EUR22302EN

PSA TECHNOLOGY AS A COMPLEMENTARY
TOOL TO SUPPORT DECISION MAKING

IN NUCLEAR SAFETY
International Eugene Wigner Training Course

on Research Reactor Safety
2006
Jozef KUBANYI, Christian KIRCHSTEIGER
DG JRC
Institute for Energy
August 2006
EUR 22302EN
Mission of the Institute for Energy
The Institute for Energy provides scientific and technical support for the conception, development, implementation
and monitoring of community policies related to energy. Special emphasis is given to the security of energy
supply and to sustainable and safe energy production.
European Commission
Directorate-General Joint Research Centre (DG JRC)
http://www.jrc.ec.europa.eu
Institute for Energy, Petten (the Netherlands)

http://ie.jrc.ec.europa.eu
Contact details:
Jozef Kubanyi
Tel.: +31-224-56-5376
E-mail: jozef.kubanyi@jrc.nl
Christian Kirchsteiger
Tel.: +31-224-56-5118
E-mail: christian.kirchsteiger@jrc.nl
Legal Notice
Neither the European Commission nor any person acting on behalf of the Commission is responsible for the
use which might be made of this publication.
The use of trademarks in this publication does not constitute an endorsement by the European Commission.
The views expressed in this publication are the sole responsibility of the author and do not necessarily reflect
the views of the European Commission.
© European Communities, 2006

Reproduction is authorised provided the source is acknowledged.
Printed in the Netherlands
Cover: JRC IE, PR & Communication

(No commercial use. Credit “Audiovisual Library European Commission”.)
PSA TECHNOLOGY AS A COMPLEMENTARY
TOOL TO SUPPORT DECISION MAKING
IN NUCLEAR SAFETY
International Eugene Wigner Training Course

on
Research Reactor Safety
2006
Jozef KUBANYI, Christian KIRCHSTEIGER
European Commission, DG JRC

Institute for Energy
August 2006
EUR 22302 EN
PSA Technology as a Complementary Tool to support Decision Making in
Nuclear Safety
Jozef Kubanyi, Christian Kirchsteiger

European Commission, DG Joint Research Centre, Institute for Energy, Petten, NL
Summary
The report provides a brief overview of overall framework of Probabilistic Safety
Assessment (PSA) technology used in various applications to assess nuclear power plant
(NPP) operational risk issues. Based on essential nuclear power engineering/safety
background and philosophy behind NPP safety justification, main terms of quantitative
risk assessment are discussed: basic aspects of Fault Tree (FT)/Event Tree (ET)
construction, modelling for graphical/logical representation of accident sequences,
Initiating Events (IE) selection, issues of consequences, data analysis and quantification
of the model. Basic aspects of Risk Informed Decision Making (RIDM) concept are
explained and discussed.
Introduction
A nuclear power plant is a thermal power station in which the heat source is one or more
nuclear reactors generating nuclear power. NPPs are base load stations, which work best
when the power output is constant. Their units range in power from about 40 MWe to
over 1000 MWe. New units and those under construction currently are typically in the
range 600-1200 MWe. As of 2005, there are 443 licensed nuclear power reactors in the
world, of which 441 are currently operational in 31 different countries. Together they
produce about 17% of the world's electric power.
NPPs are classified according to the type of reactor used. Fission power reactors generate
heat by nuclear fission of fissile isotopes of uranium and plutonium. There are two main
types of them: Thermal reactors use a neutron moderator to slow or moderate neutrons so
that they are more likely to produce another fission, while fast reactors sustain the chain
reaction without needing a neutron moderator. Because they use different fuel than
1
thermal reactors, the neutrons in a fast reactor do not need to be moderated for an
efficient chain reaction to occur. This paper concerns thermal reactors only.
There are three main groups of power reactors used at present: light water reactors
(LWR), cooled and moderated by H2O, graphite moderated reactors, which are cooled by
gas, and CANDU reactors, cooled and moderated by D2O. There are two subgroups of
LWR: boiling water reactors (BWR) and pressurized water reactors (PWR). Reactors of
VVER type belong to PWR subgroup.
Nuclear Safety
Nuclear safety covers the actions taken to prevent nuclear and radiation accidents or to
limit their consequences. Main concerns of nuclear safety are radioactive contamination,
radioactive waste, and reactor core damage. Countries utilizing nuclear power have
special institutions overseeing and regulating nuclear safety. In Czech Republic it is State
Office of Nuclear Safety (SUJB), in Hungary Hungarian Atomic Energy Agency (OAH),
in Slovakia Nuclear Regulatory Authority (UJD), in USA, for example, Nuclear
Regulatory Commission (NRC). Internationally, the International Atomic Energy Agency
(IAEA) works for the safe, secure and peaceful uses of nuclear science and technology.
As key terms of nuclear safety can be mentioned safety culture, redundancy, passive
safety, active safety, defence in depth, containment (confinement), and radiation
(radiological) protection.
Safety culture is a term introduced by the International Nuclear Safety Advisory Group
(INSAG). Safety culture is that assembly of characteristics and attitudes in organisations
and individuals, which establishes that, as an overriding priority, nuclear plant safety
issues receive the attention warranted by their significance. Safety culture is about
improving safety attitudes in people but it is also about good safety management
established by organizations. Good safety culture implies a constant assessment of the
safety significance of nuclear events and issues, so the appropriate level of attention can
be given.
2
Redundancy is duplication of critical components of a system with the intention of
increasing reliability of the system, usually in the case of a backup or fail-safe. In many
safety-critical systems, some parts of the system (including its control system) may be
doubled or tripled. A failure in one component may then be addressed or out-voted by the
other two. In a triple redundant system, the system has three subcomponents (subsystems,
“trains”), all three of which must fail before the system fails. Since each one rarely fails,
and the subcomponents are expected to fail independently, the probability of all three
failings is small.
Passive safety is a feature of modern nuclear reactor and other NPP systems that operator
actions are not required for some time in order to shut down safely in the event of a loss-
of-coolant accident (LOCA) or other emergency/accidental conditions. Besides, the
modern nuclear reactors may use the laws of physics to keep the nuclear reaction under
control rather than engineered safety systems.
Active safety is based on engineered safety features (ESF), especially emergency core
cooling system (ECCS) with its passive subsystem (hydro accumulators) and active
subsystems, consisting of high pressure injection (HPI) pumps, low pressure injection
(LPI) pumps and sprinkler (spray) (SS) pumps.
Defence in depth concept has been developed from the original idea of placing multiple
barriers between radioactive materials and the environment. At present the concept
includes a more general structure of multiple physical barriers and complementary means
to protect the barriers themselves, the so called levels of defence. It ensures that a high
level of safety is reliably achieved with sufficient margins to compensate for equipment
failures and human errors. The first level (L1) of defense is the inert, ceramic quality of
UO2 fuel, L2 is the air tight zirconium alloy of the fuel rod, L3 is the reactor coolant
system and reactor pressure vessel made of steel ~ 20 cm thick, L4 is the pressure
resistant, air tight containment, L5 is the reactor building or in newer NPPs a second
outer containment building. Defence in depth concept covers conservative design, quality
assurance (QA), safety culture, control of abnormal operation and detection of failures,
safety and protection systems, accident management, and off-site emergency response. It
3
employs successive compensatory measures to prevent accidents or mitigate damage if a
malfunction, accident or naturally caused event happens in a nuclear facility. It ensures
that safety is not wholly dependent on a single element of the design, construction,
maintenance or operation of nuclear facility.
Containment building is a steel or concrete structure enclosing a nuclear reactor. It is

designed to, in any emergency, contain the escape of radiation despite high pressures. It
is the final barrier to radioactive release. Typically it is an airtight steel structure
enclosing the reactor normally sealed off from the outside atmosphere. For PWR, the
containment also encloses the steam generators and the pressurizer, and is the entire
reactor building.
Radiation (radiological) protection is for protecting people and the environment from
the harmful effects of both particle radiation and ionizing radiation. It includes
occupational radiation protection (plant people) and public radiation protection, which is
about protection of individual members of the public, and of the population as a whole.
There are three main principles to radiation protection: those of time, distance and
shielding.
Nuclear events are accidents, incidents, anomalies, deviations and near-misses. In terms
of PSA, accidents are most important. They are divided in design basis accidents (DBA,
plant design covers them and plant ESF will cope with them) and beyond design basis
accidents (BDBA, plant design does not cover them and plant ESF would not cope with
them). Any radioactive release bigger than that involved in DBA could only occur as the
result of the sequential failure of several levels of safety protection, or of some major and
very unlikely event (e.g. failure of reactor pressure vessel). They could range in size from
those bigger than DBA to very severe accident.
There are more methods and procedures for assessment of nuclear safety, that includes
identification of safety issues, ranking of safety significance of them, and assessment of
safety itself, resulting in decision-making in corrective measures and their feasibility. The
4
methods and procedures are based on either deterministic or probabilistic approach. PSA
technology can be effective tool in the decision making processes.
Probabilistic Safety Assessment
PSA, or Probabilistic Risk Assessment (PRA) is a systematic and comprehensive

methodology to evaluate risk associated with a nuclear installation. Risk is the potential
harm that may arise from some present process or from some future event. In everyday
usage, "risk" is often used synonymously with "probability", but in professional risk
assessments, risk combines the probability of a negative event occurring with how
harmful that event would be, i. e. the consequence. Prevention of NPP specific risk
requires efficient control of the chain reaction ad hence the power produced, fuel cooling
assured under thermal hydraulic conditions designed to maintain fuel clad integrity and
containment of radioactive products in the fuel, but also in the primary coolant, in reactor
coolant system (RCS), in the containment or confinement.
Engineering definition of risk is as follows:
Tolerability to risk from NPPs would be of much interest in these considerations. In the
well known document of Health & Safety Executive, UK, 1992, The Tolerability of Risk
from Nuclear Power Stations, “Tolerability does not mean acceptability. It refers to a
willingness to live with a risk so as to secure certain benefits and in the confidence that it
is being properly controlled. To tolerate a risk means that we do not regard it as
negligible or something we might ignore, but rather as something we need to keep under
review and reduce still further if and as we can. For a risk to be “acceptable” on the other
hands means that for purpose of life or work, we are prepared to take it pretty well as it
is”.
Effectively, there are three components to be considered in estimating any risk: the
probability (whether there is a high risk or not); the event to which probability attaches;
and the severity of the consequences. In qualitative safety (risk) assessment the severity
5
of the consequences and their likelihood of occurrence are both expressed qualitatively
(e. g. through words like high, medium, low). In quantitative safety (risk) assessment risk
is characterized by two quantities: (1) Probability of occurrence of each consequence
(2) Magnitude (severity) of the possible adverse consequence. In PSA the consequences
are expressed numerically (e. g. number of people potentially hurt or killed) and their
likelihood of occurrences are expressed as probabilities or frequencies (i .e. the number
of occurrences or the probability of occurrence per time unit). The total risk then is the
sum of the products of the consequences multiplied by their probabilities.
PSA usually answers three basic questions:

1. What can go wrong with the studied NPP unit, or what are the initiators or
initiating events (IE)? IE are undesirable starting events, which lead to adverse
consequences (core damage or large early release, i. e. the rapid, unmitigated
release of airborne fission products from the containment to the environment
occurring before the effective implementation of off-site emergency response and
protective actions).
The answer requires technical knowledge of the possible causes leading to damaging
outcomes of a given activity or action. In order to focus on the most important initiators
while screening out the unimportant ones, logic tools like Master Logic Diagrams (MLD)
or Failure Modes and Effects Analyses (FMEA) have been successfully used.
2. What and how severe are the potential damages, or the adverse consequences that
the NPP unit may be eventually subjected to as a result of the occurrence of the
initiator?
The answers is obtained by developing and quantifying accident scenarios, which are
chains of events that link the initiator to the end-point damaging consequences as well as
from deterministic analyses (e.g., thermal, fluid, structural or other engineering analyses).
Those describe the phenomena, which could occur along the path of the accident scenario
when the initiator and the other subsequent events (through the damaging consequences)
take place.
6
3. How likely to occur are these undesirable consequences, or what are their
probabilities or frequencies?
The answer is obtained by using Boolean Logic methods for model development and by
probabilistic and statistical methods for the quantification portion of the model analysis,
fault tree analysis and event tree analysis.
Fault Tree (FT) is a deductive logic diagram that depicts how a particular undesired
event can occur as a logical combination of other undesired events.
Safety System 1 Fails
OR
Support System 11 Fails Support System 12 Fails

Basic
Event
AND 10 AND
Basic Basic Basic Basic OR

Event Event Event Event
11 13 11 13
Basic
Event Basic Basic
12 Event Event
14 15
An undesired event is taken as the top event of a tree of logic. Then, each situation that
could cause that effect added to the tree as a series of logic expressions. When FTs are
labelled with actual numbers about component reliability data (parameters), computer
programs can calculate top event probabilities from FTs. Any combination of component
failures causing the top event is called a cutset. A minimal cutset is the smallest
combination of component failures causing the top event.
Event Tree (ET) is a logic diagram that begins with an initiating event or condition and
progresses through a series of branches that represent expected system or operator
7
performance that either succeeds of fails and arrives at either a successful or failed end
state.
Initiating Safety Safety Safety

Consequences
Event System 1 System 2 System 3
Available
Consequence A
Available
Consequence B
Available Fails
Consequence B
Fails
Consequence C
Consequence D
Fails
Based on IEs selection, accident sequences for each selected IE with their consequences
are developed in FTs/ETs as graphical and logical representation of accident sequences.
The relevant data are analyzed and added to the model (failure rate, i. e. number of
failures per time unit, repair rate, probability of failure per demand, test intervals, mission
time, and others. The final stage then is quantification of the model.
There is important and challenging issue of (statistical) data to be used in the analyses. In
cases when the probability of an event is well known from past experience, plant specific
data (data from the plant being analyzed) as statistical data can be used, if the uncertainty
in these data is acceptably low. In other cases the relevant data, e. g. component failure
frequency is estimated by expert judgment based on engineering knowledge and
experience. This kind of data is so called generic data (US NRC, IAEA, IEEE, EPRI,
INPO, others). For rare events (e.g., system failures), for which there is no past failure
experience at all, or the data are very sparse, probabilistic failure models are developed
with deductive logic tools like fault trees, or inductive logic tools like reliability block
diagrams an Failure Mode and Effect Analysis (FMEA).
8
There are some other very important analysis tools in PSA: Human reliability analysis
(HRA), which deals with methods for modelling human error and Common-cause failure
analysis (CCF), dealing with methods for evaluating the effect of inter-system and inter–
component dependencies (dependent failures), which tend to cause significant increases
in overall system or facility risk.
Complex calculations and quantifications based beside other tools mainly on Boolean
algebra logical operations provide such results as core damage frequencies (CDF),
minimal cut sets, and their probabilities. They are simple for small ET/FT, however, to
obtain probabilities of top events, sequences and consequences including importance
analysis, uncertainty analysis and sensitivity analysis results for large and complex NPP
systems, special approximate algorithms have to be used.Computer codes like Relcon’s
Risk Spectrum, EPRI’s CAFTA or INPO’s SAPHIRE are mostly used.
PSA can be performed for internal and external IEs. Both trigger sequences of events that
challenge plant control and safety systems whose failure could potentially lead to core
damage or large early release. Internal IEs consist in hardware or system failures or
human errors in situations arising from the normal mode of operation of the NPP being
analyzed, e. g. LOCA (large, medium, small, …), Loss of Offsite Power (LOOP), Steam
Line Break (SLB), Steam Generator Tube Rupture (SGTR), support system initiators and
other transients. External IEs are outside the domain of normal operation of NPP, e. g.
earthquakes, lightnings, fires, floods, and tornados.
Based on the above, PSA of a NPP provides a comprehensive, structured approach to

identifying failure scenarios and deriving numerical estimates of the risks to plant staff
and individuals of the public as well. It is a systematic approach to determining whether
safety systems are adequate, the plant design balanced, the defence in depth requirement
have been realized and the risk as low as reasonably achievable (ALARA).
PSAs are normally performed at the following three levels. Level 1 PSA identifies the
sequences of events that can lead to core damage, estimates CDF and provides insights
9
into the strengths and weaknesses of the safety systems and procedures provided to
prevent core damage. Level 2 PSA identifies the ways in which radioactive releases from
NPP can occur and estimates their magnitudes and frequencies. This analysis provides
additional insights into the relative importance of accident prevention and mitigation
measures such as reactor containment. Level 3 PSA estimates public health and other
societal risks such as contamination of land or food. PSA is normally performed for full
power operation (PSA) and low power level and shutdown states (SPSA).
As main benefits of PSA could be mentioned that it estimates risk level of the plant,
identifies dominant event sequences affecting safety of the plant, identifies systems,
components and human actions important for safety (“week points”), and provides
decision support in various application areas. Besides the benefits, there are also some
limitations of PSA technology: binary representation (success or failure, intermediate
states are also possible, but not treated), time treatment (chronology of events instead of
actual timing), aging effect of systems, structures and components is either ignored or
considered insufficiently, uncertainty of numerical values (due to completeness,
modeling accuracy and input data uncertainties).
The publication of the Reactor Safety Study WASH-1400 and subsequent conducted NPP
PSAs had a tremendous impact on the thinking of nuclear safety experts. Two major
insights from WASH-1400 were:
1. Prior thinking was that (no quantified) frequency of severe core damage was
extremely low and the consequences of such damage would be catastrophic. The
WASH-1400 calculated a CDF in the order of 10-4 to 10-5 per reactor-year, a
much higher number than anticipated, and showed that the consequences would
not always be catastrophic.
2. A significant failure path for radioactivity release that bypasses the containment
building was identified. Traditional safety analysis methods had failed to do so.
10
Risk Informed Decision Making
Defence in depth philosophy employs successive compensatory measures to prevent

accidents or mitigate damage if a malfunction, accident or naturally caused event happens
in a nuclear facility. It will ensure that safety will not be wholly dependent on a single
element of the design, construction, maintenance or operation of nuclear facility.
However, there are some issues in deterministic approach in RIDM processes.
Deterministic approach is very effective to achieve very high safety level. Nevertheless,
its main disadvantage is that it might be not efficient regarding the use of resources
(human, financial, others) based on the risk and its impact. The risk profile produced by
deterministic principles has very high range. This is natural, because the same criteria are
applied to both high risk systems/components and low risk systems/components.
An improvement of decision making based on deterministic approach is Risk Informed

Decision Making (RIDM) concept. Risk informed (RI) approach uses risk values
(qualitative or quantitative) to determine safety requirements and risk values are provided
by PSA. RI approach is not an alternative to deterministic approach, but it is a
complementary to deterministic approach. The use of PSA results as the sole figure of
merit cannot be recommended, as it would be risk based decision making approach. In
RIDM, fundamental deterministic safety principles, mainly defense in depth and
sufficient safety margins, have to be maintained, even if probabilistic evaluation would
indicate already high enough safety level. The main elements of RIDM framework are
1) defence in depth philosophy is fully maintained, 2) insights from PSA and 3)
knowledge from NPP operation experience/feedback are considered.
Conclusion
Present application of PSAs to operating plants has provided a modelling technique and
quantification tools that are sufficiently proven, that allows the use of PSA in decision-
making. There is an international consensus on a qualitative safety objective, which is to
reduce risk, compared to existing reactors, due to accidental releases of radioactivity,
including severe accidents. To achieve this objective, in establishing additional
11
requirements, even for Design Basis Accidents (DBA), Beyond Design Basis Accidents
(BDBA) and other multiple failure situations, the PSA results should be used as input
data for various applications. Implementation of this approach should lead to the
achievement, as stated in INSAG-3 document, of a CDF less than 10-5 per reactor
operating year to be considered for new and future reactors as a reference value. This
value, as well as in some cases an objective for large early release frequency (LERF) of
less than 10-6 per reactor operating year is in common use currently. Besides, effective
NPP safety management, consisted of accident management, risk management and
emergency management should be based on RIDM concept.
References
[1] http://www.iaea.org/cgi-bin/db.page.pl/pris.oprconst.htm
[2] Kumamoto, H., Henley, E.: Probabilistic Risk Assessment and Management for
Engineers and Scientists. IEEE, New York, 1996. ISBN 0-7803-6017-6
[3] Fullwood, R. R., Hall, R. E.: Probabilistic Risk Assessment in the Nuclear Power
Industry. Fundamentals and Applications. Pergamon Press, Oxford, UK, 1988. IBSN
0-08-036362-8 or IBSN 0-08-034879-3.
[4] McCormick, N. J.: Reliability and Risk Analysis. Methods and Nuclear Power
Applications. Academic Press, Inc., Harcourt Brace & Company, Publishers, San
Diego, CA, 1981. IBSN 0-12-482360-2.
[5] Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications.
ASME RA-S-2002. An American National Standard, The American Society of
Mechanical Engineers, New York, NY 10016-5990, USA, 2002.
[6] ASME RA-Sa-2003. Addenda to ASME RA-S-2002 Standard for Probabilistic Risk
Assessment for Nuclear Power Plant Applications. The American Society of
Mechanical Engineers, New York, NY 10016, USA, 2002.
[7] INSAG, Basic Safety Principles for Nuclear Power Plants, Safety Series No.75-
INSAG 3, IAEA, Vienna, 1998.
12
(XJHQH:LJQHU&RXUVH
678%UDWLVODYD಴ 6ORYDNLD಴ 6HSWHPEHU
36$7HFKQRORJ\DVD&RPSOHPHQWDU\7RRO
WRVXSSRUW'HFLVLRQ0DNLQJLQ1XFOHDU6DIHW\
-R]HI.XEDQ\L#MUFQO &KULVWLDQ.LUFKVWHLJHU#MUFQO
(&'*-RLQW5HVHDUFK&HQWUH3HWWHQ1/
Summary
Presentation provides a brief overview of overall framework of

Probabilistic Safety Assessment (PSA) technology used in various
applications to assess nuclear power plant (NPP) operational risk
issues. Based on essential nuclear power engineering/safety
background and philosophy behind NPP safety justification, main
terms of quantitative risk assessment are discussed: basic aspects of
Fault Tree (FT)/Event Tree (ET) construction, modelling for
grafical/logical representation of accident sequences, Initiating Events
(IE) selection, issues of consequences, data analysis and
quantification of the model. Basic aspects of Risk Informed Decision
Making concept are explained, discussed and demonstrated on three
examples from engineering practice.
2
Presentation Outline
Nuclear Power Plant (NPP)
Nuclear Safety
Nuclear Safety Assessment Concept
Probabilistic Safety Assessment (PSA)
Risk Informed Decision Making (RIDM) Concept
RIDM Example 1
RIDM Example 2
RIDM Example 3
Conclusions
Some General Conclusions to RIDM
Nuclear Power Plant (1)

Thermal power station in which the heat source is one ore more nuclear
reactors generating nuclear power electric power
Their Units range in power from 40 Mwe to 1 000MWe
New units (also under construction): typically 600 – 1 200 MWe
2005: 443 licensed nuclear power reactors in the world
441 currently operational, operating in 31 countries; ~ 17% world el. power
NPP types classified according to the type of fission reactor used:
Thermal reactors use neutron moderator to slow or moderate neutrons they
are more likely to produce another fission. Neutrons created by fission are of high
energy, “fast”, and must have their energy decreased (be made thermal, “slow”)
by the moderator in order to efficiently maintain the chain reaction
Fast reactors sustain the chain reaction without needing a neutron moderator.
Because they use different fuel than thermal reactors, the neutrons in a fast
reactor do not need to be moderated for an efficient chain reactor to occur
4
Thermal reactors
Light water reactors (LWR)
• Pressurized water reactor (PWR) H2O cooled & moderated
(Westinghouse, VVER)
• Boiling water reactor
Graphite-moderated reactors
• Gas cooled reactor (GCR), Magnox type
• Advanced gas-cooled reactor (AGCR)
• High temperature gas cooled reactor (HTGR)
• RBMK (water cooled)
• Pebble bed reactor (PBMR)
CANDU (PHWR): D2O cooled & moderated

5

PWR
Cooled and moderated by high pressure/temperature H2O. Majority of current
reactors, generally considered the safest and most reliable technology
6
BWR
Cooled and moderated by water under slightly lower pressure. The water is allowed to boil
in the reactor. The thermal efficiency can be higher and they can be simpler, potentially
more stable and safe. However, the boiling water puts more stress on many of the
components, and increases the risk that radioactive water may escape in an accident

CANDU
Cooled and moderated by D2O. Instead of using a single large containment vessel as in
PWR, the fuel of natural uranium is contained in hundreds of pressure tubes
8
Pros & Advantages
No greenhouse gas emissions during normal operation (greenhouse gases are

emitted only when the Emergency Diesel Generators are tested); (the
processes of uranium mining and of building and decommissioning power
stations produce significant greenhouse gas emissions)
Does not produce air pollutants such as carbon monoxide, sulfur dioxide,
mercury, nitrogen oxides or particulates
The quantity of waste produced is small during normal operation
Low fuel costs
Large fuel reserves
Future designs may be small and modular

Cons & Disadvantages
Risk of major accidents - e.g. Three Mile Island and Chernobyl
Consequences of an accident have in the past been projected to possibly be disastrous
(see NUREG-1150)
Nuclear waste produced is dangerous for thousands of years (unless reprocessed)
Risk of nuclear proliferation associated with some designs
High capital costs (cost to build the plant)
Roughly five-year completion periods, imposing large finance costs and delaying return
on investment
High maintenance costs
Significant security concerns
High cost of decommissioning plants
Designs of current plants are all large-scale
Nuclear power is highly controversial, enough so that the building of NPPs has ceased in
Europe (except in Finland and Ukraine, perhaps in Slovakia)
10
Nuclear Safety (1)
Nuclear safety covers the actions taken to prevent nuclear and
radiation accidents or to limit their consequences
Key concepts
Concerns
Enforcement organisations
Assessment
Key concepts
Safety culture
Redundancy
Passive safety
Active safety
Defence in depth
Containment building
Radiation (radiological) protection
11
Nuclear Safety (2)

Concerns
Radioactive contamination
Radioactive waste
Nuclear core damage
Enforcement organisations
Countries utilizing nuclear power have special institutions overseeing
and regulating nuclear safety
US NRC
Slovakia: NRA SR (UJD)
Czech Republic: SONS (SUJB)
Hungary: HAEA
Internationally, the International Atomic Energy Agency (IAEA) works for the
safe, secure and peaceful uses of nuclear science and technology
12
Nuclear Safety (3)
Assessment
International Nuclear Events Scale
Probabilistic Safety Assessment (PSA) = Probabilistic Risk Assessment (PRA)
Essential documents - cornestones - from the past:
The BNL Report: Theoretical Possibilities and Consequences of Major Accidents in
Large Nuclear Power Plants, WASH-740, 1957
Rasmussen Report: Reactor Safety Study, WASH-1400, 1975
Calculation of Reactor Accident Consequences, CRAC-II, 1982
Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants,
NUREG-1150, 1991
Safety assessment issues are in close relation to key concepts of nuclear safety
Safety culture (1)

• Safety culture is a term introduced by the IAEA International Nuclear Safety Advisory
Group (INSAG). INSAG published a report on Post Accident Review Meeting on Chernobyl
Accident in 1986
13
Nuclear Safety (4)

6DIHW\FXOWXUH
• IAEA concept of safety culture: Safety culture is that assembly of

characteristics and attitudes in organisations and individuals which establishes
that, as an overriding priority, nuclear plant safety issues receive the attention
warranted by their significance. nuclear safety first
• Safety culture is about improving safety attitudes in people but it is also about
good safety management established by organisations with a holistic, whole
of community, whole of life approach. Good safety culture implies a constant
assessment of the safety significance of events, and issues, so the
appropriate level of attention can be given. Establishing and developing
attitudes towards safety culture in community is both essential, and,
effectively, cost effective
14
Nuclear Safety (5)
Redundancy
• The duplication of critical components of a system with the intention of

increasing reliability of the system, usually in the case of a backup or fail-
safe.
• In many safety-critical systems, some parts of the system (including its

control system) may be doubled or tripled. A failure in one component
may then be addressed or out-voted by the other two.
• In a triple redundant system, the system has three subcomponents

(subsystems, “trains”), all three of which must fail before the system fails.
Since each one rarely fails, and the subcomponents are expected to fail
independently, the probability of all three failings is small.
15
Nuclear Safety (6)
Passive safety
• Is a feature of modern nuclear reactor and other NPP systems that

operator actions are not required in order to shut down safely in the event
of a loss-of-coolant accident (LOCA) or other emergency/accidental
conditions
• Some such reactors use the laws of physics to keep the nuclear reaction
under control rather than engineered safety systems
16
1XFOHDU6DIHW\
Active safety
• Engineered Safety Features
• EMERGENCY CORE COOLING SYSTEM (ECCS)

Passive subsystems: hydro accumulators
Active subsystems
High Pressure Injection (HPI) Pumps
Low Pressure Injection (LPI) Pumps
Spray System (SS)
17
Nuclear Safety (8)

Defence in depth
The concept of defence in depth has been developed from the original idea of placing multiple barriers
between radioactive materials and the environment. At present the concept includes a more general
structure of multiple physical barriers and complementary means to protect the barriers themselves, the so-
called levels of defence. It ensures that a high level of safety is reliably achieved with sufficient margins to
compensate for equipment failures and human errors.
This diagram demonstrates the defense in depth quality of NPP:
1st level (L1) of defense is the inert, ceramic quality of UO2 fuel
L2 is the air tight zirconium alloy of the fuel rod
L3 is the reactor pressure vessel made of steel ~ 20 cm thick

L4 is the pressure resistant, air tight containment
L5 is the reactor building or in newer NPPs a second outer
containment building
18
Nuclear Safety (9)
Containment building
• A steel or concrete structure enclosing a nuclear reactor. It is designed to,

in any emergency, contain the escape of radiation despite high pressures.
The containment is the final barrier to radioactive release, the first being
the fuel ceramic itself, the second being the metal fuel cladding tubes, the
third being the reactor pressure vessel and reactor coolant system.
• The containment building itself is typically an airtight structure enclosing

the reactor normally sealed off from the outside atmosphere
• For PWR, the containment also encloses the steam generators and the
pressurizer, and is the entire reactor building
19
Nuclear Safety (10)

Radiation (radiological) protection
• Radiation or radiological protection is the science of protecting people and

the environment from the harmful effects of both particle radiation and
ionizing radiation.
• It includes occupational radiation protection, which is the protection of

NPP staff; and public radiation protection, which concerns protection of
individual members of the public, and of the population as a whole
• There are main three principles to radiation protection:

Time
Distance and
Shielding
20
Nuclear Safety (11)
Nuclear Events
Accidents
• Design Basis Accidents (DBA): engineered safety feature (ESF) of NPP will cope with them

They do not produce unacceptable consequences
• Beyond Design Basis Accidents (BDBA): ESF of NPP will not cope with them

Any radioactive release bigger than that involved in DBA could only occur as the result of the
sequential failure of several levels of safety protection, or of some major and very unlikely
event (e.g. failure of RPV). They could range in size from those bigger than DBA to very
severe accidents.
Incidents
Anomalies
Deviations
(Near-misses)
21
Nuclear Safety (12)

International Nuclear Event Scale (INES)
Introduced by IAEA in order to enable prompt communication of safety
significance information in case of nuclear accidents. A number of criteria and
indicators are defined to assure coherent reporting of nuclear events by
different official authorities. There are 7 levels on the INES scale:
• Major accident - Maximum credible accident (7)

• Serious accident (6)
• Accident with off-site risk (5)
• Accident without off-site risk (4)
• Serious incident (3)
• Incident (2)
• Anomaly (1)
• Deviation, no safety relevance (0)
22
Nuclear Safety Assessment Concept
Identification of safety issues

Ranking of safety significance of the issues
Decision-making in corrective measures and their
feasibility
PSA Technology can be effective tool in decision making

processes
23
Probabilistic Safety Assessment (1)

PSA, or Probabilistic Risk Assessment (PRA) is a systematic and comprehensive
methodology to evaluate risk associated with a nuclear installation
Risk is the potential harm that may arise from some present process or from
some future event. In everyday usage, "risk" is often used synonymously with
"probability", but in professional risk assessments, risk combines the
probability of a negative event occurring with how harmful that event would be,
i.e. the consequence
Prevention of NPP specific risk requires:

• Efficient control of the chain reaction ad hence the power produced
• Fuel cooling assured under thermal hydraulic conditions designed to maintain fuel clad
integrity and
• Containment of radioactive products in the fuel, but also in the primary coolant, in
reactor coolant system (RCS), in the reactor building constituting the containment or in
other parts of the NPP unit
24
Engineering definition of risk:
Philosophy behind NPP safety justification: some bare essentials: UK example (1)
• (“The Tolerability of Risk from Nuclear Power Stations”, ISBN 0 11 886368 1, HSE, Sheffield, UK,
1992)
• “Tolerability” does not mean acceptability. It refers to a willingness to live with a risk so as to secure
certain benefits and in the confidence that it is being properly controlled. To tolerate a risk means
that we do not regard it as negligible or something we might ignore, but rather as something we
need to keep under review and reduce still further if and as we can. For a risk to be “acceptable” on
the other hands means that for purpose of life or work, we are prepared to take it pretty well as it
is”.
• Effectively, there are three components to be considered in estimating any risk:

the probability (whether there is a high risk or not);
the event to which probability attaches; and
the severity of the consequences
25
Philosophy behind NPP safety justification: some bare essentials: UK (2)
(Proportion: 106 is about the number of sugar grains in a half of kg 1 in 106

is the chance of picking out a specific grain)
To learn that over 5 000 people are killed each year by traffic does not prevent us
from using the roads, though it warns us to be cautious
A woman who wants a child will not change her mind if she learns that the average
chance of her dying as a result is of the order of 1 in 104 (probability of dying is 10-4).
There is a chance of 1 in 10 000 000 000 each year that anyone of us will be killed by
lightning (1 in 107; LDF=10-7 per lightning year). Because lightning generally kills only
one person at a time, and the risk to each of us is very low, we treat it as negligible: i.
e. apart from taking certain simple precautions the possibility of dying in this way
does not influence our behaviour.
26
Philosophy behind NPP safety justification: some bare essentials: UK example (3)
Societally regulated risk
• When risks are regulated by society, the relevant judgements cease to be in the hands of the
individuals who bear the risk. The risks will be shifted around, so that some people bear
more and others less of them; and the benefits may also be unevenly distributed. E. g., the
building of any dam imposes risk on people nearby whereas the benefits are shared by
people living further away.
• Levels of fatal risk (risk of deth, average figures, approximated, per year)
1 in 100 (Death Frequency, DF=10-2): from five hours of solo rock climbing every vweekend
1 in 103 (DF=10-3): due to work in high risk groups within relatively risky industries (mining)
1 in 104 (DF=10-4): general risk of death in a traffic accident
1 in 105 (DF=10-5): in an accident at work in very safest parts of industry
1 in 106 (DF= 10-6): general risk of death in fire or explosion from gas at home
1 in 107 (DF= 10-7): by lightning
27

Qualitative safety (risk) assessment
The severity of the consequences and their likelihood of occurrence are both expressed
qualitatively (e. g. through words like high, medium, low)
Quantitative safety (risk) assessment
Risk is characterized by two quantities:
1. Probability of occurrence of each consequence
2. Magnitude (severity) of the possible adverse consequence
PSA; consequences are expressed numerically (e. g. number of people potentially
hurt or killed) and their likelihoods of occurrences are expressed as probabilities or
frequencies (i .e. the number of occurrences or the probability of occurrence per
time unit)
The total risk is the sum of the products of the consequences x by their probabilities
PSA usually answers three basic questions:
1. What can go wrong with the studied NPP unit, or what are the initiators or initiating events
(undesirable starting events) that lead to adverse consequence(s)?
2. What and how severe are the potential damages, or the adverse consequences that the NPP unit
may be eventually subjected to as a result of the occurrence of the initiator?
3. How likely to occur are these undesirable consequences, or what are their probabilities or
frequencies?
28
1. What can go wrong with the studied NPP unit, or what are the initiators or initiating events (IE -
undesirable starting events) that lead to adverse consequences (core damage or large early release, i.
e. the rapid, unmitigated release of airborne fission products from the containment to the environment
occurring before the effective implementation of off-site emergency response and protective actions )?
The answer requires technical knowledge of the possible causes leading to damaging outcomes of a given
activity or action. In order to focus on the most important initiators while screening out the unimportant
ones, logic tools like Master Logic Diagrams (MLD) or Failure Modes and Effects Analyses (FMEA) have been
successfully used.
2. What and how severe are the potential damages, or the adverse consequences that the NPP unit may be
eventually subjected to as a result of the occurrence of the initiator?
The answers is obtained by developing and quantifying accident scenarios, which are chains of events that
link the initiator to the end-point damaging consequences as well as from deterministic analyses (e.g.,
thermal, fluid, structural or other engineering analyses). Those describe the phenomena which could occur
along the path of the accident scenario when the initiator and the other subsequent events (through the
damaging consequences) take place.
3. How likely to occur are these undesirable consequences, or what are their probabilities or frequencies?
The answer is obtained by using Boolean Logic methods for model development and by probabilistic and
statistical methods for the quantification portion of the model analysis, fault tree analysis and event tree
analysis.
29

Fault tree analysis
• Fault Tree is a deductive logic diagram that depicts how a particular undesired event
can occur as a logical combination of other undesired events
Safety System 1 Fails An undesired effect is taken as the top event of a tree of
logic. Then, each situation that could cause that effect is
OR
added to the tree as a series of logic expressions. When
fault trees are labelled with actual numbers about
Support System 11 Fails Support System 12 Fails component reliability data (parameters), computer programs
Basic
Event can calculate top event probabilities from fault trees.
AND 10 AND
Basic Basic Basic Basic OR Relcon: Risk Spectrum

Event Event Event Event
11 13 11 13 EPRI: CAFTA
Basic
Event
12
Basic
Event
Basic
Event
INPO: SAPHIRE
14 15
Any combination of component failures causing the topevent is called a cutset. A minimal cutset is
the smallest combination of component failures causing the top event.
30
Event Tree Analysis
Initiating Safety Safety Safety

Consequences
Event System 1 System 2 System 3
Available
Consequence A
Available
Consequence B
Available Fails
Consequence B
Fails
Consequence C
Consequence D
Fails
31
The model
Initiating event (IE) selection

Accident sequences for each selected IE
Consequences
Event /fault trees for graphical and logical representation of accident
sequences
Data analysis
Quantification of the model
32
Quantification of the model
IE frequency (number of events per year):

Number of Events / Total Observed Time (years)
Basic events failure parameters:

• failure rate (number of failures per time unit)
• repair rate
• probability per demand
• test intervals
• mission time
• others
33

Challenging issue of (statistical) data to be used in the analyses:
• Plant specific data. In cases when the probability of an event is well known from
past experience, statistical data can be used if the uncertainty in these data are
acceptably low (data from the plant being analyzed).
• Generic data. In other cases the relevant data, e. g. component failure frequency is
estimated by expert judgment based on engineering knowledge and experience (US
NRC, IAEA, IEEE, EPRI, INPO, others).
• Rare events data. For rare events (e.g., system failures), for which there is no past
failure experience at all or the data are very sparse, probabilistic failure models are
developed with deductive logic tools like fault trees, or inductive logic tools like
reliability block diagrams (RBD) and FMEAs.
Other very important analysis tools in PSA

• Human reliability analysis (HRA): deals with methods for modelling human error
• Common-cause failure analysis (CCF): methods for evaluating the effect of inter-
system and inter–component dependencies (dependent failures), which tend to cause
significant increases in overall system or facility risk
34

Core Damage Frequency
1,E+01
1,E+00
1,E-01
1,E-02
1,E-03
1,E-04
1,E-05
1,E-06
1,E-07
1,E-08
1,E-09
1,E-10
DS-RUPT 1,0E-06
TE 1,0E-02 7,6E-07
TM 1,7E+00 4,9E-07
A-1B 2,0E-05 4,1E-07
PCB1 1,1E-02 3,7E-07
TTA 8,0E-01 3,1E-07
EPRI: CAFTA
CCI-HZ15+16 1,8E-03 3,0E-07
Calculations
TSA 5,0E-01 2,5E-07
INPO: SAPHIRE
AE B2/014&B2/02 2,0E-04 2,4E-07
CCI-HZ18 1,8E-02 2,2E-07
Computer codes
TT 2,0E-01 1,6E-07
S1-1T 1,0E-04 1,5E-07
Sensitivity analysis
CCI-ICC 2,5E-04 1,3E-07
Relcon: Risk Spectrum

Uncertainty analysis
Importance analysis
TS 1,0E-03 1,2E-07
AE B2/02 2,0E-04 1,0E-07
S1-AF 3,0E-05 8,2E-08
A-4W 5,0E-05 8,1E-08
Simple for small ET/FT
S1-4W 5,0E-05 7,2E-08

A-4S 5,0E-05 7,2E-08
S1-4S 5,0E-05 7,2E-08
S1-2 2,0E-05 6,7E-08
Core Damage Frequency (CDF)
AE-TH 2,0E-03 6,1E-08
Example of risk topography

S1-1G 2,0E-05 5,7E-08
Minimal cut sets and probabilities
S1-1B 2,0E-05 5,3E-08

TCHCS 1,0E-01 4,9E-08
S3 2,0E-03 4,7E-08
A-4S.TRANS 2,6E-05 3,9E-08
AE SWS 1,0E-04 3,3E-08
Risk Topography
Initiating Events
A-1T 2,0E-05 3,2E-08
CCI-SWS 2,0E-05 2,2E-08
S2-2 5,0E-04 1,6E-08
GDH-BLOCK 1,0E-04 1,6E-08
MSRVM 1,0E-04 1,4E-08
TD 5,0E-04 1,0E-08
• Boolean algebra logical operations (see Appx 1)
TDL 5,0E-02 9,8E-09

S2-4W 3,0E-04 9,7E-09
AE-D212 1,0E-04 8,0E-09
TF 5,0E-02 7,7E-09
S2-3 2,0E-04 6,8E-09
CCI-HZ13+15 1,8E-03 6,4E-09
Probabilities of top events, sequences and consequences
CCI-HZ19 1,8E-02 5,2E-09

CCI-HZ11+12 1,8E-03 4,6E-09
CCI-HZ13+16 1,8E-03 4,1E-09
AE-D213 1,0E-04 3,8E-09
For large and complex systems: special approximate algorithms used
AE A2/074 3,0E-04 2,5E-09

CCI-HZ11+15 1,8E-03 2,3E-09
S2-ECCS 3,0E-05 9,7E-10
S2-1B 1,0E-05 3,2E-10
S2-1T 1,0E-05 3,2E-10

S2-4S 3,0E-04 2,8E-10

AE B2/014 2,0E-04 2,6E-10
(13)
(12)
CDF
IE freq.
36
35
Mathematical interpretation of risk topography

Total Core Damage Frequency
n
CDF = ∑F
i =1
i
IE
× Pi SS
where
F is initiating event frequency
P is probability of safety system failure
37

PSA can be performed for
• Internal IE hardware or system failures or operator errors in situations arising
from the normal mode of operation of NPP, e. g.:
LOCA (large, medium, small, …)
Loss of Offsite Power (LOOP)
Steam Line Break (SLB)
Steam Generator Tube Rupture (SGTR)
Support system initiators
Other transients
…
• External IE outside the domain of normal operation of NPP: earthquakes,
lightnings, fires, floods, and tornados
• Based on the above, PSA of a NPP provides

a comprehensive, structured approach to identifying failure scenarios and deriving
numerical estimates of the risks to plant staff and members of the public as well
a systematic approach to determining whether safety systems are adequate, the plant
design balanced, the defence in depth requirement have been realized and the risk as
low as reasonably achievable
38
PSAs are normally performed at the following three levels:
Level 1 PSA, which identifies the sequences of events that can lead to core damage,
estimates core damage frequency (CDF ) and provides insights into the strengths
and weaknesses of the safety systems and procedures provided to prevent core
damage
Level 2 PSA, which identifies the ways in which radioactive releases from NPP can
occur and estimates their magnitudes and frequencies. This analysis provides
additional insights into the relative importance of accident prevention and mitigation
measures such as reactor containment.
Level 3 PSA, which estimates public health and other societal risks such as
contamination of land or food
PSA is normally performed also for

Full power operation (PSA)
Low power level and shutdown states (SPSA)
39

Main Benefits of PSA
Estimates risk level of the plant
Identifies dominant event sequences affecting safety of the plant
Identifies systems, components and human actions important for safety
Provides decision support in various application areas
Main Limitations of PSA

Binary representation (success or failure, intermediate states are also
possible, but not treated)
Time treatment (chronology of events instead of actual timing)
Aging effect is ignored or considered insufficiently
Uncertainty of numerical values (due to completeness, modeling accuracy
and input data uncertainties)
40
Reactor Safety Study WASH-1400 and subsequent conducted NPP

PSAs had a tremendous impact on thinking of nuclear safety experts.
Two major insights from WASH-1400 were
Prior thinking was that (no quantified) frequency of severe core damage
was extremely low and the consequences of such damage would be
catastrophic. WASH-1400 calculated a CDF in the order of 10-4 to 10-5
per reactor year, a much higher number than anticipated, and showed
that the consequences would not always be catastrophic
A significant failure path for radioactivity release that bypasses the

containment was identified Traditional safety analysis methods had
failed to do so
41
Risk Informed Decision Making Concept (1)
Traditional deterministic approach (1)

Principles of deterministic decision making
• The doctrine of determinism assumes that any failure has a cause and can be
explained. There are no random failures! It is a matter of knowledge to identify
and explain the cause of any event or effect
• Another fundamental concept of deterministic doctrine is that everything could be
understood by analysis
• Potential danger of nuclear reactors lead to the need of safety analysis
Defense in depth quality of NPPs, 5 levels (slide 18)

Broader concept of defence in depth principle: IAEA, SS No.75 – INSAG-3
• Conservative design, QA, safety culture
• Control of abnormal operation and detection of failures
• Safety and protection systems
• Accident management and confinement protection
• Off-site emergency response
42
Defence in depth principle
Defence in depth employs successive compensatory measures to prevent
accidents or mitigate damage if a malfunction, accident or naturally caused
event happens in a nuclear facility
It will ensure that safety will not be wholly dependent on a single element of
the design, construction, maintenance or operation of nuclear facility
Some issues in deterministic approach
Deterministic approach is very effective to achieve very high safety level.
However, its main disadvantage is that it might be not efficient regarding the
use of resources (human, financial, others) based on the risk and its impact
The risk profile produced by deterministic principles has very high range. This
is natural, because the same criteria are applied to both high risk
systems/components and low risk systems/components
• Not proportional to importance of a problem
43

An Improvement of decision making based on deterministic approach is Risk
Informed Decision Making (RIDM)
Some essentials of RIDM
Risk-informed approach uses risk values (qualitative or quantitative) to determine
safety requirements
Risk values are provided by probabilistic safety assessment (PSA) study
RI approach is not an alternative to deterministic approach, but it is a
complementary to deterministic approach
The use of PSA results as the sole figure of merit cannot be recommended, as it would
be risk-based decision making process
In RIDM, fundamental deterministic safety principles, mainly defense-in-depth and
sufficient safety margins, have to be maintained, even if probabilistic evaluation would
indicate already high enough safety level
The main elements of RIDM framework
• Defence in depth philosophy is fully maintained
• Insights from PSA
• Knowledge from NPP operation experience/feedback
44
CDF criterion in PSA application
Main criterion for risk-informed optimization applications is CDF
In general, any modifications cannot cause increasing of the CDF
US NRC allows, however, insignificant increase in CDF
Modification assessment based on CDF
Not acceptable
10
∆CDF
10
Acceptable
10 10
CDF
45
RIDM Example 1 (1)
Probabilistic safety criteria: safety goals, targets
CDF<10 exp -4 per reactor year for existing NPPs

CDF <10 exp -5 per reactor year for new or future NPPs
Reactor protection failure probability <10 exp -5
Safety system failure probability <10 exp -3
Large early release frequency (LERF)<10 exp -6 per reactor year
Screening criterion for external events <10 exp -7 per reactor year
46
RIDM Example 1 (2)
PSA in Bohunice 1 and 2 Gradual Reconstruction Process (1)
1 .7 0 E -3
1 .8 0 E -0 3 C D F d e cre a se d b y a fa cto r o f
1 .6 0 E -0 3 1 .9 66
1 .4 0 E -0 3
1 .2 0 E -0 3 8 .8 9 E -4
1 .0 0 E -0 3
8 .0 0 E -0 4
6 .0 0 E -0 4
4 .0 0 E -0 4
2 .0 0 E -0 4 2 .5 6 E -5
P re s m a ll re co n s tru ctio n P o stsm a ll re c o n stru ctio n P o s t g ra d u a l re c o n stru ctio n

(1 9 9 1 ) (1 9 9 3 ) (2 0 0 0 )
47
RIDM Example 1 (3)

PSA contributed to solving some challenging problems:

Incorporation of generator switches into the main power supply
diagram (1)
• 15. 75 kV generator switches (GS) should have been incorporated into the
main power supply diagram within basic engineering reconstruction stage
• Some other ways of increasing reliability of preferable supplying power to
emergency distribution sections were proposed (1):
doubled interconnecting circuit breakers between preferable and emergency
power distribution sections
reconstruction a nearby hydro power plant supposed as another electric
power source
48
RIDM Example 1 (4)
Incorporation of generator switches into the main power supply

diagram (2)
• Some other ways of increasing reliability of preferable supplying power to
emergency distribution sections were proposed (2):
• consistent dividing emergency and vital power supply distribution sections
into two independent separate redundant trains
• modifications in alternative (reserved) power supply of 220/110/6 kV and
several other measures
Two comparative PSA studies were developed: A & B

• A: all the above measures, but without GS CDF= 2, 85 exp -4 /reactor year
• B: all the above measures with GS CDF= 2, 57 exp -4/ reactor year
• Introducing symptom orientated EOP: even lower value of CDF
49
RIDM Example 2
Extension of AOT of motorgenerator (MG)
On the basis of PSA model after the Gradual Reconstruction, a national

engineering company and the utility proposed an extension of AOT of MG
from the original value of 8 hours ( basic risk r0 increase by a 0. 001 %) to
a value of 120 hours ( r0 increase by 0, 14 %)
Regulatory body (RB) was considering permitting AOT extension to a value of

24 hours ( r0 increase by 0, 028 %, i. e. 5x lower value)
Final standpoint of the RB and decision made: when decision-making,

current practice at performing maintenance work within the plant taken into
account: permission to extend AOT to 36 hours issued; r0 increase by a
value between 0, 028% and 0, 084%, which is the value approximately 2 up
to 5 x lower than value of risk increase when AOT=120 hours
50
RIDM Example 3 (1)
PSA in Bohunice 3 and 4: AOT of Components & Systems (1)
Technical specifications
LCO, particularly AOT of safety related

systems/components
Bohunice 3 and 4: AOT are based on deterministic methods or
engineering judgements, i.e. the basis does not incorporate PSA and
risk-based insights
Efforts undertaken by the utility and the RB to explore possibilities

and means of improving the content and format of the existing AOT
51
RIDM Example 3 (2)

RB reviews and approves any modifications to plant’s LCO
The utility was assigned the task of submitting justification for all the
outage times of components and systems permitted by the LCO
including times determined for transition of NPP unit, when the
limiting condition is not fulfilled, to an operational regime of higher
number
The required warrant had to be based and performed by using PSA

technology
52
RIDM Example 3 (3)
The proposed AOT changes are expected to meet the
following essential principles:
Meet the current regulations

Consistent with defense-in-depth philosophy
Maintain sufficient safety margins
When they result in increase in CDF, the increase should
be small and consistent with the intent of the safety goal
policy
53
RIDM Example 3 (4)

Full power/Shutdown PSA are developed for all NPPs in

Slovakia
Comparison of results from full power PSA and SPSA:

potential TecSpecs conflict between requirements for operating ability
of a safety system and AOT extension of it or its component
All Slovak NPPs and their LCO including AOT have been
designed on deterministic basis
? to shutdown the unit OR to accept a risk
increase for a limited period of time ?
54
RIDM Example 3 (5)
Allowable Outage Times
• When a component failure covered by LCO occurs, it can be under

repair either during power operation or after shutdown
• To make a decision on the optimal strategy, the risk for these two
cases should be compared taking into account both the outage risk
and the shutdown risk
• Several methods to calculate and limit the risk available
55
RIDM Example 3 (6)

AOT can be calculated e. g. by the following formula:
AOT ≤ CDP (i)sd / CDF (i) – CDF (0) , where
CDP (i)
sd is CD probability for manual shutdown including the cooling down and
follow-up startup of the reactor when component i is unavailable
CDF (0) is CDF under normal power operation, when none of the components
concerned is unavailable, i. e. baseline risk
CDF (i) is CDF under continued operation, when component i is unavailable
Obtained more conservative results than when using “acceptable risk in continued
operation” as multiple CDF (0) reference value of risk (baseline risk)
56
RIDM Example 3 (7)
Some examples of proposed AOT changes
Hydroaccumulators, HP & LP of ECCS, spray system, EFWS,

essential service water system, electric power output system,
station service load power supply system, emergency / vital electric
power systems, ESFAS, and some other systems
Two principles applied:
• The calculated value of AOT modified in a value usually used in LCO (8

hours, 24 hours, 3 days, 14 days, 21 days ...): the closest but shorter than
calculated value proposed
• If a calculated value of AOT is longer than 7 000 hours, proposed to allow
the component unavailability unlimited
57
RIDM Examle 3 (8)

Hydroaccumulators (ACCUM), 4 within reactor unit:
Current AOT for Regime 1, 2, 3:
• All 4 ACCUM shall be operable
• One ACCUM allowed inoperable for 72 hours max.
• One another ACCUM allowed inoperable for 1 hour max.
If the LCO is not fulfilled, the unit shall be in 24 hours transferred to
regime 4
Calculated and modified AOT changes:

• All 4 ACCUM shall be operable
• One ACCUM allowed inoperable for unlimited period of time
• One another ACCUM allowed inoperable for 24 hours max.
Final proposal into LCO:

AOT =24 hours for any two of the four ACCUM
58
RIDM Example 3 (9)
HP & LP of ECCS:
Current AOT for Regime 1, 2, 3:

• All 3 HP (3x2 pumps) and 3 LP(3x1 pump) trains (3) shall be operable
• One HP and one LP system of the same train allowed inoperable for 72 h max.
• Before scheduled outage of a HP or a LP system, other 2 trains shall be tested
• After tripping a HP or a LP system, other 2 trains shall be tested in 4 hours
If the LCO is not fulfilled, the unit shall be in 24 hours transferred to regime 4

• All 3 HP & LP trains incl. tanks, pumps, routs, valves and DG shall be operable
• One HP and one LP of the same train allowed inoperable due to repair/test
for 21 days max.
• Before scheduled outage of a HP or a LP system, other 2 trains shall be tested
• After tripping a HP or a LP system, other 2 trains shall be tested in 4 hours
59
RIDM Example 3 (10)

Emergency & Vital Electric Power Supply Systems:
Current AOT for Regime 1, 2, 3, 4:

• All 3 trains of EPSS / VPSS shall be operable
• One EPSS / VPSS of the same train allowed inoperable for 72 hours max.
• Before scheduled outage of a DG, other 2 DG shall be tested on 3 minute run
• After tripping a DG, other 2 DG shall be tested in 4 hours on 3 minute run
If the LCO is not fulfilled, the unit shall be in 48 hours transferred to regime 5
• All 3 trains of EPSS / VPSS shall be operable

• One EPSS / VPSS of the same train allowed inoperable for 72 hours max.
except one (of 3) 6kV EPSS section, which allowed inoperable for 8 h max.
• Before scheduled outage of a DG, other 2 DG shall be tested on 3 minute run
• After tripping a DG, other 2 DG shall be tested in 4 hours on 3 minute run
60
RIDM Example 3 (11)
PSA based Bohunice Risk Monitor Project (1)
Equipment Out Of Service (EOOS) Monitor™
Software developed under EPRI’s R&R Workstation Program, applied by SAIC in co-
operation with national engineering companies in many countries
Dynamic tool performing real-time calculations of plant risk

• to evaluate on-line maintenance schedules to minimize high risk configurations
• to monitor component outages, changes in AOT, repair and maintenance
strategies including surveillance test intervals
The basis: model and outcome of PSA L1 conducted when updating the SAR after 10
years of operation within periodic safety evaluation process
The model and results of SPSA incorporated into the EOOS MonitorTM under
sponsoring by EC within a PHARE project
61
RIDM Example 3 (12)

EOOSTM monitor screen of plant risk shows:
plant current information

safety impact of changes in work activities or plant configuration
It helps operators to make decisions by means of:
Plant Safety Index (changes in equipment status)

Maximum time allowed in the relevant configuration
List of current activities affecting plant equipment
Ranked lists of in-/out-of service equipment
Quick recalculating these safety measures for a variety of “what - if” kind of tests
62
RIDM Example 3 (13)
Risk Meter colour regions versus operator actions:
Region Condition Operator Action

Green Low risk • Proceed normally
Yellow Small risk increase • Include safety assessment
insights in pre-shift meetings
Orange Intermediate risk • Invoke contingency actions
increase • Hasten the restoration of risk
important equipment
• Notify plant management
Red High risk increase • Notify plant management
• Suspend all new work orders
• Invoke contingency actions
• Hasten the restoration of risk
important equipment
63
RIDM Example 3 (14)

64
Conclusions
Transition to risk-informed regulation is taking place gradually
Dependable PSA study with its realistic arguments is a helpful tool for the utility
to deal with nuclear safety issues, and, on the other hand, may significantly
contribute to setting requirements for regulatory applications as well
The use of risk and reliability-based techniques enables quantitatively evaluate

the risk impact and justify changes based on objective risk arguments
Application of PSA technology to operating NPPs has provided modelling

techniques and quantification tools that are sufficiently proven and allow use of
PSA for plant-specific decision making for existing NPPs as well as in design and
licensing for future plants
65
Some General Conclusions to RIDM

(formulated by Peter Kafka)
Risk-informed approach and RIDM simulate the real world with all the
determined, random and uncertain elements and parameters based on our state
of knowledge
They are based on the understanding of the system and component behaviour
implemented in deterministic codes and calculations
They integrate all the safety issues, and therefore allow rankings and
optimizations
They integrate design, manufacturing and operational aspects of safety
balancing over the life cycle of a system
They are supported explicitly (quantitatively) by our historical experience
They are quantitative, and therefore appropriate for sensitivity, importance and
optimization studies
They can be flexibly supported by codes of good engineering practices (e.g.
deterministic codes) to fulfill high safety standard design
66
APPX 1: Fundamentals of Boolean Algebra in PSA (1)
Boolean Algebra is a simple tool, methodology to find the minimal

combinations of failures that cause system failure: minimal cutsets
This is the first step in the assessment of the system failure
67

OPERATIONS AND LAWS (1)
UNION:
VX VY
VX VY SYSTEM
FINAL STATE
S S 1= SUCCESS
S F 2= FAILURE
F S 3= FAILURE
F F 4= FAILURE
68
UNION:
E = { system states } = { 1,2,3,4 }
E
A B A = { system states that contain
3 4 2 failure of VX } = { 3,4 }
B = { system states that contain

1 failure of VY } = { 2,4 }
AUB
A U B = { system states that contain all
the failures of VX OR the failures of
VY } =
= { 2,3,4 } 69

UNION: A U B is normally written as A

SYSTEM + B and in fault tree notation it
FAILURE is represented by an OR gate
P (TOP) = P(A) + P(B) - P(AB)

Using the rare event approximation:
FAILURE OF FAILURE OF
P(AB) <<< 1
VX VY
A B
P(TOP) = P(A) + P(B)
70
INTERSECTION:
VX VZ S YST EM
F IN A L S TA TE
VX S S 1 = SU C C ESS
S F 2 = SU C C ESS
F S 3 = SU C C ESS
F F 4 = FA ILU R E
VZ
71

INTERSECTION:
E = { system states } =
{ 1,2,3,4 }
E
A C A = { system states that contain
failure of VX } =
3 4 2 { 3,4 }
C = { system states that contain

1 failure of VZ } =
{ 2,4 }
A C A C = { system states that

contain failure of VX AND failure of
VZ } = {4}
72
INTERSECTION:
SYSTEM A C is normally written

FAILURE as A × C and in fault tree
notation it is represented
by an AND gate
P (TOP) = P(A) x P(C)

VX VZ (Assuming that A and C are
independent)
A C
73

COMBINATIONS OF UNIONS AND INTERSECTIONS (1)
VX VY VZ SYSTEM
FINAL STATE
S S S 1 = SUCCESS
S S F 2 = SUCCESS
VX VY S F S 3 = SUCCESS
F S S 4 = SUCCESS
S F F 5 = FAILURE
F S F 6 = FAILURE
F F S 7 = SUCCESS
VZ F F F 8 = FAILURE
74
COMBINATIONS OF UNIONS AND INTERSECTIONS (2)
E = { system states } =
{ 1,2,3,4,5,6,7,8 }
E
A B A = { system states that contain
4 7 3 failure of VX } = { 4,6,7,8 }
B = { system states that contain
8
6 5 failure of VY } = { 3,5,7,8 }
C = { system states that contain
1 failure of VZ } = { 2,5,6,8 }
2
C (A U B) C = { system failure
states } = { system states that
contain failure of VX OR VY, AND
failure of VZ } = ({ 4,6,7,8 }
(A U B) C U { 3,5,7,8 }) { 2,5,6,8 } =
{ 3,4,5,6,7,8 } { 2,5,6,8 } =
{ 5,6,8 } 75

DISTRIBUTIVE LAW
(A U B) C = (A C) U (B C)
SYSTEM SYSTEM
FAILURE FAILURE
FAILURE OF FAILURE OF VX AND VZ VY AND VZ
VX OR VY VZ
C
FAILURE OF FAILURE OF FAILURE OF FAILURE OF FAILURE OF

FAILURE OF VX VY
VX VY VZ VZ
A A C B C
B
76
OPERATIONS AND LAW S (10)
ABSORPTION LAW
A U (A B) = A
A B A B=C
C
A B
C CUA=A
77

LAWS OF THE BOOLEAN ALGEBRA
Commutative A+B = B+A AxB=BxA

Associative A + B + C = (A + B) + C = A + (B + C)
A x B x C = (A x B) x C = A x (B x C)
Distributive A x (B + C) = (A x B) + (A x C)
Idempotent A+A=A AxA=A
Null Set A+0=A Ax0=0
Universal Set A+1=1 Ax1=A
Absorption A + (A x B) = A
78
European Commission
EUR 22302 EN – DG JRC – Institute for Energy – PSA TECHNOLOGY AS A COMPLEMENTARY TOOL TO
SUPPORT DECISION MAKING IN NUCLEAR SAFETY
Luxembourg: Office for Official Publications of the European Communities

2006 – 54 pp. – 21 x 29.7 cm
Scientific and Technical Research Series
Authors:
J. Kubanyi , C. Kirchsteiger
Abstract
The report provides a brief overview of overall framework of Probabilistic Safety Assessment (PSA) technology
used in various applications to assess nuclear power plant (NPP) operational risk issues. Based on essential
nuclear power engineering/safety background and philosophy behind NPP safety justification, main terms of
quantitative risk assessment are discussed: basic aspects of Fault Tree (FT)/Event Tree (ET) construction,
modelling for graphical/logical representation of accident sequences, Initiating Events (IE) selection, issues of
consequences, data analysis and quantification of the model. Basic aspects of Risk Informed Decision Making
(RIDM) concept are explained and discussed.
The mission of the Joint Research Centre is to provide customer-driven scientific and technical support for the
conception, development, implementation and monitoring of EU policies. As a service of the European Commission,
the JRC functions as a reference centre of science and technology for the Union. Close to the policy-making
process, it serves the common interest of the Member States, while being independent of special interests,
whether private or national.

EUR22302EN

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

EUR22302EN

Uploaded by

Copyright:

Available Formats

PSA TECHNOLOGY AS A COMPLEMENTARY

TOOL TO SUPPORT DECISION MAKING

International Eugene Wigner Training Course

Jozef KUBANYI, Christian KIRCHSTEIGER

Institute for Energy, Petten (the Netherlands)

© European Communities, 2006

Cover: JRC IE, PR & Communication

International Eugene Wigner Training Course

Jozef KUBANYI, Christian KIRCHSTEIGER

European Commission, DG JRC

Jozef Kubanyi, Christian Kirchsteiger

Containment building is a steel or concrete structure enclosing a nuclear reactor. It is

Probabilistic Safety Assessment

PSA, or Probabilistic Risk Assessment (PRA) is a systematic and comprehensive

Engineering definition of risk is as follows:

PSA usually answers three basic questions:

Safety System 1 Fails

Support System 11 Fails Support System 12 Fails

Basic Basic Basic Basic OR

Initiating Safety Safety Safety

Based on the above, PSA of a NPP provides a comprehensive, structured approach to

Defence in depth philosophy employs successive compensatory measures to prevent

An improvement of decision making based on deterministic approach is Risk Informed

Presentation provides a brief overview of overall framework of

Nuclear Power Plant (1)

CANDU (PHWR): D2O cooled & moderated

Nuclear Power Plant (3)

Nuclear Power Plant (5)

No greenhouse gas emissions during normal operation (greenhouse gases are

Nuclear Power Plant (7)

Nuclear Safety (2)

Safety culture (1)

Nuclear Safety (4)

• IAEA concept of safety culture: Safety culture is that assembly of

• The duplication of critical components of a system with the intention of

• In many safety-critical systems, some parts of the system (including its

• In a triple redundant system, the system has three subcomponents

Nuclear Safety (6)

• Is a feature of modern nuclear reactor and other NPP systems that

• EMERGENCY CORE COOLING SYSTEM (ECCS)

Nuclear Safety (8)

This diagram demonstrates the defense in depth quality of NPP:

L3 is the reactor pressure vessel made of steel ~ 20 cm thick

• A steel or concrete structure enclosing a nuclear reactor. It is designed to,

• The containment building itself is typically an airtight structure enclosing

Nuclear Safety (10)

• Radiation or radiological protection is the science of protecting people and

• It includes occupational radiation protection, which is the protection of

• There are main three principles to radiation protection:

Nuclear Safety (12)

• Major accident - Maximum credible accident (7)

Identification of safety issues

PSA Technology can be effective tool in decision making

Probabilistic Safety Assessment (1)

Prevention of NPP specific risk requires:

• Effectively, there are three components to be considered in estimating any risk:

Probabilistic Safety Assessment (3)

Philosophy behind NPP safety justification: some bare essentials: UK (2)

(Proportion: 106 is about the number of sugar grains in a half of kg 1 in 106

Societally regulated risk

Probabilistic Safety Assessment (5)

Probabilistic Safety Assessment (7)

Basic Basic Basic Basic OR Relcon: Risk Spectrum