ML20080N774

Uncertainty Analysis Technology

ML20080N774
Person / Time
Issue date:	03/23/2020
From:	Nathan Siu Office of Nuclear Regulatory Research
To:
N. Siu
References
Download: ML20080N774 (61)

Text

Technology for the Treatment of Uncertainties:

History, Status, Commentary and Challenges Nathan Siu Senior Technical Adviser for PRA Analysis U.S. Nuclear Regulatory Commission Expanded version of a presentation originally developed for CRIEPI/NRRC and OECD/NEA Workshop on the Proper Treatment of Uncertainties in Reactor Safety Assessment March, 2020

Foreword On December 19, 2019, the Nuclear Risk Research Center (NRRC) of the Japan Central Research Institute of Electric Power Industry (CRIEPI) and the Organization for Economic Cooperation (OECD) Nuclear Energy Agency (NEA) invited the author to participate in a workshop on the improvement and enhancement of risk-informed decision making (RIDM) processes in reactor safety assessment. The workshop, titled A Workshop on the Proper Treatment of Uncertainties in Reactor Safety Assessment, was to be held on May 26-27, 2020 in Tokyo, Japan. At the request of the workshop organizers, the authors talk was to be titled Technology for the Treatment of Uncertainties: History, Status, and Some Challenges. On March 12, due to travel restrictions arising from the covid-19 pandemic, the author was directed to withdraw from the workshop. The following slides are an expanded version of the talk the author was planning on presenting.

2

Outline

• Framework for discussion tech*nol*o*gy, n. the sum of

- Parameter Uncertainties techniques, skills, methods, and

- Model Uncertainties processes used in the production of

- Completeness Uncertainties goods or services or in the accomplishment of objectives, such as

- Communication scientific investigation. [Wikipedia]

• Current state of practice

• History In this talk:

technology {methods, models,

• Commentary and challenges computational tools, guidance, data}

3

What are we talking about?

DISCUSSION FRAMEWORK 4

Discussion Framework Context for Treatment of P{XlC,H}

Uncertainties: Risk-Informed subjective knowledge Decisionmaking (RIDM) proposition conditions Adapted from NUREG-2150 5

Discussion Framework Parameter, Model, and Completeness Uncertainty:

A Practical Categorization mod*el, n. a M (Model of the World): representation of reality created with a specific Scope, structure objective in mind.

i: Parameters A. Mosleh, N. Siu, C. Smidts, and C. Lui, Model Uncertainty: Its Characterization and

Universe Quantification, Center for Reliability Engineering, University of Maryland, College Park, MD, 1995. (Also NUREG/CP-0138, 1994)

PRA models for NPPs

• Typically an assemblage of sub-models with parameters

• Implicitly include issues considered but not explicitly Known Unknowns quantified Unknown Unknowns 6

Discussion Framework Parameter, Model, and Completeness Uncertainty:

A Practical Categorization mod*el, n. a M (Model of the World): representation of reality created with a specific Scope, structure objective in mind.

i: Parameters A. Mosleh, N. Siu, C. Smidts, and C. Lui, Model Uncertainty: Its Characterization and

Universe Quantification, Center for Reliability Engineering, University of Maryland, College Park, MD, 1995. (Also NUREG/CP-0138, 1994)

PRA models for NPPs

• Distinctions are not necessarily crisp

• Regardless of allocation to categories, need to consider Known Unknowns in characterization of Unknown Unknowns uncertainties 7

Discussion Framework Parameter Uncertainty: An Example Flood Height Date (ft)

• Parameter of interest: frequency of flooding () 3/19/1936 36.5

• Prior state-of-knowledge: minimal 6/1/1889 34.8 10/16/1942 33.8

• Evidence: 10 events over 1877-2017 (140 years) 10/1/1896 33.0 11/6/1985 30.1

• Posterior state-of-knowledge: 9/8/1996 29.8 1/21/1996 29.4 05 = 0.040/yr Probability Density prior 11/25/1877 29.2 50 = 0.069/yr 95 = 0.11/yr 4/27/1937 29.0 posterior mean = 0.071/yr 6/23/1972 27.7 return period = 12 yr 0.00 0.05 0.10 0.15 0.20 0.25 0.30

Flood Frequency (/yr) 1880 1900 1920 1940 1960 1980 2000 8

Discussion Framework Model Uncertainty:

Hurricane Example Hurricane Andrew: 8/22/1992, 1200 UTC (about 2 days before FL landfall)

Plot adapted from University of Wisconsin-Milwaukee (https://web.uwm.edu/hurricane-models/models/archive/)

9

Discussion Framework Completeness Uncertainty:

Multiple Hurricane Example (A Known Unknown)

Turkey Point Katia Irma Jose 10 https://en.wikipedia.org/wiki/Hurricane_Irma#/media/File:Irma,_Jose_and_Katia_2017-09-07.png

Discussion Framework Risk Communication (Internal)

Adapted from NUREG-2150 Other Considerations

• Current regulations

• Safety margins

• Defense-in-depth

• Monitoring Quantitative Qualitative 11

What do people do now?

CURRENT STATE-OF-PRACTICE 12

Current State of Practice State-of-Practice: Parameter Uncertainties

• Treatment involves Estimation (including expert elicitation)

Propagation

• Straightforward mathematics and mechanics

• Some practical challenges 13

Current State of Practice State-of-Practice: Hurricane Andrew Model Uncertainties 8/22/1992, 1200 UTC Adapted from University of Wisconsin-Milwaukee (https://web.uwm.edu/hurricane-models/models/archive/)

• Important to acknowledge and treat (in context of decision)

• Multiple approaches

- Consensus model

- Sensitivity analysis

- Weighted alternatives (e.g., SSHAC)

- Output uncertainties Adapted from V.M. Andersen, Seismic Probabilistic Risk Assessment Implementation Guide, EPRI 3002000709, Electric Power Research Institute, M.H. Salley and A. Lindeman, Verification and Palo Alto, CA, December 2013 Validation of Selected Fire Models for Nuclear Power Plant Applications, NUREG-1824 Supplement 1/EPRI 3002002182, November 2016.

14

Current State of Practice State-of-Practice: NUREG-1855 Rev. 1 (2017)

Completeness Uncertainties Options:

• Progressive analysis

• Potential concerns (screening, bounding, conservative, detailed)

- Known gaps (missing scope)

• Change scope of risk-

• Scenario categories informed application

• Contributors within categories

- Unknown gaps RG 1.174 Rev. 3 (2019)

- Heuristics/biases

• Excessive amplification (fear of the dark)

• Excessive discounting (out of sight, out of mind)

• Treatment

- Analysis guidance

- Additional analysis/R&D

- Risk-informed decisionmaking 15

Current State of Practice State-of-Practice: Internal Risk Communication

• Often implicit (focus on mean values)

• Various graphic displays

• Includes story as well as numbers Likelihood Class 5 (10-5/yr) 4 (10-4/yr) 3 (10-3/yr) 2 (10-2/yr) 1 (10-1/yr)

A Marginal Undesirable Undesirable Critical Critical Documents and Interactive Severity Class Presentations Discussion B Marginal Marginal Undesirable Undesirable Critical (Flatland) (Storytelling) C No Action Marginal Marginal Undesirable Undesirable D No Action No Action Marginal Marginal Undesirable E No Action No Action No Action Marginal Marginal 16

How did we get here?

A BRIEF HISTORY 17

History A Series of Challenges and Responses Modern Applications Expansion Across Industry Early PRAs Hanford to WASH-1400 1940 1950 1960 1970 1980 1990 2000 2010 2020 18

History From Hanford to WASH-1400 Technical Challenges: 1) Quantifying accident probability

2) Means to communicate risk WASH-740 Hanford AEC/NRC Credible Accident UKAEA Estimates:

not in the generation

- OpE (pessimistic) of the ACRS members - Decomposition present (optimistic)

Recommend: Farmer Curve WASH-1400 accident System chain System reliability reliability SGHWR analysis studies studies analysis 1950 Windscale 1960 1970 TMI-2 1980 For more information: T.R. Wellock, A Figure of Merit: Quantifying the Probability of a Nuclear Reactor Accident, 19 Technology and Culture, 58, No. 3, July 2017, pp. 678-721.

History WASH-1400 Uncertainties (Level 1)

WASH-1400: it is reasonable to believe that the WASH-1400 Uncertainties (Estimated*)

core melt probability of about 5x10-5 per reactor-year predicted by this study should not be significantly larger and would almost certainly not exceed the value of 3x10-4 which has been estimated as the upper 5th 50th 95th Surry mean bound for core melt probability.

Peach Bottom Risk Assessment Review Group (NUREG/CR-0400):

We are unable to define whether the overall 1.E-05 1.E-04 1.E-03 CDF (/ry) probability of a core melt given in WASH-1400 is high or low, but we are certain that the error bands are *Based on data from Tables V 3-14 (PWR) and 3-16 (BWR) of Appendix V, assuming distributions are lognormal; median values are somewhat higher understated. We cannot say by how much. than reported in Section 7.3.1 of the Main Report.

20

History Some Early Developments and PRAs Challenges: 1) Filling known gaps (completeness uncertainty)

2) Clarifying meaning: models and results Biblis Sizewell

(+aircraft)

(+DI&C) USDOE Clinch River Oyster Creek NRC (LMFBR)

Indian Point

(+seismic)

(full scope)

US Industry AIPA Forsmark International Limerick (HTGR) Koeberg Zion Millstone Other Notable

(~WASH-1400) (full scope)

Seabrook Super (full scope)

Phénix RSSMAP/IREP (FBR DHR) TMI-1 Oconee (full scope)

Apostolakis Kaplan/ (full scope)

Fleming (subjective Garrick EC/JRC Benchmarks

(-factor) probability) (risk) NUREG/CR-2300 (systems, CCF, HRA) 1975 TMI-2 1980 1985 Chernobyl 21

History Sample Level 1 Results Display 22

History Sample Results - Sub-Model Uncertainty Effect Effects of fire model (COMPBRN) uncertainty on fire growth time N. Siu, "Modeling Issues in Nuclear Plant Fire Risk Analysis," in EPRI Workshop on Fire Protection in Nuclear Power Plants, EPRI NP-6476, J.-P. Sursock, ed., August 1989, pp. 14-1 through 14-16.

23

History Sample Results - Model Uncertainty (User Effect)

Early core melt, containment cooling Early core melt, no containment cooling Damage State Frequency (/yr), Review 10-4 Late core melt, containment cooling Late core melt, no containment cooling Containment bypass Steam generator tube rupture Direct containment failure 10-6 Internal Events External Events 10-8 1.E-03 1.E-03 1.E-04 1.E-04 1.E-05 1.E-05 1.E-06 Review 1.E-06 Review 1.E-07 1.E-07 10-10 1.E-08 1.E-08 1.E-09 1.E-09 1.E-10 1.E-10 1.E-11 1.E-11 1.E-11 1.E-10 1.E-09 1.E-08 1.E-07 1.E-06 1.E-05 1.E-04 1.E-03 10-10 10-8 10-6 10-4 1.E-11 1.E-10 1.E-09 1.E-08 1.E-07 1.E-06 1.E-05 1.E-04 1.E-03 Original Original Damage State Frequency (/yr), Original Data source: G.J. Kolb, et al., Review and Evaluation of the Indian Point Probabilistic Safety Study, NUREG/CR-2934, December 1982.

24 (ML091540534)

History Severe Expansion Across Industry (US)

Accident Policy Technical challenges: 1) Characterizing the fleet (variability)

Statement 2) Developing confidence for mainstreaming RIDM Safety Goal PRA Policy NRC Policy Statement Statement US Industry GL 88-20 GL 88-20 Supplement 4 NUREG-1560 NUREG-1742 NUREG-1150 NUREG-1150 (draft) (final) 1982 ASP Plant Class Models SPAR Models IPEEEs IPEs 1985 Chernobyl 1990 1995 2000 9/11 25

History NUREG-1150 Estimated* Uncertainties (Level 1)

Model Uncertainty Model Uncertainty

• Notes: totals shown in this

1) NUREG-1150 does not aggregate the hazard-specific results. The totals shown are rough estimates assuming that the NUREG-1150 distributions are lognormal.

26 2) The WASH-1400 distributions are based on data from Tables V 3-14 (PWR) and 3-16 (BWR) of Appendix V, assuming that the distributions are lognormal. The median values are somewhat higher than reported in Section 7.3.1 of the Main Report

History IPE/IPEEE - Variability Across Fleet Internal Events + Internal Floods Total 40 40 BWR BWR PWR PWR 30 30 Number Number 20 20 10 10 0 0 1x10-6 3x10-6 1x10-5 3x10-5 1x10-4 3x10-4 1x10-3 1x10-6 3x10-6 1x10-5 3x10-5 1x10-4 3x10-4 1x10-3 CDF (/ry) CDF (/ry) 27

History The Modern Era (US)

Technical challenges: 1) RIDM issues (e.g., realism, heterogeneity, aggregation)

SECY-98-144 2) Post-Fukushima issues (e.g., external hazards)

3) New/advanced reactors (e.g., conduct of operations)

RG 1.174 NUREG-2150 ASME PRA NRC Risk-Standard NTTF Request US Industry Informed for Information ROP NUREG-1855 (Reevaluations) 10 CFR 50.48(c)

NFPA 805 (Fire Protection) NFPA 805 LARs (Fire Protection)

SAMAs (Life Extension)

Risk-Informed License Amendment Requests (LARs)

SPAR Models 2000 9/11 2005 2010 Fukushima 2015 2020 28

History Variability in Recent Results (Level 1) 0.35 0.30 Population Mean:

4.7x10-5 0.25 Fraction of Plants 0.20 0.15 0.10 Lowest Highest Reported: Reported:

0.05 3.5x10-6 1.3x10-4 0.00

-6.0 -5.5 -5.0 -4.5 -4.0 -3.5 -3.0 1E-6 1E-5 1E-4 1E-3 CDF (per reactor year) 29

History Variability in Results - Comparison with IPE/IPEEE 1E-3 0.001 0.50 NFPA 805 Total CDF (IPE + IPEEE) 0.40 Fraction of PRAs IPE/IPEEE 0.30 1E-4 0.0001 0.20 0.10 0.00 1 2 3 4 5 6 7 8 9 10 0.01 0.1 1 10 100 1000 1E-5 0.00001 1E-5 1.00E-05 1E-4 1.00E-04 1E-3 1.00E-03 Fire CDF/Internal Events CDF Total CDF (Recent LARs) 30

Where might we do better and how?

COMMENTARY AND CHALLENGES 31

Commentary and Challenges An Important Note

• Challenges regarding the treatment of uncertainty in PRA and RIDM exist for non-probabilistic approaches as well; the PRA/RIDM approach acknowledges these challenges explicitly.

• The following slides are not a critique of the overall PRA/RIDM philosophy - they should be viewed in the framework of continuous improvement.

32

Commentary and Challenges A Changing World

• Evolving situation*

- market forces

- new nuclear technologies

- new analytical methods and data

- new professionals

• Increased reliance on risk models, characterization of uncertainties

• See Applying the Principles of Good Regulation as a Risk-Informed Regulator, 33 October 15, 2019 (ADAMS ML19260E683)

Commentary and Challenges: Parameter Uncertainties Reminder: Parameter Uncertainties and Mean Values

• Mathematically defined probability density function Mean

• Affected by tail

• Does not correspond to 0

50th (Median) = 3.9 x 10-5 /yr a specific percentile Mean = 7.6 x 10-5 /yr 95th = 2.6 x 10-4 /yr frequency (/yr) 34

Commentary and Challenges: Parameter Uncertainties Parameter Uncertainties: Challenges

• Quantification generally required, diverse views on value added 2015 Industry-wide estimates from: https://nrcoe.inl.gov/resultsdb/AvgPerf/

• Service Water Pumps: 2 failures in 16,292,670 hours0.00775 days <br />0.186 hours <br />0.00111 weeks <br />2.54935e-4 months <br />

• Technical challenges:

• Normally Running Pumps: 225 failures in 59,582,350 hours0.00405 days <br />0.0972 hours <br />5.787037e-4 weeks <br />1.33175e-4 months <br /> Standby Pumps (1st hour operation): 48 failures in 437,647 hours0.00749 days <br />0.18 hours <br />0.00107 weeks <br />2.461835e-4 months <br />

- Effect of data pre-processing

• Selection Probability Density Function Service Water

• Interpretation Normally Running

- Effect of analysis shortcuts Standby (Normalized)

• Standard prior distributions

• Simplified expert elicitation

• Independence assumption 1.E-09 1.E-08 1.E-07 1.E-06 1.E-05 1.E-04 1.E-03

- Ensuring correspondence with actual Failure Rate (/hr) state-of-knowledge

• Basic events (micro)

• Overall results (macro) 35

Commentary and Challenges: Model Uncertainties Model Uncertainties - Commentary

• Model uncertainties can be large; importance depends on decision Hurricane Irma: 9/8/2017, 0000 UTC

• Some practical approaches (e.g., consensus (about 2 days before FL landfall) models, deterministic screening) can understate uncertainties Outer

• Subjective probability framework => prediction is closest

- Need to include user effect to actual course

- Raises question regarding fundamental meaning of weighted average approaches Plot adapted from University of Wisconsin-Milwaukee (https://web.uwm.edu/hurricane-models/models/archive/)

• Model output uncertainty approach is appealing but care is needed in implementation 36

Commentary and Challenges: Model Uncertainties Model Uncertainty User Effects: HRA Example 1 NRC, SPAR-H INL, SPAR-H Same method, different teams NRI, CREAM NRI, DT+ASEP Same team, different methods All teams, all methods A Bye, et al., International HRA Empirical Study, NUREG/IA-0216, August 2011.

37

Commentary and Challenges: Model Uncertainties Model Uncertainty User Effects: HRA Example 2 1.0E+0 Human Error Probability (HEP)

ASEP Team 1 1.0E-1 ASEP Team 2 SPAR-H Team 1 SPAR-H Team 2 1.0E-2 CBDT & HCR/ORE Team 1 CBDT & HCR/ORE Team 2 1.0E-3 CBDT & HCR/ORE Team 3 ATHEANA Team 1 1.0E-4 ATHEANA Team 2 Empirical 95th Percentile Empirical 5th Percentile 1.0E-5 HFE 2A HFE 1C HFE 1A HFE 3A HFE 1B Decreasing difficulty Adapted from NUREG-2156 38

Commentary and Challenges: Model Uncertainties Challenges: Quantification of Model Output Uncertainty Time (s) Experiment (K) DRM (K)

• Bayesian methods 180 400 450 Data 360 465 510

- Framework consistent with overall PRA 720 530 560

- Early approaches used in past PRAs 840 550 565

- Can address practical issues (e.g., non- Temperature (K) homogeneous data)* Assume Assume Non-Percentile Homogeneous Homogeneous Output Uncertainty

• Challenges include Data Data 1st 415.2 372.8

- Uncertainties in unmeasured parameters 5th 437.5 400.7

- Sub-model limits of applicability 50th 457.1 470.5

- Representativeness of computed results 95th 479.7 559.4 99th 509.1 608.7

• See E. Droguett and Ali Mosleh, Bayesian methodology for model uncertainty using model performance data, 39 Risk Analysis, 28, No. 5, 1457-1476, 2008.

Commentary and Challenges: Completeness Uncertainties Completeness Uncertainty It would cease to be a

• Sources danger if we could define it.

- Known gaps (missing scope) - Sherlock Holmes

- Unknown gaps (The Adventure of the Copper Beeches)

• Concerns Car Wont Start

- Excessive amplification (Fear of the dark)

- Excessive discounting (availability heuristic:

Out of sight, out of mind) Battery Charge Insufficient Fuel System Defective Other Engine Problems All Other Problems Starting System Ignition System Mischievous Acts Defective Defective Of Vandalism B. Fischhoff, P. Slovic, S. Lichtenstein, Fault trees: Sensitivity of estimated failure probabilities to problem representation, Journal of Experimental Psychology: Human Perception and Performance, 4(2), May 1978, 330-344.

40

Commentary and Challenges: Completeness Uncertainties Known Gaps (Known Unknowns)

• Broad scenario categories Rationale Common Example(s)

Out of scope security/sabotage, operation outside approved limits Low significance (pre-analysis judgment) external floods (many plants pre-Fukushima)

Appropriate PRA technology* unavailable management and organizational factors PRA not appropriate software, security

• Contributors within categories Category Example(s)

External hazards multiple coincident or sequential hazards Human reliability errors of commission, non-proceduralized recovery Passive systems thermal-hydraulic reliability 41 *Technology = {methods, models, tools, data}

Commentary and Challenges: Completeness Uncertainties Unknown Unknowns: You Say Tomto Model

• Explicit or implicit?

• Extent of coverage? Viewpoint Precise classification is Known important only if it affects:

Unknowns

• Understanding

• Known by whom?

• Known when?

• Communication

• Time from idea to theory

• Decision making to PRA implementation?

Unknown Unknowns 42

Commentary and Challenges: Completeness Uncertainties Unknown Unknowns: A Demonstrated Problem?

Then (a surprise?)

Now (treated in current PRAs?)

Browns Ferry fire (1975) - a long-recognized hazard; not in draft Model WASH-1400 but routinely treated now TMI (1979) - precursors include Davis-Besse (1977); operator EOCs not in models; current recognition and some explorations Chernobyl (1986) - precursor at Leningrad (1975); non-routine test Known Unknowns during shutdown in any LPSD analyses?

Blayais flood (1999) - external floods often screened at time; current recognition, multi-hazard under development Maanshan HEAF/SBO (2001) - HEAF phenomenon known, in any PRAs at time? Now included as an initiator; smoke effect?

Davis-Besse RPV corrosion (2002) - RPV failure analyses focused on Unknown Unknowns crack propagation; M&O failure not in PRAs Fukushima Daiichi (2011) - precursors: Blayais (1999), Indian Ocean (2004), hazard under review at time; PRA models under development 43

Commentary and Challenges: Completeness Uncertainties Illuminating Uncertainties: From Lampposts to Search Beacons Wheres the goat???

44

Commentary and Challenges: Completeness Uncertainties What Can We (PRA R&D) Do?

• Continue to develop technology to address Event (NUREG/CR-4839), 1992 known gaps Aircraft impact Avalanche

- Risk-informed prioritization Coastal erosion

- Fully engage appropriate disciplines Drought External flooding

- Take advantage of general computational and Extreme winds and tornadoes methodological developments Fire

• Facilitate re-emphasis on searching Fog Forest fire

- Demonstrate efficiency and effectiveness with Frost Hail current tools (e.g., MLD, HBFT) vs. High tide, high lake level, or high checklist/screening river stage

- Develop improved tools (including OpE mining) 45

Commentary and Challenges: Internal Risk Communication Sources of Breakdowns: Risk Communication Between Risk Managers and Public*

• Differences in perception of information

- Relevance

- Consistency with prior beliefs

• Lack of understanding of underlying science

• Conflicting agendas

• Failure to listen

• Trust

• J.L. Marble, N. Siu, and K. Coyne, Risk communication within a risk-informed regulatory decision-making environment, International 46 Conference on Probabilistic Safety and Assessment (PSAM 11/ESREL 2012), Helsinki, Finland, June 25-29, 2012. (ADAMS ML120480139)

Commentary and Challenges: Internal Risk Communication Risk Information: Inherently Complex

• Hyperdimensional

- Scenarios Will somebody find me a

- Likelihood one-handed scientist?!

- Multiple consequence measures

• Heterogeneous - Senator Edmund Muskie

- Qualitative and quantitative (Concorde hearings, 1976)

- Multiple technical disciplines I. Flatow, Truth, Deception, and the Myth of the One-Handed Scientist,

• Dynamic October 18, 2012. Available from:

https://thehumanist.com/magazine/november-december-

- System changes (e.g., different operational modes, effects 2012/features/truth-deception-and-the-myth-of-the-one-handed-of decisions) scientist

- Changing information (learning, adding/discounting data)

- New applications (and contexts)

• Uncertain

- Sparse or non-existent data

- Outside range of personal experience 47

Commentary and Challenges: Internal Risk Communication and the World is changing

• Experiences, knowledge

• Information content and delivery preferences

• Comfort with analytics, risk, probability

• Mobility Language is not merely a tool for human communication; language is itself a means by which the realities of the world are divided and viewed.

- P.S. Dull, 1978 Source: https://www.nrc.gov/reading-rm/doc-collections/commission/slides/2019/20190618/staff-20190618.pdf 48 P.S. Dull, A Battle History of the Imperial Japanese Navy (1941-1945), Naval Institute Press, Annapolis, MD, 1978

Commentary and Challenges: Internal Risk Communication Addressing Complexity (and Escaping Flatland)

• Tufte model: use rich displays and reports, encourage user Continuing Challenges to explore

- Promotes active involvement of decision maker

• Target audience(s)

- Heterogeneous

- Increases general trust? - Changing

• A graduated technical approach to assist? - Constrained resources Interface Interaction Mode

• Schema

- No standards:

- Hyperlinked dashboards, reports - Manual currently an art

- Video - AI assist - Solutions being Time developed

- Visual immersion intuitively; no scientific testing

- Multisensory immersion 49

Commentary and Challenges: Internal Risk Communication From Static to Interactive Dashboard to Sci-Fi?

M. Korsnick, Risk Informing the Commercial Nuclear Enterprise, Promise of a Discipline: Reliability and Risk in Theory and in Practice, University of Maryland, April 2, 2014. Graphic adapted from https://www.flickr.com/photos/83823904@N00/64156219/

(permission CC-BY-2.0) 50

Closing Remarks

• RIDM, enabled by PRA, provides a practical approach to safety-related decisionmaking under uncertainty

• Appropriate application of RIDM requires  !

appropriate characterization and communication Many calculations bring of uncertainties, supported by technology success; few calculations

• Moving forward: bold exploration or avoidance? bring failure. No calculations at all spell disaster!

Jason/ (Momotar) or Pandora/ - Sun-Tzu (The Art of War)

(Urashima Tar)?

51

Acknowledgments The author gratefully acknowledges helpful suggestions by G. Apostolakis, A. Mosleh, and M. Cheok on presentation structure, approach, and content, and technical information provided by M. Kazarians and J. Nakoski.

52

ADDITIONAL SLIDES 53

Reasonable Assurance of Adequate Protection USAEC/USNRC UKAEA Staff UKAEA AEA (Amended) adequate protection to the Farmer Curve health and safety of the public Atoms for NRC Letter AEC Chairman Peace Conf. reasonable assurance recognize every possible event UKAEA call for of adequate protection assure that the probability of a comprehensive mishap is satisfactorily low safety assessment MIT Proposal for Atomic Energy Act (AEA) AEC Staff reactor risk study protect health and Credible Accident minimize danger TRG Report 1949(R)

WASH-740 SGHWR analysis 1940 1950 1960 1970 54

Parameter Uncertainties:

Some Historical Results Industry results from: Garrick, B.J., Lessons learned from 21 nuclear plant probabilistic risk assessments, Nuclear Technology, 84, No. 3, 319-339(1989).

55

Uncertainty Reduction - Perspective Depends on Scaling 56

Early Views on Completeness

• W. F. Libby (Acting Chairman, AEC) - March 14, 1956 response to Senator Hickenlooper: it is incumbent upon the new industry and the Government to make every effort to recognize every possible event or series of events which could result in the release of unsafe amounts of radioactive material to the surroundings and to take all steps necessary to reduce to a reasonable minimum the probability that such events will occur in a manner causing serious overexposure to the public. [Emphasis added]

• L. Silverman (Chairman, ACRS) - October 22, 1960 letter to AEC Chairman John A. McCone: We believe that a searching analysis which is necessary at this stage [reactor siting approval] should be done independently by the owner of the reactor [Emphases added]

57

ACRS Concerns with WASH-1400 Methodology*

Topic Signature Events[1] Post-WASH-1400 Accident initiator quantification Extensive treatment: fires, earthquakes Fukushima (Presumably external events) Inconsistent treatment: floods Atypical reactors Fermi 1 [2] Multiple PRAs for non-LWRs Many design and operational improvements identified Design errors [3] by PRAs; database includes events involving design problems Multiple methods emphasizing importance of context; Operator error quantification TMI-2 still an active area of development Consequence modeling Chernobyl, Fukushima Continuing, evolutionary improvements (MACCS)

Improved hardware database; fits and starts with Data Many HRA; extreme natural hazards a continuing challenge

• ACRS letter to Congressman Udall re: adequacy for estimating likelihood of low probability/high consequence events (Dec. 16, 1976)

Table Notes:

1. Events whose key characteristics (for the given topic) might not have been captured by a WASH-1400 vintage analysis.

58 2.

3.

Fermi 1 had limited fuel melting. However, without an analysis, it isnt clear if a WASH-1400 vintage analysis would have captured this scenario.

Design weaknesses have played a role in multiple events. More detailed review is needed to determine if: a) these are errors, and b) if they would have been missed by a WASH-1400 vintage analysis.

Empirical Experience Accidents Some Significant* U.S. Precursors Year Plant(s) Precursor? Year Plant(s) Notes 1979 TMI Davis-Besse (1977) 1975 Browns Ferry Worst precursor Fire => loss of U1 ECCS 1986 Chernobyl Leningrad (1975) 1978 Rancho Seco Next worst precursor 2011 Fukushima Blayais (1999) Human error (maintenance) => loss of NNI, LOFW 2002 Davis-Besse Most recent significant precursor Multiple human/organizational faults

=> RPV head corrosion

• Per Accident Sequence Precursor (ASP) program 59

Some Other Interesting International Events Year Plant(s) Scenario Type Notes 1957 Windscale 1 (UK) Fire Graphite fire in core, release to environment.

Power cable fire, loss of main feedwater, pressurizer safety 1975 Greifswald 1 (East Germany) Fire valves fail to re-seat.

Partial loss of offsite power (LOOP) and subsequent loss of 1977 Gundremmingen A (East Germany) LOOP/LOCA cooling accident (LOCA) with internal flooding.

Turbine Building fire spreads into Main Control Room, collapses 1978 Beloyarsk 2 (Soviet Union) Fire Turbine Building roof.

1981 Hinkley Point A-1, A-2 (UK) External Flood; LOOP (weather) Severe weather LOOP and loss of ultimate heat sink (LOUHS).

1982 Armenia 1 (Soviet Union) Fire Fire-induced station blackout (SBO).

1989 Vandellos 1 (Spain) Fire Fire-induced internal flood.

1991 Chernobyl 2 (Soviet Union) Fire Fire-induced Turbine Building roof collapse.

1993 Narora 1 (India) Fire Fire-induced SBO.

1993 Onagawa 1 (Japan) Reactivity Excursion Seismically-induced reactivity excursion.

1999 Blayais 1, 2 (France) External Flood Severe weather LOOP and partial LOUHS.

2001 Maanshan 1 (Taiwan) LOOP (Weather); Fire (HEAF) Severe weather LOOP and subsequent SBO.

Pickering 4-8; Darlington 1, 2, and 4; Bruce 3, 4, and 6 (Canada);

2003 Fermi 2 , Fitzpatrick, Ginna, Indian Point 2 and 3, Nine Mile LOOP (weather) Northeast Blackout.

Point 1 and 2, Oyster Creek, Perry (U.S.)

2004 Madras 2 (India) External Flood Tsunami-induced LOUHS.

2009 Cruas 2-4 (France) External Flood LOUHS due to flood debris.

Fukushima Dai-ichi 5-6, Fukushima Dai-ni 1-4, Onagawa 1-3, Earthquake- and tsunami-induced incidents (in addition to 2011 Tokai Dai-ni, Higashidori 1-2 (Japan) External Flood accidents at Fukushima Dai-ichi 1-3).

60

External Hazards Scenario-Based Classification:

An Aid for Completeness?

61