Core Damage Frequency ( CDF) is a risk metric employed by nuclear regulatory bodies worldwide. Numerical values for this metric are required by U.S. regulators, prior to reactor licensing, and reported values can trigger regulatory inspections. CDFis reported as a constant, sometimes accompanied by a conﬁdence interval. It is well understood that CDFcharacterizes the arrival rate of a stochastic point process modeling core damage events. However, conse- quences of the assumptions imposed on this stochastic process as a computational necessity are often overlooked. Herein, we revisit CDFin the context of modern counting processes. We will argue that the assumptions required to obtain a numerical value for CDF(e.g.,with Probabilistic Risk Assessment ( PRA)) are typically unrealistic and lead to an underestimate bias. We will conclude that: 1. The computation of core damage frequency (CDF) cannot account for the stochastic dependence between reactor protections and arriving initiating events. corresponding author, wortman@haztechrisk.org 1 2. In practice, there can be no direct observational data reﬂecting the propensity for core damage. 3. CDF calculated via PRA or PSA is optimistically biased. 4. The optimistic bias of CDFshould disqualify its use in regulatory oversight. Keywords— PRA, PSA, CDF, Core Damage Frequency, counting processes, martingales 1 Overview CDFhas a long history as a risk metric for the U.S. civilian nuclear ﬂeet. It is a data–derived constant intended to provide insight as to the likelihood of core damage events. CDFis used to report both historical ﬂeet performance and to predict performance of individual reactor units. As an historical performance metric,CDFis simply the quotient of total industry core damage events and total reactor years of operation. For example, see Ha-Duong and Journé for such history up to 2014. But, risk is concerned with future operationalbehaviors.Sinceanypracticalreactorwillexperienceatmostonecoredamageevent,‘frequency’ is an unnatural concept that must be understood within the context of modeling used to support the computation of a predictive CDF. A large body of literature is devoted to computing estimates of CDF; most of this work extends from Rasmussen (1981). The central theme of this corpus focuses on how to analytically connect possible core damage with the status of reactor protections and the arrival of initiating events that, if unmitigated by protections, might exceed to catastrophe. Examples, among many reported in the literature, that employ or extend Rasmussen’s work include Zhang et al. (2021) who argue that the cost and beneﬁt of safety enhancements can be in part evaluated against predicted CDF. Cho et al. (2017) describe how, based onCDF, some protections are less important than others. Williams et al. (2018) describe a method that integrates prediction of conditional probability of core damage events with predicted frequency of core damage. Haraguchi et al. (2020) use a combination of CDFand core damage probability in a seismic risk 2 study. These typical analyses rely on the Rasmussen characterization of CDFas the product of a predicted arrival rate of initiating events (denoted by ) with a predicted proportion of initiating events that exceed to core damage (denoted by p). However, the Rasmussen approach relies on informal mathematics that treats pas the long–run probability reactor protections are unavailable and thereby adopts an implicit assumption that long–run reactor protection unavailability as seen at the epochs of the randomly arriving initiating events is the same as would be observed at an arbitrary ( i.e.,non–random) time. This assumption leads to computationally tractable estimates of CDF. Unfortunately, however, it holds only in special circumstances that typically defy practical justiﬁcation. We will show that assuming the proportion of initiating events that exceed to core damage is equal to the limiting probability that protections are unavailable leads to an optimistic bias when estimating CDF.1We refer to this assumption as the Rasmussen characterization. We will explore practical conditions under which the Rasmussen characterization of CDFis deﬁcient, and then gauge the usefulness of CDFas a risk metric by addressing the following questions: 1. When does CDFexist? 2. Is it feasible to estimate CDF, when it exists? 3. Do estimates of CDFclosely approximate its true value? We approach these questions by ﬁrst introducing three easily proved propositions and their corollaries in Section 2. We then conclude with Section 3 where we directly address these questions by applying the results of Section 2. Our analyses rely on standard results from the theory of martingales and stochastic counting processes. 1There is a large literature devoted to bias phenomena that arise with stochastic point and counting process models. Famous well–studied examples include the Inspection Paradox, Feller’s Paradox, and Palm Probabilities. A common feature of these bias phenomena is the discrepancy between event probabilities as seen across diﬀerent classes of stopping times. It should be of no surprise that counting processes used to study CDFwould exhibit a bias phenomenon. 3 2 Predictive Model Consider a single reactor unit equipped with protections having a predictive model constructed on a prob- ability space that is tailored to incorporate the following features. Predictive Model Features. The nuclear reactor unit under investigation is equipped with protections designed for the purpose of mitigating operational anomalies and exogenous inﬂuences, called initiating events, that might lead to core damage. The sequence of initiating events occur randomly and thus forms a stochastic point process. A single reactor can experience multiple core damage events over the course of its deployment.2 The stream of arriving initiating events is bifurcated according to the state of the protections at the time of arrival. Thus, core damage events occur at epochs of those initiating events that breach reactor protections. In our arguments that follow, we employ the standard analytical framework of ﬁltered probability spaces for characterizing ‘historical events’ on which stochastic process temporal dynamics depend. Our notation closely follows that of most standard stochastic process textbooks, such as Çınlar (2011) or Rogers and Williams (2000). All random processes we model are adapted to the ﬁltration fFtgt0on the ﬁltered probability space ( ;F;fFtgt0;P). 2.1 Almost Sure Behavior LetND t,t0be the number of core damage events the reactor suﬀers in the interval [0;t].CDFis understood to be the limiting number of core damage events per unit time. That is, 2This modeling feature is essential in order to accommodate estimating a core damage ‘frequency.’ 4 Deﬁnition 1 (Core Damage Frequency) . CDF = lim t!11 tND t; 1 whenever convergence to a constant occurs almost surely (a.s.) CDFis reported as a numerical constant. Of course, convergence of eq. 1 is not guaranteed. Further, even when eq. 1 convergences, there is no guarantee that its limit is a constant; convergence to a random variable is a completely plausible circumstance. We emphasize that CDFis a numerical constant, estimates of which are used to gauge the risk of suﬀering a core damage event. As will be shown, the existence of CDFis predicated in part on the dynamics of initiating event arrivals. LetNtbe the number of initiating events arriving in the interval [0;t]. Without loss of generality we require that for almost all !2 , the trajectory Nt(!)is right continuous and proceeds in jumps of magnitude one. The limiting arrival rate of initiating events is deﬁned as follows. Deﬁnition 2 (Initiating Event Frequency) . = lim t!11 tNt; 2 whenever convergence occurs a.s. In general can be a random variable, and convergence to a constant occurs only when =E[] NotethatfND tgt0inheritsright–continuityfrom fNtgt0,anditnowfollowsdirectlyfromDeﬁnitions1 and 2 that when is a constant, CDFa.s.= lim t!1ND t NtNt t=p 3 where, p= lim t!1ND t Nt: Thus,CDFis the product of the initiating event frequency with the proportion of initiating events that 5 exceed to core damage. Typically, estimating is straightforward. Estimating pis more challenging. Note that whileptakes values in the interval [0;1], it is deﬁned as the limiting value of a ratio of random variables. However, under certain circumstances pcan be interpreted as the probability that an arriving initiating event will exceed to core damage. One such circumstance occurs when initiating events form an ordinary Poisson process. Then, the well-known Poisson Arrivals See Time Averages ( PASTA) result applies, and pcan be computed as the limiting unavailability of reactor protections (see Wolﬀ, 1982). Unfortunately, the assumptions needed to justify PASTAdefy practical justiﬁcation. Consequently, estimating pis quite diﬃcult in practice. There are a variety of approaches for crafting estimators for pthat incorporate the joint histories of initiating event arrivals, protection maintenance activity, environmental conditions, etc.Monte Carlo methods, owing to their adaptability to complex engineering models, have gained acceptance and popularity for estimating pand other statistics. These methods are not, however, a panacea because they require characterizing probability laws on subordinate stochastic processes that must be mapped into the dynamics of protection availability in order to build useful estimators. Characterizing probability laws on stochastic processes is often impractical due to the intensive data support required for all but the most stylized processes. In order to better appreciate the manner in which CDFjointly depends on the arrival of initiating events and the eﬃcacy of reactor protections, we will appeal to the martingale characterization of stochastic point processes (see Bremaud, 1981). Let Ntbe (as stated previously) the number of initiating events arriving in the interval [0;t]. It is reasonable in practice to require that initiating events occur one at a time a.s.It follows that the trajectories of fNtgt0are nonnegative non-decreasing and proceed in jumps of size one a.s.We deﬁnefXtgt0as the state of reactor protections at time ttaking values in the set f0;1g. When an initiating event arrives to ﬁnd Xt= 1, protection holds. Otherwise, with Xt= 0, protection fails and core damage will ensue. BothfNtgt0andfXtgt0are adapted to the ﬁltration fFtgt0. We deﬁne Xtto be left continuous 6 and thusFt-predictable. Clearly, fNtgt0forms anF-sub–martingale. Appealing to the standard results from the martingale calculus (see Çınlar, 2011), it follows from the Doob–Mayer Decomposition Theorem that Nt=Mt+ t; 4 where the process fMtgt0forms anFt-martingale with compensator ftgt0(tis increasing a.s.and Ft-predictable), with t=Zt 0sds: 5 Here,tis well deﬁned when for all nonnegative, fFtg-predictablefCtgt0such that EhZ1 0CtdNti =EhZ1 0Cttdti : 6 When well deﬁned, tis a unique Radon–Nikodym derivative deﬁned on the usual equivalence class, with the stochastic intensity process ftgt0adapted tofFtgt0and predictable. Informally, t=E[dNtjFt] and can be understood as the propensity for an initiating event to arrive in the next instant of time given the history of initiating events and reactor protections. Now, consider the martingale transform MD tof protection unavailability (1Xt)with respect to Mt of eq. 4, where MD tdef=Zt 0(1Xs)dMs=Zt 0(1Xs)dNsZt 0(1Xs)ds: Proposition 1 (Core Damage Martingale) .fMD tgt0is a martingale whenever the stochastic intensity process of arriving initiating events ftgt0exists. Proof.SinceXtisFt-predictable and 0Xt(!)1for all!2 andt0, it follows thatfMD tgt0is also anFt-martingale (see Rogers and Williams, 2000), and noting that ND t=Rt 0(1Xs)dNscounts the 7 number of core damage events in the interval [0;t], we have that MD t=ND tZt 0(1Xs)ds and, substituting from eq. 5 gives MD t=ND tD t: 7 We refer tofMD tgt0as theCore Damage Martingale and its compensator is given by D t=Zt 0D sds=Zt 0(1Xs)sds: Remark 1. Equation 7stands as the most general expression characterizing the relationship among core damage events, the arrival of initiating events, and the eﬃcacy of reactor protections. It is important to keep in mind that, for all t0,MD t,ND t,D t,Xt, and (in particular) tare random variables. Hence, eq.7is nontrivial as it requires stochastic integration. Consider now, the following proposition: Proposition 2 (Existence of CDF).If lim t!1MD t ta.s.= 0; 8 thenDexists (and is possibly a random variable) and for almost all (a.a.) !2 D(!) = lim t!1ND t(!) t= lim t!11 tZt 0(1Xs(!))s(!)ds where, 0<D(!)<1. 8 That is, lim t!1MD t ta.s.= 0if and only if lim t!1ND t ta.s.=Dand lim t!11 tZt 0(1Xs)sdsa.s.=D:9 Proof.Proposition 2 is an obvious consequence of Deﬁnition 1 and eq. 7. Remark 2. Clearly, CDF exists only ifMD t ta.s.!0andDa.s.=E[D]<1. Proposition 2 reveals the chal- lenge in estimating CDF. In the absence of observed core damage events, predictive estimates of CDF must be formulated in terms of phenomena that can be observed. To this end, analysts must rely on observations of initiating event arrival times, and reactor protection performance (principally in the form of maintenance records and failure data). These observations are, of course, insuﬃcient to capture the joint dynamics of f(Xt;t)gt0needed to directly employ the strong law relationship of Proposition 2, where, Da.s.= lim t!1D t t= lim t!11 tZt 0(1Xs)sds: Monte Carlo methods do not escape the diﬃculty of computing D.fXtgt0andftgt0are not mutually independent (even when fNtgt0is Poisson with rate ) andtis not directly observable. Since this de- pendence requires a Monte Carlo model to rely on an accurate characterization of the probability law on the joint stochastic process f(Xt;t)gt0, it is clear that the data requirements to support accurate estimation of this probability law are beyond the practical reality of reactor unit operations records. 2.2 Behavior in Expectation Important insights regarding CDFare revealed by exploring the expectation ofMD t t. In particular, we are interested in the consequences of the stochastic dependence the state of system protections fXtgt0and the arrival of initiating events fNtgt0and consequently ftgt0. Consider now, 9 Proposition 3 (Moment Convergence) .Suppose thatMD t ta.s.= 0, then lim t!1EhMD t ti = 0if and only if lim t!1EhND t] ti =E[D]and lim t!1Eh1 tZt 0(1Xs)sdsi =E[D]:10 And, with the additional condition that D=E[D]<1, CDF = lim t!11 tZt 0E[(1Xs)s]ds: 11 Proof.Recall that almost sure convergence implies convergence in expectation (see Dudley, 2018). Hence, eq. 10 follows directly from Proposition 2. Nonnegativity of the integrand in eq. 10 allows a routine applica- tion of Tonelli’s Theorem to exchange the order of expectation and integration to show eq. 11 (see Folland, 1999). Finally, D=E[D]<1implies thatND t ta.s.!E[D], a ﬁnite constant, thus ensuring the existence ofCDF. Recalling the deﬁnition of covariance3, it immediately follows that Corollary 1. WhenD=E[D]<1, then CDFa.s.= lim t!11 tZt 0cov((1Xs);s)ds+ lim t!11 tZt 0E[(1Xs)]E[s]ds 12 Proof.Simply apply the deﬁnitions of CDFand covariance. Corollary 2. WhenD=E[D]<1, CDFa.s.= lim t!11 tZt 0E[(1Xs)]E[s]ds 13 3For two random variables YandZ,cov(Y;Z)def=E[ZY]E[Z]E[Y]. 10 if and only if E[tjFt] =E[t]for allt0. Proof.We need only show that cov((1Xt);t) = 0if and only if E[tjFt] =E[t]. First, assume that E[tjFt] =E[t]for allt0for allt0. Note that E[(1Xt)t] =E[E[(1Xt)tjFt] =E[E[(1Xt)E[t]jFt] =E[t]E[E[(1Xt)jFt] =E[t]E[(1Xt)]: Thus, it follows from the deﬁnition of covariance that cov((1Xt);t) = 0. Now, assume that cov((1Xt);t) = 0. It follow trivially that E[(1Xt)t] =E[t]E[(1Xt)]: Corollary 3 (Rasmussen Characterization of CDF) .When,E[tjFt] =E[t] = <1andXta.s.!X, then CDFa.s.=lim t!11 tZt 0(1Xs)ds: 14 Proof.It follows from eq. 13 that when E[tjFt] =E[t] =<1, CDFa.s.=lim t!11 tZt 0E[(1Xs)]ds; and sinceXta.s.!X, lim t!11 tZt 0E[(1Xs)]ds=lim t!11 tZt 0(1Xs)ds; eq. 14 follows. 11 Remark3. It is important to appreciate that Corollary 3 doesnot imply that the state of reactor protections fXtgt0is independent of initiating event arrivals fNtgt0. The condition E[tjFt] =implies that Xt, the state of system protections at time t, does not inﬂuence the arrival times of future initiating events (a circumstance that we discuss more fully in Section 3). The conditions establishing Corollary 3 allow for the possibility that initiating events can cause a failure of system protections (in addition to the possibility protections were already failed immediately prior to arrival). Equation 14has, as a special case, the condition that arriving initiating events fNtgt0form an ordinary Poisson process of rate . We also could have shown eq.14as a special case of eq. 9where, the constant can be moved outside the integral (see Wolﬀ, 1982) for a full development of when Poisson arrival see time averages. We point out, however, that the condition E[tjFt] =can hold for initiating event streams that are not Poisson (see Melamed and Whitt, 1990). Hence, eq. 14is a bit more general than the Wolﬀ (1982) result. Of course, Corollary 3 also holds under the more restrictive condition that fXtgt0andfNtgt0are independent processes. 3 Summary and Conclusions The appeal of CDFas a risk metric is that it reports as a single numerical value that is computed using historical data captured for a given reactor unit using physics and operations-based predictive modeling. The magnitude of the reported value is intended to quantify expectations regarding time between core damage events. That is, the reciprocal of CDFestimates the “expected” time between core damage events. And, since in practice, an operating reactor unit has never suﬀered a core damage event, CDFis intended to oﬀer insight as to expectation of the remaining time until the ﬁrst core damage event might occur. Estimates of CDFare almost always developed through PRAand Probabilistic Safety Analysis ( PSA) studies. These studies use combinational logic models (fault trees) of reactor protections subordinated to a Monte Carlo simulation experiment. Monte Carlo relies on estimates of the probability law for the various fault tree elements and initiating events. Fault tree element probability laws ( i.e.,reliability functions) are estimated from historical data associated with reactor unit operations and maintenance. Initiating event 12 laws are developed from histories of both exogenous inﬂuences ( e.g.,weather events, seismic disturbances, etc.) and endogenous inﬂuences ( e.g.,equipment failures, human operator errors, etc.). Modeling reliance on historical data reveals the necessity of strong law characterizations of event probabilities. But, it is important to appreciate that Level-1 PRAstudies rely on the Rasmussen characterization of CDF. That is, either through explicit or implicit assumption, future arriving initiating events are taken to be independent of the present state of reactor protections. Consequently, Monte Carlo estimates of CDFdeveloped through PRAconverge to the form given in eq. 13. Whether or not the appeal of CDFas a risk metric is justiﬁed is the subject of much literature that we will not review. It is nonetheless fact that CDFis a quantity of interest to regulators, design engineers, utility operators, and the public, and is a focus of Level-1 PRAstudies. Our focus is limited to the existence ofCDFand the ﬁdelity of its estimates. To this end, we revisit the three question posed in Section 1. 3.1 When does CDF exist? We establish the conditions required for the existence of CDFin Proposition 2. We observe that existence relies on the strong convergence to zero of the core damage martingale. As Proposition 2 shows, convergence cannot be achieved when either reactor protections or initiating events do not achieve a steady state regime. For instance, if climate change is deemed to be in play during the operational life time of a reactor unit, then exogenously arriving weather–response initiating events are unlikely to be in steady state. Similarly, our present understanding of seismic activity relies on self–exciting stochastic point processes. This suggests that exogenous initiating events arising from seismic activity are unlikely to achieve steady state during a reactor unit’s operating lifetime. Finally, and perhaps most importantly, much engineering eﬀort is devoted to discovering and eliminating reactor protection failure modes not included in preliminary Failure Mode and Eﬀects Analysis ( FMEA) studies. These discoveries and corresponding design corrections dramatically inﬂuence the probability law on fXtgt0and whether or not reactor protections converge to a steady state regime. It is important recognize that the discovery of any new failure mode after time tcannot appear in 13 the prior history captured in the ﬁltration fFtgt0; this practical engineering reality suggests that “good engineering practice” and innovation contribute to the lack of stationarity for reactor protections. 3.2 Is it feasible to estimate CDF, when it exists? Accepting the existence of CDF, it is a straightforward matter to compute estimates under the Rasmussen characterization; this is the function of Level-1 PRAstudies. If, however, the Rasmussen characterization is rejected, CDFis not easily estimated. In order to better understand this, let Tn,n1be the time of thentharriving initiating event. Tn= infft>0 :Ntng;n1: WhenCDFexists, XTna.s.!~XandXta.s.!X: 15 Under the Rasmussen characterization, ~Xa.s.=X=)E[~X] =E[X]a.s.= lim t!11 tZt 0Xsds: 16 That is, the Rasmussen characterization requires that the state of reactor protections as seen at epochs of initiating event arrivals is the same as would be seen at an arbitrary time. Of course, relaxing the requirements of the Rasmussen characterization implies that E[tjFt]6=which has the consequence that eq. 16 does not hold. Corollary 1 reveals the bias between true CDFand the Ramussen characterization as CDF(1E[X])a.s.= lim t!11 tZt 0cov((1Xs);s)6= 0; 17 and while the bias is known to exist, stochastic intensity tis a Radon–Nikodym derivative that is not directly observable; hence, there are no data to support a Bayesian estimator either parametric or non– 14 parametric. 3.3 Do estimates of CDF closely approximate its true value? Any special properties associated with the bias given eq. 17 are of considerable practical interest. To this end, recall the deﬁnition of the Pearson correlation coeﬃcient (Y;Z)between any two random variables YandZdeﬁned on a common probability space where (Y;Z)def=cov(Y;Z)p var(Y)p var(Z): (Y;Z)is positive if and only if Y and Z tend to be simultaneously greater than, or simultaneously less than, their respective expected values.4 It immediately follows from the deﬁnition of correlation coeﬃcient that (1Xt)andtare either positively correlated or uncorrelated if and only if cov((1Xt);t)0. Observe that for each t;s0, and !2 ,Xt+s(!)Xt(!)takes values only the the set f1;0;1g. Straightforward engineering reasoning reveals that for all t;s> 0, lim s#0P(Xt+sXt= 1;NtNts= 1) = 0: This is to say, almost surely an arriving initiating event will not cause non-functioning reactor protections to suddenly function , and it follows that lim s#0P(Xt+sXt0jNtNts= 1) = 1: This is equivalent to saying that Xtalmost surely will not increase given an increase in Nt. SinceNtis nondecreasing in t, we observe that XtandNtmust be either negatively correlated or uncorrelated. As an immediate consequence, (1Xt)andNtmust be either positively correlated or uncorrelated. Noting 4The converse is true for a negative value of (Y;Z). 15 the informal relationship that E[dNtjFt] =tdt, it is easily reasoned that tand(1Xt)must be either positively correlated or uncorrelated. This circumstance agrees with engineering experience.5Thus, whentand(1Xt)are positively correlated or uncorrelated, increasing the propensity for an initiating event to arise in the next instant of time increases the propensity for core damage. Similarly, decreasing the propensity of an arriving initiating event in the next instant of time decreases the propensity for core damage. More precisely, lim s#0P(Xt+sXt0j~t)a.s.>lim s#0P(Xt+sXt0j^t);for any ~ta.s.>^t and lim s#0P(Xt+sXt0j~t)a.s.<lim s#0P(Xt+sXt0j^t);for any ~ta.s.<^t: We, thus, conclude that since for all t0,(1Xt)andtcannot be negatively correlated, the bias of eq. 17 must be nonnegative. The nonnegative bias appearing in Corollary 1 ensures that when CDFexists, the Rasmussen characterization always underestimates the true value of CDF. In practice, numerical values for CDFare typically computed within a PRAorPSAstudy that relies on the Rasmussen characterization for Level-1 studies. The inadequacy of the Rasmussen characterization, of course, derives from how (typically very sophisticated) protection (un-)availability analysis in incorporated intoPRA. Rasmussen insightfully seeks to extended traditional protection availability analysis, by noting that the risk of a core damage event should be understood as a consequence of an unmitigated initiating event. Hence, it is only at arrival times of initiating events that protection unavailability would lead to a core damage event. Treating limt!1(1Xt)as the top event of a fault tree analysis of the unit protective system,theRasmussencharacterizationreasonsthat p= lim t!1E[(1Xt)]isthelikelihoodofcoredamage at the time of an initiating event. However, a closer examination reveals that unavailability at instants of initiating events should be written as limn!1E[(1XTn)]. Since the index on unavailability at the time 5For example, when 12 of 13 emergency backup diesel generators were washed away at Fukushima Daiichi, loss of onsite power and thus the ability to sustain cooling lead to core meltdown in each of the reactor units. 16 of initiating event arrivals is the sequence of random variables fTn;n1g, it is logical that, except under very special conditions, limn!1E[(1XTn)]6= lim t!1E[(1Xt)]. An arriving initiating event will ﬁnd system protections either working or failed. If the protections are working, they will ensure that the initiating event does not lead to catastrophe. On the other hand, if protections are failed upon arrival, catastrophe will ensue. Catastrophe ensues in two distinct scenarios: 1. System protections are failed at time Tnfor reasons unrelated to the arrival of the nthevent. 2. System protections were working, but the arrival of the nthevent caused protection failure. Clearly, the covariance bias term in Corollary 1 is associated with item 2. Because the Rasmussen charac- terization relies on protective system reliability modeling which only describes (1Xt),t0, uncertainty associated with the initiating event arrival time point process fTn;n0gis not represented. Upon recog- nizing this modeling deﬁciency, it might seem reasonable to extend the Rasmussen characterization so as to overcome its optimistic bias. But, the very purpose of exploring CDFis to approximate it with a numerical value that is supported by operations and maintenance date. Yet, there will exist not observational data to support estimating protection unavailability (1XTn), for anyn1because in practice we have no historical core damage events In practice, an unbiased estimate of CDF, in the absence of any observed core damage events should (except under very special circumstances) seem too good to be true, whenever initiating events are believed to eﬀect protection reliability. Rasmussen and his successor PRAresearchers were ensnared by a common paradox (the random observer problem) that is untangled in the large and well–known Palm Calculus literature. Unfortunately, understanding the Rasmussen bias is not the same as escaping it. There is no “ﬁx” to correct this bias, and this deﬁciency has important implications for PRA andPSAand risk-informed regulatory oversight. 3.4 Final Observations WehaveshownthattheRasmussencharacterizationof CDFwillatbestyieldvaluesthatunderestimatetrue CDFand at worst provide values for a metric that does not exist. We observe from corollary 1 of proposition 17 3 that the optimistic bias of CDFoccurs under the Rasmussen characterization because it generally does not account for the possibility that an arriving initiating event exceeds to catastrophe by damaging the functionality of system protections. Clearly, it is infeasible to quantify such catastrophes since historical data does not exist. Further, reliance on ad hoccharacterizations of the Rasmussen characterization bias lack the rigor necessary to support the objectives of high–consequence risk analyses like PRAandPSA. Thus, philosophical objections regarding the usefulness of CDFaside, reported values of CDFare not particularly informative as a risk metric quantifying reactor safety because their optimistic bias cannot be analytically quantiﬁed. This observation calls into question the use of CDFin regulatory language. The intent of regulators oversight is to ensure adequate safety for the public. To this end, the public is better served by well–developed prescriptive regulations than optimistically biased risk–informed regulations built uponPRAorPSAanalyses.