Risk‐Informed Regulation and Safety Management of Nuclear Power Plants—On the Prevention of Severe Accidents

There are four operating nuclear power plant (NPP) units in Finland. The Teollisuuden Voima (TVO) power company has two 840 MWe BWR units supplied by Asea‐Atom at the Olkiluoto site. The Fortum corporation (formerly IVO) has two 500 MWe VVER 440/213 units at the Loviisa site. In addition, a 1600 MWe European Pressurized Water Reactor supplied by AREVA NP (formerly the Framatome ANP—Siemens AG Consortium) is under construction at the Olkiluoto site. Recently, the Finnish Parliament ratified the government Decision in Principle that the utilities' applications to build two new NPP units are in line with the total good of the society. The Finnish utilities, Fenno power company, and TVO company are in progress of qualifying the type of the new nuclear builds. In Finland, risk‐informed applications are formally integrated in the regulatory process of NPPs that are already in the early design phase and these are to run through the construction and operation phases all through the entire plant service time. A plant‐specific full‐scope probabilistic risk assessment (PRA) is required for each NPP. PRAs shall cover internal events, area events (fires, floods), and external events such as harsh weather conditions and seismic events in all operating modes. Special attention is devoted to the use of various risk‐informed PRA applications in the licensing of Olkiluoto 3 NPP.     

Integrating Software into PRA: A Test-Based Approach

Probabilistic risk assessment (PRA) is a methodology to assess the probability of failure or success of a system's operation. PRA has been proved to be a systematic, logical, and comprehensive technique for risk assessment. Software plays an increasing role in modern safety critical systems. A significant number of failures can be attributed to software failures. Unfortunately, current probabilistic risk assessment concentrates on representing the behavior of hardware systems, humans, and their contributions (to a limited extent) to risk but neglects the contributions of software due to a lack of understanding of software failure phenomena. It is thus imperative to consider and model the impact of software to reflect the risk in current and future systems. The objective of our research is to develop a methodology to account for the impact of software on system failure that can be used in the classical PRA analysis process. A test-based approach for integrating software into PRA is discussed in this article. This approach includes identification of software functions to be modeled in the PRA, modeling of the software contributions in the ESD, and fault tree. The approach also introduces the concepts of input tree and output tree and proposes a quantification strategy that uses a software safety testing technique. The method is applied to an example system, PACS.     

Probabilistic Risk Assessment of Wastes Buried in the Ground

The differences between probabilistic risk assessment (PRA) and safety analysis (SA) are discussed, and it is shown that PRA is more suitable than SA for determining the acceptability of a technology. Since a PRA by the fault tree-event tree analysis method used for reactor safety studies does not seem to be practical for buried waste, an alternative approach is suggested using geochemical analogs. This method is illustrated for the cases of high-level and low-level radioactive waste and for chemical carcinogens released in coal burning.     

Managing Safety‐Related Disruptions: Evidence from the U.S. Nuclear Power Industry

Low‐probability, high‐impact events are difficult to manage. Firms may underinvest in risk assessments for low‐probability, high‐impact events because it is not easy to link the direct and indirect benefits of doing so. Scholarly research on the effectiveness of programs aimed at reducing such events faces the same challenge. In this article, we draw on comprehensive industry‐wide data from the U.S. nuclear power industry to explore the impact of conducting probabilistic risk assessment (PRA) on preventing safety‐related disruptions. We examine this using data from over 25,000 monthly event reports across 101 U.S. nuclear reactors from 1985 to 1998. Using Poisson fixed effects models with time trends, we find that the number of safety‐related disruptions reduced between 8% and 27% per month in periods after operators submitted their PRA in response to the Nuclear Regulatory Commission's Generic Letter 88‐20, which required all operators to conduct a PRA. One possible mechanism for this is that the adoption of PRA may have increased learning rates, lowering the rate of recurring events by 42%. We find that operators that completed their PRA before Generic Letter 88‐20 continued to experience safety improvements during 1990–1995. This suggests that revisiting PRA or conducting it again can be beneficial. Our results suggest that even in a highly safety‐conscious industry as nuclear utilities, a more formal approach to quantifying risk has its benefits.     

Site-Specific Applications of Probabilistic Health Risk Assessment: Review of the Literature Since 2000

Whether and to what extent contaminated sites harm ecologic and human health are topics of considerable interest, but also considerable uncertainty. Several federal and state agencies have approved the use of some or many aspects of probabilistic risk assessment (PRA), but its site-specific application has often been limited to high-profile sites and large projects. Nonetheless, times are changing: newly developed software tools, and recent federal and state guidance documents formalizing PRA procedures, now make PRA a readily available method of analysis for even small-scale projects. This article presents and discusses a broad review of PRA literature published since 2000.     

A Discourse on the Incorporation of Organizational Factors into Probabilistic Risk Assessment: Key Questions and Categorical Review

This article presents a discourse on the incorporation of organizational factors into probabilistic risk assessment (PRA)/probabilistic safety assessment (PSA), a topic of debate since the 1980s that has spurred discussions among industry, regulatory agencies, and the research community. The main contributions of this article include (1) identifying the four key open questions associated with this topic; (2) framing ongoing debates by considering differing perspectives around each question; (3) offering a categorical review of existing studies on this topic to justify the selection of each question and to analyze the challenges related to each perspective; and (4) highlighting the directions of research required to reach a final resolution for each question. The four key questions are: (I) How significant is the contribution of organizational factors to accidents and incidents? (II) How critical, with respect to improving risk assessment, is the explicit incorporation of organizational factors into PRA? (III) What theoretical bases are needed for explicit incorporation of organizational factors into PRA? (IV) What methodological bases are needed for the explicit incorporation of organizational factors into PRA? Questions I and II mainly analyze PRA literature from the nuclear domain. For Questions III and IV, a broader review and categorization is conducted of those existing cross-disciplinary studies that have evaluated the effects of organizational factors on safety (not solely PRA-based) to shed more light on future research needs.     

Multicriteria Decision Analysis: A Comprehensive Decision Approach for Management of Contaminated Sediments

Contaminated sediments and other sites present a difficult challenge for environmental decisionmakers. They are typically slow to recover or attenuate naturally, may involve multiple regulatory agencies and stakeholder groups, and engender multiple toxicological and ecotoxicological risks. While environmental decision-making strategies over the last several decades have evolved into increasingly more sophisticated, information-intensive, and complex approaches, there remains considerable dissatisfaction among business, industry, and the public with existing management strategies. Consequently, contaminated sediments and materials are the subject of intense technology development, such as beneficial reuse or in situ treatment. However, current decision analysis approaches, such as comparative risk assessment, benefit-cost analysis, and life cycle assessment, do not offer a comprehensive approach for incorporating the varied types of information and multiple stakeholder and public views that must typically be brought to bear when new technologies are under consideration. Alternatively, multicriteria decision analysis (MCDA) offers a scientifically sound decision framework for management of contaminated materials or sites where stakeholder participation is of crucial concern and criteria such as economics, environmental impacts, safety, and risk cannot be easily condensed into simple monetary expressions. This article brings together a multidisciplinary review of existing decision-making approaches at regulatory agencies in the United States and Europe and synthesizes state-of-the-art research in MCDA methods applicable to the assessment of contaminated sediment management technologies. Additionally, it tests an MCDA approach for coupling expert judgment and stakeholder values in a hypothetical contaminated sediments management case study wherein MCDA is used as a tool for testing stakeholder responses to and improving expert assessment of innovative contaminated sediments technologies.     

Probabilistic Risk Analysis for a High-Level Radioactive Waste Repository

A probabilistic risk analysis (PRA) for a high-level radioactive waste repository is very important since it gives an estimate of its health impacts, allowing comparisons to be made with the health impacts of competing technologies. However, it is extremely difficult to develop a credible PRA for a specific repository site because of large uncertainties in future climate, hydrology, geological processes, etc. At best, such a PRA would not be understandable to the public. An alternative proposed here is to develop a PRA for an average U.S. site, taking all properties of the site to be the U.S. average. The results are equivalent to the average results for numerous randomly selected sites. Such a PRA is presented here; it is easy to understand, and it is not susceptible to substantial uncertainty. Applying the results to a specific repository site then requires only a simple, intuitively acceptable "leap of faith" in assuming that with large expenditures of effort and money, experts can select a site that would be at least as secure as a randomly selected site.     

Compressed Natural Gas Bus Safety: A Quantitative Risk Assessment

This study assesses the fire safety risks associated with compressed natural gas (CNG) vehicle systems, comprising primarily a typical school bus and supporting fuel infrastructure. The study determines the sensitivity of the results to variations in component failure rates and consequences of fire events. The components and subsystems that contribute most to fire safety risk are determined. Finally, the results are compared to fire risks of the present generation of diesel-fueled school buses. Direct computation of the safety risks associated with diesel-powered vehicles is possible because these are mature technologies for which historical performance data are available. Because of limited experience, fatal accident data for CNG bus fleets are minimal. Therefore, this study uses the probabilistic risk assessment (PRA) approach to model and predict fire safety risk of CNG buses. Generic failure data, engineering judgments, and assumptions are used in this study. This study predicts the mean fire fatality risk for typical CNG buses as approximately 0.23 fatalities per 100-million miles for all people involved, including bus passengers. The study estimates mean values of 0.16 fatalities per 100-million miles for bus passengers only. Based on historical data, diesel school bus mean fire fatality risk is 0.091 and 0.0007 per 100-million miles for all people and bus passengers, respectively. One can therefore conclude that CNG buses are more prone to fire fatality risk by 2.5 times that of diesel buses, with the bus passengers being more at risk by over two orders of magnitude. The study estimates a mean fire risk frequency of 2.2 x 10(-5) fatalities/bus per year. The 5% and 95% uncertainty bounds are 9.1 x 10(-6) and 4.0 x 10(-5), respectively. The risk result was found to be affected most by failure rates of pressure relief valves, CNG cylinders, and fuel piping.     

The Repeatability of Uncertainty and Sensitivity Analyses for Complex Probabilistic Risk Assessments

The performance of a probabilistic risk assessment (PRA) for a nuclear power plant is a complex undertaking, involving the assembly of an accident frequency analysis, an accident progression analysis, a source term analysis, and a consequence analysis. Each of these analyses is, in itself, quite complex. Uncertainties enter into a PRA from each of these analyses. An important focus in recent PRAs has been to incorporate these uncertainties at each stage of the analysis, propagate the subsequent uncertainties through the entire analysis, and include uncertainty in the final results. Monte Carlo procedures based on Latin hypercube sampling provide one way to perform propagations of this type. In this paper, the results of two complete and independent Monte Carlo calculations for a recently completed PRA for a nuclear power plant are compared as a means of providing empirical evidence on the repeatability of uncertainty and sensitivity analyses for large-scale PRA calculations. These calculations use the same variables and analysis structure with two independently generated Latin hypercube samples. The results of the two calculations show a high degree of repeatability for the analysis of a very complex system.     

Scheduling Updates of Probabilistic Risk Assessments: The Arkansas Nuclear One-Unit 1 Experience

This paper presents the results of a study that identified how often a probabilistic risk assessment (PRA)should be updated to accommodate the changes that take place at nuclear power plants. Based on a 7-year analysis of design and procedural changes at one plant, we consider 5 years to be the maximum interval for updating PRAs. This conclusion is preliminary because it is based on the review of changes that occurred at a single plant, and it addresses only PRAs that involve a Level 1 analysis (i.e., a PRA including calculation of core damage frequency only). Nevertheless, this conclusion indicates that maintaining a useful PRA requires periodic updating efforts. However, the need for this periodic update stems only partly from the number of changes that can be expected to take place at nuclear power plants–changes that individually have only a moderate to minor impact on the PRA, but whose combined impact is substantial and necessitates a PRA update. Additionally, a comparison of two generations of PRAs performed about 5 years apart indicates that PRAs must be periodically updated to reflect the evolution of PRA methods. The most desirable updating interval depends on these two technical considerations as well as the cost of updating the PRA. (Cost considerations, however, were beyond the scope of this study.)     

Probabilistic Reliability Analysis, Quantitative Safety Goals, and Nuclear Licensing in the United Kingdom

Although unpublicized, the use of quantitative safety goals and probabilistic reliability analysis for licensing nuclear reactors has become a reality in the United Kingdom. This conclusion results from an examination of the process leading to the licensing of the Sizewell B PWR in England. The licensing process for this reactor has substantial implications for nuclear safety standards in Britain, and is examined in the context of the growing trend towards quantitative safety goals in the United States.     

On the Development of Threshold Criteria for Action for Light Water Reactors

A survey of recently proposed threshold criteria for regulatory action on light water reactors (LWRs) is presented together with some commentary. This is followed by a new proposal for threshold action criteria which includes some different risk attributes than are found in previous criteria. Some preliminary risk values are suggested for the criteria and then evaluated in terms of a few hypothetical accident scenarios. Finally, several licensing issues are examined in terms of various threshold action criteria.     

Principles for Conduct of Pest Risk Analyses: Report of an Expert Workshop

The North American Free Trade Agreement (NAFTA) and the General Agreement on Tariffs and Trade (GATT) have focused attention on risk assessment of potential insect, weed, and animal pests and diseases of livestock. These risks have traditionally been addressed through quarantine protocols ranging from limits on the geographical areas from which a product may originate, postharvest disinfestation procedures like fumigation, and inspections at points of export and import, to outright bans. To ensure that plant and animal protection measures are not used as nontariff trade barriers, GATT and NAFTA require pest risk analysis (PRA) to support quarantine decisions. The increased emphasis on PRA has spurred multiple efforts at the national and international level to design frameworks for the conduct of these analyses. As approaches to pest risk analysis proliferate, and the importance of the analyses grows, concerns have arisen about the scientific and technical conduct of pest risk analysis. In January of 1997, the Harvard Center for Risk Analysis (HCRA) held an invitation-only workshop in Washington, D.C. to bring experts in risk analysis and pest characterization together to develop general principles for pest risk analysis. Workshop participants examined current frameworks for PRA, discussed strengths and weaknesses of the approaches, and formulated principles, based on years of experience with risk analysis in other setting and knowledge of the issues specific to analysis of pests. The principles developed highlight the both the similarities of pest risk analysis to other forms of risk analysis, and its unique attributes.     

A Review of Plant Specific PRAs

A large number of PRA studies have been completed for specific plants at specific sites. From these studies, taken individually or collectively, many significant insights have evolved into items important to risk and safety. The content of this paper is primarily based on the material contained in the EPRI funded review of five PRA studies: Big Rock Point, Zion, Limerick, Grand Gulf, and Arkansas Nuclear One. The first three were the utility sponsored studies publicly available at the time of project initiation while the other two were deemed representative of the NRC's RSSMAP and IREP programs respectively. The results of PRA studies are usually expressed in terms of core melt frequencies, radionuclide release frequencies, and frequencies of occurrence of different reactor accident consequences (e.g., early and latent fatalities) depending on the level of PRA. These subjects are prominently addressed in this paper. One of the results of a PRA study is identification of a relatively small number of accident sequences that represent the dominant contributors to core melt. An analysis of the salient features of the dominant accident sequences from eleven PRA's yielded a characterization of accident sequence categories discussed at some length. Impact of external events is discussed very briefly. Next to an explicit quantification of public risk or core melt frequency, the identification of specific safety concerns and the evaluation of possible solutions to implement risk management are probably the best recognized and most widely used applications of PRA. Several illustrative examples are briefly discussed. Human interactions are extremely important contributors to safety and reliability of the plants. A review of PRA studies concluded that it was necessary to account for five types of human interactions; some of which may mitigate while others may exacerbate an accident sequence.     

Recent Case Studies and Advancements in Probabilistic Risk Assessment

During the period from 1977 to 1984, Pickard, Lowe and Garrick, Inc., had the lead in preparing several full scope probabilistic risk assessments for electric utilities. Five of those studies are discussed from the point of view of advancements and lessons learned. The objective and trend of these studies is toward utilization of the risk models by the plant owners as risk management tools. Advancements that have been made are in presentation and documentation of the PRAs, generation of more understandable plant level information, and improvements in methodology to facilitate technology transfer. Specific areas of advancement are in the treatment of such issues as dependent failures, human interaction, and the uncertainty in the source term. Lessons learned cover a wide spectrum and include the importance of plant specific models for meaningful risk management, the role of external events in risk, the sensitivity of contributors to choice of risk index, and the very important finding that the public risk is extremely small. The future direction of PRA is to establish less dependence on experts for in-plant application. Computerizing the PRAs such that they can be accessed on line and interactively is the key.     

A Comparative Analysis of PRA and Intelligent Adversary Methods for Counterterrorism Risk Management

In counterterrorism risk management decisions, the analyst can choose to represent terrorist decisions as defender uncertainties or as attacker decisions. We perform a comparative analysis of probabilistic risk analysis (PRA) methods including event trees, influence diagrams, Bayesian networks, decision trees, game theory, and combined methods on the same illustrative examples (container screening for radiological materials) to get insights into the significant differences in assumptions and results. A key tenent of PRA and decision analysis is the use of subjective probability to assess the likelihood of possible outcomes. For each technique, we compare the assumptions, probability assessment requirements, risk levels, and potential insights for risk managers. We find that assessing the distribution of potential attacker decisions is a complex judgment task, particularly considering the adaptation of the attacker to defender decisions. Intelligent adversary risk analysis and adversarial risk analysis are extensions of decision analysis and sequential game theory that help to decompose such judgments. These techniques explicitly show the adaptation of the attacker and the resulting shift in risk based on defender decisions.     

Should Persons with Diabetes Be Licensed to Drive Trucks?—Risk Management

How should a regulatory agency interpret a risk analysis that concludes there is a small increase in risk? The agency must decide on behalf of society whether the increased risk is large enough to justify banning the risky activity or taking some other step to lessen the risks. In a companion paper (Songer et al.), we conclude that licensing insulin using persons to drive commercial motor vehicles in interstate commerce would result in 42 additional crashes each year. Here we address risk management issues by interpreting the number of additional crashes and the relative risks of the prospective handicapped drivers. Are the number of additional crashes (42) significant? Is the increase in the annual crash risk (from 0.00785 to 0.032 for non-insulin dependent and 0.048 for insulin dependent persons) significant? Are the relative risks significant for all insulin using drivers (4.7)? For drivers with a history of severe hypoglycemic reactions (19.8)? How should society tradeoff risk increases for increases in opportunity for these handicapped persons? We review other social decisions concerning highway safety: Accepting the increasing risks of letting 16 year olds drive, allowing extremely light cars, allowing some unsafe highways, and allowing extremely unsafe driving conditions at some times of day. We conclude that the additional risks from insulin using persons are well within the current accepted range of risks. Currently, 70% of states permit insulin using persons to drive trucks within their state. Nonetheless, the social cost, due to fatalities, injuries, and property damage from allowing a person with a history of severe hypoglycemic reactions to drive is more than $19,700 per year.     

The Role of Environmental Accidental Risk Assessment in the Process of Granting Development Consent

Environmental impact assessment (EIA) is a procedure that must be followed for certain types of development before they are granted development consent. The procedure requires the developer to compile an environmental impact report (EIR) describing the likely significant effects of the project on the environment. A regulatory requirement in Slovenia is that an accidental risk assessment for a new installation should be a part of an EIR. The article shows how risk assessment (RA) related to accidental release of methylene diphenyl diisocyanate (MDI) or a polyvalent alcohol mixture from a new planned unit of a chemical factory in the Alpine region of Slovenia was performed in the framework of an EIA for the purpose of obtaining a construction permit. Two accidental scenarios were considered: (a) a spill of 20 m³ of MDI or polyvalent alcohol mixture into the river Soča (the river runs close to the chemical factory) and (b) a fire in the warehouse storing the raw material, where emission of toxic gases HCN, NO_x, and CO is expected during combustion of MDI. One of the most important results of this case is the agreement among the developer, the competent authority, and a consultant in the field of EIA and RA to positively conclude the licensing process despite the absence of formal (regulatory) limit values for risk. It has been approved that transparent, reasonably uncertain, and semi-quantitative environmental risk assessment is an inevitable component of an EIA, and an essential factor in informed, licensing-related decision making.     

A Definition and Categorization System for Advanced Materials: The Foundation for Risk‐Informed Environmental Health and Safety Testing

Novel materials with unique or enhanced properties relative to conventional materials are being developed at an increasing rate. These materials are often referred to as advanced materials (AdMs) and they enable technological innovations that can benefit society. Despite their benefits, however, the unique characteristics of many AdMs, including many nanomaterials, are poorly understood and may pose environmental safety and occupational health (ESOH) risks that are not readily determined by traditional risk assessment methods. To assess these risks while keeping up with the pace of development, technology developers and risk assessors frequently employ risk‐screening methods that depend on a clear definition for the materials that are to be assessed (e.g., engineered nanomaterial) as well as a method for binning materials into categories for ESOH risk prioritization. The term advanced material lacks a consensus definition and associated categorization or grouping system for risk screening. In this study, we aim to establish a practitioner‐driven definition for AdMs and a practitioner‐validated framework for categorizing AdMs into conceptual groupings based on material characteristics. Results from multiple workshops and interviews with practitioners provide consistent differentiation between AdMs and conventional materials, offer functional nomenclature for application science, and provide utility for future ESOH risk assessment prioritization. The definition and categorization framework established here serve as a first step in determining if and when there is a need for specific ESOH and regulatory screening for an AdM as well as the type and extent of risk‐related information that should be collected or generated for AdMs and AdM‐enabled technologies.