ML24141A113

Insights from Multi-Unit Level 1, 2 and 3 Probabilistic Risk Assessment Results for Light-Water Reactor Designs - What Can Be Extrapolated to Advanced Reactor Designs?

ML24141A113
Person / Time
Issue date:	05/20/2024
From:	Ball E, Keith Compton, Susan Cooper, Hathaway T, Alan Kuritzky, Selim Sancaktar NRC/RES/DRA/PRAB
To:
References
Download: ML24141A113 (1)

Text

Insights from Multi-Unit Level 1, 2 and 3 Probabilistic Risk Assessment Results for Light-Water Reactor Designs - What Can Be Extrapolated to Advanced Reactor Designs?

Susan E Cooper1, Erick Ball1, Trey Hathaway1, Keith Compton1, Selim Sancaktar2, Alan Kuritzky1, Latonia Enos-Sylla1 1US Nuclear Regulatory Commission, Rockville, MD, USA 2 Retired, formerly US Nuclear Regulatory Commission

[leave space for DOI, which will be inserted by ANS]

ABSTRACT The U.S. Nuclear Regulatory Commission (NRC) has performed a full-scope site Level 3 probabilistic risk assessment (PRA) project (L3PRA project) for a two-unit pressurized-water reactor reference plant. The scope of this project includes all hazards (internal and external) and all radiological sources on the reference site (i.e., two reactors; two, connected spent fuel pools (SFPs),

and a dry cask storage (DCS) facility). The NRC has published a series of reports documenting the results of all of these PRA efforts.

In addition to the single unit PRAs performed for NRCs L3PRA project, multi-unit PRA (MUPRA) results have been generated. First, a sitewide dependency assessment was performed. Using these results, at-power, Level 1 MUPRA results were developed for all internal and external hazards.

Current work includes multi-unit (MU) Level 2 and Level 3 calculations for a limited number of sitewide initiating events to be addressed. Finally, the risk contributions from the SFPs and DCS will be integrated with the MU risk results to obtain integrated site risk (ISR) results.

At present, results for the ISR task are preliminary and have not yet been published.

Because of the L3PRA project, the NRC has gained important experience related to performing multi-unit PRA and sitewide risk calculations. From these results, the NRC expects to develop important insights regarding MU core damage frequency results as well as MU release category and MU offsite consequence results. While the ISR work is still being performed, the MU risk results and insights already developed will be used to discuss and compare such results for existing, light-water reactor designs to the hypothetical, parallel results for advanced reactor designs.

More generally, some future advanced light-water reactor (ALWR) and advanced non-light-water reactor (NLWR) applicants may rely heavily on the results of analyses similar to those used in the L3PRA project to establish their licensing basis and design basis by using the Licensing Modernization Project (LMP) (NEI 18-04, Rev. 1) which was endorsed via Regulatory Guide 1.233 in June 2020. Licensees who use the LMP framework are required to perform Level 3 PRA analyses.

Therefore, another potential use of the methodology and insights generated from the L3PRA project is to inform regulatory, policy, and technical issues pertaining to ALWRs and NLWRs.

Keywords: Multi-unit PRA, multi-unit Level 2 PRA, multi-unit Level 3 PRA, sitewide dependency

1.

INTRODUCTION The U.S. Nuclear Regulatory Commission (NRC) has performed a full-scope site Level 3 probabilistic risk assessment (PRA) project (L3PRA project) for a two-unit pressurized-water reactor reference plant. The

scope of this all-hazards, sitewide L3PRA project includes integrated site risk (ISR), including estimation of multi-unit risk. This effort was directed by the Commission (see staff requirements memorandum [1]

that resulted from SECY-11-0089 [2]) and included the following radiological sources on the reference site:

Two (nearly identical) operating pressurized water reactor units (Unit 1 and Unit 2)

Two, hydraulically connected spent fuel pools (SFPs), one for each operating reactor unit (Unit 1 and Unit 2).

An independent dry cask storage (DCS) facility.

Previous NRC PRA efforts, such as NUREG-1150 [3], did not include consideration of risk from the SFPs or DCS, or risk of multi-unit accidents. Consequently, ISR is a new task that has not been previously addressed in NRC PRA efforts.

In general, PRA has traditionally been performed for single units only, though the Seabrook PRA [4] was an early industry PRA effort that considered two-unit risk. In response to the 2011 Great Japan Earthquake and the events at the Fukushima Daiichi nuclear power station (e.g., two reports by the Government of Japan [5, 6], an IAEA report [7], and two Institute of Nuclear Power Operations (INPO) reports [8, 9]),

there has been increased interest in multi-unit risk in both the U.S. and internationally. Zhou and Modarres

[10] summarize the history and current status of multi-unit PRA (MUPRA) development. In addition, there have been multiple responses from the NRC, including lessons learned [11] and implications for PRA [12].

In addition to the limited experience in performing MUPRAs, there is also limited guidance for developing MUPRAs. Three reports that provide such guidance were used in the L3PRA projects ISR task:

Two International Atomic Energy Agency (IAEA) reports on multi-unit probabilistic safety assessment [13, 14]

One report on the use of MUPRA to support risk-informed decision-making by the Electric Power Research Institute (EPRI) [15]

It also should be noted that the American Nuclear Society (ANS)/American Society of Mechanical Engineers (ASME) Joint Committee on Nuclear Risk Management (JCNRM) is currently developing a MUPRA Standard for at-power, existing light water reactors (LWRs).

At present, draft reports for the single unit reactor Level 1, 2, and 3 PRAs for the NRCs L3PRA project have been published. However, the SFP and DCS PRA draft reports are still being finalized and the NRC is continuing work on the ISR task. Note, for the L3PRA project, flexible mitigation strategies (FLEX) were addressed only in a sensitivity study, since the projects freeze date is 2012.

2.

SITEWIDE DEPENDENCY ASSESSMENT The ISR task for the L3PRA project included a sitewide dependency assessment for all radiological sources on the reference site (i.e., reactors, spent fuel pools, and dry cask storage facility). A formal approach and associated guidance were developed to support the L3PRA projects technical leads who performed the sitewide dependency assessments. Results of this dependency assessment formed an important basis for the development of multi-unit risk results.

2.1.

Approach for Performing L3PRA Projects Sitewide Dependency Assessment The sitewide dependency assessment approach used by the L3PRA projects ISR task is based upon the previous work by the IAEA [13, 14] and EPRI [15]. In particular, the L3PRA projects sitewide dependency assessment approach used:

a categorization scheme to identify, characterize, and document the sitewide dependencies for the selected NPP site that was based upon a similar scheme provided in the IAEA [13, 14] and EPRI

[15] reports.

a phased approach for the assessment for the different categories of potential sitewide dependencies that is similar to that described in the EPRI report [15].

Three phases of sitewide dependency assessment were defined as follows:

Phase 1 Assessment:

Sitewide and multi-unit initiating events Phase 2 Assessment:

Shared physical resources Shared or connected systems, structures, and components (SSCs)

Phase 3 Assessment:

Identical components (e.g., expansion of CCF groups)

Proximity dependencies Human or organizational dependencies Accident propagation between units Potential hazards correlations Assessment guidance was provided for each category of potential sitewide dependency in the three phases.

Some overlap in the definition of categories was recognized and discussed.

2.2.

High-Level Results from L3PRA Projects Sitewide Dependency Assessment Results from the L3PRA projects sitewide dependency assessment were developed using the Level 1, 2, and 3 PRA results for the reactors, SFPs, and DCS. While this sitewide dependency assessment has been completed, the ISR report that documents these results has not yet been published. Consequently, only high-level and generalized results are discussed here.

2.2.1. Phase 1 of the L3PRA Projects Sitewide Dependency Assessment Phase 1 sitewide dependency assessment identified multi-unit initiating events (MUIEs) to address in later efforts to estimate multi-unit core damage frequency (MUCDF). This identification was based on the screening criteria that have been used in other guidance (e.g., IAEA and EPRI reports). Specifically, a Level 1 PRA initiating event (IE) can be screened out from consideration as an MUIE if all three of these screening criteria are true:

1. The event does not immediately result in a trip of both units.

2. The event does not result in an immediate trip of one unit and a degraded condition at another unit that will eventually lead to a trip (including a required manual trip).

3. The event does not result in a degraded condition at both units that will eventually lead to a trip of the units (including required manual trip(s)).

The following MUIEs were identified for consideration in estimating MUCDF:

Losses of offsite power (LOOPs) o plant-centered o switchyard-centered o grid-related o weather-related Certain fire scenarios (including main control room abandonment scenarios and fires that can spread from one unit to another)

Losses of service water Seismic events (Bins 1-8)

Wind events

These results for MUIEs are generally consistent with the discussion in the IAEA [13, 14] and EPRI [15]

reports, including the associated case studies.

2.2.2. Phase 2 of the L3PRA Projects Sitewide Dependency Assessment As defined above, Phase 2 sitewide dependency assessment identifies two different types of potential dependencies: shared physical resources and shared or connected systems, structures, and components (SSCs).

For the two reactors, only three physical resources were found to be shared:

1. switchyards

2. an alternate electric power source

3. water supplies used to implement Extensive Damage Mitigation Guidelines (EDMGs) in Level 2 PRA scenarios The list of shared or connected SSCs for the two reactors is similarly small and consists of:

portable pumps and associated equipment needed for response to Level 2 PRA scenarios the FLEX building several buildings that are connected between the two units; specifically, (a) auxiliary buildings, (b) control buildings (including the Technical Support Center (TSC)), (c) main control rooms (MCRs),

(d) cable spreading rooms, and (e) turbine buildings In addition to the results above, the two reactors on the reference site were assessed for coupling per the definition provided in the EPRI report [15]. Based on guidance developed for the L3PRA projects ISR task, the two reactors were assessed to be loosely coupled for all hazards, except certain fire scenarios and seismic events (which are addressed in the Phase 3 sitewide dependency assessment, as discussed below).

2.2.3. Phase 3 of the L3PRA Projects Sitewide Dependency Assessment The remaining five categories of potential sitewide dependencies were assessed in Phase 3 (i.e., cross-unit or multi-unit common cause failures (MU CCFs), human and organizational dependencies, proximity dependencies, cascading failures, and hazard correlations). Except for certain fire scenarios, the reference site was assessed as unlikely to have cascading failures relevant to the Level 1 PRA, so this potential dependency is not discussed below.

Two different types of potential MU CCFs were identified and documented for potential consideration in assessing ISR:

1. CCFs that are already modeled in the L3PRA projects single unit PRA models that could be expanded in group size to include both units

2. New MU CCFs involving identical components in each unit Multiple CCFs from the single unit PRAs were identified to be represented as MU CCFs in MUCDF calculations. Most of these candidate MU CCFs were identified in the single unit, internal events PRA.

Only one new CCF group was identified, consisting of the turbine-drive auxiliary feedwater pumps (one in each unit).

The potential human and organizational dependencies that were identified include:

Both units have shared or common MCRs, training, procedures, human-machine interface, TSC, offsite technical support, and so on. However, as discussed in EPRIs report [15], both positive and negative potential impacts are possible from this sharing, but it is generally believed that commonalities would have a positive effect.

From the Phase 2 sitewide dependency assessment for shared physical resources, there are potential implications with respect to human failure event modeling and cross-unit dependencies for the following:

o Switchyards: For example, the same operator actions taken to restore switchyard-related LOOPs for one reactor also restore power for the second reactor. Such operator actions should be modeled as single actions that affect both units.

o Storage water tanks are called out for use when implementing the EDMGs in the Level 2 human reliability analysis. There is ambiguity in the EDMGs regarding adequate staffing if both reactors require such resources.

For the Phase 3 sitewide dependency assessment of proximity dependencies, three cases were identified as needing consideration, including identified scenarios that require both MCRs to be abandoned due to environmental conditions. Specifically, if a fire affects the habitability of either MCR, both MCRs are treated as being affected, since the MCRs are connected.

For Level 2 PRAs, high radiation levels from a reactor post-core damage are possible in some locations.

It is possible that, if such radiation levels exist, operator actions to implement EDMG strategies for both units could be affected. The operator actions could be delayed (e.g., waiting for health physics personnel to perform radiation surveys) or could be rendered infeasible (i.e., radiation levels too high to attempt the action).

Regarding proximity dependencies, the likelihood for this type of sitewide dependency for the reference site is limited by:

Separation or independence of most SSCs modeled Few conditions (e.g., only those caused by fires, internal floods, external hazards, or radiation) can catastrophically affect SSCs in both reactors Regarding hazard correlations, the following were identified as requiring attention for ISR:

Seismic correlation for SSCs between two units were warranted, whenever necessary, for multi-unit seismic initiating events.

Wind-related SSC failures that may affect both units.

3.

POTENTIAL CHARACTERISTICS OF ADVANCED REACTORS AND ASSOCIATED SITEWIDE DEPENDENCY ASSESSMENT Advanced reactor designs vary, and some aspects of these new designs are not yet known. However, a few characteristics can be assumed as compared to the existing light water reactors (LWRs), such as:

Smaller, multiple reactors on a single site Passive accident response design features Shared structures (and, perhaps, systems)

Smaller operating crew Shared control room, operating crew, and procedures Advanced instrumentation and control (I&C) systems (and, possibly, automation)

Minimal or no evacuation plans A formal sitewide dependency assessment cannot be performed with only these characteristics. However, a few assumptions can be made, such as:

MU CCFs of active equipment may not need to be modeled, or be as important, for advanced reactor designs.

There are likely to be dependencies between reactor units for all (or nearly all) operator actions.

It is likely that more correlated structural failures will need to be considered.

If there are shared systems, these dependencies (as for the existing LWRs) could be important.

Although there may not be any active equipment to power for accident response, there still will be a need for a source of electric power for instrumentation (e.g., for monitoring).

There may be new dependencies associated with I&C and automation (e.g., software failures) that need to be addressed.

In general, advanced reactors on a site are likely to be assessed as tightly coupled per the definitions given in the EPRI report [15].

4.

IMPLICATIONS FOR MULTI-UNIT LEVEL 1 PRA 4.1.

High-Level Insights from Multi-Unit Level 1 PRA Results Because work on the L3PRA projects ISR task is not complete and not published, the MU risk results provided in this paper are brief and generalized. For development of MU Level 1 PRA results, all identified MUIEs were addressed and MUCDF results were produced.

In summary, the MUCDF results for the reference site, containing two essentially identical PWRs, are:

Total MUCDF is between 10 and 15 percent of the single unit CDF (SUCDF) developed in the traditional, single unit PRA (SUPRA) o MUCDF contributions from LOOPs are relatively small (e.g., the MUCDF of each LOOP represents about 5 percent or less of SUCDF) o MUCDF contributions from seismic events drive the overall percentage of MUCDF as compared to SUCDF, e.g.,

MUCDF is 75 percent of SUCDF for seismic bin 4 MUCDF is 100 percent of SUCDF for seismic bins 7 and 8 Contributions to total MUCDF are approximately:

o 2 percent from selected fire scenarios o 6 percent from wind events o 14 percent from LOOPs (with the largest contribution from grid-related LOOPs) o 25 percent from loss of service water o 53 percent from seismic events The MU dependencies that underlie these results are different for different MUIEs. For example, MUCDF for LOOPs, loss of service water, wind events, and seismic bin 1 is dominated by MU CCFs. All other MUCDF results for seismic events are dominated by assigned seismic correlations. As noted before, the fire scenarios are all due to either shared or adjacent spaces and cascading failures.

4.2.

Expected Differences for Advanced Reactors Based on the assumed MU dependencies for advanced reactors given in Section 3, we can make some projections for associated, hypothetical MUCDF results.

Regarding the MUIEs that were addressed in the L3PRA projects ISR task, the following would seem relevant to advanced reactors:

Seismic events LOOPs Additional design-specific and site-specific initiating events could be also relevant and are expected to be analyzed for advanced reactors.

Some MU dependencies that are important to the MUCDF results summarized above also could be important to advanced reactors. In fact, because advanced reactors are expected to be tightly rather than loosely coupled, the following MU dependencies could be much more important to advanced reactors than to LWRs:

Seismic correlations Cascading failures that propagate from one unit to another (similar to certain fire scenarios)

Note that, for advanced reactors, there may be new types of IEs involving propagation of failures from one unit to another.

Other MU dependencies identified in Section 3 are likely to be even more important contributors to MUCDF for advanced reactors than for the LWRs addressed in the L3PRA project. From Section 3, these MU dependencies and associated possible representations in MUPRA are:

PRA logic model additions to represent shared physical resources (e.g., support systems) and shared systems and components Additional correlations to represent shared structures Common human failure events in PRA logic models to represent some operator actions relevant to all units Strong dependence between all other operator actions (e.g., because they are likely taken by the same operating crew)

Also, assuming the same plant design is to be duplicated N times on a single site and seeking the financial benefit of using the same components across the units, potential CCF modeling assumptions and limitations could pose modeling challenges and may have risk effects for events like LOOPs and yet-unmodeled design-specific initiating events.

5.

IMPLICATIONS FOR MULTI-UNIT LEVEL 2 PRA 5.1.

High-Level Insights from Multi-Unit Level 2 PRA Results Level 2 MUPRA was performed for two initiators at the reference site: a weather-related LOOP (LOOPWR) and a seismic event in bin 6. Frequency estimates were developed for each combination of possible release categories that could follow a multi-unit core damage accident (e.g., late containment failure due to overpressure at one unit but no containment failure at the other unit would be one such combination). These were compared with the frequencies that would be expected if the outcomes at the two units were entirely independent (aside from the assumption of core damage at both units). Briefly, the results showed:

For weather-related LOOP, the distribution of release category combinations that accounted for dependencies was very similar to the independent distribution. Accounting for common cause failures would be expected to shift frequency toward combinations where the outcome is the same for both units, but this effect was minimal. The containment failure mode for station blackout scenarios (which dominate core damage due to LOOP) depends largely on physical phenomena such as hydrogen combustion and hot leg creep failure that are not correlated between units.

Notably in a station blackout scenario, the operation of containment systems (containment sprays and cooling units) is irrelevant due to lack of AC power.

For seismic bin 6, by contrast, the distribution did skew more toward matching containment failure modes at the two units. In particular, seismic failure of the containment isolation system is a large contributor to the single-unit release frequency for this initiating event (20%), and correlation of that seismic failure between the units greatly decreases the frequency of having isolation failure at one but not the other.

The surrogate risk measures Large Release Frequency (LRF) and Large Early Release Frequency (LERF) were addressed as well. LRF is defined as a Cesium release fraction of 2.9e-4, and LERF is defined as a 3.5-hour delay from declaration of General Emergency to release of 1% of iodine, combined with eventual release of 4% of iodine.

Combining all pairs of the source terms developed for the single-unit PRA, it is not possible for an accident in which both units end up in non-LRF release categories to have a combined release that meets the LRF threshold (although adding a second release to a release that already meets the LRF threshold can cause it to get there slightly sooner). Nor is it possible for two non-LERF source terms to combine into a LERF release. Because some releases at Unit 1 overlap with those at Unit 2, multi-unit LRF and LERF would be less than simply double the corresponding SUPRA values.

5.2.

Expected Differences for Advanced Reactors The coupling of post-core damage accident progression is expected to be stronger for a typical advanced reactor design with several small units on the same site than it is for a site with large LWRs. Some phenomenological events occurring inside containment, such as creep failures, would remain independent.

Others, such as combustion, are more likely to affect multiple units due to proximity and shared secondary containment structures. Cascading failures may be more risk significant for the same reasons. Operator actions that were judged independent at the reference plant would also be more correlated.

The observations about LRF and LERF for the two-unit reference plant are not expected to hold in general.

Source terms for a plant with a larger number of reactors could more easily combine to create a release that has substantial offsite consequences, while any of those reactors individually might have minor effects that do not require an emergency response or environmental remediation. Tighter coupling of the accident progressions could also bring the releases more in line temporally, increasing the likelihood of large early release compared to a single unit.

Estimation of multi-unit release frequencies for sites with many reactors may be a substantial computational challenge. With two units, it is possible (but not trivial) to create combined cut sets that represent a release category combination, by pairing the most significant cut sets from one unit to those of the other unit and checking them for dependencies. The number of cut sets to evaluate is the product of the number of cut sets needed from each unit. Adding a third unit, therefore, would make the method intractable as implemented here. Ways of reducing the numerical complexity would have to be developed if detailed understanding of the frequencies of possible release category combinations are needed. It will likely be necessary to calculate some type of simplified upper bound on the frequency and magnitude of risk-significant multi-unit releases.

6.

IIMPLICATIONS FOR MULTI-UNIT LEVEL 3 PRA 6.1.

High-Level Insights from Multi-Unit Level 3 PRA Results Consequence analysis efforts for the L3PRA projects ISR task are underway. A scoping study has been performed to estimate consequences from a multi-unit accident using the MACCS multi-source capability.

Combinations of release categories were selected to reflect a range of release characteristics in terms of both timing and release magnitude. The scoping study considered both nominal evacuation scenarios and degraded evacuation scenarios. Because work on the L3PRA projects ISR task is not complete and not published, the insights identified below are considered preliminary.

The results were generated by superposition of source terms generated for the single-unit analyses using the MACCS multi-source capabilities. Both units were assumed to be characterized by a middle-of-cycle (MOC) core burnup. The accidents were assumed to be initiated at both units at the same time and the accident progression at each unit was assumed to be independent (i.e., accident progression at one unit was

not affected by the accident progression at the other unit). Emergency plans were assumed to be triggered off the events occurring at Unit 1 to simplify model creation. The emergency plan was assumed to be triggered at the same time as the single unit analyses (i.e., the timing of emergency declarations for offsite protective actions were assumed to be unaffected by the fact that an accident was initiated at more than one unit).

Comparisons were made between the results calculated for a multi-unit, multi-source release and the sum of the results from the independent single-unit, single-source releases. Generally (but not in all cases), for collective dose, early health effects, and latent health effects, the consequences for the multi-unit multisource release were less than or equal to the sum of the independent single-unit, single-source releases.

Results for ground contamination, intermediate phase relocation, and total economic costs were closer to being equal between the two sets of calculations. These results demonstrate that the sum of consequences computed for independent source terms may be sufficient for some of the metrics of interest, although this may overestimate results for collective doses and health effects. This insight is consistent with the observation drawn from the single unit analyses that many consequences are either linear or sublinear with the magnitude of the release.

6.2.

Expected Differences for Advanced Reactors At this time, the authors do not expect that the key insight from the scoping study - that the consequences of multi-unit, multi-source releases are likely to be reasonably bounded by the sum of the consequences from the component single-unit, single-source releases - would be significantly affected by the specific reactor technology. However, this observation assumes that the multiunit accident progression can be represented by the superposition of source terms from single unit analyses. It is expected that any effect of changes in the source term arising as a result of a multiunit accident would propagate forward into the consequence analysis, but analyses to explore this potential effect are not possible at this time because of the lack of analyses of multi-unit accident progression.

7.

CONCLUSIONS Based on the preliminary L3PRA projects preliminary ISR results, it is anticipated that MUPRA for advanced reactors should address similar dependencies as for the existing LWRs, and many of these dependencies are likely to be even more important contributors to MUCDF for advanced reactors.

In addition, the coupling of post-core damage accident progression is expected to be stronger for a typical advanced reactor design with several small units on the same site than it is for a site with large LWRs. Some phenomenological events occurring inside containment, such as combustion, are more likely to affect multiple units due to proximity and shared secondary containment structures. Cascading failures may be more risk significant for the same reasons.

It is expected that the consequences of multi-unit, multi-source releases are likely to be reasonably bounded by the sum of the consequences from the component single-unit, single-source releases, regardless of specific reactor technology, as long as there are no significant changes in the source term arising as a result of a multiunit accident (beyond the simple increase in magnitude from the multiple units involved).

Finally, regardless of the reactor type, the modeling at all PRA levels is likely to present significant challenges.

ACKNOWLEDGMENTS The NRC staff is grateful for the voluntary participation of the reference site in NRC/RES' site-wide, multi-hazard L3PRA project. Also, the authors are grateful for the input and support of the following members of NRCs L3PRA project: Chris Hunter, Jeff Wood, Michelle Gonzalez, Brian Wagner.

REFERENCES

[1]

U.S. Nuclear Regulatory Commission, Staff Requirements Memorandum (SRM) - SECY 0089 - Options For Proceeding With Future Level 3 Probabilistic Risk Assessment (PRA)

Activities, September 21, 2011 (ML112640419).

[2]

U.S. Nuclear Regulatory Commission, Options for Proceeding with Future Level 3 Probabilistic Risk Assessment (PRA) Activities, SECY-11-0089, July 10, 2011 (ADAMS Accession No. ML11090A039).

[3]

U.S. Nuclear Regulatory Commission, Severe Accident Risks: An Assessment for Five U.S.

Nuclear Power Plants, NUREG-1150, December 1990.

[4]

Pickard, Lowe, & Garrick, Inc., Seabrook Station Probabilistic Safety Assessment, prepared for the Public Service Company of New Hampshire and Yankee Atomic Electric Company, December 1983.

[5]

Government of Japan, Investigation Committee on the Accident at the Fukushima Nuclear Power Stations of Tokyo Electric Company, Interim Report, December 26, 2011.

[6]

Government of Japan, Investigation Committee on the Accident at the Fukushima Nuclear Power Stations of Tokyo Electric Power Company, Final Report, July 23, 2012.

[7]

International Atomic Energy Agency, The Great East Japan Earthquake Expert Mission. IAEA International Fact Finding Expert Mission Of The Fukushima Dai-Ichi NPP Accident Following The Great East Japan Earthquake And Tsunami, Vienna, Austria, June 2011.

[8]

Institute of Nuclear Power Operations, Special Report on the Nuclear Accident at the Fukushima Daiichi Nuclear Power Station, INPO 11-005, November 2011.

[9]

Institute of Nuclear Power Operations, Lessons Learned from the Nuclear Accident at the Fukushima Daiichi Nuclear Power Station, INPO 11-005 Addendum, August 2012.

[10]

Zhou and Modarres, Multi-Unit Nuclear Power Plant Probabilistic Risk Assessment: A Comprehensive Survey, Reliability Engineering and System Safety, 213, 2021.

[11]

U.S. Nuclear Regulatory Commission, Recommendations for Enhancing Reactor Safety in the 21st Century: The Near-Term Task Force Review of Insights from the Fukushima Daiichi Accident, July 2011 (ML111861807).

[12]

N. Siu, D. Marksberry, S. Cooper, K. Coyne, M. Stutzke, PSA technology challenges revealed by the Great East Japan Earthquake, PSAM Topical Conference in Light of the Fukushima Dai-Ichi Accident, Tokyo, Japan (2013), April 14-18, 2013.

[13]

International Atomic Energy Agency, Technical Approach to Probabilistic Safety Assessment for Multiple Reactor Units, Safety Report Series No. 96, Vienna, 2019.

[14]

International Atomic Energy Agency, Multi-Unit Probabilistic Safety Assessment, Safety Series Report 110, Vienna, to be published in 2023.

[15]

Electric Power Research Institute, Framework for Assessing Multi-Unit Risk to Support Risk-Informed Decision-Making - Phase 1 and 2: General Framework and Application-Specific Refinements, EPRI 3002020765, June 2021.