The following quantitative objectives are used to determine achievement of the safety goals:

• The risk to an average individual in the vicinity of an NPP of prompt fatalities that might 

result from reactor accidents should not exceed one-tenth of one percent (0.1 percent) of 

the sum of prompt fatality risks to which members of the U.S. population are generally 

exposed.

• The risk to the population in the area near an NPP of cancer fatalities that might result 

from NPP operation should not exceed one-tenth of one percent (0.1 percent) of the sum 

of cancer fatality risks resulting from all other causes.

R5. What is the relationship of surrogate risk measures to the safety goals?

Surrogate risk measures provide an approximate method for determining when the safety goals 

are met. Because surrogate risk measures are easier to compute than quantitative risk 

estimates, they are useful when making certain types of risk-informed decisions.

The NRC uses two surrogate risk measures that are directly related to the safety goals: core 

damage frequency (CDF) and large early release frequency (LERF). These terms are defined 

in the PRA standard endorsed by the NRC (ASME and ANS, 2009) and in NUREG-2122 

(NRC, 2013c):

• Core damage 3 frequency (CDF): The frequency 4 of accidents that cause uncovery and 

heatup of the reactor core to the point at which prolonged oxidation and severe fuel 

damage are anticipated and involving enough of the core, if released, to result in offsite 

public health effects. CDF is the surrogate risk measure for individual latent cancer 

 3 For a definition and discussion of the term “core damage,” see FAQ C1. 4 For a definition and discussion of the term “frequency,” see FAQ B3.
7

fatality risk (the second quantitative objective used to determine achievement of the 

safety goals).

• Large early release 5 frequency (LERF): The frequency of a rapid, unmitigated release 

of airborne fission products from the containment to the environment that occurs before 

effective implementation of offsite emergency response and protective actions, such that 

there is a potential for early health effects. LERF is the surrogate risk measure for 

individual prompt fatality risk (the first quantitative objective used to determine 

achievement of the safety goals).

R6. What is the NRC’s philosophy regarding the use of risk information?

When using risk information in regulatory decisionmaking, the NRC employs a risk-informed 

approach. This means that risk information is not the sole basis for decisions.

SECY-98-0144 (NRC, 1998a) defines a risk-informed decision as one in which the results and 

findings of risk assessments are considered together with other factors (integrated 

decisionmaking, Figure 2-2). Regulatory Guide (RG) 1.174 (NRC, 1998b), including its latest 

revision (NRC, 2011a), elaborates on these other factors (compliance with current regulations, 

defense in depth, safety margins, and monitoring) in discussing an acceptable approach to 

risk-informed changes in a plant’s licensing basis. Subsequent to the initial publication of 

RG 1.174 in 1998, its general philosophy and specific criteria have been adopted in other 

risk-informed regulatory applications.

Figure 2-2 Risk-informed, integrated decisionmaking (NRC, 1998b)

 5 For a definition and discussion of the term “large early release,” see FAQ L1.
8

R7. What is the NRC’s policy regarding the use of PRA?

The NRC encourages the use of PRA in all nuclear regulatory matters to the extent supported 

by the state of the art in terms of methods and data.

The NRC’s 1995 PRA Policy Statement (NRC, 1995) was issued to encourage (but not to 

prescribe or require) increased staff and industry use of PRA methods, and to help ensure that 

potential applications of PRA could be implemented in a consistent and predictable manner that 

promoted regulatory stability and efficiency. The provisions of the policy statement are as 

follows:

1. The use of PRA technology should be increased in all regulatory matters to the extent 

supported by the state of the art in PRA methods and data and in a manner that 

complements the NRC’s deterministic approach and supports the NRC’s traditional 

defense-in-depth philosophy.

2. PRA and associated analyses (e.g., sensitivity studies, uncertainty analyses, and 

importance measures) should be used in regulatory matters, where practical within the 

bounds of the state of the art, to reduce unnecessary conservatism associated with 

current regulatory requirements, regulatory guides, license commitments, and staff 

practices. Where appropriate, PRA should be used to support a proposal for additional 

regulatory requirements in accordance with Title 10 of the Code of Federal Regulations

(10 CFR) 50.109, “Backfitting.” Appropriate procedures for including PRA in the process 

for changing regulatory requirements should be developed and followed. It is, of course, 

understood that the intent of this policy is that existing rules and regulations shall be 

complied with unless these rules and regulations are revised.

3. PRA evaluations in support of regulatory decisions should be as realistic as 

practicable and appropriate supporting data should be publicly available for review.

4. The Commission’s safety goals for NPPs and subsidiary numerical objectives 6 are to be 

used with appropriate consideration of uncertainties in making regulatory judgments on 

the need for proposing and backfitting new generic requirements on NPPs.

The Federal Register notice publishing the policy statement also includes considerable 

discussion on the history, benefits, and current uses of PRA; and the rationale and process 

for developing the policy statement. It also summarizes public comments received during the 

development of the policy statement and presents staff responses.

FAQ R8 discusses the implementation of this Policy Statement.

R8. Where does the NRC use PRA in regulatory decisionmaking?

The NRC currently uses PRA models and results in its nuclear reactor regulatory activities 

concerning (1) the development of regulations and guidance, (2) licensing decisions and

certification of reactor designs, (3) oversight of licensee operations and facilities, and (4) the 

evaluation of operational experience.

 6 See the Commission’s Safety Goal Policy Statement (USNRC, 1986). See also FAQs R4 and R5.
9

The NRC conducts a wide variety of regulatory activities in performing its mission (see 

Figure 2-3). Per its 1995 PRA Policy Statement (NRC, 1995)—see FAQ R7—the agency has 

been increasing its use of PRA technology in regulatory activities, especially in activities 

involving commercial power reactors. Some notable examples of reactor-related activities 

supported by PRA models and results are as follows.7

Figure 2-3 NRC’s regulatory activities

(http://www.nrc.gov/about-nrc/regulatory.html)

Regulations and Guidance

• Potential new or amended regulations: As part of its process for considering whether to 

introduce additional regulatory requirements on licensees under the backfit provisions of 

10 CFR 50.109, the “Backfit Rule” (CFR, 2007a), PRA results are used in a regulatory 

analysis to determine whether the new requirements could lead to a substantial safety 

improvement, and to assess the potential benefits of different regulatory options 

(e.g., reduced expected public dose from accidents) which are then monetized and 

compared against the cost of these options. Guidelines for performing regulatory 

analysis are provided in NUREG/BR-0058 (NRC, 2004) and NUREG/BR-0184 

(NRC, 1997b).

• Station blackout protection: 10 CFR 50.63, the “Station Blackout (SBO) Rule”

(CFR, 2007b), requires that NPPs be capable of withstanding an SBO (complete loss of 

alternating current power to the essential and nonessential electric switchgear buses) for 

a specified, plant-specific duration and of maintaining core cooling during that period. 

This rule, which, when promulgated in 1988, provided new requirements for licensees,

was prompted by PRA findings regarding the risk significance of SBO scenarios.

• Maintenance management: 10 CFR 50.65, the “Maintenance Rule” (CFR, 2007c),

requires that licensees assess and manage the risk of maintenance activities (including,

but not limited to, surveillance, post-maintenance testing, and corrective and preventive 

maintenance). Licensees typically use their PRAs in their evaluations to comply with this 

 7 Additional details can be found on the NRC’s Web site (see, for example, 

http://www.nrc.gov/about-nrc/regulatory/risk-informed/rpp.html) and in a recent international survey of PRA 

activities (OECD, 2012).
10

requirement. This requirement was introduced following the results of the NRC 

inspections which found a lack of consideration of plant risk in prioritizing, planning, 

and scheduling maintenance activities.

• Combustible gas control: 10 CFR 50.44 (CFR, 2003), which provides requirements 

for post-accident combustible gas control, was amended to relax or remove the 

requirements for certain reactor containment types. This change was prompted by the 

results of PRAs which showed that the then-current requirements would not be effective 

for risk-significant scenarios.

• Fire protection: 10 CFR 50.48(c) (CFR, 2007d), which is commonly referred to by a 

National Fire Protection Association (NFPA) standard endorsed by the rule NFPA 805 

(NFPA, 2001), provides a voluntary option by which a licensee can use fire PRA to 

support the development of a risk-informed, performance-based fire protection program. 

This option, which was developed recognizing the value of PRA in focusing attention on 

risk-significant issues, provides licensees with an alternative, nondeterministic approach 

for achieving compliance with the NRC’s fire protection requirements.

• Reactor pressure vessel protection: 10 CFR 50.61a, the “Pressurized Thermal Shock 

(PTS) Rule” (CFR, 2010), provides licensees with an optional method to assess the 

limiting level of radiation-induced embrittlement of the reactor pressure vessel beyond 

which they cannot continue operation without further plant-specific evaluation. This 

method was developed with the support of PRAs indicating that the risk of vessel 

cracking because of embrittlement was much lower than previously estimated 

(NRC, 2007a) and that some degree of relaxation in associated requirements 

could reduce regulatory burden without jeopardizing safety.

• Special treatment of structures, systems, and components (SSCs): 10 CFR 50.69

(CFR, 2004) allows a licensee to use a plant-specific PRA to support the grouping of

SSCs into four classes used to determine the required degree of special treatment 

(e.g., beyond-commercial grade quality assurance) for the SSCs. These classes are 

Risk-Informed Safety Class (RISC)-1 (safety-related SSCs that perform safety-significant 

functions), RISC-2 (nonsafety-related SSCs that perform safety-significant functions), 

RISC-3 (safety-related SSCs that perform low safety-significant functions), and RISC-4 

(nonsafety-related SSCs that perform low safety-significant functions). The process is 

risk-informed; the PRA results are not used as the sole basis for categorization.

• New reactor certification and licensing: 10 CFR 52.47 (CFR, 2009) requires that an 

application for standard design certification contain, among other things, a description 

of the plant-specific PRA and its results. A similar requirement is provided for combined 

license applicants in 10 CFR 52.79 (CFR, 2013). Additional requirements related to the 

maintenance and upgrading of the PRA, which must be met by the time of initial fuel 

load and throughout subsequent plant operation, are contained in 10 CFR 50.71

(CFR, 2007e).

• PRA technical adequacy: Regulatory Guide (RG) 1.200 (NRC, 2009a) provides 

an approach for determining the acceptability of a PRA when used in a regulatory 

application. It establishes the attributes and characteristics of a technically acceptable 

PRA and endorses consensus PRA standards and the industry peer review process.
11

Licensing, Decommissioning, and Certification

• Changes in plant licensing basis: RG 1.174 (NRC, 2011a) provides an acceptable 

general approach by which a licensee can use risk information to support a voluntary 

change from a plant’s current (and accepted) licensing basis to a new licensing basis. 

The RG is written quite broadly, and the general principles discussed in the RG have 

been adopted in many NRC risk-informed application-specific regulatory guides. For 

example, RG 1.177 (NRC, 2011b) supports risk-informed changes to plant Technical 

Specifications regarding “completion times” (i.e., the time by which service work on an 

SSC needs to be completed) and “surveillance frequencies” (which prescribe how often 

SSCs should be tested). The RG identifies both deterministic and risk considerations 

(see FAQ R6). Other NRC risk-informed regulatory guides that build off of the guidance 

in RG 1.174 include RG 1.178 (NRC, 2003) for inservice inspections, RG 1.201 

(NRC, 2006a) for categorization of SSCs under 10 CFR 50.69, and RG 1.205 

(NRC, 2009b) for fire protection. In situations in which licensees apply for 

non-risk-informed license amendments (i.e., amendment applications not supported with 

risk information), the NRC staff still may perform a risk evaluation to determine whether 

the proposed amendment has the potential to significantly affect risk, but only if special 

circumstances are identified by the staff (NRC, 2007b).

• Environmental reviews: When submitting applications for plant license renewals

and combined licenses, or certified designs, applicants are required, as part of their 

environmental assessments, to identify and evaluate potentially cost-beneficial severe 

accident mitigation alternatives (SAMAs) or severe accident mitigation design 

alternatives (SAMDAs), respectively. Although not required, the applicants typically use 

plant-specific PRAs to support these evaluations. The NRC staff’s reviews of SAMA 

analyses are documented in published supplements to NUREG-1437 (NRC, 2013b), and 

SAMDA reviews can be found in the Environmental Assessment developed as part of 

the design-specific 10 CFR 52 appendix.

Oversight

• Reactor Oversight Process: In the NRC’s Reactor Oversight Process (ROP) 

(NRC, 2006b), PRA results are used to support inspection planning, and, as discussed 

in the NRC’s Inspection Manual Chapter 0609 (NRC, 2011c), PRA tools (including the 

licensee’s PRA and the NRC’s Standardized Plant Analysis Risk (SPAR) models 

(NRC, 2014a)) are used to determine the risk significance of inspection findings. The 

Mitigating Systems Performance Index, one of the performance indicators used in the 

ROP, is a risk-informed performance indicator that uses licensee PRA results in its 

computation (NRC, 2005).

• Incident investigation: Following the NRC’s Management Directive 8.3 (NRC, 2001), the 

NRC staff uses PRA models to support decisions regarding the appropriate response to 

a reported incident. Conditional core damage probability (CCDP) is calculated and is 

considered along with other factors (including uncertainty of the results) when 

determining the type of inspection team (an incident investigation team, an augmented 

inspection team, or a special inspection team) to send with a higher CCDP generally 

leading to a larger, more thorough inspection.
12

• Notice of Enforcement Discretion: As discussed in the NRC’s Inspection Manual 

Chapter 0410 (NRC, 2012b), the NRC staff uses risk models to support decisions 

regarding whether enforcement discretion is warranted for unanticipated temporary noncompliances with various license conditions.

Operational Experience

• Accident precursors: The NRC’s Accident Sequence Precursor Program (NRC, 2014a) 

uses SPAR models and other sources of information to evaluate operational events 

(both actual events and degraded conditions) at U.S. NPPs to identify, document, and 

rank these events. This program was mandated by Congress, and the NRC provides an 

annual report.

• Emergent issues: Following the General Accounting Office’s (GAO’s) audit of the NRC’s 

actions (including its use of risk information) in response to reactor pressure vessel head 

degradation at the Davis-Besse Nuclear Power Station plant (GAO, 2004), the NRC 

developed and implemented a process to document risk-informed decisions (including 

decisions to shut down a plant) dealing with emergent issues. The guidance, which is 

provided in the Office of Nuclear Reactor Regulation’s Office Instruction LIC-504 

(NRC, 2010a), follows the general principles of risk-informed decisionmaking described

in RG 1.174 and places a strong emphasis on documenting the decision so that factors 

driving the decision are identified and suitably qualified to address uncertainties.

• Generic issues: The NRC uses PRA results to support the assessment and disposition 

of potential safety issues that can affect more than one plant. The Generic Issues 

Program is described in NUREG-0933 (NRC, 2011d). The approach used to determine 

whether further regulatory assessment and action should be recommended is described 

in the NRC’s Management Directive 6.4 (NRC, 2009c) and the NRC Office of Nuclear 

Regulatory Research’s Office Instruction TEC-002 (NRC, 2010b).

Decision Support

• SPAR models. The NRC maintains a fleet of Level 1, at-power, internal events PRA 

models covering all U.S. commercial operating reactors. There are also a limited number 

of models addressing fires and external hazards, low power and shutdown operations, 

and some new reactors. These models are used in a variety of regulatory applications, 

as discussed above. A discussion of the models is provided by Appignani, Sherry, and 

Buell (2008). SECY-14-0107 (NRC, 2014a) provides a recent status report.

• Consequence analyses. The NRC uses PRA results to identify accident scenarios 

potentially worthy of detailed examination in accident consequence analyses, such 

as the recent State-of-the-Art Reactor Consequence Analyses documented in 

NUREG-1935 (NRC, 2012d). Such analyses also provide tools and results that can be 

useful for subsequent PRAs.

• Risk management methods. Recently, the NRC has published NUREG-2150 

(NRC, 2012a), which proposes a risk management regulatory framework that could be 

used to improve consistency among the NRC’s reactors, materials, waste, fuel cycle, 

and transportation programs and discusses implementing such a framework for specific 

program areas.
13

R9. Why does the NRC use PRA in regulatory decisionmaking?

Past PRAs have provided valuable safety perspectives and supported effective improvements. 

Using a top-down approach that starts with the definition of a decision problem, derives the 

quantitative measures of risk important to that problem, and develops plant-specific models to 

assess those measures, PRA enables an open, integrated treatment of diverse safety issues 

and the evaluation of the impact of potential changes consistent with the current state of 

knowledge.

Starting with WASH-1400 (NRC, 1975), NPP PRAs have provided important, actionable safety 

insights and lessons. WASH-1400 pointed out, contrary to the prevailing view of the time, that 

some accidents (e.g., a loss-of-coolant accident resulting from a small pipe break) less severe 

than a plant’s design-basis accident (a loss-of-coolant accident resulting from a large pipe 

break) could be more important to risk (Beckjord, Cunningham, and Murphy, 1993). Thus, it was 

important to explicitly identify, analyze, and ensure appropriate defenses against such 

scenarios. WASH-1400 also showed the risk significance of so-called “non-safety” systems 

(e.g., a plant’s auxiliary feedwater system), human error, and the failures of multiple, redundant 

components because of a single cause (common-cause failures). Thus, these systems and 

failures deserved a high level of attention.

Subsequent PRAs performed by the nuclear industry (e.g., see (Garrick, 1989) and (Gaertner, 

True, and Wall, 2003)) and by the NRC (e.g., NUREG-1150 (NRC, 1990)) demonstrated the risk 

significance of scenarios involving widespread loss of electrical power (the so-called “station 

blackout” scenarios), scenarios involving the loss of the plant’s ultimate heat sink, and scenarios 

triggered by hazards originating within the plant (notably fires and floods) and those outside 

(notably earthquakes, high winds, and floods). Importantly, these studies showed that, although 

broad, fleet-wide statements could be made about potentially risk-significant scenarios, the 

important scenarios for a particular plant were highly plant-specific. Technical details in the plant 

design and operation were (and continue to be) important factors in determining the dominant 

contributors to risk.

Especially in the early years before the widespread use of PRA, the lessons derived from PRA 

were not always consistent with then-current wisdom. Moreover, it was recognized that the PRA 

models, as with any engineering analysis models, were (and remain) imperfect representations 

of reality. Nevertheless, industry and regulatory decisionmakers took major actions suggested 

and supported by PRAs.

These early PRAs were generally performed for anticipatory reasons, and not in reaction to 

actual accidents, incidents, or inspection findings. Nevertheless, their results and insights 

prompted numerous actions. Arguably, this can be attributed to some key features of a 

PRA model:

• Top-down. A PRA modeling effort generally starts with the specification of a decision 

problem (or class of problems) to be solved. Once the problem is specified, the factors 

affecting the decision (notably, the measures of risk—“risk metrics”—in the case of 

risk-informed decisions) can be identified and the models needed to assess these 

factors developed. Thus, the PRA model is focused on issues relevant to the 

safety decision.
14

• Engineering-oriented. Nuclear power plant PRA models are structured to directly 

represent plant SSCs and plant responses to abnormal conditions (including operator 

actions). Thus, the scenarios generated by a PRA (each of which represents a “story”) 

can be understood by people directly responsible for plant safety who are not 

necessarily specialists in PRA modeling.

• Integrated. Severe accident scenarios typically involve a wide variety of events and 

phenomena. Inputs are often needed from a variety of diverse engineering and scientific 

disciplines, including plant operations (e.g., to identify expected and potential hardware 

and crew responses to abnormal events), human factors (e.g., to identify the potential 

effects of different plant conditions), thermal hydraulics (e.g., to assess plant transient 

behavior and determine the equipment performance required to avoid fuel damage), civil 

engineering (e.g., to assess the performance of plant structures under seismic or 

post-core damage conditions), the geosciences (e.g., to assess the likelihood and 

magnitude of external hazards such as earthquakes or floods), and specialized 

disciplines (e.g., to model the effects of fire and explosions). A PRA model provides 

a single, consistent framework needed to weigh and combine the inputs from these 

different disciplines. Moreover, it enables decisionmaking across very different scenarios 

(e.g., a scenario initiated by a reactor coolant system pipe break versus one initiated by 

a turbine-generator oil fire versus another one initiated by a hurricane storm surge). This 

decisionmaking typically involves PRA-suggested solutions that are effective across a 

wide range of scenarios, as well as tradeoffs between scenario-specific solutions.

• Systematic. Although other less formal processes (e.g., brainstorming) can be used 

to identify and characterize potentially important accident scenarios, PRA tools and 

techniques provide the support needed for a systematic assessment of such complex 

facilities as NPPs. No practical engineering analysis approach can guarantee that all 

potentially important scenarios are identified—all tools rely on our current state of 

knowledge—but the PRA modeling process, which asks the fundamental question “what 

can go wrong?”, at least prompts the analyst to look for possibilities that might otherwise 

be overlooked. PRA models also, by their nature, include combinations of identified 

possibilities that could easily be missed by less systematic approaches.

• Sufficiently realistic. In general, PRA models are aimed at assessing accidents that are 

sufficiently rare that they cannot be validated against accident statistics. As discussed in 

FAQ R7, the NRC’s 1995 PRA Policy Statement requires that PRA evaluations used in 

support of regulatory decisions should be as realistic as practicable. In this context, the 

term “realistic” means that conservatisms are not deliberately introduced into the PRA 

model to compensate for uncertainties. The NRC’s confidence that PRA models can be 

sufficiently realistic for decisionmaking purposes stems from (1) the models’ use of 

available, relevant information, including empirical data and research results 

(e.g., regarding the causes and likelihood of human error), in identifying and quantifying 

model sub-elements (e.g., the failure rate of a particular component), (2) the formal and 

informal PRA model reviews performed prior to and during model application, and (3) the 

existence of various activities and programs (e.g., inspections, operational experience 

reviews, accident precursor studies) that have identified issues in PRA modeling 

approaches as well as with specific models.

• Supportive of “what-if” analyses. As with other systems analysis methods, PRA provides 

a mechanism for proactively assessing events that have not yet occurred and for plant 
15

changes that have not yet been made, and for exploring the impact of different modeling 

conditions and assumptions on the results of such assessments. Thus, a PRA model 

provides the means to assess the risk impact of different decision options.

• Openness. Again, as with other systems analysis methods, a well-documented PRA 

model enables a reviewer to trace how model inputs are transformed into outputs, to 

identify important modeling features and assumptions, to see whether and how specific 

issues are modeled, and to identify “what-if” analyses to explore the potential 

implications of alternate modeling assumptions. The understanding resulting from such 

explorations (and from answers to questions stemming from exploration) can improve 

confidence in the model and its results.

In general, as stated in its PRA Policy Statement (NRC, 1995), the NRC believes that the use of 

PRA leads to an improved regulatory process by enhancing safety decisionmaking, making 

more efficient use of agency resources, and reducing unnecessary burden on licensees.

Comparing a probabilistic approach with a deterministic approach, the Policy Statement 

provides the following:

The NRC has generally regulated the use of nuclear material based on 

deterministic approaches. Deterministic approaches to regulation consider a set 

of challenges to safety and determine how those challenges should be mitigated. 

A probabilistic approach to regulation enhances and extends this traditional, 

deterministic approach, by: (1) Allowing consideration of a broader set of 

potential challenges to safety, (2) providing a logical means for prioritizing these 

challenges based on risk significance, and (3) allowing consideration of a 

broader set of resources to defend against these challenges.

It should be emphasized again that, in the NRC’s risk-informed decisionmaking environment

(see FAQ R6), PRA results do not constitute the sole basis for decisionmaking. Information from 

a variety of sources (including traditional engineering analyses and expert panels) is also used 

as appropriate to the decision at hand. Further, as discussed in RG 1.174 (NRC, 2011a), 

monitoring and inspection programs are used to ensure that PRA model assumptions 

remain appropriate.

R10. If nuclear power plant accident statistics are available, is there a need for PRA?

Statistical estimates for nuclear power plant accident rates are based on modeling assumptions 

that are usually inappropriate for regulatory decisionmaking. PRA remains necessary to bring in 

important design-, site-, and plant-specific information not addressed by such estimates and to 

evaluate the impact of potential changes.

Nuclear power plant accidents are rare events, and any lessons following an accident should 

be seriously considered when taking actions aimed at preventing future such occurrences. In 

recent years, there have been attempts to derive statistical estimates of NPP accident rates 

based solely on accident data. Examples are studies published by Cochran (2011, 2012), 

Lelieveld, Kunkel, and Lawrence (2012), Kaiser (2012), and Gallucci (2012) following the 

March 2011 Fukushima Dai-ichi reactor accidents.8

 8 These statistically derived estimates of CDF are further discussed in FAQ C2. FAQ C3 discusses PRA-derived 

CDFs. Similarly, FAQ L2 discusses statistically derived estimates of LERF, and FAQ L3 discusses PRA-derived 

estimates.
16

However, it is important to recognize that these estimates are based on a strong modeling 

assumption: all plants in the analyzed group are of identical design and are operating under 

the same conditions. In mathematical terms, all of the plants in the analyzed group over the 

analyzed time period are assumed to be “exchangeable.” Only when this assumption of 

exchangeability is valid can past accidents be used to say something about the future behavior 

of plants in that group.

The assumption of exchangeability of plants is not valid because of two major reasons: plant 

risk is heavily dependent on plant-specific details (e.g., design and operations), and major 

safety improvements have been made over time in reaction to analyses of hypothetical 

accidents (such as in PRAs) or actual accidents.

Broad discussions of plant changes spurred by PRAs can be found in a number of sources, 

(e.g., (Garrick, 1989) and (Gaertner, True, and Wall, 2003)). Numerous plant-specific 

discussions of PRA-prompted changes can be found in licensee-submitted risk-informed license 

amendment requests (LARs), which are publicly available through the NRC’s Agencywide 

Documents Access and Management System (ADAMS),

9 and in the NRC staff’s reviews of 

licensee analyses of potentially cost-effective SAMAs performed to support plant license 

renewal applications. These latter reviews are published in plant-specific supplements to 

NUREG-1437 (NRC, 2013b).

Of course, PRAs employ modeling assumptions as well, and it is important to validate these 

assumptions with empirical information when such information becomes available. However, 

as discussed in FAQ R10, PRA is valuable for decision support because it brings in a broader 

range of information (including non-statistical, phenomenological information regarding accident 

causation and progression), identifies and analyzes possibilities not yet seen in actual incidents 

or accidents, and enables the identification and analysis of potential improvements.

 9 Currently, risk-informed LARs can be found using the advanced ADAMS search capability that can look for specific 

terms in the document content (e.g., “CDF”) as well as key words in the document title (e.g., “license amendment 

request”).
17

3. PRA BASICS

In discussions of accident statistics and probabilistic risk assessments (PRAs), one sometimes

hears statements directly or implicitly indicating misconceptions regarding PRA. This section 

provides the following frequently asked questions (FAQs) addressing the philosophy and 

practice of PRA.

B1. What is PRA?

B2. Do PRAs predict the future?

B3. If a PRA quantifies likelihoods in terms of probabilities, what are frequencies?

B4. What is the meaning of the percentiles for CDF reported by some PRAs?

B5. In situations in which the CDF is highly uncertain, is the mean CDF a meaningful 

quantity for regulatory decisionmaking?

B6. What are aleatory and epistemic uncertainties and why do we distinguish between 

the two?

B7. What is the most valuable output of a PRA?

B8. Are PRAs supposed to be conservative?

B9. Is PRA a mature analysis technology?

B10. How are PRAs updated to reflect operational experience and other 

new information?

B11. What is the current international status of nuclear power plant PRA and 

risk-informed decisionmaking?

B12. Is PRA limited to event tree/fault tree analysis?
18

B1. What is PRA?

“PRA” is an acronym standing for “Probabilistic Risk Assessment.” It is also called “Probabilistic 

Safety Assessment” (PSA). PRA answers three fundamental questions: What can go wrong? 

How likely is it? And, what are the consequences?

PRA 1 is an engineering analysis process that models a nuclear power plant (NPP) as a system.

By answering the three fundamental risk questions (see FAQ R2), it provides both qualitative 

and quantitative information. It builds on and represents the current state of knowledge 

regarding (1) what design, operation, and environmental (physical and regulatory) aspects of 

the plant are important to risk, what elements are not important, and why, and (2) what is the 

magnitude of the risk associated with the overall plant.

An NPP PRA model will, for some plant operational mode (e.g., at-power operation, low power 

conditions, shutdown conditions), typically delineate and analyze a large number of accident 

scenarios, starting with an “initiating event,” (i.e., a disturbance to plant normal operations such 

as the loss of coolant), an internal hazard (e.g., a fire or flood starting within the plant 

boundaries), or an external hazard (e.g., an earthquake or external flood), and ending 

with some level of consequence.

Regarding consequences, the definition of PRA is sufficiently broad to encompass a wide 

variety of analysis endpoints. Thus, depending on the needs of the decision problem at hand, 

a PRA can assess consequences in terms of core condition (this is the endpoint of a 

Level 1 PRA), radioactive material release from the plant (a Level 2 PRA), or offsite effects (a 

Level 3 PRA).

The general framework for performing an NPP PRA was first proposed by Farmer in 1967 

(Farmer, 1967). This framework emphasized a probabilistic approach involving the treatment 

of a wide spectrum of accident scenarios (thereby avoiding the need to distinguish between 

“credible” and “incredible” accidents), the use of logic models to identify these scenarios, the 

use of reliability engineering methods (including statistical analysis for component performance)

to quantify scenario likelihoods, the use of expert judgment to assess the performance of 

structures, and the calculation of public health consequences from potential releases. This 

framework was, with some improvements, implemented in the U.S. Nuclear Regulatory 

Commission’s (NRC’s) Reactor Safety Study (WASH-1400), the first comprehensive NPP PRA 

(NRC, 1975). Other notable past U.S. PRA studies 2 include the first industry-sponsored Indian 

Point and Zion PRAs (notable from a technical perspective for their systematic treatment of 

uncertainties, internal hazards, and external events; the Indian Point study is also notable from 

a regulatory perspective for its use in an adjudicatory process),3 the industry’s individual plant 

examinations (IPEs) and individual plant examinations of external events (IPEEE) performed in 

response to the NRC’s Generic Letter 88-20 (NRC, 1988) and supplements (notably 

NRC, 1991), the NRC’s risk study of five plants documented in NUREG-1150 (NRC, 1990), and 

the NRC’s follow-on study of low-power and shutdown (LP&S) risk at two plants (Chu,

et al., 1993), (Whitehead, et al., 1994).

 1 The international community uses the term “probabilistic safety assessment” (PSA) instead of PRA (IAEA, 2010). 

For all intents and purposes, these terms are equivalent. 2 See FAQ B11 for a discussion of international PSAs. 3 Remarks on these proprietary studies are provided by Garrick (1984, 1989). The NRC-sponsored reviews of these 

studies are documented in NUREG/CR-2934 (Kolb, et al., 1982) and NUREG/CR-3300 (Berry, et al., 1984). The 

findings and recommendations of the Atomic Safety Licensing Board and the Commission’s ultimate decisions can 

be found in the NRC’s public records (ASLB, 1983), (NRC, 1985).
19

Since the performance of the initial IPE and IPEEE studies, most U.S. plants have updated 

their PRA studies in support of various risk-informed applications (primarily involving license 

amendment requests) and to support the identification and analysis of potentially cost-effective 

severe accident mitigation alternatives in support of plant license renewal applications. The 

results of these studies are discussed in FAQs C3 and L3.

B2. Do PRAs predict the future?

No, PRAs do not make predictions. PRAs identify potential accident sequences and produce 

statements regarding their likelihood and consequences, thereby informing our current state of 

knowledge on which decisions are based.

As a simple analogy, consider a single roll of two dice (which is known to be fair), and assume 

the sum of the two dice face values will be analyzed. A probabilistic model will conclude that the 

most likely outcome is a “7” (with probability (6/36) = 0.17), and the least likely outcomes are “2” 

and “12” (each with probability (1/36) = 0.028). The probabilistic model does not suggest that 

the next roll will be “7.” It only says that this value is the most likely to occur (based on current 

knowledge). In addition, even though a “7” is the most likely outcome, its probability is fairly low.

All this information would be useful to a gambler who might be willing to bet on the outcome of a 

roll. The intent is not to predict the outcome of that roll but to inform the gambler’s state of 

knowledge regarding the likelihood of the potential outcomes.

Similarly, an NPP PRA enumerates the numerous ways an accident can occur and indicates 

which scenarios are more likely than others (based on current information). If the next accident 

involves the most likely scenario, this does not mean the PRA was “right.” Similarly, if the next 

accident involves a much more unlikely scenario, this does not necessarily mean the PRA was 

“wrong.” In both cases, a detailed comparison of the causal mechanisms built into the PRA with 

those underlying the actual accident will shed more light on the PRA’s representation of reality, 

but it must be recognized that any scenario included in the PRA is believed to be possible.

The converse is not necessarily true (i.e., that scenarios not included in the PRA are believed 

to be impossible). Scenarios can be excluded in situations in which they are believed to be 

unimportant relative to the decision problem at hand. Also, of course, scenarios can be 

excluded because of limitations in the state of knowledge when the PRA was developed 

(assuming that the PRA had been properly reviewed). Incompleteness of our state of knowledge 

is a fact that is readily acknowledged by decisionmakers. The thousands of accident sequences 

that PRAs identify help to reduce this incompleteness, but do not eliminate it.

B3. If a PRA quantifies likelihoods in terms of probabilities, what are frequencies?

The frequency of an event is the average number of occurrences of that event or accident 

condition per unit of time (usually 1 year in PRAs).

The frequency of an event does not imply that the event will occur at regular intervals. Thus, for 

example, if the loss of offsite power frequency at a plant is 5×10−2

/yr, this does not mean that 

the plant will suffer a loss of offsite power once every 20 years. It means that the statistical 
20

average of the time between such events (where this time interval is a random variable) is 

20 years.4

Note that for very small event frequencies (e.g., 10−4

/yr), the associated average time between 

events (10,000 years in this case) is a theoretical concept. The practical value of the event 

frequency is twofold: (1) it can be used to compute the probability of occurrence of an event in a 

given time interval, and (2) it can be used to compute the frequency (and probability) of multiple, 

jointly occurring events (such as those in an accident scenario).

Appendix A provides a detailed discussion on the concept of frequency as it is used in 

PRAs and on the mathematical connection between event frequencies and probabilities.

B4. What is the meaning of the percentiles for CDF reported by some PRAs?

The percentiles for CDF indicate the assessor’s degree of uncertainty in the value of CDF.

The Pth percentile for core damage frequency (CDF), CDFP, is 100 times the probability that the 

true value of CDF is less than CDFP. Thus, for example, the 95th percentile for CDF, CDF95, is 

that value for which there is a 0.95 probability that the value of CDF is less than CDF95. PRAs 

that report CDF percentiles often report the 5th and 95th percentiles as indicators of the 

potential range of CDF.

Notes—

• The CDF percentiles are indicative of the probability distribution that quantifies 

the assessor’s state of knowledge regarding CDF (i.e., the assessor’s epistemic 

uncertainties).

5 Closer percentile values indicate a smaller degree of uncertainty in the 

range of possible values for CDF.

• The uncertainties in CDF because of specific contributors or scenarios can be very large 

(perhaps with 5th-to-95th percentile ranges spanning multiple orders of magnitude). 

However, the total plant CDF, which is the sum of the CDFs from all contributors, will 

have a significantly smaller spread, as conceptually illustrated in Figure 3-1. FAQ C7 

provides more discussion on the magnitude of uncertainties in total CDF.

 4 Note that the definition of frequency provided in NUREG-2122 (USNRC, 2013c) refers to the “expected” number of 

occurrences. Recognizing that the terms “expected value,” “average,” and “mean” are synonymous in the field of 

probability and statistics, NUREG-2122 is mathematically correct. This report uses the term “average” to avoid any 

implications that a particular value is actually expected in a broad sense. 5 See FAQ B6 for a discussion of epistemic (and also aleatory) uncertainties.
21

Figure 3-1 Illustrative probability density functions for CDF 

(adapted from Garrick, 2014)6

B5. In situations in which the CDF is highly uncertain, is the mean CDF a meaningful 

quantity for regulatory decisionmaking?

The mean CDF is a useful metric for risk-informed decisionmaking because it is relatively simple 

to compute and use, and it provides some accounting for uncertainties. This usefulness does 

not rely on the intuitive meaningfulness of the metric.

The mean value is a mathematical quantity that, although precisely defined,7 has no everyday

intuitive meaning.

Consider a situation in which we are estimating the mean CDF for a plant whose CDF is 

described by a lognormal distribution with 5th and 95th percentiles of 10−6

/reactor-year (RY)

and 10−4

/RY, respectively. In this situation, as shown in Figure 3-2, the CDF mode equals 

1.4×10−6

/RY, the CDF median equals 1.0×10−5/RY, and the CDF mean equals 2.7×10−5/RY. In 

this case, the mean value corresponds to the 76th percentile of the CDF distribution. It is neither 

the most likely value (i.e., the mode), nor an indication of the “middle” of the distribution (i.e., the 

median 8

). For situations involving larger degrees of uncertainty, the mean value will correspond 

to even higher percentiles of the distribution.

Although the mean value does not have an intuitive meaning, it is still useful in decisionmaking. 

First, and not to be discounted, it is clearly defined, is easily computable, and is a scalar (i.e., a 

 6 The probability density function for an uncertain variable X can be viewed as representing the probability that X

“equals” any selected value x. More formally, the function is proportional to the probability that X takes on a value in 

the interval (x,x+dx), where dx is an infinitesimally small value. 7 For a positively valued random variable X, the mean value (also called the average or expected value) is defined 

by:

mean value of X ≡ � x∙fX(x)dx

∞

0

 where fX(x) is the probability density function for X. 8 More precisely, the median is the value for which there is equal likelihood that the uncertain variable—CDF in our 

case—is greater or lesser. In other words, as shown in Figure 3-2, the area under the probability density function 

curve to the left of the median equals 0.50, as does the area under the curve to the right of the median.
22

single value). The last characteristic means that it can be easily compared with simple criteria, 

which allows decisionmakers to make informed decisions without needing to consider the full 

results of a detailed uncertainty analysis.9 Also, because it is computed using the entire 

probability distribution, the mean value provides some reflection of the uncertainty quantified by 

that distribution. (Note that the median is not affected by the length of distribution tails (i.e., the 

possibility of large deviations from the distribution center), and the mode, in most practical 

situations, represents only one point on the distribution.) Finally, in formal theories of 

decisionmaking, it can be shown that the mean value is the theoretically appropriate metric 

to use under certain conditions.

Regulatory Guide (RG) 1.174 (NRC, 2011a) emphasizes the use of the mean value, stating that 

“Because of the way the acceptance guidelines ... were developed, the appropriate numerical 

measures to use in the initial comparison of the PRA results to the acceptance guidelines are 

mean values.”

Figure 3-2 Example CDF distribution with key characteristics

B6. What are aleatory and epistemic uncertainties and why do we distinguish between 

the two?

Aleatory uncertainty, also referred to as “stochastic,” “statistical,” or “random” uncertainty, 

is uncertainty that arises because of inherent variability in a modeled process. Epistemic 

uncertainty, also referred to as “state-of-knowledge” uncertainty, is uncertainty that arises 

because of limitations in the state of knowledge of the assessor. The distinction between 

aleatory and epistemic uncertainties is a modeling decision and not absolute. However, it is 

useful for ensuring the clarity of PRA models and therefore in interpreting and communicating 

the results of these models.

 9 During the development of RG 1.174, different treatments of uncertainty were discussed. Some involved the use of 

two criteria (e.g., the mean value and the 90th percentile). The staff eventually decided to use a single criterion 

based on the mean value.
23

The conceptual distinction between aleatory and epistemic uncertainties, discussed in a PRA 

context by Apostolakis (1978, 1990, 1994),10 is well-established by longstanding modeling 

conventions in many parts of a PRA model. Thus, for example, the number of times a pump will 

fail on demand in a series of repeatable trials, which is unknown prior to executing the trials, is 

treated as an aleatory variable. On the other hand, the underlying failure rate of the pump, 

whose precise value is unknown even after the trials are executed (because a different set of 

trials could lead to a different set of successes and failures), is treated as an epistemic 

parameter. Similarly, the number of core damage accidents over a set period of time is treated 

as an aleatory variable, whereas the underlying CDF is an epistemic parameter estimated using 

a PRA model.

There are situations in which the distinction is less clear cut (Siu, 1999), (Siu et al., 2000). As 

pointed out by Apostolakis (1990 and 1994), the assessor must take care to clearly articulate 

the “model of the world,” the model which, among other things, defines what the assessor 

chooses to treat as “random” and unknowable versus what is deterministic and knowable. 

Through this articulation, the assessor can precisely state what the PRA’s statements on 

uncertainty are referring to. Rather than generic references to “the uncertainties in the analysis,” 

the assessor can point to uncertainties in specific quantities, thereby aiding the communication 

of results to decisionmakers.

Appendix A provides additional discussion on aleatory and epistemic uncertainties.

B7. What is the most valuable output of a PRA?

The relative value of the qualitative (accident sequences) and quantitative (frequencies) outputs 

of a PRA depends on the information needs of the decision problem at hand; neither one nor 

the other can be stated to be more important independently of the decision context.

In discussions of the strengths and weaknesses of PRA, one sometimes hears, “The 

quantitative results are meaningless—only the insights matter.” Conversely, discussions of PRA 

results sometimes focus too readily on the numerical results (e.g., the mean CDF) and ignore 

the valuable qualitative information conveyed by accident scenarios.

Clearly, both of these points of view are limited. Quantitative results play an explicit role in those 

risk-informed regulatory applications that employ numerical guidelines, particularly for CDF and 

large early release frequency, following the lead established by RG 1.174 (NRC, 2011a). 

Numerical results also enable comparisons of risk contributions across disparate scenarios 

(e.g., scenarios initiated by plant hardware failures versus those initiated by external natural 

phenomena). On the other hand, neglect of qualitative information and insights ignores PRA’s 

value in conveying an understanding of sources of risk, underlying reasons, and possible 

sources of improvement. PRA results are valuable when they can support effective 

decisionmaking.

 10 The terminology “aleatory” and “epistemic” uncertainties was introduced to the nuclear PRA community by 

Apostolakis (1994) and Budnitz et al. (1997), and later echoed in Regulatory Guide 1.174 (USNRC, 1998b). Earlier 

discussions in the PRA literature variously refer to “statistical” and “frequency” distributions in representing the 

former and “state-of-knowledge” distributions in representing the latter.
24

B8. Are PRAs supposed to be conservative?

PRAs are expected to be realistic. Although some conservative assumptions are inevitable, 

analysts should strive to avoid bias and to characterize uncertainty. This helps ensure that 

decisionmakers are presented with a reasonable representation of the current state of 

knowledge regarding risk. The decisionmaker may decide to make conservative decisions 

to account for uncertainties.

NRC’s principles of good regulation (see NRC, 2014b) include the following statement: “Final 

decisions must be based on objective, unbiased assessments of all information....” With respect 

to PRA, the Advisory Committee on Reactor Safeguards states, “A PRA should be done 

realistically. The proper time to add an appropriate measure of conservatism is when its results 

are used in the regulatory process. If the PRA itself is done with conservative assumptions ... 

and is then used in a conservative regulatory decisionmaking process, self-deception can result, 

or resources can be squandered.” (ACRS, 1991). The need for realism is re-emphasized in the 

NRC’s 1995 PRA Policy Statement: “PRA evaluations in support of regulatory decisions should 

be as realistic as practicable...” (NRC, 1995). Thus, the role of the analyst is to provide the 

decisionmaker with the best possible information. It is important to recognize that realism 

includes explicit consideration of uncertainties, given the possibly large uncertainties in any 

assessment of rare events. Characterizations of risk that ignore these uncertainties are likely 

to be misleading.

In practice, PRAs are often performed in an iterative fashion to focus analytical resources on the 

most important scenarios. In this iterative approach, scenarios are initially analyzed using 

conservative modeling assumptions, and scenarios that appear to be important are further 

analyzed using progressively more realistic assumptions. This approach increases 

computational efficiency, but care is needed when using the model and results in situations for 

which the analysis was not originally performed (e.g., when performing conditional analyses 

involving the assumed failure of particular components).

B9. Is PRA a mature analysis technology?

PRA methods, models, tools, and data are sufficiently mature to support risk-informed 

decisionmaking at the NRC.

Although judging the maturity of a technical field is a subjective matter, some rigor can be 

introduced by a systematic consideration of key factors. Different authors have identified some

characteristics they consider to be indicators of maturity. Stetkar, Shack, and Nourbakhsh 

(2011), in a discussion of the current status of efforts to risk-inform plant fire protection 

programs, distinguish between the maturity of an analysis technology (which dictates what level 

of analysis is possible) and the maturity of the application of that technology (which indicates 

what is happening in the field). They also tie the notion of maturity to the number of experienced 

analysts performing fire PRAs. Budnitz (1998) provides similar indicators in a discussion of the 

state of seismic PRA, referring to the number of practitioners (or groups of practitioners), the 

degree of practice, and the state of technical development of the field (including the availability 

of detailed guidance for new practitioners). Budnitz emphasizes the use of the technology in 

support of practical decisionmaking as an important indicator of maturity. Cornell (1981), in a 

discussion on the state of structural safety engineering, describes characteristic situations 

associated with the different stages of development of a technical field based on his 

observations from a number of fields (including geotechnical engineering, structural dynamics, 
25

and finite element analysis). Table 3-1 provides a summary of Cornell’s discussion, grouping his 

situations into one of three categories of indicators involving the field’s practitioners, research 

agenda, and applications.

The above discussion indicates that NPP PRA is, on the whole, in an intermediate-to-late 

stage of maturity.11 PRA results have been used to support major decisions, starting with the 

Commission’s 1985 decision to allow continued operation of the Indian Point Plants 

(NRC, 1985), continuing with plant changes identified in the IPEEE program (NRC, 2002), and 

more recently with staff approvals of licensee-requested fire protection program transitions 

(Hamzehee, 2014). These show that the technology is being used in practical applications. 

Further, it appears that the field has many of the characteristics shown in the third column of 

Table 3-1 and a few of those in the second column.

It is important to recognize that the existence of reducible uncertainties (with an associated 

need for research and development (R&D)) does not necessarily imply that the discipline is 

immature. As indicated in Table 3-1, even mature technologies have needs for R&D.

It is also important to recognize that the issues of PRA maturity and realism, although related, 

are actually separate. The concept of maturity addresses the relative state of development of a 

technical discipline. On the other hand, in a PRA context, the concept of realism addresses the 

degree to which an analysis represents the technical and organizational system relevant to the 

decision problem. The analytical technology (i.e., methods, models, tools, and data) of a less 

mature discipline could, but need not, produce unrealistic analysis results. Conversely, a more 

mature discipline could, for practical reasons, employ technology with known weaknesses, only 

requiring that the weaknesses be understood and appropriately addressed in the 

decisionmaking process.

 11 There are variations within the field. For example, the treatment of internal events scenarios is more mature than 

the treatment of some external hazards (e.g., tsunamis).
26

Table 3-1 Indicators of Stages of Technical Maturity (adapted from Cornell, 1981)

B10. How are PRAs updated to reflect operational experience and other new 

information?

Over the years, with the accumulation of operational experience from actual events and lessons 

from analyses, PRA models have been expanded to include new accident scenarios, and the 

values of PRA model parameters have been re-estimated. PRA standards and guidance help 

ensure that PRAs used to support decisionmaking reflect current knowledge.

PRA models can be characterized by (1) their structure (often represented using event trees 

and fault trees) which identifies possible accident scenarios and (2) the numerical values of their 

parameters (e.g., component failure rates). An important example of PRA model structure 

changes spurred by actual events is provided by the introduction of detailed models for fire 

scenarios following the 1975 Browns Ferry fire (Scott, 1976). WASH-1400 (NRC, 1975), which 

was published as a draft report in 1974 and as a final report in 1975, provided only a cursory 

analysis of the risk implications of that fire. As lessons from the fire became available, detailed 

fire PRA methods and models were developed and used in the industry-sponsored Zion and 

Indian Point studies (Apostolakis, Kazarians, and Bley, 1982).

Developmental Stage

Early

(Infancy, Emerging)

Intermediate

(Adolescent, Developing)

Late

(Mature, Stable)

Practitioners

• Small research 

community

• Small number 

of practitioners

• Strong personality 

influences, 

competing 

schools of thought

• Larger number of 

practitioners

• Larger number 

of experienced 

researchers

• Many well-trained and 

experienced practitioners

• Recognize limits of 

applicability of methods

• Can adapt methods to 

new situations

• Can work with researchers 

to identify important issues

Research 

Agenda

• Driven by 

perceived needs

• Problem selection 

affected by 

personal choice 

(e.g., because of

ease of 

formulation or 

solution)

• New practice-driven 

research problems

• Some consensus 

positions for some 

broadly defined 

problem areas

• Some unproductive 

research lines 

abandoned

• Incomplete coverage 

of topics

• Most research driven by 

needs of practice

• More abstract research 

addresses needs clearly 

identifiable by all 

concerned

Applications

• Local applications 

(addressing small 

parts of larger 

problems)

• No broader 

framework

• Fast growth

• Developing vocabulary

• Optimistic views on 

new methods; 

limitations not 

well understood

• Vocabulary has evolved

• General framework exists

• Little “selling” of area
27

An example of model structure changes spurred by analyses is provided by the introduction of 

analyses for accident scenarios occurring during LP&S operation. Consideration of these 

scenarios was prompted by a French study (Lanore, 1990), (Brisbois, et al., 1991), which 

showed that the CDF during LP&S operations could, under some conditions, be comparable to 

the CDF associated with full-power operations. In reaction to this finding, the NRC sponsored 

LP&S analyses of two plants (Chu, et al., 1993), (Whitehead, et al., 1994) as a follow-up to the 

well-known NUREG-1150 (at-power) study (NRC, 1990). Nowadays, the need to consider LP&S

risk is internationally recognized.

Regarding the numerical values of PRA model parameters, the NRC has performed a number 

of studies assessing the statistical performance of selected nuclear components based on 

operational experience and comparing the results of these assessments against values used in 

the NUREG-1150 and IPE studies. These component studies, which are documented in the 

NUREG-1715 series of reports, (e.g., NRC, 2000) indicate general consistency between the 

statistical estimates and the parameter values used in the PRAs (recognizing that there are 

uncertainties in both).

12 This is not surprising because PRA component failure rates are derived 

using operating experience, as explained below. The assumption of exchangeability is 

approximately valid at the component level.

To provide up-to-date parameter estimates consistent with the latest experience, Bayesian 

updating statistical methods, as discussed in current PRA standards (ASME and ANS, 2009) 

and described in guidance documents, (e.g., NUREG/CR-6823 (Atwood, et al., 2003)), are 

routinely used both in plant-specific PRAs and in generic studies performed to develop 

industrywide estimates for such parameters as initiating event frequencies. An example of the 

latter is provided in NUREG/CR-6928 (Eide, et al., 2007). An interesting observation is that 

initiating event frequencies used in early PRAs, and which were derived from expert judgment,

turned out to be higher than estimates produced by statistical analysis.

B11. What is the current international status of nuclear power plant PRAs and 

risk-informed decisionmaking?

PRAs, often referred to as PSAs internationally, are widely used to support safety-related 

decisionmaking. Increasingly, these PRAs are Level 2 studies that cover internal events, 

internal hazards (notably fires and floods), and external hazards.

A recent survey of probabilistic safety assessment (PSA) uses is provided by a Nuclear 

Energy Agency (NEA) survey of NEA members and participating nonmembers (OECD, 2012).

As described in the NEA report and summarized by Lanore, Siu, and Amri (2012), the 

performance of PSA is widely encouraged in the surveyed countries. In many countries, PSAs 

are required for operating plants, typically as part of the documentation required for periodic 

safety reviews. Moreover, most of the surveyed countries require PSAs for new plants. Several 

of the countries have defined and use reference values for risk and associated metrics 

(e.g., CDF), and several countries have developed PSA standards and guidance documents.

 12 The NRC has also sponsored a series of studies investigating the statistical performance of selected systems 

typically modeled in PRAs. These system studies are documented in the NUREG/CR-5500 series of reports 

(e.g., Poloski, et al., 1998). As discussed by Rasmuson, et al. (1998), the statistical- and PRA-based estimates for 

system reliability were reasonably consistent for four of the five system types compared; the comparison for the 

fifth system was hindered by limited operational data. 
28

The report observes that all operating plants in the surveyed countries have a Level 1 internal 

events PSA and that many have Level 2 (or at least a “Level 1+”13) PSA. In several cases, the 

PSAs address events during LP&S operation as well as at-power operation, and many address 

internal hazards (fires and floods) and external hazards (e.g., earthquakes, high winds, floods) 

as appropriate to their sites. In general, many of the surveyed countries are moving to develop 

Level 2 PSAs that (1) address all modes of operation (at-power, low-power, and shutdown 

conditions) and all initiating events (including those caused by internal and external hazards) 

and (2) are regularly updated. The report also observes a wide range of PSA applications, 

including design evaluations, operational decisions (e.g., regarding the timing of refueling 

outages and the performance of maintenance), and the analysis of operational events.

B12. Is PRA limited to event tree/fault tree analysis?

The definition of PRA is sufficiently broad to accommodate any systematic engineering analysis 

that answers the three fundamental questions: What can go wrong? How likely is it? What are 

the consequences?

Most current U.S. PRA efforts are focused on Level 1 PRA. These analyses typically use 

logic-based models (event trees and fault trees) to define accident scenarios and to compute 

the probabilities of these scenarios. However, PRAs can employ alternate modeling approaches 

as long as these are appropriate to the needs of the decision problem. Thus, for example, 

Level 2 PRAs make heavy use of phenomenological models when developing event trees 

that delineate possible scenarios following core damage, and Level 3 PRAs typically use 

Monte Carlo simulation approaches to assess the potential offsite consequences of radiological 

releases. NUREG/CR-2300 (ANS and IEEE, 1983) provides an early, but nevertheless still quite 

useful, compilation of modeling approaches.

Within the PRA research community, some alternate approaches have been suggested to 

improve the fidelity of current PRAs in analyzing complex accident scenarios. Many of these 

alternate approaches, referred to as “dynamic PRA” (or “dynamic PSA” in the international 

community), are focused on more detailed modeling of the behavior of a plant and its operators 

over time (in a probabilistic context). The potential capabilities of these approaches are 

discussed by Siu in a survey article (Siu, 1994), and the subject continues to be a matter 

of active interest in international PRA conferences and workshops (e.g., Smidts and 

Aldemir, 2007). To date, partly because of modeling and computational complexities, there have 

been no dynamic PRA applications affecting regulatory decisions. With continuing increases

in available computational power and with progress in the treatment of key technical issues 

(e.g., regarding the modeling of operating crew behavior), ongoing research efforts may result 

in practical tools aimed at current regulatory needs (e.g., Coyne, et al., 2012).

 13 A Level 1+ PSA is a PSA that groups core melt sequences into different categories based on containment behavior 

but does not include actual calculations of the amount, composition, and timing of radioactive material release.
29

4. CDF—CURRENT STATE OF KNOWLEDGE

CDF, the frequency of core damage, is a metric used widely in risk-informed decisionmaking. 

The following frequently asked questions (FAQs) address the definition of core damage and our 

current state of knowledge regarding the numerical value of CDF for U.S. plants.

C1. What is “core damage”?

C2. What do global accident statistics tell us about core damage frequency (CDF)?

C3. What are U.S. PRA studies telling us about CDF for operating plants?

C4. Are PRA estimates for CDF “better” than global statistical estimates?

C5. What is ∆CDF? How is it used in regulatory decisionmaking?

C6. What does our current state of knowledge regarding CDF tell us about 

the probability of a future accident anywhere in the United States?

C7. How large are the uncertainties in CDF?
30

C1. What is core damage?

In a risk-informed regulatory context, “core damage” is a state in which the nuclear fuel in the 

core is damaged to an extent that radioactive material released from the fuel, should it escape 

to the environment, could significantly affect public health and safety.

The preceding definition is from NUREG-2122 (NRC, 2013c).1

Past probabilistic risk assessments (PRAs) have considered a variety of conditions to represent 

the end point of a Level 1 analysis (see Table 4-1 for some examples), ranging from the onset 

of damage through core melt.

Table 4-1 Example Definitions of Core Damage and Core Melt

PRA Terms Notes

NUREG-1150 draft 

(NRC, 1987a)

Severe core 

damage, 

core melt

• A severe core damage accident occurs when reactor 

conditions have degraded sufficiently to threaten loss of 

core cooling.

• Core melt (large portions of the fuel becoming molten and 

penetrating the reactor pressure vessel) would occur if the 

accident is not terminated.

NUREG-1150 final 

(NRC, 1990)

Core 

damage

Core damage accidents involve core uncovery with 

reflooding not imminently expected. Operationally,

• Pressurized-Water Reactors (PWRs): reactor water level 

drops to a point at the top of the active fuel.

• Boiling Water Reactors (BWRs): reactor water level drops 

to a point 2 feet (0.6 meters) above the bottom of the 

active fuel

Individual Plant 

Examinations, as 

summarized in 

NUREG-1560 

(NRC, 1997c)

Core 

damage, 

core melt

• Core damage: “uncovery and heatup of the reactor core 

because of a loss of core cooling to the point where 

prolonged clad oxidation and fuel damage is anticipated.”

• Core melt: “severe damage to the reactor fuel and core 

internal structures following the onset of core damage, 

including the melting and relocation of core materials.”

• Notes that submittals have used several definitions of 

core damage (e.g., involving peak cladding temperature, 

oxidation levels, or water level in the vessel), but all would 

release a substantial amount of gap activity (equivalent or 

greater than the design basis).

As pointed out by NUREG-2122 (NRC, 2013c), the terms “core damage” and “core melt” are 

sometimes incorrectly considered as being synonymous; the former refers to a less severe state 

than the latter.2 However, some past PRAs have argued that, for practical purposes, this 

difference does not affect the results for risk-significant scenarios because of the relatively short 

time gap between the two states. In other words, the PRA model lacks sufficient detail to make 

a significant distinction, effectively assuming that scenarios severe enough to cause core 

damage are likely to cause core melt before any realistic chance of terminating the accident. 

 1 This definition is adapted from that provided in the ASME/ANS PRA Standard: “uncovery and heatup of the reactor 

core to the point at which prolonged clad oxidation and severe fuel damage are anticipated and involving enough of 

the core, if released, to result in offsite public health effects.” (ASME and ANS, 2009) 2 Core melt occurs after the onset of core damage. Core damage does not necessarily indicate that the reactor fuel 

has melted, only that radioactive material could be released from the core into the reactor vessel.
31

NUREG-1560 (NRC, 1997c) generally concurs, but notes that the differences can sometimes 

matter, depending on whether and how the performance of various systems is credited following 

core uncovery.

NUREG/CR-6042 reports that during the Three Mile Island (TMI) accident, there was a gap of 

about 40 minutes between the time of initial fuel uncovery (and initial fuel damage) and initial 

fuel melting. There was an additional delay of some 80 minutes before large-scale fuel 

movement (Haskin, et al., 2002). In the case of the Fukushima Dai-ichi 1, 2, and 3 accidents, 

MELCOR analyses sponsored by the U.S. Department of Energy (Gauntt, et al., 2012) indicate 

that there may have been a 1–2-hour gap between initial fuel damage and initial fuel movement, 

and an additional 2–3-hour delay until major fuel movement for Units 1 and 3. (The core debris 

in Unit 2 does not appear to have moved to the lower portion of the reactor pressure vessel.) 

The results of these analyses appear to be generally consistent with data and analysis results 

from the Tokyo Electric Power Co. (TEPCO, 2012a) and more recent analysis results sponsored 

by the Electric Power Research Institute (EPRI) (Luxat and Gabor, 2013). The treatment of the 

recovery activities following the onset of core damage will lead to more realistic assessments 

of risk.

Regardless of the precise formulation, and even discounting the potentially important difference 

between core damage and core melt,3 all of these definitions indicate a state of widespread fuel 

damage (potential or actual), which is an important precursor to potentially significant 

radiological releases and subsequent public health and safety impacts.

C2. What do global statistics tell us about core damage frequency (CDF)?

Recent estimates for CDF, based on worldwide statistics for reactor accidents, range from about 

1×10−4 to 2×10−3 per reactor-year. These point estimates do not reflect the diversity of designs 

and operational practices in the worldwide fleet.

After the reactor accidents at Fukushima Dai-ichi plant, statistical estimates for CDF have been 

developed by a variety of authors, including Cochran (2011, 2012), Gallucci (2012), Kaiser 

(2012), and Lelieveld, Kunkel, and Lawrence (2012). These estimates, shown in Table 4-2, are 

derived by (1) defining the population of reactors of interest (e.g., all reactors, all power 

reactors, all boiling water reactors (BWRs)) and (2) taking the ratio of the number of reactor 

accidents experienced by that population and the number of years of operating experience for 

the population:

(C2-1)

where

N = number of reactor accidents

 3 NUREG/CR-7177 (Krall, et al., 2014) documents a recent investigation of the potential effect of different accident 

sequence end state definitions.

CDF=

N

T
32

T = total number of operating reactor-years4

Underlying this simple formula is the key assumption that reactor accidents are exchangeable 

events (i.e., that they are independent events generated from a population of nominally identical 

reactors). As discussed below and in FAQ R10, satisfying this assumption for nuclear power 

plants is problematic.

Consider, for example, the upper end CDF estimate of 2×10−3 per reactor-year (Cochran, 2011). 

This estimate is derived by focusing on BWRs with Mark I or Mark II containments and by 

treating the Fukushima Dai-ichi accidents as three independent events. The estimate treats all 

U.S. and international BWRs with Mark I or Mark II containments as being the same. Clearly, 

this is a strong simplification, as it does not account for important differences across BWR 

design types (which affect, for example, postaccident cooling requirements, and specify the 

cooling systems and operational procedures provided to meet these requirements) and across 

sites (including such design features as the spatial arrangement of equipment and the number 

of emergency diesel generators provided, and environmental features such as the site-specific 

external hazards). Within the United States alone, current PRAs indicate that these differences 

can lead to over an order-of-magnitude difference in CDF estimates.

5 The wide variety of 

physical and operational (including regulatory) environments for plants worldwide can lead 

to even larger variations.

Table 4-2 Some Recent Statistical Point Estimates of CDF

Source CDF Estimate(s) Notes*

Cochran, 2011 8×10−4/RY (World power reactors)

2×10−3/RY (World BWRs with Mark I or II containments) 1, 2

Cochran, 2012 4×10−4/RY (World power reactors) 3

Gallucci, 2012 1×10−4/RY (U.S. power reactors, inland sites)

3×10−4/RY (World power reactors, coastal sites) 4

Kaiser, 2012 2×10−4/RY (World power reactors) 5

Lelieveld, Kunkel, 

and Lawrence, 2012 2×10−4/RY (World power reactors) 6

*Notes—

1. Power reactor estimate based on 11 events involving reactors connected to the grid at some 

point (Sodium Reactor Experiment, Fermi 1, Chapelcross 2, St. Laurent A-1 and A-2, TMI, 

Chernobyl, Greifswald 5, Fukushima Dai-ichi 1–3) and 14,400 reactor-years of operation.

2. BWR Mark I and II estimate based on three events (Fukushima Dai-ichi 1–3) and 

1,900 reactor-years of operation.

3. Estimate inferred from data presented in (Cochran, 2012): six events (after eliminating events 

indicated as being questionable): Fermi 1, TMI, Chernobyl, and Fukushima Dai-ichi 1–3. 

Operational experience is 15,400 reactor-years.

4. Considers estimated conditional core damage probabilities developed by the U.S. Accident 

Sequence Precursor Program (NRC, 2014a) in addition to six events (TMI, St. Laurent A-2, 

Chernobyl, and Fukushima Dai-ichi 1–3) with an International Atomic Energy Agency (IAEA) 

International Nuclear and Radiological Event Scale (INES) rating of Level 4 or higher. Uses 

 4 Because reactors cannot operate at full power all the time (shutdowns, both scheduled and unscheduled, are 

needed for maintenance and refueling), the number of operating years for a reactor is shorter than the number of 

calendar years the reactor has been available for operation. For the rough estimation purposes of this report (see 

Appendix B for details), the numerical difference between operating years and calendar years is relatively small 

and is ignored. 5 For the studies discussed in FAQ C3, the smallest reported BWR CDF is about 4×10−6/RY; the largest is about 

8×10−5/RY. (Both of these estimates include contributions from external, as well as internal, hazards.)
33

operational experience of 14,000 reactor-years and different approaches to select a point 

estimate from estimated ranges.

5. Considers three events (TMI, Chernobyl, and Fukushima Dai-ichi) with an INES rating of Level 5 

or higher. Treats Fukushima as one event. Develops separate estimates for 1979, 1986, and 

2011, but the separate estimates are quite similar. Reports 95% confidence interval of 

[4.4×10−5/RY to 6.2×10−4/RY] for 2011.

6. Considers four events (Chernobyl, Fukushima Dai-ichi 1–3) with an INES rating of Level 7 and 

14,500 reactor-years of operation. Paper makes a minor adjustment to the direct statistical 

estimate (3×10−4/RY), judging that this latter estimate is “high-biased.”

A second simplification underlying Equation (C2-1) is its assumption that the risk-significant 

features of the plants do not change over time. This assumption neglects numerous plant 

changes made over the years, some of which were prompted by events (e.g., TMI), and others 

which were prompted by analyses (including PRAs). FAQ C3 indicates that there has been a 

general decrease in CDF from the time of the individual plant examination/individual plant 

examination of external events (IPE/IPEEE) analyses to the present.

In summary, statistical estimates for CDF accident frequency estimates based on global 

accident statistics require the strong and arguable modeling assumption of exchangeability 

across plants and over time and are too coarse for formal regulatory decisionmaking purposes. 

Post-Fukushima global estimates for CDF have not played a significant role in the U.S. Nuclear 

Regulatory Commission’s (NRC’s) post-Fukushima response or in other recent regulatory 

activities. For example, in a response to a public comment received during the Davis-Besse

Nuclear Power Station license renewal process, the staff states—

Basing CDF on global statistical estimates ignores the variations in plant design, 

variations in operating procedures and variations in regulatory requirements. In 

addition, basing CDF on global statistical estimates ignores the lessons learned 

from past accidents including both design and procedure changes. The NRC 

staff disagrees that the applicant’s SAMA analysis is inadequate because the 

CDF is not estimated generically from direct experience. The SAMA analysis for 

license renewal ... should be evaluated on a site-specific basis. (NRC, 2015)

It should be noted that, because global statistical estimates provide an independent perspective 

on PRA-based estimates, they are not entirely devoid of value. In particular, large differences 

between global estimates and PRA-based estimates, in combination with knowledge of the 

causal factors and chains of events involved in actual accidents, can provide a useful spur to 

the PRA community to examine its standard modeling practices in light of these differences.

As a technical side note, even if it could be assumed that plants are actually exchangeable, it is 

important to recognize that Equation (C2-1) only provides a point-estimate, and that there is a 

significant degree of uncertainty in the true value of CDF because the empirical data are sparse.

For example, following the standard methods described in NUREG/CR-6823 (Atwood 

et al., 2003) and using the event data provided in Cochran (2012), it can be shown that the 5th

and 95th percentiles for the worldwide CDF are about 2×10−4

/reactor-year (RY) and 7×10−4/RY, 

respectively, as shown in Figure 4-1.6 (Per Table 4-2, the point estimate is 4×10−4

/RY.) Using 

the same approach with just U.S. light water reactor data (one core damage accident—TMI—in

about 3,840 RY), the estimate for the CDF of currently operating U.S. plants is about 

 6 Details on the calculations underlying Figures 4-1 and 4-2 are provided in Appendix B.
34

3×10−4

/RY; the 5th and 95th percentiles are about 1×10−5/RY and 8×10−4/RY, respectively, as 

shown in Figure 4-2.7

Figure 4-1 Uncertainty band about Cochran (2012) estimate

Figure 4-2 Statistical estimate for CDF (U.S. plants only)

 7 The “reverse J-shape” in this figure shows that when very small numbers of events have been observed, extremely 

small values of CDF cannot be ruled out. In fact, smaller values are more likely than larger ones.
35

C3. What are U.S. PRA studies telling us about mean CDF for operating plants?

Current point estimates for CDF (for potential accidents occurring during power operation 

including external as well as internal initiators) range from about 4×10−6 to 1×10−4 per 

reactor-year. The CDF estimates and the dominant contributors to CDF are plant specific. The 

range in quantitative and qualitative results reflects the diversity of plant configurations (design 

and operations), the particular plant configuration at the time the PRA was performed, and the 

modeling approach used in the PRA.

Figure 4-3 illustrates the results of a review of recent licensee point estimates of CDF.8 This

review identified estimates for 61 units that included CDF contributions from internal-event, 

internal-hazard, and external-event scenarios. Most of these estimates were developed to 

support various risk-informed license amendment requests (LARs) to change requirements 

governing such things as allowed equipment outage times, containment leak rate testing, or 

plant fire protection. These LARs can be found using the NRC’s Agencywide Documents 

Access and Management System.

Figure 4-3 Distribution of recent point estimates for total CDF, U.S. plants 

(Sources: LAR submittals and SAMA analyses)

A few of the CDF estimates identified in the review were developed to support analyses of 

potentially cost-beneficial severe accident mitigation alternatives (SAMAs). These analyses are 

performed as part of the Environmental Impact Analyses conducted by licensees applying for 

operating license extensions. The NRC staff’s reviews of these SAMA analyses, documented in 

plant-specific supplements to NUREG-1437 (NRC, 2013b), provide both the total reported CDF 

and the key contributors to that total. Importantly, the reviews also typically provide a discussion 

of the sources of difference between the current CDF estimate and the estimate provided by the 

 8 See FAQ C7 for a discussion of uncertainties.
36

licensee’s IPE and IPEEE submittals. These differences, some of which involve increases in 

CDF, arise because of both plant changes and PRA modeling improvements.

The earliest result included in Figure 4-3 is from a 2002 analysis. However, most of the results 

are more recent; over 80 percent of the results are from 2008 or later. The figure shows that the 

estimates range from around 4×10−6

/RY to 1×10−4/RY. The median is about 5×10−5/RY, and the 

population mean is also about 5×10−5

/RY. It is important to recognize that these statistics are 

characteristics of the population variability distribution for U.S. plant mean CDFs; they are not 

the same as the percentiles for CDF discussed in FAQs B4 and C2. The latter represent 

epistemic (i.e., state-of-knowledge) uncertainties in the CDF for a particular plant.9

Similar to the IPE and IPEEE analyses, the LAR and SAMA analyses typically do not 

provide quantitative estimates of the uncertainty associated with their CDF estimates.

Overall, it is important to recognize that—

• As discussed in FAQ R10, past PRAs have consistently shown that potential 

vulnerabilities (and therefore plant risk) are highly plant specific.

• Design and operational changes addressing lessons identified by PRAs can lead to 

significant changes in CDF. This is illustrated by (1) a general decrease in CDFs from 

the IPE and IPEEE analyses to the present (see Figure 4-4), some of which can be 

attributed to plant improvements as discussed earlier, and (2) the small CDF values 

reported for new reactor designs (which have benefitted from the lessons of past PRAs). 

Current new reactor estimates range from around 4×10−8 to 2×10−6 per RY.

• The above estimates for total CDF are developed by adding the CDFs estimated 

for different accident scenarios.

• The CDF contributions from accidents caused by internal hazards (e.g., floods, fires) and 

external events (e.g., earthquakes, high winds, and external floods) can be significant.

When reviewing CDF estimates, the reader should ensure that the estimates come from 

PRAs with the same scope.

 9 In the case of FAQ C2, the “particular plant” is any plant, since the assumption of exchangeability treats all plants 

as being alike.
37

Figure 4-4 Comparison of recent and past estimates for total CDF, U.S. plants 

(Sources: IPE, IPEEE, LAR, and SAMA analyses)

C4. Are PRA estimates for CDF “better” than global statistical estimates?

PRA estimates are well-suited for regulatory decisionmaking support because they reflect the 

current state of knowledge regarding plant design, operation, and regulation.

Regulatory decisionmaking needs to be based on information that accurately reflects the 

current situation. Global statistical estimates, with their fundamental (and flawed) assumption 

of exchangeability, do not account for differences between plants and changes over time 

(including, for example, the numerous changes that have occurred following the Three Mile 

Island Unit 2 accident). Thus, these numerical estimates do not provide an adequate basis for 

regulatory decisionmaking.

FAQ R10 provides additional discussion on the benefits of PRA as a decision support tool.
38

C5. What is ∆CDF? How is it used in regulatory decisionmaking?

∆CDF, read “delta CDF,” is the result obtained by subtracting one CDF estimate (typically the 

CDF for a plant before a potential change) from another CDF estimate (typically the CDF after 

the potential change).

∆CDF provides an important measure of the difference between two decision options. 

Moreover, because the “before” and “after” estimates are based on the same PRA model (save 

for those portions of the model that have been modified to reflect the “after” conditions), ∆CDF is 

less sensitive to the effect of many PRA uncertainties than the before/after estimates of CDF 

themselves.

∆CDF plays an explicit role in several regulatory applications. Example applications include the 

evaluation of licensee-proposed risk-informed changes to a plant’s licensing basis, as discussed 

in Regulatory Guide (RG) 1.174 (NRC, 2011a); the NRC’s Significance Determination Process 

(NRC, 2011c); the NRC’s evaluation of potential generic issues discussed in NUREG-0933 

(NRC, 2011d); and the NRC’s evaluation of proposed regulatory backfits per the provisions of 

Title 10 of the Code of Federal Regulations (10 CFR) 50.109, “Backfitting” (CFR, 2007a).

Figure 4-5 shows how both ∆CDF and CDF are used in RG 1.174 to determine regions of 

acceptability and of regulatory attention. Particularly noteworthy is the assignment of a particular 

value of ∆CDF (1×10−6

/RY) to indicate when a change in CDF is considered to be “small.”

Figure 4-5 Acceptance guidelines for CDF from RG 1.174 (NRC, 2011a)

Figure 4-5 also shows that the boundaries between the different regions of acceptability and 

attention are not crisp. This reflects a fundamental precept of risk-informed decisionmaking: the 

numerical results of a PRA, although important, should not provide the sole basis for a decision.
39

C6. What does our current state of knowledge regarding CDF tell us about the 

probability of a future core damage accident anywhere in the United States?

Given current conditions, the probability of a core damage accident anywhere in the 

United States is about 5×10−3 per year.

The frequency of a core damage accident anywhere in the United States is the sum of the CDFs 

for all U.S. plants. For the currently operating fleet, and assuming an average CDF derived from 

LARs and SAMA analyses that addressed internal events, internal hazards, and external 

events, this frequency is roughly 5×10−3

/yr. The probability of such an accident in the next 

T years is, for most conditions of interest 10, the product of this frequency times T (assuming 

that the situation remains reasonably constant (i.e., that there are no significant changes in the 

plants, in the external environment, or in the PRA community’s state of knowledge)). Thus, the 

probability of an accident in the next year is 0.005 11, and the probability of an accident in the 

next 10 years is 0.05. These results are, of course, based on the key assumption that, in the 

future, the fleet will be the same as it is today, without improvements because of operating 

experience, new technologies, regulatory changes, or substantive changes in the number 

of plants. Given the significant changes in regulatory requirements following the Fukushima 

accident, this assumption is clearly not true.

To provide a perspective on the importance of this assumption, consider the results of the IPE 

and IPEEE studies, which were completed in the middle 1990s. Using the results of studies that 

provided CDF estimates for internal hazards and external events as well as internal events,12

the total accident rate for a 100-reactor fleet was roughly 1×10−2 /yr. This translates to a 10-year 

nationwide probability of 0.1. The reduction in probability is because of both actual plant 

changes and to PRA modeling improvements since the completion of the IPE and IPEEE 

studies (see FAQ C3).

 10 See Appendix A for additional discussion. 11 As a historical note, WASH-1400 (USNRC, 1975) estimated the total accident rate for a 100-reactor fleet to be 

around 5×10−3/yr. The similarity with the estimate provided above is largely coincidental, as WASH-1400 did not 

provide quantitative estimates for the CDF contributions due to external events (notably seismic events) or internal 

hazards (notably internal fires and floods). 12 A number of IPEEE studies used “margins” approaches that did not require the estimation of seismic or fire CDF.
40

C7. How large are the uncertainties in CDF?

The reported ranges for CDF from past full-scope PRAs are typically an order of magnitude or 

greater. These ranges typically represent the uncertainties associated with the uncertainties in 

PRA model parameters; they typically do not include contributions from uncertainties in the PRA 

models themselves, and do not include contributions from scenarios outside the scope of the 

analyses (e.g., security-related scenarios or scenarios involving aging).

Even considering the experience from the Fukushima Dai-ichi reactor accidents in 2011, core

damage events remain unlikely. With relatively little empirical evidence for key PRA model 

inputs, the uncertainties in PRA results are considerably larger than those associated with 

traditional engineering analyses.

Limited information is available to provide quantitative estimates of the uncertainty in the results 

of current PRAs. The current PRA ASME/ANS standard requires the characterization (but not 

quantification) of uncertainties. Although this helps ensure a qualitative understanding of the 

sources and effect of parameter and model uncertainties,13 it does not provide a direct answer 

to the question.

Quantitative information regarding uncertainties in past PRA estimates is available from some

past full-scope studies.14 Figure 4-6 shows the results for the NRC-sponsored NUREG-1150 

(NRC, 1990) study,15 and for some industry-sponsored studies as reported by Garrick (1989). 

All of the latter are for pressurized-water reactors (PWRs). It can be seen that the ratio of the 

95th to 5th percentile is nearly a factor of 10 or greater for most of the studies.16

It should be noted that all of the studies whose results are shown in Figure 4-6 were performed 

in the 1980s. Since that time, the plants have made numerous changes,17 and new information 

from experiments (e.g., regarding the likelihood of fire-induced spurious operations), analyses 

(e.g., on the seismic hazards faced by plants in the central and Eastern United States) and 

events (e.g., the Fukushima Dai-ichi reactor accidents) has come to light. The effect of these 

changes (some of which will tend to reduce the plant CDF and others which will tend to increase

it) on the uncertainty in full-scope PRA estimates is not clear.

 13 As discussed in NUREG-1855 (NRC, 2013a), PRA uncertainties are typically classified as parameter, model, or 

completeness uncertainties. The effect of parameter uncertainties on the overall CDF estimate can be estimated in 

a straightforward manner using standard PRA tools and techniques. Model uncertainties, although quantifiable in 

principle, are typically treated using sensitivity studies consistent with current guidance. Completeness 

uncertainties, some of which arise from scope limitations and others of which are from “unknown unknowns,” are 

typically not quantified. 14 A full-scope PRA addresses scenarios triggered by internal hazards (e.g., internal fires, internal floods) and 

external hazards (e.g., earthquakes, external floods, high winds) as well internal events. 15 The NUREG-1150 studies did not report the distributions for the sum of the internal events, fire, and seismic CDFs. 

The approximate totals shown in Figure 4-6 are based on lognormal fits to the separate hazard distributions. (The 

actual distributions are not lognormal, but the approximation is believed to be good enough for the purpose of this 

FAQ.) 16 The reasons for the apparently systematic difference between the NRC- and industry-sponsored studies would 

require indepth review of the individual studies and is beyond the scope of this report. 17 Many of the plant-specific supplements to NUREG-1437 (NRC, 2013b) provide detailed information regarding 

changes to the plant or to the plant’s PRA, and the effect of these changes on the estimated CDF (principally, the 

internal events CDF).
41

Figure 4-6 Uncertainties in CDF from some past full-scope PRAs

It should also be noted that published estimates of uncertainty typically represent the effect of 

parameter uncertainties. Model uncertainties are typically treated through sensitivity analyses 

(e.g., see NUREG-1150’s separation of the seismic risk estimates produced using hazard 

curves developed by Lawrence Livermore National Laboratory and those produced using 

hazard curves developed by EPRI) or qualitative discussions.18

Overall, the uncertainties in PRA results involve orders of magnitude. The reader should keep 

such uncertainties in mind when reviewing published results that show multiple significant digits.

 18 A number of early industry-sponsored fire PRAs addressed fire model uncertainties through an error factor 

calibrated using limited experimental data (Siu and Apostolakis, 1982). This approach has not been used in more 

recent PRAs.
42
43

5. LERF—CURRENT STATE OF KNOWLEDGE

LERF, the frequency of a large early release, is another metric used in risk-informed 

decisionmaking. The following frequently asked questions (FAQs) address the definition of 

“large early release” and our current state of knowledge regarding the numerical value of LERF 

for U.S. plants.

L1. What is a “large early release”?

L2. What do accident statistics tell us about large early release frequency (LERF)?

L3. What have past PRA studies told us about LERF for operating plants?
44

L1. What is a large early release?

In a risk-informed regulatory context, a “large early release” is an event involving a rapid, 

unmitigated release of airborne fission products from the containment to the environment that 

occurs before effective implementation of offsite emergency response, and protective actions, 

such that there is a potential for early health effects.

The preceding definition is from NUREG-2122 (USNRC, 2013c), which mirrors the definition 

provided in the ASME/ANS Probabilistic Risk Assessment (PRA) Standard (ASME and

ANS, 2009).

The concept that timing, as well as the magnitude of an accidental radiological release, is 

a significant factor in determining public health risk (particularly, the likelihood of prompt 

fatalities 1

) was recognized in early PRAs, starting from WASH-1400 (USNRC, 1975). However, 

these PRAs tended to tie the notion of “early” with in-plant accident processes. Thus, for 

example, NUREG-1150 defined “early containment failure” as a failure “occurring before or 

within a few minutes of reactor vessel breach” (for pressurized-water reactors) and a failure 

“occurring before or within 2 hours of vessel breach” (for boiling water reactors). The 

introduction of offsite actions into the term “large early release” appears to have been made 

in Draft Regulatory Guide (RG) DG-1061 (USNRC, 1997d), the predecessor to RG 1.174 

(USNRC, 1998b).2

At present, as discussed in an international survey report (OECD, 2009), there are no 

quantitative criteria attached to the term “large early release.” As discussed in that report, 

some countries have defined “large release” in terms of specific amounts of radionuclides. For 

example, Finland and Canada define a large release as involving 100 terabecquerels (TBq 3

) of 

cesium-137 (Cs-137). The United Kingdom defines a large release as involving 104 TBq of 

iodine-131 (I-131) or 200 TBq of cesium-137 or 200 TBq of other isotopes. To provide some 

perspective, Table 5-1 presents estimated release timing and amounts for the Three Mile Island, 

Chernobyl, and Fukushima Dai-ichi reactor accidents.

 1 Prompt fatalities (also referred to as early fatalities) are “deaths from the acute effects of radiation that may occur 

within a few months of the exposure” (NRC, 2013c). 2 DG-1061 (NRC, 1997d) states that “LERF [Large Early Release Frequency] is being used as a surrogate for the 

early fatality QHO [the Quantitative Health Objective of the NRC’s Safety Goal Policy Statement (NRC, 1986)]. It is 

defined as the frequency of those accidents leading to significant, unmitigated releases from containment in a time 

frame prior to effective evacuation of the close-in population such that there is a potential for early health effects. 

Such accidents generally include unscrubbed releases associated with early containment failure at or shortly after 

vessel breach, containment bypass events, and loss of containment isolation.” 3 A TBq is a unit of radioactivity. 1 TBq = 1012 becquerels (Bq) = 27 curies (Ci) = 2.7×10−5 megacuries (MCi).
45

Table 5-1 Estimated Release Amounts and Timing for Major Nuclear Power 

Plant Accidents

Release Magnitude 

(TBq/MCi)

Time to 

Core Damage

(hr)

Time to 

Release

(hr)

Time to 

Start Evacuation

(hr)

TMI-2 I-131: 0.55/1.5×10−5 2 3 54

Chernobyl-4 I-131: 1.2×106/32

Cs-137: 8.5×104/2.3 ~0 ~0 10.5

Fukushima Dai-ichi I-131: 1.3×105/3.5

Cs-137: 1.1×104/0.3

Unit 1: 4

Unit 2: 77

Unit 3: 42

Unit 1: 15

Unit 2: 109

Unit 3: 66

6

Sources—

1. TMI-2: (Rogovin, 1980)

2. Chernobyl-4: (OECD, 1996), (USNRC, 1987b)

3. Fukushima Dai-ichi: (GoJ, 2011), (Gauntt, et al., 2012), (JANTI, 2012), (TEPCO, 2012b)

L2. What do accident statistics tell us about large early release frequency (LERF)?

Classifying Chernobyl as the world’s single instance of a large, early release, a global statistical 

point estimate for LERF for the world’s reactors is about 7×10−5 per reactor-year. This estimate 

assumes that all plants are exchangeable. Meaningful statistical estimates of LERF for 

U.S. plants cannot be made independently of U.S. PRA estimates.

To date, the authors have been unable to identify any open literature estimates of LERF 

based on global statistics.4 However, such estimates can be made using the same modeling 

assumptions and Bayesian updating approach used to estimate core damage frequency (CDF)

(see FAQ C2 and Appendix B).

At the world level, the statistical evidence is one large, early release 5 in about 

15,200 reactor-years (RY) of operation. The resulting mean estimate is about 7×10−5

/RY with a 

5th percentile of 3×10−6

/RY and a 95th percentile of 2×10−4/RY (see Figure 5-1). Just as with 

previous global estimates of CDF, this estimate assumes that Chernobyl is exchangeable with 

U.S. reactors, an assumption that is clearly not valid.

 4 Lelieveld, Kunkel, and Lawrence (2012) do estimate the frequency of accidents with INES rating of Level 7, which 

can be equated to the frequency of large release (but not large, early release). Smythe (2011) presents an analysis 

of the frequency of different magnitude incidents and accidents, considering facilities (both military and civilian) for 

nuclear fuel processing and reprocessing, as well as nuclear power plants. 5 It appears that, by all practical measures, the Chernobyl release was both large and early. However, it should also 

be noted that classifying Chernobyl as a large, early release per the definition of large, early release in FAQ L1 

requires the judgment that there was a potential for early (i.e., acute) offsite fatalities, since there were no such 

effects from the actual event despite a 10-hour delay until evacuation (OECD, 2002).
46

Figure 5-1 Uncertainty band about point estimate for LERF (world reactors)

At the U.S. level, the statistical evidence is zero large, early releases in about 3,840 RY of 

operation. The resulting mean estimate is about 2×10−5

/RY with a 5th percentile of 2×10−9/RY

and a 95th percentile of 1×10−4

/RY.

6 It should be noted that although any Bayesian estimates of 

accident frequency based on a small number of observed events are sensitive to the assessor’s 

mathematical representation of knowledge prior to the treatment of observed events (i.e., to the 

“prior distribution”), the estimates are especially uncertain when there have been no observed 

events.

It should be strongly emphasized that the numerical results provided in this FAQ are provided 

only for perspective. In addition to the cautions regarding the key assumption of exchangeability 

underlying any global statistical estimate, additional caution is warranted because the results 

are heavily influenced by the assessor’s prior distribution. Should a decisionmaking need arise 

when the experiential evidence is weak, the assessor needs to develop (e.g., through formal 

expert elicitation) a prior distribution that reasonably represents the actual state of knowledge 

regarding the unknown quantity.

L3. What have past U.S. PRA studies told us about LERF for operating plants?

Current point estimates for LERF (for potential accidents occurring during power operation, and 

considering external as well as internal initiators) range from about 8×10−8/RY to 3×10−5/RY. 

The LERF estimates and the dominant contributors to LERF are plant specific. The range in 

quantitative and qualitative results reflects the diversity of plant configurations (design and 

operations), the particular plant configuration at the time the PRA was performed, and the 

modeling approach used in the PRA.

 6 Appendix B provides details on the calculations behind these results. It should be cautioned that, in this case, the 

5th percentile is especially sensitive to mathematical modeling assumptions.
47

Figure 5-2 illustrates the spectrum of recent licensee estimates of LERF. This figure is based on 

estimates for 55 units that included LERF contributions from internal-event, internal-hazard, and 

external-event scenarios. Similar to the CDF estimates discussed in FAQ C3, these 

plant-specific estimates were developed to support various risk-informed license amendment 

requests (LARs).7

Figure 5-2 Distribution of recent point estimates for total LERF, U.S. plants 

(from LAR submittals)

The earliest result included in Figure 5-2 is from a 2002 analysis. However, most of the results 

are more recent; about 85 percent of the results are from 2008 or later. The figure shows that

the estimates range from around 8×10−8

/RY to 3×10−5/RY. The median is about 3×10−6/RY and 

the population mean is about 4×10−6

/RY.

8 In general, the LAR analyses do not provide 

quantitative estimates of the uncertainty associated with their LERF estimates.

Many of the observations and cautions provided in FAQ C3 regarding the interpretation of CDF 

estimates apply to LERF as well:

• As discussed in FAQ R10, past PRAs have consistently shown that 

potential vulnerabilities (and therefore plant risk) are highly plant specific.

• Design and operational changes addressing lessons identified by PRAs can lead 

to significant changes in CDF. This is illustrated by a general downward shift in the 

population distribution for LERF, at least for internal events scenarios, as shown in 

(Figure 5-3).

 7 In general, the SAMA analyses do not report estimates for LERF, as this is not a metric used in the evaluation of 

the different SAMAs. 8 Similar to the discussion in FAQ C3, these statistics are characteristics of the population variability distribution for 

U.S. plant mean LERFs; they are not the same as the percentiles for risk metric for a particular plant.
48

Figure 5-3 Comparison of LAR and IPE estimates for total LERF, U.S. plants (internal 

events only) (IPE results from NUREG-1560)

• The above estimates for total LERF are developed by adding the LERFs estimated for 

different accident scenarios.

• The LERF contributions from accidents caused by internal hazards (e.g., floods, fires) 

and external events (e.g., earthquakes, high winds, and external floods) can be 

significant. When reviewing LERF estimates, the reader should ensure that the 

estimates come from PRAs with the same scope.
49

6. CONCLUSION

In keeping with its 1995 Probabilistic Risk Assessment (PRA) Policy Statement (USNRC, 1995), 

and as discussed in NUREG-2150 (USNRC, 2012a), the U.S. Nuclear Regulatory Commission 

(NRC) is increasing its use of the results and insights from PRA models in its regulatory 

activities. Regarding activities involving nuclear power plants, as discussed in this report’s 

frequently asked questions, the PRA models are well-suited for regulatory decision 

support because—

• Regulatory decisionmaking concerning safety must be based on the current state of 

knowledge regarding plant risk.

• Plant risk is affected by such plant-specific factors as design, operation, and 

environment (physical and regulatory).

• PRA models reflect the current state of knowledge regarding these factors and can 

be used to assess the impact of potential changes (including changes prompted by 

regulatory action).

However, PRA models, as with any models, are imperfect representations of reality.1

Furthermore, unlike many models, PRA models also have to address the possibility of unlikely 

situations for which empirical data are (fortunately) sparse or even nonexistent. It is, therefore,

important from a model validity viewpoint, as well as a broader safety viewpoint, to look for

lessons from accidents and other significant operational events if and when such events occur.

Just as the definition of risk has qualitative aspects and quantitative aspects, the lessons 

learned from operational events can be both qualitative and quantitative. Both can be

instructive. From a qualitative perspective, PRA models do not predict the future; instead, they 

evaluate and assess potential accident scenarios to inform the decisionmakers’ current state of 

knowledge. It is still useful to determine if the observed chain of events during an accident—

• is typically addressed as part of the current PRA state-of-practice, or, if not,

• can be addressed with current PRA methods, models, and tools

(Note that there should be no expectation that a PRA will reproduce the exact chain of events 

observed. PRA models treat accident scenarios at a discrete, macro level—each scenario 

represents a bundle of possibilities involving variations in the precise timing and manner of 

component behaviors, with the latter usually being idealized as being either “successes” 

or “failures.”)

From a quantitative perspective, as discussed in this report, accident frequency estimates 

based on global accident statistics require the strong and arguable modeling assumption of 

exchangeability across plants and over time and are too coarse for formal regulatory 

decisionmaking purposes. (Note that global statistics have not played a significant role in the 

NRC’s post-Fukushima actions.) However, because such estimates provide an independent 

perspective on PRA-based estimates, they are not entirely devoid of value. In particular, large 

 1 British statistician G.E.P. Box is credited with the well-known aphorism “All models are wrong, but some are useful” 

(Box and Draper, 1987). While not providing a charter for sloppy work, this statement provides an important 

reminder for analysts and decisionmakers.
50

differences between global estimates and PRA-based estimates, in combination with knowledge 

of the causal factors and chains of events involved in actual accidents, can provide a useful 

spur to the PRA community to examine its standard modeling practices in light of these 

differences.

Of course, care must be exercised when drawing lessons from major events. Such events are 

rare occurrences and represent a very small sample of accident possibilities. Statistically based 

estimates are subject to large uncertainties, and qualitative lessons can be strongly affected by 

the particulars of a single event. (Consider the lessons that might have been drawn had the

March 2011 Tōhoku earthquake led to the same tsunami height at Fukushima Dai-ni but a much 

lesser tsunami height at Fukushima Dai-ichi.) PRA models are currently being used by the 

NRC’s Accident Sequence Precursor Program to identify noteworthy operational events 

(e.g., see USNRC, 2014a). As demonstrated by NUREG/CR-6738 (Nowlen, Kazarians, and 

Wyant, 2001) in its review of major fire events, PRA’s structured approach to representing 

accident scenarios can be used to draw broad qualitative lessons across events. It appears that 

further exploitation of PRA models to identify, organize, and prioritize lessons during operational 

experience reviews, such as those conducted following the Fukushima Dai-ichi reactor 

accidents (e.g., see OECD, 2014) could be fruitful.
51

7. REFERENCES

ACRS, 1991 Advisory Committee on Reactor Safeguards, “The 

Consistent Use of Probabilistic Risk Assessment,” 

letter from D.A. Ward, Chairman, ACRS, to I. Selin, 

Chairman, U.S. Nuclear Regulatory Commission, 

July 19, 1991.

ANS and IEEE, 1983 American Nuclear Society and the Institute 

of Electrical and Electronics Engineers,

“PRA Procedures Guide,” NUREG/CR-2300, 

January 1983.

Apostolakis, 1978 Apostolakis, G.E., “Probability and risk assessment: 

the subjectivistic viewpoint and some suggestions,” 

Nuclear Safety, 9, 305–315(1978).

Apostolakis, 1990 Apostolakis, G.E., “The concept of probability in 

safety assessments of technological systems,” 

Science, 250, 1359–1364(1990).

Apostolakis, 1994 Apostolakis, G.E., “A commentary on model 

uncertainty,” in “Model Uncertainty: Its 

Characterization and Quantification,” A. Mosleh, 

N. Siu, C. Smidts, and C. Lui, eds., 

NUREG/CP-0138, 1994.

Apostolakis, Kazarians, and Bley, 1982 Apostolakis, G.E., M. Kazarians, and D.C. Bley, 

“Methodology for assessing the risk from cable 

fires,” Nuclear Safety, 23, 391–407(1982).

Appignani, Sherry, and Buell, 2008 Appignani, P., R. Sherry, and R. Buell, “The 

NRC’s SPAR models: current status, future 

development, and modeling issues,” Proceedings 

of International Topical Meeting on Probabilistic 

Safety Analysis (PSA08), Knoxville, TN, 2008.

ASLB, 1983 Atomic Safety and Licensing Board, “In the Matter 

of Docket Nos. 50-247-SP and 50-286-SP,”

LBP-83-68, October 24, 1983. (In “Opinions and 

Decisions of the Nuclear Regulatory Commission 

with Selected Orders, Vol. 18, July 1, 1983–

December 31, 1983, Vol. 18”)
52

ASME and ANS, 2009 American Society of Mechanical Engineers 

and American Nuclear Society, “Standard for 

Level 1/Large Early Release Frequency 

Probabilistic Risk Assessment for Nuclear Power 

Plant Applications,” ASME/ANS RA-Sa-2009, 

Addendum A to RA-S-2008, ASME, New York, NY, 

American Nuclear Society, La Grange Park, IL,

2009.

Atwood, 1996 Atwood, C.L., “Constrained noninformative priors in 

risk assessment,” Reliability Engineering and 

System Safety, 53, 37-46 (1996).

Atwood, et al., 2003 Atwood, C.L., J.L. LaChance, H.F. Martz, 

D.J. Anderson, M. Englehardt, D. Whitehead, and 

T. Wheeler, “Handbook of Parameter Estimation for 

Probabilistic Risk Assessment,” NUREG/CR-6823, 

September 2003.

Beckjord, Cunningham, and Murphy, 1993 Beckjord, E.S., M.A. Cunningham, and J.A. Murphy 

“Probabilistic safety assessment development in 

the United States: 1972-1990,” Reliability 

Engineering and System Safety, 39, 159-

170(1993).

Berry, et al., 1984 Berry, D.L., N.L. Brisbin, D.D. Carlson, 

R.G. Easterling, J.W. Hickman, A.M. Kolaczkowski, 

G.J. Kolb, D.M. Kunsman, A.D. Swain, 

W.A. Von Riesemann, R.L. Woodfin, J.W. Reed, 

and M.W. McCann, “Review and Evaluation of the 

Zion Probabilistic Safety Study,” NUREG/CR-3300, 

May 1984. (Available from USNRC Agencywide 

Documents Access and Management System 

(ADAMS) Accession No. ML091540533)

Box and Draper, 1987 Box, G.E.P. and N.R. Draper, “Empirical 

Model-Building and Response Surfaces,” 

John Wiley & Sons, New York, NY, 1987.

Brisbois, et al., 1991 Brisbois, J., J-M. Lanore, A. Villemeur, J-P. Berger, 

and J-M. de Guio, “Insights gained from PSAs of 

French 900MWe and 1300MWe units,” Nuclear 

Engineering International, 1991.

Budnitz, 1998 Budnitz, R.J., “Current status of methodologies for 

seismic probabilistic safety analysis,” Reliability 

Engineering and System Safety, 62, 71–88(1998).
53

Budnitz, et al., 1997 Budnitz, R.J., G.E. Apostolakis, D.M. Boore, 

L.S. Cluff, K.J. Coppersmith, C.A. Cornell, and 

P.A. Morris, “Recommendations for Probabilistic 

Seismic Hazard Analysis: Guidance on Uncertainty 

and Use of Experts,” NUREG/CR-6372, April 1997.

CFR, 2003 U.S. Code of Federal Regulations, “Combustible 

Gas Control for Nuclear Power Reactors,” 

10 CFR 50.44, October 27, 1978, last amended 

September 16, 2003.

CFR, 2004 U.S. Code of Federal Regulations, “Risk-Informed 

Categorization and Treatment of Structures, 

Systems and Components for Nuclear Power 

Reactors,” 10 CFR 50.69, November 22, 2004.

CFR, 2007a U.S. Code of Federal Regulations, “Backfitting,” 

10 CFR 50.109, August 28, 2007.

CFR, 2007b U.S. Code of Federal Regulations, “Loss of All

Alternating Current Power,” 10 CFR 50.62, 

June 21, 1988, last amended August 28, 2007.

CFR, 2007c U.S. Code of Federal Regulations, “Requirements 

for Monitoring the Effectiveness of Maintenance at 

Nuclear Power Plants,” 10 CFR 50.65, 

July 10, 1991, last amended August 28, 2007.

CFR, 2007d U.S. Code of Federal Regulations, “Fire 

Protection,” 10 CFR 50.48, June 20, 2000, last 

amended August 28, 2007.

CFR, 2007e U.S. Code of Federal Regulations, “Maintenance of 

Records, Making of Reports,” 10 CFR 50.71, 

July 4, 1968, last amended August 28, 2007.

CFR, 2009 U.S. Code of Federal Regulations, “Contents of 

Applications; Technical Information,” 10 CFR 52.47, 

August 28, 2007, last amended June 12, 2009.

CFR, 2010 U.S. Code of Federal Regulations, “Alternate 

Fracture Toughness Requirements for Protection

against Pressurized Thermal Shock Events,” 

10 CFR 50.61a, January 4, 2010, last amended 

November 26, 2010.

CFR, 2013 U.S. Code of Federal Regulations, “Contents of 

Applications; Technical Information in Final Safety 

Analysis Report,” 10 CFR 52.79, August 28, 2007, 

last amended June 7, 2013.
54

Chu, et al., 1993 Chu, T-L., G. Bozoki, P. Kohut, Z. Musicki,

S.M. Wong, B. Holmes, J. Yang, C-J. Hsu, 

D.J. Diamond, N. Siu, and R-F. Su, “Status of the 

pressurized water reactor low power and shutdown 

accident frequencies program,” Proceedings of 

Probabilistic Safety Assessment International 

Topical Meeting (PSA ’93), Clearwater Beach, FL, 

1993.

Cochran, 2011 Cochran, T.B., “Statement: Fukushima Nuclear 

Disaster and Its Implications for U.S. Nuclear 

Power Reactors, Joint Hearings of the 

Subcommittee on Clean Air and Nuclear Safety and 

the Committee on Environment and Public Works, 

United States Senate, Washington, D.C.,” Natural 

Resources Defense Council, Washington, DC, 

April 12, 2011.

Cochran, 2012 Cochran, T.B., “A Global Perspective on the Safety 

of Nuclear Power Reactors,” Natural Resources 

Defense Council, March 22, 2012.

Cornell, 1981 Cornell, C.A., “Structural safety: some historical 

evidence that it is a healthy adolescent,” 

Proceedings of Third International Conference on 

Structural Safety & Reliability (ICOSSAR ’81), 

Trondheim, Norway, June 23–25, 1981.

Coyne, et al., 2012 Coyne, K., C. Hunter, G. DeMoss, N. Siu, Y. Li, 

and A. Mosleh, “Nuclear power plant precursor risk 

assessment using a dynamic probabilistic risk 

method,” Proceedings of PSAM 11/ESREL 2012, 

Eleventh International Conference of Probabilistic

Safety Assessment and Management, Helsinki, 

Finland, 2012.

Eide, et al., 2007 Eide, S.A., T.E. Wierman, C.D. Gentillon, 

D.M. Rasmuson, and C.L. Atwood, 

“Industry-Average Performance for Components 

and Initiating Events at U.S. Commercial Nuclear 

Power Plants,” NUREG/CR-6928, February 2007.

Farmer, 1967 Farmer, F.R., “Reactor safety and siting: a 

proposed risk criterion,” Nuclear Safety, 8, 539–

548(1967).

Gaertner, True, and Wall, 2003 Gaertner, J.P., D. True, and I.B. Wall, “Safety 

benefits of risk assessment at U.S. nuclear power 

plants,” Nuclear News, 96, 28–36(2003).
55

Gallucci, 2012 Gallucci, R., “What—me worry?” “Why so 

serious?”: A personal view on the Fukushima 

nuclear reactor accidents,’ Risk Analysis, doi: 

10.1111/j.1539-6924.2011.01780, 2012.

GAO, 2004 U.S. General Accounting Office, “Nuclear 

Regulation—NRC Needs to More Aggressively and 

Comprehensively Resolve Issues Related to the 

Davis-Besse Nuclear Power Plant’s Shutdown,” 

GAO-04-415, 2004.

Garrick, 1984 Garrick, B.J., “Recent case studies and 

advancements in probabilistic risk assessment,” 

Risk Analysis, 4, 267–279(1984).

Garrick, 1989 Garrick, B.J., “Lessons learned from 21 nuclear 

plant probabilistic risk assessments,” Nuclear 

Technology, 84, No. 3, 319–339(1989).

Garrick, 2014 Garrick, B.J., “Accelerating Implementation of 

Contemporary Nuclear Safety Assessment,”

U.S.-Japan Probabilistic Risk Assessment 

Roundtable, Tokyo, Japan, February 20–21, 2014. 

(Available from 

http://garrickfoundation.org/publications/)

Gauntt, et al., 2012 Gauntt, R., D. Kalinich, J. Cardoni, J. Phillips, 

A. Goldmann, S. Pickering, M. Francis, K. Robb, 

L. Ott, D. Wang, C. Smith, S. St. Germain, 

D. Schwieder, and C. Phelan, “Fukushima Daiichi 

Accident Study (Status as of April 2012),” Sandia 

National Laboratories, SAND2012-6173, 

August 2012.

GoJ, 2011 Government of Japan, “Investigation Committee 

on the Accident at the Fukushima Nuclear Power 

Stations of Tokyo Electric Power Company, Interim 

Report,” December 26, 2011. (Available from 

http://www.cas.go.jp/jp/seisaku/icanps/eng/interimreport.html)

Hamzehee, 2014 Hamzehee, H., “Status of risk-informed regulatory 

reviews in NRR and associated challenges,” 

Regulatory Information Conference (RIC) 2014, 

March 11–13, 2014. (Available from 

http://www.nrc.gov/public-involve/conferencesymposia/ric/past/2014/docs/abstracts/hamzeheehw24-r1-hv.pdf)
56

Haskin, et al., 2002 Haskin, F.E., A.L. Camp, S.A. Hodge, D.A. Powers, 

“Perspectives on Reactor Safety,” 

NUREG/CR-6042, Revision 2, March 2002.

IAEA, 2010 International Atomic Energy Agency, “Development 

and Application of Level 1 Probabilistic Safety 

Assessment for Nuclear Power Plants,” Specific 

Safety Guide No. SSG-3, Vienna, Austria, 2010.

JANTI, 2012 Japan Nuclear Technology Institute, Examination 

Committee on Accident at Fukushima Daiichi 

Nuclear Power Station, “Examination of Accident at 

Tokyo Electric Power Co., Inc.’s Fukushima Daiichi 

Nuclear Power Station and Proposal of 

Countermeasures,” Final Report, April 25, 2012.

Jeffreys, 1961 Jeffreys, H., Theory of Probability, 3rd edition, 

Clarendon Press, Oxford, 1961.

Kaiser, 2012 Kaiser, J.C., “Empirical risk analysis of severe 

reactor accidents in nuclear power plants after 

Fukushima,” Science and Technology of Nuclear 

Installations, doi: 10.1155/2012/384987, 2012.

Kaplan and Garrick, 1981 Kaplan, S. and B.J. Garrick, “On the quantitative 

definition of risk,” Risk Analysis, 1, 11–37(1981).

Kolb, et al., 1982 Kolb, G.J., D.L. Berry, R.G. Easterling, 

J.W. Hickman, A.M. Kolaczkowski, A.D. Swain, 

W.A. Von Riesemann, R.L. Woodfin, J.W. Reed, 

M.W. McCann, and D.M. Kunsman, “Review and 

Evaluation of the Indian Point Probabilistic Safety 

Study,” NUREG/CR-2934, December 1982.

(ADAMS Accession No. ML091540534)

Krall, et al., 2014 Krall, A., P. Sawant, S. Choi, M. Khatib-Rahbar, 

and D. Helton, “Compendium of Analyses To 

Investigate Select Level 1 Probabilistic Risk 

Assessment End-State Definition and Success 

Criteria Modeling Issues,” NUREG/CR-7177, 

May 2014.

Lanore, 1990 Lanore, J-M., “The French 900 MWe PWR PSA 

results and specificities,” Proceedings of 

CSNI Workshop on PSA Applications and 

Limitations, NUREG/CP-0115, NEA/CSNI-175, 

1990.
57

Lanore, Siu, and Amri, 2012 Lanore, J-M., N. Siu, and A. Amri, “PSA use and 

development: an international overview by 

WGRISK,” Proceedings of Eleventh International 

Conference of Probabilistic Safety Assessment and 

Management (PSAM 11/ESREL 2012), Helsinki, 

Finland, 2012.

Lelieveld, Kunkel, and Lawrence, 2012 Lelieveld, J., D. Kunkel, and M.G. Lawrence, 

“Global risk of radioactive fallout after major nuclear 

reactor accidents,” Atmos. Chem. Phys., 12, 

4245–4258(2012).

Luxat and Gabor, 2013 Luxat, D. and J. Gabor, “Fukushima Technical 

Evaluation: Phase 1—MAAP5 Analysis, Final 

Report,” Electric Power Research Institute 

Technical Report 1025750, 2013.

NFPA, 2001 National Fire Protection Association, 

“Performance-Based Standard for Fire Protection 

for Light Water Reactor Electric Generating Plants, 

2001 Edition,” NFPA 805, Quincy, MA, 2001.

Nowlen, Kazarians, and Wyant, 2001 Nowlen, S.P., M. Kazarians, and F. Wyant, “Risk 

Methods Insights Gained from Fire Incidents,” 

NUREG/CR-6738, September 2001.

NRC, 1975 U.S. Nuclear Regulatory Commission, “Reactor 

Safety Study: An Assessment of Accident Risks in 

U.S. Commercial Nuclear Power Plants,” 

WASH-1400, (NUREG-75/014), October 1975.

NRC, 1985 U.S. Nuclear Regulatory Commission, “In the 

Matter of Docket Nos. 50-247-SP and 50-286-SP,” 

CLI-85-6, May 7, 1985. (In “Nuclear Regulatory 

Commission Issuances: Opinions and Decisions of 

the Nuclear Regulatory Commission with Selected 

Orders, Vol. 21, May 1, 1985–June 30, 1985, 

Vol. 21, Book II of II”) (Available from 

U.S. Government Printing Office, Washington, DC)

NRC, 1986 U.S. Nuclear Regulatory Commission, “Safety 

Goals for the Operation of Nuclear Power Plants; 

Policy Statement; Correction and Republication,” 

Federal Register, Vol. 51, p. 30028 (51 FR 30028), 

August 21, 1986.

NRC, 1987a U.S. Nuclear Regulatory Commission, “Reactor 

Risk Reference Document,” NUREG-1150, draft for 

comment, February 1987.
58

NRC, 1987b U.S. Nuclear Regulatory Commission, “Report on 

the Accident at the Chernobyl Nuclear Power 

Station,” NUREG-1250, January 1987.

NRC, 1988 U.S. Nuclear Regulatory Commission, “Individual 

Plant Examination for Severe Accident 

Vulnerabilities—10 CFR 50.54(f),” Generic 

Letter 88-20, November 23, 1988.

NRC, 1990 U.S. Nuclear Regulatory Commission, “Severe 

Accident Risks: An Assessment for 

Five U.S. Nuclear Power Plants,” NUREG-1150, 

December 1990.

NRC, 1991 U.S. Nuclear Regulatory Commission, “Individual 

Plant Examination of External Events (IPEEE) for 

Severe Accident Vulnerabilities—10CFR 50.54(f),” 

Generic Letter No. 88-20, Supplement 4, 

June 28, 1991.

NRC, 1995 U.S. Nuclear Regulatory Commission, “Use of 

Probabilistic Risk Assessment Methods in Nuclear 

Activities; Final Policy Statement,” Federal 

Register, Vol. 60, p. 42622 (60 FR 42622), 

August 16, 1995.

NRC, 1997a U.S. Nuclear Regulatory Commission, “Discussion 

on Safety and Compliance,” COMSAJ-97-008, 

August 25, 1997.

NRC, 1997b U.S. Nuclear Regulatory Commission, “Regulatory 

Analysis Technical Evaluation Handbook,” 

NUREG/BR-0184, January 1997.

NRC, 1997c U.S. Nuclear Regulatory Commission, “Individual 

Plant Examination Program: Perspectives on 

Reactor Safety and Plant Performance,” 

NUREG-1560, December 1997.

NRC, 1997d U.S. Nuclear Regulatory Commission, “An 

Approach for Using Probabilistic Risk Assessment 

in Risk-Informed Decisions on Plant-Specific 

Changes to the Current Licensing Basis,” DG-1061, 

June 1997. (ADAMS Accession No. ML003739197)

NRC, 1998a U.S. Nuclear Regulatory Commission, “White 

Paper on Risk-Informed and Performance-Based 

Regulation,” SECY-98-144, June 22, 1998.
59

NRC, 1998b U.S. Nuclear Regulatory Commission, “An 

Approach for Using Probabilistic Risk Assessment 

in Risk-Informed Decisions on Plant-Specific 

Changes to the Licensing Basis,” Regulatory 

Guide 1.174, July 1998. (ADAMS Accession 

No. ML003740133)

NRC, 1999 U.S. Nuclear Regulatory Commission, “Proposed 

Guidelines for Applying Risk-Informed 

Decisionmaking In License Amendment Reviews,” 

SECY-99-246, October 12, 1999. 

(ADAMS Accession No. ML993080121)

NRC, 2000 U.S. Nuclear Regulatory Commission, “Component 

Performance Study—Turbine-Driven Pumps, 

1987–1998,” NUREG-1715, Vol. 1, April 2000.

(ADAMS Accession No. ML003708823)

NRC, 2001 U.S. Nuclear Regulatory Commission, 

“NRC Incident Investigation Program,” 

Management Directive 8.3, March 31, 1997, last 

revised March 27, 2001. (ADAMS Accession 

No. ML031250592)

NRC, 2002 U.S. Nuclear Regulatory Commission, 

“Perspectives Gained from the Individual Plant 

Examination of External Events (IPEEE) Program,” 

NUREG-1742, April 2002.

NRC, 2003 U.S. Nuclear Regulatory Commission, “An 

Approach for Plant-Specific Risk-Informed 

Decisionmaking for Inservice Inspection of Piping,” 

Regulatory Guide 1.178, Revision 1, 

September 2003.

NRC, 2004 U.S. Nuclear Regulatory Commission, “Regulatory 

Analysis Guidelines of the U.S. Nuclear Regulatory 

Commission,” NUREG/BR-0058, Revision 4, 

September 2004.

NRC, 2005 U.S. Nuclear Regulatory Commission, 

“Independent Verification of the Mitigating Systems 

Performance Index (MSPI) Results for the Pilot 

Plants,” NUREG-1816, February 2005.

(ADAMS Accession No. ML050810636)
60

NRC, 2006a U.S. Nuclear Regulatory Commission, “Guidelines 

for Categorizing Structures, Systems, and 

Components in Nuclear Power Plants according to 

Their Safety Significance,” Regulatory Guide 1.201, 

Revision 1, May 2006. (ADAMS Accession 

No. ML061090627)

NRC, 2006b U.S. Nuclear Regulatory Commission, “Reactor 

Oversight Process,” NUREG-1649, Revision 4, 

December 2006. (ADAMS Accession 

No. ML070890365)

NRC, 2007a U.S. Nuclear Regulatory Commission, “Technical 

Basis for Revision of the Pressurized Thermal 

Shock (PTS) Screening Limit in the PTS Rule 

(10 CFR 50.61),” NUREG-1806, August 2007.

NRC, 2007b U.S. Nuclear Regulatory Commission, “Review of 

Risk Information Used to Support Permanent 

Plant-Specific Changes to the Licensing Basis: 

General Guidance,” NUREG-0800, Chapter 19.2, 

June 2007. (ADAMS Accession No. ML071700658)

NRC, 2009a U.S. Nuclear Regulatory Commission, “An 

Approach for Determining the Technical Adequacy 

of Probabilistic Risk Assessment Results for 

Risk-Informed Activities,” Regulatory Guide 1.200, 

Revision 2, March 2009. (ADAMS Accession 

No. ML090410014)

NRC, 2009b U.S. Nuclear Regulatory Commission, 

“Risk-Informed, Performance-Based Fire Protection 

for Existing Light-Water Nuclear Power Plants,” 

Regulatory Guide 1.205, Revision 1, 

December 2009.

NRC, 2009c U.S. Nuclear Regulatory Commission, “Generic 

Issues Program,” Management Directive 6.4, 

November 17, 2009. (ADAMS Accession 

No. ML083181192)

NRC, 2010a U.S. Nuclear Regulatory Commission, “Integrated 

Risk-Informed Decision-Making Process for 

Emergent Issues,” Office of Nuclear Reactor 

Regulation Office Instruction LIC-504, Revision 3, 

April 12, 2010. (ADAMS Accession

No. ML100541776)
61

NRC, 2010b U.S. Nuclear Regulatory Commission, “Procedure 

for Processing Generic Issues,” Office of Nuclear 

Regulatory Research Office Instruction TEC-002, 

Revision 1, September 29, 2010. 

(ADAMS Accession No. ML102500426)

NRC, 2011a U.S. Nuclear Regulatory Commission, “An 

Approach for Using Probabilistic Risk Assessment 

in Risk-Informed Decisions on Plant-Specific 

Changes to the Licensing Basis,” Regulatory 

Guide 1.174, Revision 2, May 2011.

(ADAMS Accession No. ML100910006)

NRC, 2011b U.S. Nuclear Regulatory Commission, “An 

Approach for Plant-Specific, Risk-Informed 

Decisionmaking: Technical Specifications,” 

Regulatory Guide 1.177, Revision 1, May 2011.

(ADAMS Accession No. ML100910008)

NRC, 2011c U.S. Nuclear Regulatory Commission, “Significance 

Determination Process,” Inspection Manual 

Chapter 0609, June 2, 2011. (ADAMS Accession 

No. ML101400479)

NRC, 2011d U.S. Nuclear Regulatory Commission, “Resolution 

of Generic Safety Issues: Introduction,” 

NUREG-0933, Main Report with Supplements 1–

34, latest version available from

http://nureg.nrc.gov/sr0933/Introduction/

Introductions.html, December 2011.

NRC, 2012a U.S. Nuclear Regulatory Commission, “A Proposed 

Risk Management Regulatory Framework,” 

NUREG-2150, April 2012.

NRC, 2012b U.S. Nuclear Regulatory Commission, “Notices 

of Enforcement Discretion,” Inspection Manual 

Chapter 0410, October 4, 2012. 

(ADAMS Accession No. ML12263A456)

NRC, 2012c U.S. Nuclear Regulatory Commission, 

“State-of-the-Art Reactor Consequence Analyses 

(SOARCA) Report,” NUREG-1935, 

November 2012.

NRC, 2013a U.S. Nuclear Regulatory Commission, “Guidance 

on the Treatment of Uncertainties Associated with 

PRAs in Risk-Informed Decision Making,” 

NUREG-1855, Revision 1, March 2013.
62

NRC, 2013b U.S. Nuclear Regulatory Commission, “Generic 

Environmental Impact Statement for License 

Renewal of Nuclear Plants—Final Report,” 

NUREG-1437, Revision 1, June 2013.

NRC, 2013c U.S. Nuclear Regulatory Commission, “Glossary of 

Risk-Related Terms in Support of Risk-Informed 

Decisionmaking,” NUREG-2122, November 2013.

(ADAMS Accession No. ML13311A353)

NRC, 2014a U.S. Nuclear Regulatory Commission, “Status of 

the Accident Sequence Precursor Program and the 

Standardized Plant Analysis Risk Models,” 

SECY-14-0107, October 6, 2014. 

(ADAMS Accession No. ML14230A102)

NRC, 2014b U.S. Nuclear Regulatory Commission, “Principles 

of Good Regulation,” May 15, 2014. 

(ADAMS Accession No. ML14135A076)

NRC, 2015 U.S. Nuclear Regulatory Commission, “Generic 

Environmental Impact Statement for License 

Renewal of Nuclear Plants, Supplement 52: 

Regarding Davis-Besse Nuclear Power Station, 

Final Report Appendices,” NUREG-1437, Supp. 52, 

Volume 2, April 2015.

OECD, 1996 Organisation for Economic Co-operation and 

Development, “The Chernobyl Reactor Accident 

Source Term: Development of a Consensus View,” 

OCDE/GD (96)12, NEA/CSNI/R (95)24, Nuclear 

Energy Agency, Paris, France, 1996.

OECD, 2002 Organisation for Economic Co-operation and 

Development, “Chernobyl: Assessment of 

Radiological and Health Impacts (2002 Update of 

Chernobyl: Ten Years On),” NEA3508, Nuclear 

Energy Agency, Paris, France, 2002.

OECD, 2009 Organisation for Economic Co-operation and 

Development, “Probabilistic Risk Criteria and 

Safety Goals,” NEA/CSNI/R (2009)16, Nuclear 

Energy Agency, Paris, France, 2009.

OECD, 2012 Organisation for Economic Co-operation and 

Development, “Use and Development of 

Probabilistic Safety Assessment: An Overview of 

the Situation at the End of 2010”, NEA/CSNI/R 

(2012)11, Nuclear Energy Agency, Paris, France, 

2012.
63

OECD, 2014 Organisation for Economic Co-operation and 

Development, “Working Group on Operating 

Experience (WGOE) Report on Fukushima Daiichi 

NPP Precursor Events”, NEA/CNRA/R (2014)1, 

Nuclear Energy Agency, Paris, France, 2014.

Poloski, et al., 1998 Poloski, J.P., G.M Grant, C.D. Gentillon, 

W.J. Galyean, and J.K. Knudsen, “Reliability 

Study: Auxiliary/Emergency Feedwater System, 

1987–1995,” NUREG/CR-5500, Vol. 1, May 1998.

Rasmuson, et al., 1998 Rasmuson D.M., T.R. Wolf, S.E. Mays, J.J. Poloski, 

C.D. Gentillon, W.E. Galyean, and C.L. Atwood, 

“An overview of the USNRC’s system reliability 

studies,” Proceedings of PSAM 4, International 

Conference on Probabilistic Safety Assessment 

and Management, New York, NY, 1998.

Rogovin, 1980 Rogovin, M., Three Mile Island: A Report to the 

Commissioners and to the Public, 

NUREG/CR-1250, 1980.

Ross, 2014 Ross, S.M., “Introduction to Probability Models, 

11th Edition,” Amsterdam: Academic Press, 2014.

Scott, 1976 Scott, R.L., “Browns Ferry Nuclear Power Plant 

Fire on Mar. 22, 1975,” Nuclear Safety, 17, 

592–611(1976).

Siu, 1994 Siu, N., “Risk assessment for dynamic systems: an 

overview,” Reliability Engineering and System 

Safety, 43, No. 1, 43–73(1994).

Siu, 1999 Siu, N., “Uncertainty Analysis and Pressurized 

Thermal Shock: An Opinion,” white paper, 

September 3, 1999. (ADAMS Accession 

No. ML992710066)

Siu and Apostolakis, 1982 Siu, N. and G.E. Apostolakis, “Probabilistic models 

for cable tray fires,” Reliability Engineering, 3, 

213–227(1982).

Siu and Kelly, 1983 Siu, N. and D.L. Kelly, "Bayesian Parameter 

Estimation in Probabilistic Risk Assessment," 

Reliability Engineering and System Safety, 62, 89-

116 (1998).
64

Siu, et al., 2000 Siu N., H. Woods, S. Malik, D. Bessette, A. Mosleh, 

and M. Modarres, “Treating Aleatory and Epistemic 

Uncertainties in Analyses of Pressurized Thermal 

Shock,” Proceedings of PSAM 5, International 

Conference on Probabilistic Safety Assessment 

and Management, Osaka, Japan, 2000.

Smidts and Aldemir, 2007 Smidts C. and T. Aldemir, eds., International 

Workshop on Dynamic Reliability, University of 

Maryland, Center for Risk and Reliability, ISSN: 

1084-5658, 2007.

Smythe, 2011 Smythe, D., “An objective nuclear accident 

magnitude scale for quantification of severe and 

catastrophic events,” Physics Today, The American 

Institute of Physics, December, 2011.

Stetkar, Shack, and Nourbakhsh, 2011 Stetkar, J.W., W.J. Shack, and H.P. Nourbakhsh, 

“The Current State of Transition to Risk-Informed 

Performance-Based Fire Protection Programs,” 

U.S. Nuclear Regulatory Commission Advisory 

Committee on Reactor Safeguards, February 2011. 

(ADAMS Accession No. ML110430035)

TEPCO, 2012a Tokyo Electric Power Company, “MAAP 

Code-based Analysis of the Development of the 

Events at the Fukushima Daiichi Nuclear Power 

Station,” March 12, 2012. (Available from 

http://www.tepco.co.jp/en/nu/fukushimanp/images/handouts_120312_04-e.pdf)

TEPCO, 2012b Tokyo Electric Power Company, “Fukushima 

Nuclear Accidents Investigation Report,” 

June 20, 2012. (Available from 

http://www.tepco.co.jp/en/press/

corp-com/release/2012/1205638_1870.html)

Webster, 1977 Webster’s New Twentieth Century Dictionary, 

Unabridged, 2nd Edition, 1977.

Whitehead, et al., 1994 Whitehead, D.W., B.D. Staple, S.I. Daniel, J. Darby, 

J. Yakle, S. Miller, and J. Forester, “Results and 

insights from the low power and shutdown 

Level 1 PRA of the Grand Gulf Nuclear Power 

Station,” Proceedings of PSAM II, International 

Conference on Probabilistic Safety Assessment 

and Management, San Diego, CA, 1994.

Winkler and Hays, 1975 Winkler, R.L. and W.L. Hays, Statistics: Probability, 

Inference, and Decision, 2nd Edition, Holt, Rinehart 

and Winston, 1975
A-1

APPENDIX A

THEORETICAL FRAMEWORK FOR PRA TREATMENT 

OF UNCERTAINTIES

A.1 Introduction

Current nuclear power plant (NPP) probabilistic risk assessments (PRAs) address both 

(1) “aleatory uncertainties” (i.e., uncertainties arising because of randomness in the occurrence 

of key events (e.g., initiating events that trigger accidents, equipment failures, core damage 

accidents)) and (2) “epistemic uncertainties” regarding that randomness, (i.e., uncertainties in 

the state of knowledge regarding characterizations of randomness (Apostolakis, 2004), 

(NRC, 2009d)). Following the general approach used by WASH-1400 (NRC, 1975) 

and formalized by Kaplan and Garrick (1981), event frequencies (per unit time or per demand) 

are used to characterize randomness. When uncertainties in these frequencies are quantified, 

this is typically done using probability distributions.

This appendix elaborates on this two-level treatment. In particular, it provides a tutorial 

discussion of the mathematical framework underlying the notion of frequency (as used in PRA 

models 1

) and of the concepts of aleatory and epistemic uncertainties in the context of this 

framework. More detailed discussions can be found in Apostolakis (1978, 1990, 1994), Siu 

and Kelly (1998), Atwood, et al. (2003), and NUREG-1855 (NRC, 2013a).

A.2 Mathematical Definition of Event Frequency

Of the several dictionary definitions of the term “frequency,” one quite close to the concept as 

addressed by PRAs is “the number of times any action or occurrence is repeated in a given 

period” (Webster, 1977). This definition is both clear and intuitive. However, it can be read as 

implying that (1) the notion of frequency is meaningful only when events actually occur (and are 

therefore countable), and (2) events occur with some regularity (as they would in the case of 

periodic, physical processes).

In many risk-informed decisionmaking applications, the likelihood of occurrence of events 

of interest may be such that actual occurrences, although possible and potentially worthy of 

protective measures, may not be expected over the period of time relevant to a particular 

decision. In addition, even in a thought experiment involving multiple trials over an extremely 

long observation period, because of random variations in the factors affecting event occurrence, 

one would not expect to see the same number of events in each trial.

To address these issues, PRAs use the concept of frequency not as a direct measure of the 

number of events in a given class, but as a measure of the rate of occurrence of a class of 

random (but not necessarily likely) events.

 1 FAQ B3, following NUREG-2122 (NRC, 2013c), defines frequency as the expected number of occurrences of an 

event expressed per unit time. Although less formal, this definition is consistent with the mathematical framework, 

as discussed later in this appendix. A benefit of the mathematical framework is that it provides a solid, theoretical 

basis for the simpler definition.
A-2

To explain this approach, it is useful to start with the following three observations:

1. At a detailed modeling level, PRAs deal with some physical variables that are, in 

principle, observable. Example variables include the time to failure of a pump, the 

number of times a relief valve operates prior to failure, and the time at which an operator 

takes a particular action at a given point in an accident sequence.

2. Because of limitations in resources, lack of knowledge, or both, PRAs treat some of 

these variables as being the results of random processes. For such variables, if one 

employs a thought experiment involving a number of repeatable trials, one can envision 

observing a distribution of values (e.g., an empirical histogram).

3. PRAs treat the remaining variables as being deterministic (if perhaps imprecisely 

known). For such variables, if one employs a thought experiment involving a number 

of repeatable trials, one can envision observing a single value (or, at least, a range of 

values sufficiently small that representing the range as a point value is adequate for 

practical applications).

It is important to recognize that there is no fundamental principle dictating whether a variable 

must be modeled as being random or deterministic. The analyst needs to decide if the notion 

of repeatable trials makes sense for the problem being addressed. For many situations, PRA 

modeling conventions developed over years of practical use are well established.2 In other more 

novel applications, considerable effort may be needed to develop a satisfactory approach. (See, 

for example, Siu, 1999 and Siu, et al., 2000 for discussions of the treatment of uncertainties in 

the consideration of reactor pressure vessel failure caused by pressurized thermal shock.) In 

general, the analyst needs to clearly define the PRA “model of the world” (i.e., the model of the 

physical situation at hand) and to treat uncertainties in a manner consistent with that model 

(Apostolakis, 1990, 1994).

Focusing on the first two observations (the third will be discussed in the following section), the 

standard PRA model of the world for random events occurring over time is a simple one.3 In this 

model, it is assumed that—

(i) The physical process leading to event occurrences is not changing over time.

(ii) The likelihood of an event occurring in a given time period does not affect the likelihood 

of a separate event occurring in a separate and distinct time period.

(iii) The likelihood of separate events occurring at exactly the same time is vanishingly small.

It should be emphasized that these are modeling assumptions. For example, Assumption (i) 

does not hold over long (multiyear) time scales for NPPs because of changes (e.g., plant 

changes prompted by PRA results) made over time. The modeling assumption is that, at the 

particular point in time of the analysis, the underlying physical processes are reasonably 

 2 For example, hardware component failures are typically modeled using simple one-parameter probabilistic models 

of the type discussed in this appendix. (One can envision much more complicated models involving the 

mechanistic simulation of component performance under a variety of conditions.) 3 The discussion in this section focuses on events occurring over time. The treatment of events occurring on a 

demand basis is similar, as briefly discussed later in this appendix. Additional details are provided in Siu and Kelly 

(1998) and Atwood et al. (2003).
A-3

constant. Regarding Assumption (ii), dependencies between events over time are treated using 

different models. The modeling assumption is that the PRA model captures all of the important 

dependencies. A similar point holds regarding Assumption (iii).4

Using the three modeling assumptions above, the mathematical laws of probability can be 

used to show that the probability of observing R events in a time period T is governed by the 

Poisson distribution:

(A.1)

Where P{R|λ,T}, read as the “probability of R given λ and T,” is the probability of observing 

exactly R events in a time interval of length T, assuming λ (which has units of inverse time) has 

a known value. It should be emphasized that, according to this probability model, there is not 

one “true value” of R; different values of R (i.e., different numbers of observed events) can arise 

with different probabilities. The single parameter determining the likelihood of R is λ. This 

parameter is called the “event frequency.” Matching intuition, as either λ or T (or both) increase, 

the likelihood of events also increases (see Figure A-1).

Figure A-1 Effect of increasing λT on event occurrences

Because portraying the full distribution of R as in Figure A-1 can be cumbersome, simple 

metrics are typically used to represent key aspects of the distribution. One such metric is the 

 4 Note that parametric common-cause failure models are typically used in current PRAs to treat “simultaneous” 

component failure events. Arguably, a similar approach would be appropriate for treating “simultaneous” 

macro-scale events such as the multiple core damage events at Fukushima Dai-ichi. Section A.3 provides 

additional discussion on such an approach.

P(R|λ,T)=

(λT)R

R! e-λT
A-4

average value of R, also called the “mean” and “expected” value of R. By definition, this average 

value is a weighted sum over all possible values of R:

5

(A.2)

Working through the math, it can be shown that Equation A.2 reduces to a very simple result:

(A.3)

or

(A.4)

Equation A.4 provides the relationship between the formal notion of frequency discussed in this 

appendix and the definition given in NUREG-2122.

\

A.3 Additional Topics

A.3.1 Implications of Poisson Model for Event Timing

The preceding discussion has centered on modeling the number of events (R). In PRAs, this is 

useful for treating events in the detailed PRA models (e.g., initiating events, equipment failures). 

However, for risk management purposes, the time to the first occurrence of a major event 

(e.g., a core damage accident) may be of greater importance.6

 5 It is important to recognize that the term “expected value,” as used in PRA (and in statistics), refers to 

a mathematically defined quantity. In some cases (e.g., when the random variable follows a Gaussian distribution, 

where the average value is also the most likely value), this mathematical quantity coincides with everyday notions 

of expectation. In many other cases of interest to PRA, the average value does not have an intuitive meaning, and 

should only be viewed as one metric characterizing the random variable’s distribution. 6 Of course, should such a major event occur, the Poisson model would have to be reevaluated, or at least reapplied 

to new circumstances, since such an event could precipitate changes that would invalidate modeling assumption 

(i).

R� ≡�R∙P(R|λ,T)

∞

R=0

R� = λT

λ = R�

T

To recap—

• PRAs use the Poisson distribution to model the occurrence of events occurring 

randomly over time.

• The event frequency is the single parameter of the Poisson distribution.

• The event frequency is numerically equal to the ratio of the average number of events 

over a time period T divided by T.
A-5

It can be shown that for a Poisson process, if T1 is the time to the first event, then the 

distribution of T1 is exponentially distributed.7 Thus, the cumulative distribution function for T1

(i.e., the probability that T1 is less than or equal to some fixed value, denoted by “t”) is given by:

(A.5)

If the product λt is small (say, less than 0.1), then the cumulative distribution for T can be 

approximated very simply:

(A.6)

For example, if λ equals 10−2 per year, the probability that T1 is less than 1 year (which is 

equivalent to saying that there will be at least one event in 1 year) is approximately 0.01.

Using Equation A.5, it can be seen that as λ increases, the probability of observing the 

first event by a specified time also increases (albeit at a decreasing rate). This is illustrated in 

Figure A-2.

Figure A-2 Effect of increasing λ on cumulative distribution for first occurrence time

As with the random variable R, simple metrics are useful for characterizing the full distribution of 

T1. In this case, the average (or “mean” or “expected”) value of T1, often called the “return 

period,” is given by:

(A.7)

It is important to recognize that this simple result does not mean that, in an experiment involving 

repeated trials, events will occur at regular intervals of 1/λ. In fact, for a Poisson process, 

 7 The converse is also true. If the time to first occurrence is exponentially distributed, then the number of events is 

Poisson-distributed.

FT1(t) ≡ P{T1 ≤ t} = 1 - e-λt

FT1(t) ≈ λt

T1 ���� ≡ � t∙fT1(t)dt = 1

λ

∞

0
A-6

smaller values of T1 are more likely to be observed than larger values. To show this, consider

the probability density function for T1 (which is proportional to the probability that T1 “equals” t 8

). 

This density function is the derivative of the cumulative distribution function given in 

Equation A.5:

(A.8)

The “reverse J-shape” of this function, which increases with smaller values of t, is illustrated in 

Figure A-3.

Figure A-3 Probability density functions for T1

An illustrative time trace for a Poisson process is shown in Figure A-4. In this figure, each 

diamond represents an event occurrence, and the distance between two diamonds is the time 

interval between the occurrences. In Figure A-4, the time intervals were obtained by 

Monte Carlo sampling off of an exponential distribution. It can be seen that, even though the 

events are independent, the time trace is characterized by clusters of events, with occasional 

longer gaps.

Figure A-4 Example time trace for a Poisson process

Figure A-4 shows that a Poisson model does not imply regularity. If an event has not occurred 

over a period of time, this does not mean that an event is “due.” The chance that an event will 

 8 More precisely, the probability density function is proportional to the probability that T1 lies in the interval {t, t+dt}, 

where dt is an infinitesimally small increment.

fT1(t) = d

dt FT1(t) = λe-λt
A-7

occur in the next year is the same chance that would have been computed at the beginning of 

the event-free period, and the same chance that would be computed years down the road.

The plot also shows that an observation of uneven spacing of intervals between events 

(whether increasing or decreasing) does not a priori invalidate the Poisson model.

Finally, it should be observed that most of the time intervals shown in Figure A-4 are less than 

the mean value of T1 (100 years in this example). For an exponential distribution, the mean 

value corresponds to the 63rd percentile of T1. Unlike the mean value for a normal distribution, 

the mean value for an exponential distribution has no intuitive meaning. It is only a mathematical 

index that, through an integration that includes the probability distribution function for the 

random variable (see Equation A.7), provides some treatment of the uncertainty in the 

random variable.

A.3.2 Treatment of Single Accident Sequences

PRA accident sequences typically comprise an initiating event and a subsequent set of events 

representing the success or failure of plant systems, structures, and components in 

accomplishing a defined mission. The initiating events and some of the subsequent events can 

occur randomly in time and are modeled using the Poisson distribution as discussed in the 

preceding section. Other subsequent events are modeled as events that occur “on demand,”

(i.e., in response to some trigger (e.g., a command to operate)). As discussed below, under 

standard modeling assumptions, the preceding discussion of frequency and event occurrences 

applies to accident sequences as well as basic events.9

Consider a basic event representing the failure of a component (e.g., an emergency diesel 

generator) to start on demand following an initiating event (e.g., a loss of offsite power). Denote 

the probability of the event occurrence (i.e., the failure) by p. Assuming that—

(i) There are only two possible outcomes (success or failure) given a demand.

(ii) The physical process leading to event occurrences is not changing over time, so the 

failure probability (p) and the success probability (1−p) are constant from demand to 

demand.

(iii) The likelihood of an event occurring on a given demand does not affect the likelihood 

of a separate event occurring on a different demand (i.e., event occurrences across 

separate demands are statistically independent).

the process of generating events is called a “Bernoulli process”10 and the probability 

of observing R events in N demands is given by the binomial distribution:

(A.9)

 9 As defined in NUREG-2122 (NRC, 2013c), a “basic event” is “[a]n element of the PRA model for which no further 

decomposition is performed because it is at the limit of resolution consistent with available data.” Initiating events 

and component failures are examples of events that can be treated as basic events. 10 Also known as the “coin flip process,” where p is equal to 0.5 if the coin is fair

P(R|p,N)= N!

R!(N-R)!

pR(1-p)N-R
A-8

Using the definition of average value:

(A.10)

it can be shown that the average number of events is given by:

(A.11)

Consider now an accident sequence (a compound event) comprising an initiating event 

(generated by a Poisson process with frequency λI) and a demand failure event (generated by a 

Bernoulli process with probability pB).11 Using the mathematical laws governing probabilities, it 

can be shown that accident sequence occurrences follow a Poisson distribution with overall 

frequency λI pB (Ross, 2014):

(A.12)

A similar result can be developed for accident sequences composed of an initiating event and 

an arbitrary number of successes and failures following that initiating event.

Thus, the simple relationship for frequencies of events given in Equation A.4 and the 

exponential distribution for the timing of events given in Equation A.5 hold for accident 

sequences as well as basic events as long as Assumptions (i) through (vi) are valid. 

Conversely, if the assumptions are not valid, these equations no longer apply.

A.3.3 Treatment of Multiple Accident Sequences

In a typical NPP PRA model, core damage can result from thousands or even millions of 

accident sequences. As discussed below, as long as the accident sequences can be modeled 

using the Poisson distribution, the occurrence of core damage can be modeled using the 

Poisson distribution with a frequency (i.e., core damage frequency (CDF)) equal to the sum 

of the frequencies of the contributing accident frequencies.

Consider the simplified example event tree shown in Figure A-5, in which initiating event I can, 

depending on the particular sequence, be followed by subsequent events A through C. Core 

damage can result from accident sequences 2, 4, and 5. The frequencies of these sequences 

are as shown in Figure A-5. (Note that the event probabilities are, in general, dependent on 

preceding events.)12

 11 This generating process is sometimes called a “filtered Poisson” process. 12 This is not a contradiction of Assumption (vi). That assumption applies to each particular event singly 

(e.g., event A) and not to combinations of different events (e.g., A and B).

R� ≡�R∙P(R|p,N)

∞

R=0

R� = Np

P�R|λI,pB,T�=

�λIpBT�

R

R! e-λIpBT
A-9

Figure A-5 Example event tree

Figure A-6 shows an equivalent “state-transition diagram” representation of the event tree. This 

representation emphasizes that the transition from its initial “OK” state to core damage (CD) can 

occur via one of three paths, and that the (random) times to core damage along each path, TCD2, 

TCD4, and TCD5, respectively, are governed by the frequencies of the paths (λ2, λ4, and λ5). Core 

damage will occur by the path which happens to be the quickest.13 Thus, the overall time to core 

damage, TCD, is the minimum of the three possible core damage times:

TCD = min(TCD2,TCD4,TCD5) (A.13)

Figure A-6 Equivalent state-transition diagram for example

Using (1) the fact that the path-dependent core damage times are exponentially distributed (see 

Equation A.5) and (2) Equation A.13, it can be shown that TCD is also exponentially distributed 

with frequency parameter CDF = λ2 + λ4 + λ5:

(A.14)

It can be seen that this result can be generalized to larger event trees and to full PRA models 

with multiple initiating events.

 13 In the statistical literature for health care applications, models such as those shown in Figure A-6 are often referred 

to as “competing risks” models.

FTCD(t) ≡ P{TCD ≤ t} = 1 - e-(λ2+λ4+λ5)t
A-10

A.4 Aleatory and Epistemic Uncertainties

The preceding discussion addresses uncertainties because of “inherent randomness.” In earlier 

literature, they are often called “random uncertainties” or “stochastic uncertainties.” Using the 

terminology introduced to the nuclear PRA community by Apostolakis (1994) and Budnitz et al.

(1997) and adopted in many regulatory documents, (e.g., Regulatory Guide 1.174 

(USNRC, 1998b, 2011a)), they are called “aleatory uncertainties.” Their principal characteristic 

is that they are (or are modeled as being) irreducible; they are defined by the form of the 

probability distribution (e.g., the Poisson distribution) and the value of the distribution 

parameters (e.g., λ).

Note that in the examples given earlier, the variability in the uncertain variable (e.g., R or T) is 

observable, at least in principle. In other words, repeated observations of the variable will result 

in an empirical distribution of values. This provides a way to think about aleatory uncertainties—

if repeated trials of an idealized thought experiment (in which the conditions are kept constant 

from trial to trial) will lead to a distribution of outcomes for the variable. This distribution is a 

measure of the aleatory uncertainties in the variable.

Another type of uncertainty addressed in PRAs is “epistemic uncertainty,” which has been called 

“state-of-knowledge uncertainty” in earlier papers because it is because of weaknesses in the 

current state of knowledge of the assessor. Uncertainties in a deterministic variable whose true 

value is unknown are epistemic. Repeated trials of a thought experiment involving the variable 

will, in principle, result in a single outcome, the true value of the variable.

Unlike aleatory uncertainty, epistemic uncertainty is reducible with the collection of additional 

information. In PRAs, for example, it is typically assumed that the Poisson model is a good 

representation for the number of failures of equipment while running, (i.e., it is a good model 

To recap—

• The Poisson model for the occurrence of random events over time implies 

an exponential distribution for the occurrence times of these events.

• The average (or “mean” or “expected”) event occurrence time, also called the “return 

period,” is equal to the inverse of the event frequency (i.e., to 1/λ).

• A characteristic time trace for Poisson-distributed events is irregular. Smaller time 

intervals occur more often than larger time intervals (leading to apparent clustering), 

and most of the time intervals are less than the average event occurrence time.

• The occurrence of an accident sequence can be modeled using the Poisson 

distribution as long as initiating event occurrences can be treated using the Poisson 

distribution and subsequent successes and failures can be treated using the 

binomial distribution.

• The occurrence of core damage can be modeled using the Poisson distribution 

with an overall CDF equal to the sum of the frequencies of the contributing accident 

sequences as long as the occurrence of accident sequences can be modeled using 

the Poisson distribution.
A-11

for the aleatory uncertainties). It is assumed that there is a particular failure rate for each 

component. Initially, we may not have much failure data for a component, and our epistemic 

uncertainties in the value of the failure rate will be large. After we collect a large enough sample 

of failure data, we can get a very good estimate of the failure rate, (i.e., the epistemic 

uncertainties in the value of the failure rate will be small).

The epistemic uncertainties are quantified using probability distributions. Figure A-7 provides an 

example showing how the distributions are narrowed (i.e., the uncertainties are reduced) when 

additional information is collected.14 In this figure, R represents the number of observed failures 

and T represents the total number of component-years (i.e., the cumulative years of experience 

for all of the components in the population). In both cases, the ratio of R to T is the same. 

However, because one case has 10 times the amount of data as the other, the uncertainties 

in the underlying value of λ are significantly less.

Figure A-7 Reduction in epistemic uncertainty with increased data

Figure A-8 shows how aleatory and epistemic uncertainties can be represented when dealing 

with event occurrence times as modeled in PRAs. (An analogous representation can be 

developed for variables representing the number of events in a given time period.) The heavy 

curves (solid and dashed) are the cumulative probability distributions quantifying the aleatory 

uncertainties in the event occurrence time. The light curve crossing these heavy curves is the 

probability density function quantifying the epistemic uncertainties in λ. As discussed in 

Section A.2, the aleatory distributions are conditioned on the value of λ; the three curves shown 

correspond to the 5th percentile (λ05), mean (λ�), and 95th percentile (λ95) values of λ. Note that 

PRA results typically focus on characterizing the epistemic uncertainty in λ; the aleatory 

uncertainties in the observable variable are assumed to be understood.

 14 The method for generating these distributions, given data, is discussed in Appendix B.
A-12

Figure A-8 Representation of aleatory and epistemic uncertainties in event 

occurrence time

APPENDIX B

To recap—

• Uncertainties in a variable are treated in PRAs as being aleatory when the variable 

is assumed to be the result of a random process (i.e., repeated trials of a thought 

experiment will lead to a distribution of values for the events). Typical aleatory 

variables are the failure times of components (while running) and the number of 

times a component fails on demand.

• Uncertainties in a variable are treated in PRAs as being epistemic when the variable 

is assumed to be deterministic (i.e., repeated trials of a thought experiment will lead to 

a single value for the variable). Typical epistemic variables are the rate of occurrence 

of initiating events and the rate of failure of components (per demand or while 

running).
B-1

APPENDIX B

BAYESIAN ESTIMATION OF CDF AND LERF

B.1 Introduction

Figures 4-1, 4-2, and 5-1 in the main body of this report show distributions for plant core 

damage frequency (CDF) and large early release frequency (LERF) derived from global 

statistics under a variety of assumptions. Such distributions, which are not discussed in most 

published estimates, quantify the epistemic uncertainty in the CDF and LERF estimates. These 

distributions were derived using Bayes’ Theorem, as described in this appendix. Additional 

information on the philosophy and application of Bayesian estimation (in the context of 

probabilistic risk assessment (PRA)) can be found in many places, including Apostolakis 

(1978, 1990), Siu and Kelly (1998), and Atwood, et al. (2003).

B.2 Bayes’ Theorem

The quantification of the uncertainties in many quantities of interest in PRAs involves the 

collection and interpretation of a variety of forms of evidence (e.g., model predictions, expert 

opinion, empirical data) and the application of an appropriate estimation procedure that uses 

this evidence. Formally, the estimation procedure involves the application of Bayes’ Theorem.

The general form of this theorem is:

(B.1)

Where θ is the vector of epistemic parameters to be estimated; Ε is the evidence; π1(θ|Ε) is 

the posterior epistemic distribution (i.e., the probability distribution for θ after observing the 

evidence); L(Ε|θ) is the likelihood function (i.e., the aleatory probability of observing the 

evidence if it is known); π0(θ) is the prior epistemic distribution for θ (i.e., the probability 

distribution for θ prior to observing the evidence); and the integral on the right-hand side of the 

equation is performed over all possible values of θ (so the denominator is just a normalization 

constant).

While Equation B.1 may appear to be complicated, its application is straightforward in many 

practical cases. In this report, for example, we are interested in estimating λ, the frequency of an 

event, and the evidence consists of an observation of R events in a specified time interval T. As 

discussed in Appendix A, event occurrences are typically modeled in PRAs using the Poisson 

distribution (Equation A.1, reproduced as Equation B.2 below for convenience).

(B.2)

Thus, after some simplification by removing constants that are common to the numerator and 

denominator, Equation B.1 becomes:

π1�θ|E� = L�E|θ�π0�θ�

∫ L�E|θ�π0�θ�dθ ∞

Θ

P(R|λ,T)=

(λT)R

R! e-λT
B-2

(B.3)

This equation has analytical solutions for some forms of the prior distribution. For other forms, it 

can be solved numerically using simple tools (e.g., spreadsheets or equation solving software).

When the evidence is not in the form of R events in time T, the use of Bayes’ Theorem may not 

be as straightforward. For example, the evidence may consist of expert estimates for λ, perhaps 

including uncertainties. Although Bayesian procedures have been developed to address such 

cases, current PRAs often employ alternative procedures (e.g., elicitation processes such as 

those described in NUREG/CR-6372 (Budnitz et al., 1997) to develop the probability 

distribution).

B.3 Non-Informative Prior Distributions for λ

In principle, the prior distribution, π0(λ) in our case, quantifies the analyst’s belief regarding 

the possibility that the uncertain variable (λ) takes on values in different ranges. In practice, 

in situations for which large amounts of data are available, the precise shape of the prior 

distribution is unimportant; the data “overwhelms” prior beliefs in shaping the posterior 

distribution. In order to avoid the effort needed to develop (and potentially defend) a prior 

distribution in such situations, practical studies often make use of so-called “non-informative” 

prior distributions.

Non-informative prior distributions are mathematically defined functions constructed to represent 

a relative state of ignorance regarding the uncertain variable. Because there is no one unique 

way to define this state of ignorance, there is no one unique way to define a non-informative 

prior distribution. Three distributional forms found in PRA analyses and used in this report are

(1) the non-informative distribution as defined by Winkler and Hays (1975), (2) the Jeffreys’ Rule 

prior (Jeffreys, 1961), and (3) the constrained non-informative prior distribution (Atwood, 1996; 

Atwood et al., 2003). For our problem of estimating λ, these take the functional form:

(1) (B.4)

(2) (B.5)

(3) (B.6)

where E0[λ] is the mean value of λ prior to observing any new data. (The constants of 

proportionality are unimportant for all three forms because, for each case, the constant appears 

in the numerator and denominator of Equation B.3.)

π1(λ|R,T) = λRe-λTπ0(λ)

∫ λRe-λTπ0(λ)dλ ∞

0

π0(λ) ∝ 

1

λ

π0(λ) ∝ 

1

√λ

π0(λ) ∝ 

1

√λ

e

- λ

2E0[λ]
B-3

It is extremely important to recognize that these different prior distributions are intended for use 

when there are sufficient amounts of data to make the precise shape of the prior unimportant.1

In more general cases, useful statistical estimates for an unknown quantity should be based on 

a prior distribution that represents the state of knowledge regarding the unknown quantity prior 

to observing the evidence (Apostolakis, 1978, 1990).

B.4 Posterior Distribution for λ

Using the likelihood function given by Equation B.2 and any of the prior distributions given by 

Equations B.4 through B.6, it can be shown that Equation B.3 has the following analytical 

solution:

(B.7)

where

Γ() = gamma function 2

α' = R + α

β' = T + β

and the parameters α and β are parameters characterizing the prior distribution, as shown in 

Table B-1.

Table B-1 Non-Informative Prior Distribution Parameter Values

Distribution Form α β

(1) Non-informative per Winkler and Hays 

(1975)

0 0

(2) Jeffreys prior 0.5 0

(3) Constrained non-informative 0.5 0.5/Ε0[λ]

The mean value and variance of the posterior distribution are given by:

(B.8)

(B.9)

The percentiles of the posterior distribution have to be determined by numerical integration. For 

example, λ95, the 95th percentile, is determined by solving the implicit equation:

 1 Note that in such cases, the singular behavior of π0(λ) as λ approaches zero is not a practical concern. 2 The gamma function is a complicated integral but can be solved using built-in functions provided in common 

spreadsheet and equation solving software packages.

π1(λ|R,T) = Γ�α'

+β'�

Γ(α')Γ(β')

λα'

-1

e-β ́λ

E1[λ|R,T] = α'

β'

Var1[λ|R,T] = α'

β'2
B-4

(B.10)

B.5 Posterior Distributions for CDF and LERF

Using the results of Section B.4 above, posterior distributions for CDF and LERF can be 

determined in a generally straightforward manner.3 The parameter values used in the 

calculations (which are based upon reactor-years through 2013) are shown in Table B-2; 

the results are shown in Figures B-1 through B-4. We used the equation solving package 

MathCAD 15.0 by Parametric Technology Corporation (PTC).

Table B-2 Parameter Values Used in Bayesian Estimates of CDF and LERF

Data Prior Distribution Parameters

Figure Parameter R T* α β

B-1 CDF (Worldwide) 6** 15182 0 0

B-2 CDF (U.S.) 1 3839 0 0

B-3 LERF (Worldwide) 1 15182 0 0

B-4 LERF (U.S.) 0 3839

0 (Blue)

0.5 (Red)

0.5 (Green)

0 (Blue)

0 (Red)

5×104 yr (Green) *

Based on worldwide reactor-years through 2013; does not account for outages **From Cochran (2012)

Figure B-1 Uncertainty band about Cochran (2012) estimate

Note that the prior distribution parameters underlying the blue, red, and green curves shown in 

Figure B-4 characterize the three different “non-informative” prior distributions discussed in 

Section B.3. Setting α and β to zero corresponds to Equation B.4, setting α to 0.5 and β to zero 

 3 To obtain the result shown in Figure B-4, since there have been no large early releases in the United States,

numerical problems arise when solving Equation B.7. In this case, we truncated the prior distribution for LERF, 

setting a lower value of 10−9/RY and an upper value of 10−2/RY.

0.95 = � Γ�α'

+β'�

Γ(α')Γ(β')

λα'

-1

e-β ́λ dλ

λ95

0
B-5

corresponds to Equation B.5, and setting α to 0.5 and β to 5×104 corresponds to Equation B.6 in 

which the mean prior value is set to a value of 1×10−5

/reactor-year (RY) (a round number 

suggested by past PRAs).

Figure B-2 Statistical estimate for CDF (U.S. plants only)

Figure B-3 Uncertainty band about point estimate for LERF (world reactors)

We caution that the results shown in Figures B-1 through B-4 are for illustration purposes only. 

Clearly, as demonstrated in Figure B-4, the available statistical evidence is weak and the 

assumption that the precise shape of the prior distribution is unimportant is incorrect for most 

of the data sets analyzed. (The results shown in Figure B-1 are fairly robust.) Should there be a 

need to develop a Bayesian estimate for CDF or LERF to support decisionmaking, this should 

involve the development of an informative prior (i.e., a prior distribution that reflects what is 

currently known about the parameter of interest).
B-6

Figure B-4 Statistical estimate for LERF (U.S. plants only)




NUREG

-2201 Probabilistic Risk Assessment and Regulatory Decisionmaking:

Some Frequently Asked Questions