ML21138A810

PRA and RIDM - UCLA

ML21138A810
Person / Time
Issue date:	02/21/2021
From:	Nathan Siu NRC/RES/DRA, Univ of California - Los Angeles
To:
Siu, Nathan - 301 415 0744
Shared Package
ML21138A647	List: ML21138A778 ML21138A779 ML21138A781 ML21138A792 ML21138A793 ML21138A805 ML21138A810
References
Download: ML21138A810 (66)

Text

PRA and RiskInformed Decision Making at the NRC:

Some Trends and Challenges*

Nathan Siu Senior Technical Advisor for PRA Office of Nuclear Regulatory Research Presented at the Garrick Institute of Risk Sciences UCLA, Los Angeles, CA February 21, 2020

• The views expressed in this presentation are not necessarily those of the U.S. Nuclear Regulatory Commission

Thats so cool Are we Outline there yet?

• Use of risk information at NRC

• A changing world: trends and PRA/RIDM challenges

• Challenge: treatment of uncertainty

• Challenge: risk communication

• Closing thoughts 2

It is of the highest importance in the art of decision making to be able to recognize, out of a number of facts, which are incidental and which vital. Otherwise your energy and attention must be dissipated instead of concentrated.

With apologies to Sherlock Holmes (The Hound of the Baskervilles)

NRC USE OF RISK INFORMATION 3

NRC Use of Risk Information Triplet Definition of Risk (Kaplan and Garrick, 1981)*

Features Risk { i , i, i}

• Vector, not scalar

• Qualitative and

• What can go wrong? quantitative

• What are the consequences?

• Differences across

• How likely is it? accident spectrum

• Adopted by NRC. See:

White Paper on RiskInformed and PerformanceBased Regulation (Revised), SRM to SECY98144, March 1, 1999 Glossary of RiskRelated Terms in Support of RiskInformed Decisionmaking, NUREG2122, May 2013 Probabilistic Risk Assessment and Regulatory Decisionmaking: Some Frequently Asked Questions, NUREG2201, September 2016 4

NRC Use of Risk Information NRC Uses of Risk Information PRA Policy Statement (1995)

• Increase use of PRA technology in all regulatory matters Regulations and Guidance - Consistent with PRA stateoftheart

- Complement deterministic approach, support defenseindepth philosophy Licensing

• Benefits:

Operational Decision and (1) Considers broader set of potential challenges Experience Support Certification (2) Helps prioritize challenges (3) Considers broader set of defenses U.S. Nuclear Regulatory Commission, Use of Probabilistic Oversight Risk Assessment Methods in Nuclear Activities; Final Policy Statement, Federal Register, 60, p. 42622 (60 FR 42622), August 16, 1995.

5

NRC Use of Risk Information RiskInformed Regulatory a philosophy whereby risk Decision Making (RIDM) insights are considered together with other factors to establish requirements Defenseindepth that better focus licensee Current regulations Safety margins and regulatory attention on design and operational issues commensurate with their Integrated importance to public health Decision Making and safety. [Emphases added]

White Paper on RiskInformed and PerformanceBased Regulation, SECY98144, Monitoring Risk January 22, 1998.

Adapted from RG 1.174 Adapted from: U.S. Nuclear Regulatory Commission, An Approach for Using Probabilistic Risk Assessment in RiskInformed 6 Decisions on PlantSpecific Changes to the Licensing Basis, Regulatory Guide 1.174, Revision 3, January 2018.

NRC Use of Risk Information In Addition to Immediate Decision Support Adapted from NUREG2150 Risk Information

• Results

• Insights

• Explanations

• Uncertainties

• Qualifications 7

Its tough to make predictions, especially about the future.

Yogi Berra A CHANGING WORLD: TRENDS AND CHALLENGES 8

Trends and Challenges Looking Ahead: Possible Futures U.S. Nuclear Regulatory Commission, The Dynamic Futures for NRC Mission Areas, 2019. (ADAMS ML19022A178) 9

Trends and Challenges Drive to RIDM: Transformation

• Evolving situation (market forces, new nuclear technologies, new analytical methods and data, new professionals)

• Vision: make safe use of nuclear technology possible

• Continuing standard: reasonable assurance of adequate protection

• Potentially different ways of achievement - embrace change Applying the Principles of Good Regulation as a RiskInformed Regulator, 10 October 15, 2019 (ADAMS ML19260E683)

Trends and Challenges Drive to RIDM: Effect of Market Forces "RiskInformed PerformanceBased TechnologyInclusive Guidance for NonLight Water Reactors," NEI 1804, Rev. 1, August 29, 2019.

11

Trends and Challenges Drive to RIDM: New Technologies Im worried about the mission, Dave.

Cmon HAL, open the pod bay door Photo courtesy of NEA Halden Reactor Project

• New designs

• Smart Reactor Systems

• New operational concepts

• Improved Analysis 12

Trends and Challenges Drive to RIDM: New Professionals Changing

• Experiences, knowledge

• Information content and delivery preferences

• Comfort with analytics, risk, probability

• Mobility Source: https://www.nrc.gov/readingrm/doccollections/commission/slides/2019/20190618/staff20190618.pdf 13

Trends and Challenges Drive to RIDM: Integrated PRA

• PRA:

- Involves multiple disciplines

- Views accidents as sequences of events

- Takes traditional systems engineering (divide and conquer) approach

• Ideal

- Teamwide understanding of model (how things fail) We need to talk and results

• Thats too complicated [for PRA].

- Full ownership: We not Them

• PRA was never meant to model that.

• Challenges

• I get nightmares every time I think of that [PRA]

course.

- Boxologyencouraged stovepiping, interactions as handoffs across simplified interfaces

• PRA is for my PhDs.

• We dont want you [PRA] guys to be gatekeepers.

- Different technical cultures, different perspectives on

• Youll never risk this requirement away.

treatment of uncertainty (analysis and communication) 14

Trends and Challenges Drive to RIDM: Back to the Future SECY190036, April 11, 2019 (ML19060A081):

• Early years: progressive evolution of the staff is seeking Commission affirmation that protection considering maximum credible the most damaging single active failure of safety accident related equipment is required to be considered in

- Remote siting performing design, and transient and accident

- Containment analyses, unless such a failure can be shown with

- Engineered safeguards, single failure criterion high confidence to not be credible.

SRMSECY190036, July 19, 2019 (ML19183A408): In any licensing review or other regulatory decision, the staff should apply risk informed principles when strict, prescriptive application of deterministic criteria such as the

• Current: engineering solutions considered single failure criterion is unnecessary to provide

- Single failure for reasonable assurance of adequate protection

- Containment? of public health and safety.

15

Trends and Challenges PRA/RIDM Challenges for NRC

• Heavier reliance on risk information, e.g., to compare against established criteria => improved models, improved characterization and communication of uncertainties

• Changing nuclear technologies => be prepared to review

• Changing analytical technologies => be prepared to review, adapt for use

• Changing staff => changing risk communication 16

Any truth is better than indefinite doubt.

Sherlock Holmes (The Yellow Face)

CHALLENGE: TREATMENT OF UNCERTAINTY 17

Treatment of Uncertainties: General Treatment of Uncertainties: Analyst View Many calculations bring success; few calculations bring failure. No calculations at all spell disaster!

SunTzu (The Art of War) 18

Treatment of Uncertainties: General A Bigger Picture: Uncertainty Analysis for RIDM Adapted from NUREG2150 Other Considerations

• Current regulations

• Safety margins

• Defenseindepth

• Monitoring Quantitative Qualitative 19

Treatment of Uncertainties: General Uncertainty Types for RIDM Support mod*el, n. a A practical classification: representation of reality created with a specific objective in mind.

• Parameter A. Mosleh, N. Siu, C. Smidts, and C. Lui, Model Uncertainty: Its Characterization and

• Model Quantification, Center for Reliability Engineering, University of Maryland, College Park, MD, 1995. (Also NUREG/CP0138, 1994)

• Completeness PRA models for NPPs

• Typically an assemblage of sub models with parameters

• Implicitly include issues considered but not explicitly quantified 20

Treatment of Uncertainties: Parameters Parameter Uncertainty Mature Bayesian framework and Some Technical Challenges mechanics but diverse views on value

• Effect of data preprocessing Selection Interpretation

• Effect of analysis shortcuts Standard prior distributions Simplified expert elicitation Independence assumption

• Ensuring correspondence with stateofknowledge Basic events (micro)

Overall results (macro) 21

Treatment of Uncertainties: Models Model Uncertainty:

Hurricane Example Hurricane Andrew: 8/22/1992, 1200 UTC (about 2 days before FL landfall)

Plot adapted from University of WisconsinMilwaukee (https://web.uwm.edu/hurricanemodels/models/archive/)

22

Treatment of Uncertainties: Models Model Uncertainty:

Hurricane Example Hurricane Irma: 9/8/2017, 0000 UTC (about 2 days before FL landfall)

Plot adapted from University of WisconsinMilwaukee (https://web.uwm.edu/hurricanemodels/models/archive/)

23

Treatment of Uncertainties: Models Model Uncertainty: HRA Example NRC, SPARH INL, SPARH Same method, different teams NRI, CREAM NRI, DT+ASEP All teams, all methods Same team, different methods A Bye, et al., International HRA Empirical Study, NUREG/IA0216, August 2011.

24

Treatment of Uncertainties: Models Model Uncertainty: HRA Example 1.0E+0 ASEP Team 1 Human Error Probability (HEP) 1.0E1 ASEP Team 2 SPARH Team 1 SPARH Team 2 1.0E2 CBDT & HCR/ORE Team 1 CBDT & HCR/ORE Team 2 1.0E3 CBDT & HCR/ORE Team 3 ATHEANA Team 1 1.0E4 ATHEANA Team 2 Empirical 95th Percentile Empirical 5th Percentile 1.0E5 HFE 2A HFE 1C HFE 1A HFE 3A HFE 1B Decreasing difficulty HEPs by HFE (All Methods)

Adapted from NUREG2156 25

Treatment of Uncertainties: Models Model Uncertainty: Status and Challenges

• Consensus: important to understand (considering decision at hand)

• Different technical points of view on treatment:

- Competition between models vs. multiple (correlated) sources of evidence

- Quantify vs. characterize Adapted from V.M. Andersen, Seismic Probabilistic Risk Assessment Implementation Guide, EPRI 3002000709, Electric Power Research Institute, Palo Alto, CA, December 2013

- Include or exclude user effects

• Methods to quantify model output uncertainty exist;* challenges include

- Uncertainties in unmeasured parameters

- Submodel limits of applicability M.H. Salley and A. Lindeman, Verification and Validation of

- Representativeness of computed results Selected Fire Models for Nuclear Power Plant Applications, NUREG1824 Supplement 1/EPRI 3002002182, November 2016.

• See, for example, E. Droguett and Ali Mosleh, Bayesian methodology for model uncertainty using 26 model performance data, Risk Analysis, 28, No. 5, 14571476, 2008.

Treatment of Uncertainties: Completeness Completeness Uncertainty

• Potential concerns Wheres the

- Known gaps (missing scope) goat???

• Excessive amplification (Fear of the dark)

• Excessive discounting (Out of sight, out of mind)

- Unknown gaps

• RIDM guidance (NUREG1855 Rev. 1, 2017)

- Progressive analysis (screening, bounding, It would cease to be a conservative, detailed) danger if we could

- Nonprobabilistic approaches define it.

• Important (critical?) to acknowledge and Sherlock Holmes characterize for risk communication (The Adventure of the Copper Beeches) 27

Treatment of Uncertainties: Completeness Known Gaps (Known Unknowns)

• Broad scenario categories Rationale Common Example(s)

Out of scope security/sabotage, operation outside approved limits Low significance (preanalysis judgment) external floods (many plants preFukushima)

Appropriate PRA technology* unavailable management and organizational factors PRA not appropriate software, security

• Contributors within categories Category Example(s)

External hazards multiple hazards Human reliability errors of commission, nonproceduralized recovery Passive systems thermalhydraulic reliability 28 *Technology = {methods, models, tools, data}

Treatment of Uncertainties: Completeness Multiple Hurricanes:

A Known Unknown 29 https://en.wikipedia.org/wiki/Hurricane_Irma#/media/File:Irma,_Jose_and_Katia_20170907.png

Treatment of Uncertainties: Completeness Unknown Unknowns: You Say Tomto

• Explicit or implicit? Classification is only Model

• Extent of coverage? important if it affects:

• Understanding

• Communication Known Unknowns

• Decision making

• Known by whom?

• Known when?

• Time from idea to theory Now its garbage!

Unknown to PRA implementation? Oscar Madison Unknowns (The Odd Couple) 30

Treatment of Uncertainties: Completeness Unknown Unknowns: A Demonstrated Problem?

Then (a surprise?)

Now (treated in current PRAs?)

Browns Ferry fire (1975) - a longrecognized hazard; not in draft Model WASH1400 but routinely treated now TMI (1979) - precursors include DavisBesse (1977); operator EOCs not in models; current recognition and some explorations Chernobyl (1986) - precursor at Leningrad (1975); nonroutine test Known Unknowns during shutdown in any LPSD analyses?

Blayais flood (1999) - external floods often screened at time; current recognition, multihazard under development Maanshan HEAF/SBO (2001) - HEAF phenomenon known, in any PRAs at time? Now included as an initiator; smoke effect?

DavisBesse RPV corrosion (2002) - RPV failure analyses focused on Unknown Unknowns crack propagation; M&O failure not in PRAs Fukushima Daiichi (2011) - precursors: Blayais (1999), Indian Ocean (2004), hazard under review at time; PRA models under development 31

Treatment of Uncertainties: Completeness What Can We (PRA R&D) Do?

Event (NUREG/CR4839), 1992

• Continue to develop technology to address Aircraft impact known gaps Avalanche Coastal erosion

- Riskinformed prioritization Drought

- Fully engage appropriate disciplines External flooding Extreme winds and tornadoes

- Take advantage of general computational and Fire Wheres the methodological developments Fog goat???

Forest fire

• Facilitate reemphasis on searching Frost Hail

- Demonstration of efficiency and effectiveness High tide, high lake level, or high river stage (vs. checklist/screening)

- Develop improved tools (including OpE mining) 32

Will somebody find me a onehanded scientist?!

Senator Edmund Muskie (Concorde hearings, 1976)

I. Flatow, Truth, Deception, and the Myth of the OneHanded Scientist, October 18, 2012. Available from:

https://thehumanist.com/magazine/novemberdecember2012/features/truthdeceptionandthemythoftheonehandedscientist CHALLENGE: INTERNAL RISK COMMUNICATION 33

Internal Risk Communication Internal Risk Communication Adapted from NUREG2150 With To Other Considerations

• Current regulations

• Safety margins

• Defenseindepth

• Monitoring Quantitative Qualitative 34

Internal Risk Communication Current Mechanisms Documents and Interactive Presentations Discussion (Flatland) (Storytelling) 35

Internal Risk Communication Its Complicated

• Risk information complexity Uhh, we seem to have

- Hyperdimensional a TEP vulnerability,

- Heterogeneous maybe, I think

- Dynamic

- Uncertain Thermal

• Individual user differences, e.g., Exhaust

- Knowledge Port

- Preferences/heuristics

• Social factors, e.g.,

- Trust

- Decision and group dynamics

• Situational context, e.g.,

- Available time

- Decision support vs. informational 36

Internal Risk Communication Thinking Ahead

• Tufte model: use rich displays and reports, encourage user to explore*

• A graduated technical approach to assist and then go beyond?

Interface Interaction Mode Hyperlinked dashboards and reports Manual Time Video AI assist Visual immersion Multisensory immersion

• See Tuftes website for complaints about the current PowerPoint culture 37

Internal Risk Communication From Static to Interactive Dashboard to SciFi?

M. Korsnick, Risk Informing the Commercial Nuclear Enterprise, Promise of a Discipline: Reliability and Risk in Theory and in Practice, University of Maryland, April 2, 2014. Graphic adapted from https://www.flickr.com/photos/83823904@N00/64156219/

(permission CCBY2.0) 38

And what if the bird wont sing?

Nobunaga: Make it sing.

Hideyoshi: Make it want to sing.

Tokugawa: Wait.

Eiji Yoshikawa (Taik)

CLOSING THOUGHTS 39

Closing Thoughts An Evolving Environment (1)

Ongoing changes

• Market forces

• Nuclear technologies Increasing demands (qualitative and

• Analytical methods quantitative) on and data PRA/RIDM technology (operating fleet and

• Professional new reactors) workforce 40

Closing Thoughts An Evolving Environment (2)

NRC Research Budget (FY 1976 - FY 2019) 700 50 45 600 Actual ($M)

Inflation Adjusted ($M) 40

% NRC Total 500 35 Contracting Budget ($M) 30 400

% NRC Total 25 300 20 200 15 10 100 5

0 1975 1976 1977 1978 1979 1980 0

1981 1982 1983 1984 1985 1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019 Budget data from NUREG1350 (NRC Information Digest) Year 41

Closing Thoughts Challenge to NRC/RES and Opportunities To increase effectiveness and efficiency

• [Enterprise] riskinformed prioritization

• Consider new technical approaches

• Better target available resources (e.g.,

university grant funds)

• Leverage other programs

- Observe (learn, provide feedback)

- Cooperate

- Collaborate Dial 1800CALLRES

• Good ideas are welcome!

42

ADDITIONAL SLIDES 43

RIDM and NRCs Principles of Good Regulation Readily Defense- Efficiency Logical Understood

• Independence Acceptable In-Depth Risk Safety Best

• Openness Margins Integrated Information

• Efficiency Decision Reliability Openness Coherent

• Clarity Performance Current Making Monitoring

• Reliability Practical Regulations Independence U.S. Nuclear Regulatory Candid Public Commission, Principles of Good Highest Clarity Competence Regulation (ADAMS ML14135A076)

Standards 44

Daedalus Problem: A RIDM Example 45

How to get away?

• Options considered

- Flight by sea

- Flight by air

• Apparent metric

- Successful escape for Daedalus and Icarus

• Adopted solution

- Practice

- Specific cautions to Icarus

• Flying too close to the sun

• Flying too close to the ocean 46

A good example of RIDM?

• Current regulations: N/A (escaping authority)*

• DefenseinDepth: none

• Safety margins: vague characterization

• Risk assessment: incomplete (see next)

• Performance monitoring: inflight observation but little/no chance of intervention (see DefenseinDepth)

• Even if flight had been sanctioned by King Minos (Crete), no mention of currying favor with Olympians 47

On that risk assessment

• Did Daedalus consider the full set of potentially Models Risk Metrics Options Scenarios

• Phased escape Deity Action relevant metrics? **

Impact Knownon:

Wax failure Shipboard (too closebribery, (stowaway, to sun) )

• Unknowns Icarus mother Pilot Inexperience

• Did he fully consider other potential options? ** Lift failure Outside

• CALL Friends (damp feathers) rescue 1800HELPRES on Crete(Takeoff/Landing)

• High Tech (sub, fast

• Environment surface, )

(postcrash)

• Did he have the right models for his scenarios?

• Do nothing

• Refugee Irradiance havens Altitude Effects?

vs Altitude

• Did he know about other possible scenarios?

1400 Mechanical Failure 1350 Conceivability 1300 Irradiance (W/m2)

• Might a better analysis (or even a chat with his 1250 MidAir Collision 1200 buddy down the hall) have helped him make a 1150 Design Error 1100 better (in hindsight) decision? 1050 Mt Ida Altitude Effects?

Unknown 1000 Unknowns 0 2000 4000 6000 8000 10000 Altitude (m) Clear Air Turbulence 48

Risk Info Uses - Regulations Example (RiskInformed Fire Protection)

• Browns Ferry Nuclear Power Plant fire (3/22/75) Adapted from NUREG-0050

• Candle ignited foam penetration seal, initiated cable tray fire; water suppression delayed; complicated shutdown 11.5m 8.5m

• Secondmost challenging event in U.S.

nuclear power plant operating history TVA File Photo

• Spurred changes in requirements and 3m analysis 49

Risk Info Uses - Regulations Example (RiskInformed Fire Protection)

• PostBrowns Ferry deterministic fire protection (10 CFR Part 50, Appendix R)

- 3hour fire barrier, OR

- 20 feet separation with detectors and auto suppression, OR

- 1hour fire barrier with detectors and auto suppression

• Riskinformed, performancebased fire protection (10 CFR 50.48(c), NFPA 805)

- Voluntary alternative to Appendix R

- Deterministic and performancebased elements

- Changes can be made without prior approval; risk must be acceptable

- More than 1/3 U.S. fleet has completed transition

• Methods adopted by international organizations From Cline, D.D., et al., Investigation of TwentyFoot Separation Distance as a Fire Protection Method as Specified in 10 CFR 50, Appendix R, NUREG/CR3192, 1983.

50

Risk Info Uses - Licensing Example (Changes in plant licensing basis - RG 1.174)

• Voluntary changes: licensee requests, NRC reviews

• Small risk increases may be acceptable

• Change requests may be combined

• Decisions are riskinformed 51

Risk Info Uses - Oversight Example (Reactor Oversight Program)

• Inspection planning CDF < 1E-6 LERF < 1E-7

• Determining significance of findings

- Characterize performance deficiency 1E-6 < CDF < 1E-5 1E-7 < LERF < 1E-6

- Use review panel (if required)

- Obtain licensee perspective 1E-5 < CDF < 1E-4

- Finalize 1E-6 < LERF < 1E-5

• Performance indicators CDF > 1E-4 LERF > 1E-5 52

Risk Info Uses - OpE Example (Accident Sequence Precursor Program)

• Program recommended by WASH1400 review group (1978) significant precursor

• Provides riskinformed view of nuclear plant operating experience

- Conditional core damage probability (events) precursor

- Increase in core damage probability (conditions)

Licensee Event Reports 19692018

• Supported by plantspecific Standardized (No significant precursors since 2002)

Plant Analysis Risk models 53

Risk Info Uses - Decision Support Example Decision (Research) re*search, n. diligent and systematic inquiry or investigation in order to discover or revise facts, theories, applications, etc.

Specific Analyses Typical products (regulatory research)

• Ways to look at and/or approach problems (e.g.,

Methods, Models, frameworks, methodologies)

R&D Tools, Databases,

• Points of comparison (e.g., reference Standards, calculations, experimental results)

Guidance,

• Job aids (e.g., computational tools, databases, standards, guidance: best practices, procedures)

• Problemspecific information (e.g., results, Foundational Knowledge insights, uncertainties)

Side benefits

• Education/training of workforce Regulatory Decision Support

• Networking with technical community 54

Risk Info Uses - Decision Support Example (Research: Frameworks/Methodologies)

NRCsponsored Fire PRA Technology Neutral R&D (universities) Framework

• Started after Browns

• Explored use of risk Ferry fire (1975) metrics to identify

• Developed fire PRA licensing basis events approach first used in

• Inspiration and part industry Zion and basis for current Indian Point PRAs Licensing (early 80s), same basic Modernization approach today Program

• Started path leading to riskinformed fire protection (NFPA 805) 55

Risk Info Uses - Decision Support Example (Research: Reference Points)

NUREG1150 SOARCA

• Continuing point of

• Detailed analysis of comparison for potential severe Level 1, 2, 3 results accidents and offsite

• Expectations consequences (ballpark)

• Updated insights on

• Basis for regulatory margins to QHOs Peach Bottom analysis (backfitting, generic issue resolution)

NUREG1150 (Surry)

Surry Sequoyah 56

Risk Info Uses - Decision Support Example (Research: Methods/Models/Tools)

SPAR IDHEASG

• Independent plant IDHEAS is coming.

• Improved support for specific models Resistance is futile! qualitative analysis (generic data)

• Explicit ties with cognitive

• Allhazards (many) science (models, data)

• Support SDP, MD 8.3,

• General framework for ASP, GSI, SSC studies developing focused

• Adaptable for specific applications (e.g., IDHEAS circumstances ECA)

SAPHIRE

• Benefits from NPP simulator studies

• General purpose

• Consistent with current modelbuilding tool HRA good practices

• Multiple user guidance (NUREG1792) interfaces From https://en.wikipedia.org/wiki/SAPHIRE 57

Parameter Uncertainties:

Some Historical Results Industry results from: Garrick, B.J., Lessons learned from 21 nuclear plant probabilistic risk assessments, Nuclear Technology, 84, No. 3, 319-339(1989).

58

Parameter Uncertainties: Logarithmic vs Linear 59

Generic Runtime Failure Rates 2015 Industrywide estimates from: https://nrcoe.inl.gov/resultsdb/AvgPerf/

• Service Water Pumps: 2 failures in 16,292,670 hours0.00775 days <br />0.186 hours <br />0.00111 weeks <br />2.54935e-4 months <br />

• Normally Running Pumps: 225 failures in 59,582,350 hours0.00405 days <br />0.0972 hours <br />5.787037e-4 weeks <br />1.33175e-4 months <br />

• Standby Pumps (1st hour operation): 48 failures in 437,647 hours0.00749 days <br />0.18 hours <br />0.00107 weeks <br />2.461835e-4 months <br /> Point estimates wont alert user Runtime Failures to potential Probability Density Function inconsistencies Service Water (Normalized)

Normally Running Standby 1.00E09 1.00E08 1.00E07 1.00E06 1.00E05 1.00E04 1.00E03 Failure Rate (/hr) 60

Example Quantification of Model Ouput Uncertainty Time (s) Experiment (K) DRM (K) 180 400 450 360 465 510 720 530 560 840 550 565 Notes:

1) Bayesian methodology accounts for possibility of inhomogeneous data.

2) Very large uncertainty bands might be unrealistic.

E. Droguett and Ali Mosleh, Bayesian methodology for model uncertainty using model performance data, Risk Analysis, 28, No. 5, 14571476, 2008.

61

Early Views on Completeness

• W. F. Libby (Acting Chairman, AEC) - March 14, 1956 response to Senator Hickenlooper: it is incumbent upon the new industry and the Government to make every effort to recognize every possible event or series of events which could result in the release of unsafe amounts of radioactive material to the surroundings and to take all steps necessary to reduce to a reasonable minimum the probability that such events will occur in a manner causing serious overexposure to the public. [Emphasis added]

• L. Silverman (Chairman, ACRS) - October 22, 1960 letter to AEC Chairman John A. McCone: We believe that a searching analysis which is necessary at this stage [reactor siting approval] should be done independently by the owner of the reactor [Emphases added]

62

ACRS Concerns with WASH1400 Methodology*

Topic Signature Events[1] PostWASH1400 Accident initiator quantification Extensive treatment: fires, earthquakes Fukushima (Presumably external events) Inconsistent treatment: floods Atypical reactors Fermi 1 [2] Multiple PRAs for nonLWRs Many design and operational improvements identified Design errors [3] by PRAs; database includes events involving design problems Multiple methods emphasizing importance of context; Operator error quantification TMI2 still an active area of development Consequence modeling Chernobyl, Fukushima Continuing, evolutionary improvements (MACCS)

Improved hardware database; fits and starts with Data Many HRA; extreme natural hazards a continuing challenge

• ACRS letter to Congressman Udall re: adequacy for estimating likelihood of low probability/high consequence events (Dec. 16, 1976)

Table Notes:

1. Events whose key characteristics (for the given topic) might not have been captured by a WASH1400 vintage analysis.

2. Fermi 1 had limited fuel melting. However, without an analysis, it isnt clear if a WASH1400 vintage analysis would have captured this scenario.

63 3. Design weaknesses have played a role in multiple events. More detailed review is needed to determine if: a) these are errors, and b) if they would have been missed by a WASH1400 vintage analysis.

Empirical Experience Accidents Some Significant* U.S. Precursors Year Plant(s) Precursor? Year Plant(s) Notes 1979 TMI DavisBesse (1977) 1975 Browns Ferry Worst precursor Fire => loss of U1 ECCS 1986 Chernobyl Leningrad (1975) 1978 Rancho Seco Next worst precursor 2011 Fukushima Blayais (1999) Human error (maintenance) => loss of NNI, LOFW 2002 DavisBesse Most recent significant precursor Multiple human/organizational faults

=> RPV head corrosion

• Per Accident Sequence Precursor (ASP) program 64

Some Other Interesting International Events Year Plant(s) Scenario Type Notes 1957 Windscale 1 (UK) Fire Graphite fire in core, release to environment.

Power cable fire, loss of main feedwater, pressurizer safety 1975 Greifswald 1 (East Germany) Fire valves fail to reseat.

Partial loss of offsite power (LOOP) and subsequent loss of 1977 Gundremmingen A (East Germany) LOOP/LOCA cooling accident (LOCA) with internal flooding.

Turbine Building fire spreads into Main Control Room, collapses 1978 Beloyarsk 2 (Soviet Union) Fire Turbine Building roof.

1981 Hinkley Point A1, A2 (UK) External Flood; LOOP (weather) Severe weather LOOP and loss of ultimate heat sink (LOUHS).

1982 Armenia 1 (Soviet Union) Fire Fireinduced station blackout (SBO).

1989 Vandellos 1 (Spain) Fire Fireinduced internal flood.

1991 Chernobyl 2 (Soviet Union) Fire Fireinduced Turbine Building roof collapse.

1993 Narora 1 (India) Fire Fireinduced SBO.

1993 Onagawa 1 (Japan) Reactivity Excursion Seismicallyinduced reactivity excursion.

1999 Blayais 1, 2 (France) External Flood Severe weather LOOP and partial LOUHS.

2001 Maanshan 1 (Taiwan) LOOP (Weather); Fire (HEAF) Severe weather LOOP and subsequent SBO.

Pickering 48; Darlington 1, 2, and 4; Bruce 3, 4, and 6 (Canada);

2003 Fermi 2 , Fitzpatrick, Ginna, Indian Point 2 and 3, Nine Mile LOOP (weather) Northeast Blackout.

Point 1 and 2, Oyster Creek, Perry (U.S.)

2004 Madras 2 (India) External Flood Tsunamiinduced LOUHS.

2009 Cruas 24 (France) External Flood LOUHS due to flood debris.

Fukushima Daiichi 56, Fukushima Daini 14, Onagawa 13, Earthquake and tsunamiinduced incidents (in addition to 2011 Tokai Daini, Higashidori 12 (Japan) External Flood accidents at Fukushima Daiichi 13).

65

External Hazards ScenarioBased Classification:

An Aid for Completeness?

66