- Email: [email protected]
Achieving reasonable conservatism in nuclear safety analyses
Reliability Engineering and System Safety 137 (2015) 112–119
Contents lists available at ScienceDirect
Reliability Engineering and System Safety journal homepage: www.elsevier.com/locate/ress
Achieving reasonable conservatism in nuclear safety analyses Kamiar Jamali Office of Nuclear Safety, Associate Administrator for Safety and Health, National Nuclear Security Administration, United States Department of Energy, 19901 Germantown Road, Germantown, MD 20874, USA
art ic l e i nf o
a b s t r a c t
Article history: Received 13 August 2014 Received in revised form 22 December 2014 Accepted 14 January 2015 Available online 23 January 2015
In the absence of methods that explicitly account for uncertainties, seeking reasonable conservatism in nuclear safety analyses can quickly lead to extreme conservatism. The rate of divergence to extreme conservatism is often beyond the expert analysts’ intuitive feeling, but can be demonstrated mathematically. Too much conservatism in addressing the safety of nuclear facilities is not beneficial to society. Using certain properties of lognormal distributions for representation of input parameter uncertainties, example calculations for the risk and consequence of a fictitious facility accident scenario are presented. Results show that there are large differences between the calculated 95th percentiles and the extreme bounding values derived from using all input variables at their upper-bound estimates. Showing the relationship of the mean values to the key parameters of the output distributions, the paper concludes that the mean is the ideal candidate for representation of the value of an uncertain parameter. The mean value is proposed as the metric that is consistent with the concept of reasonable conservatism in nuclear safety analysis, because its value increases towards higher percentiles of the underlying positively skewed distribution with increasing levels of uncertainty. Insensitivity of the results to the actual underlying distributions is briefly demonstrated. Published by Elsevier Ltd.
Keywords: Nuclear Safety analysis Probabilistic risk assessment (PRA) Uncertainty analysis Reasonable Conservatism
1. Introduction Safety analyses are performed to ensure that a nuclear facility’s design and operational controls provide assurance that the public, workers, and the environment are protected from all nuclear hazards. Since there are many sources of uncertainties within the analyses, the assurance of “adequate protection” is provided through conservatisms applied throughout all related analyses, supporting disciplines (e.g., Quality Assurance), and the resulting design provisions (e.g., incorporation of defense-in-depth and appropriate safety margins) and operational controls. This highly desirable conservative philosophy in nuclear safety can predispose nuclear safety professionals to seek everincreasing levels of conservatism in all areas of nuclear safety assurance. The downside of this approach is that in the absence of methodologies that explicitly account for uncertainties, including what, a priori, may appear to be reasonable conservatism can in fact lead to extreme conservatism. The divergence to extreme conservatism occurs far more rapidly than is generally recognized as shown through examples in this paper. This phenomenon is often beyond the expert analysts’ intuitive feeling, but it can be demonstrated mathematically. When complex analyses are used to derive the distributions of output variables for representation of uncertainties in analysis
E-mail address: [email protected] http://dx.doi.org/10.1016/j.ress.2015.01.008 0951-8320/Published by Elsevier Ltd.
results, the 95th percentile is generally associated with the upperbound [1–3]. While it is well known that the use of multiple conservative assumptions can lead to extremely conservative results, the rate and the degree of this divergence have not been widely demonstrated in the past. This paper shows that when several input parameters are taken at their bounding values, the obtained result dwarfs the derived 95th percentile of the output by orders of magnitude. Extreme conservatism is often intentionally exercised in safety analyses because it can pay dividends in simplified analysis and review efforts. However, the search for increased conservatism cannot be pursued without consequences. Extreme conservatism can lead to safety conclusions and decisions with significantly higher safety costs, which can make nuclear facilities, even those with very low hazard and risk profiles, prohibitively expensive. This can deprive the public from the benefits derived from the operations of these facilities, from nuclear power to medical isotopes and national security needs. It can also lead to overall higher risks to the public in mission delays (e.g., waste processing), cancellation of programs resulting in continued reliance on older facilities, or unnecessary expenditure of funds and resources that might have been used in more effective projects for risk reduction. In order to strike a balance between competing objectives of safety versus cost (including mission impacts) and to ensure a judicious use of resources, a reasonable degree of conservatism must be sought in nuclear safety analyses. However, recognizing
K. Jamali / Reliability Engineering and System Safety 137 (2015) 112–119
the threshold for a reasonable level of conservatism in a given application is difficult in the absence of a detailed treatment of uncertainties, including what is referred to as the “full propagation” of input parameter uncertainties. This paper explores the impact of input parameter uncertainties on selected outputs from a nuclear safety analysis. Input parameter uncertainty is a specific but important type of uncertainty among several [4]. It has a significant impact in many areas of nuclear safety analyses and calculations including Documented Safety Analyses (DSAs) [5], Safety Analysis Reports, Integrated Safety Analyses, and Probabilistic Risk Assessments (PRAs). The concept of reasonable conservatism in this paper is synonymous with the Nuclear Regulatory Commission (NRC) Chairman Diaz’s speech on “Realistic Conservatism” given at the 2003 Nuclear Safety Research Conference [6]. In that speech, the Chairman stated that: Neither under-regulation nor over-regulation serves anyone’s interests. Under-regulation puts the public safety at risk; overregulation diminishes the value to society of the regulated activity. Over-regulation could also be counter-productive to safety by diverting resources from the important safety issues. … public policy should not be based on worst case scenarios and that we have to deal with probabilities and not with all possibilities. So called ‘worst case scenarios’ are only good as vehicles to achieve the proper bounding of realistic scenarios early in the process. Nuclear policies and regulations are necessarily conservative, but should not be driven by nonphysical or unrealistic assumptions. Worst case assumptions are often considered as a first step and are used because they are simple. But, the unfortunate consequences of using worst case assumptions is that they often continue to propagate and eventually become part of the established framework. And, frankly, no one wants to appear as ‘non-conservative,’ or ‘less conservative;’ it is always easier to add to conservatism than to bring realism. But realism is what could be in the best interest of the public well-being. Rather than using worst case scenarios, we should be using realistic conservatism – based on the right science, engineering and technology – so that the end product is recognizable and useable. I believe we should avoid the ‘worst case’ syndrome… and seek out ‘realistic conservatism.’ … Sprinkling unrealistic conservatisms, even if they are small but compounding conservatisms, throughout an analysis or study can skew the results significantly. They do add up, or even multiply. How can a safety-conscious decision maker, in the broadest sense of the term, use a study that is filled with unrealistic assumptions? Who pays for unnecessary conservatism? Society does. Some may argue that in the aftermath of the Fukushima events, no degree of conservatism in nuclear safety is too much conservatism. In this context, it should suffice to note that those location-dependent plant designs for protection against natural phenomena hazards did not meet the long-held deterministic design requirements as a minimum expected set of standards [7,8]. In other words, Fukushima reactors simply did not meet current, well-established location-specific NPH requirements for safety system designs (safety system performance goals in the range of 1E 4 to 1E 5/yr) applicable in the United States and other countries. The NRC has long recognized the problem of over-conservatism in safety analyses and sought to establish methods for addressing it. Code Scaling, Applicability, and Uncertainty (CSAU) is one such methodology [9,10]. In the CSAU approach, the licensees can
113
provide the best-estimate analysis results along with an estimation of uncertainty of the calculations. This paper concludes that, in the absence of full propagation of parameter uncertainties, using mean values for nearly all input parameters (the use of bounding values may be unavoidable in a few cases) in many safety analysis disciplines is the best approach for addressing the effects of parameter uncertainties. The typical levels of conservatism when using mean values is also consistent with the concept of “reasonable conservatism” as promoted in the Department of Energy (DOE) standard DOE-NA-STD-3016-2006 [11] and elsewhere.
2. Background Nuclear safety practitioners use different terms for the value of an input or an output variable as the desired choice among different options for parameter estimations. These include best-estimate, point-estimate, mean value, median value, upper/lower-bound, or specific percentiles of a distribution (e.g., 95th percentile) as the parameter of choice. Best-estimates and point-estimates are sometimes used interchangeably, while in certain applications the former is associated with the median- and the latter with the mean-values of the underlying distributions. Point-estimate is often a substitute for any one of the single numerical estimates that could have been chosen in the specific analysis, such as the only known value, the mean, median, the upper-bound, etc. A key characteristic of nuclear safety analyses is that uncertainties in individual input parameters are generally large and represented by factors rather than percentages. For example, a typical input (such as the initiating event frequency) may have a factor of three, 10, or higher as the ratio between the mid-range/ best-/point-/realistic-estimate and the upper- and/or lower-bound estimates. This ratio is often referred to as the uncertainty (or error) factor (UF) in PRA applications.
3. Some basics 3.1. Representation of parameter uncertainty Any uncertain quantity, such as the probability of the occurrence of a failure, an airborne release fraction, or the height of people in a population, can be represented by a random variable. Random variables can be discrete or continuous. A random variable takes on a specific value (for a discrete distribution) or a range of values (for a continuous distribution) with an associated probability that is derived from the underlying distribution defining its variability. 3.2. Central limit theorem and lognormal distribution The central limit theorem states that, given certain conditions, the distribution of the sum (or average) of a large number of independent, identically distributed variables will tend to the normal distribution, regardless of the underlying distribution. Therefore, if Y is the product of n random variables X1,…,Xn with an arbitrary distribution, then the logarithm of Y is: log Y ¼
n X
log X i
ð1Þ
i¼1
And the distribution of “log Y” will tend toward a normal distribution with an increasing value of n. In addition, given that “log Y” is normally distributed, the distribution of Y will be lognormal by definition [12,13]. Since division and exponentiation are special forms of multiplication,
114
K. Jamali / Reliability Engineering and System Safety 137 (2015) 112–119
and many complex relationships can be approximated through series expansions, for many mathematical models used in safety analysis regimes, the distribution of the output variable would usually be well-represented by a lognormal distribution. Examples include the frequency of an accident scenario or the magnitude of a source term, each of which are mathematically represented by the product of several variables. Lognormal distributions possess three unique properties: (1) The median value of the product of lognormally distributed independent random variables is equal to the product of the medians, (2) The distribution of the product of lognormally distributed independent random variables is also lognormal, and (3) Geometric symmetry, in the sense that it assigns equal likelihood (i.e., in terms of symmetric percentiles such as 5th and 95th) that the actual value of a random variable is above or below the best-estimate/median by the same factor. In other words, the 20th and 80th percentiles have the same ratio below and above the 50th percentile. The last property is extremely important in modeling of rare events where there is a lack of evidence of bias for the actual parameter value being above or below the best-estimate (median value). In other words, if it is believed that it is equally likely for the actual parameter value to be higher or lower than the median by the same factor, lognormal is the only proper representation of the uncertainty. The UF for the lognormal distribution is generally defined [1–3] as the ratio of the 95th percentile (equated with the upper-bound) to the median—the 50th percentile. As mentioned above, the UF is therefore also equal to the ratio of the median to the 5th percentile (generally equated with the lower-bound). Lognormal is a positively skewed distribution with a high tail (i.e., often all key parameters fall on the tail portion of the probability density function after the mode, as shown in Fig. 1) that makes its use as a conservative representation of the variability of an input parameter more desirable. This property is demonstrated in this paper by the comparison of lognormal and gamma distribution results. Two parameters define a specific lognormal distribution:
A point-estimate—which is often associated with a mean or a median, and
An UF, or instead of an UF, a limiting value associated with a specific percentile. The use of lognormal distribution dominates all other distributions in a majority of PRAs [1,2,14,15].
the PRA community. This association is explicit in DOE-STD-30162006 [11], Section 8 that states “… the mean of the distribution as the representative and reasonably conservative point-estimate…” The median is more often associated with the “best-estimate” as it rests on the geometric half-way point between the highest and lowest bounds. However, many consider the mean or the expected value as a literal “best” single-parameter representation of an uncertain input parameter precisely because of its dual desirable qualities of propagation through most mathematical manipulations (involving independent random variables) while retaining reasonably conservative characteristics, as discussed below. Relative uncertainties in the output variables decrease when random variables are summed, but they increase when random variables are multiplied. The latter property is explicitly shown in this paper, while the former is simply mentioned for general background information and is based on experience from several PRAs [1,2,13,14]. Individual nuclear reactor accident scenario frequency distributions are calculated in PRAs. Results of methodologies such as Monte-Carlo techniques that allow for full propagation of parameter uncertainties [14] have shown that these accident frequencies can sometimes span four orders of magnitude between the 5th and 95th percentiles (as is the case for some seismically initiated accident scenarios) for Core Damage Frequency (CDF) and significantly higher uncertainties for public risk. The latter is shown in [14,16] to span as many as 15 orders of magnitude. Even then, the total CDF may have uncertainty factors that are less than ten in many cases because they are summations of accident frequencies of thousands of accident scenarios [1,2,14–15]. Distributions on the variability of a specific quantity, such as the failure probability of a pump on demand or operator failure probability to perform a specific step are almost never constructed from detailed statistical data. Rather, limited data is often fit into distributions based on limited information, some observations, and mathematical properties such as those discussed above. In PRAs for nuclear power plants, semi-quantitative information on the range of variability of a parameter are combined with estimates on the central tendency and assumptions on the nature of the underlying distribution (e.g., lognormal, beta, gamma, uniform, etc.). For lognormal distributions, two key parameters, such as the median and the upper-bound or the uncertainty factor, must be selected to construct the entire distribution that describes the expected variability of the parameter of interest. Finally, as demonstrated through personal experience with different distributions using computer programs, such as [14–16], and the example calculations provided in this paper, the specific forms of the assumed underlying distributions have relatively small impacts on the results of uncertainty analyses. This observation is subject to certain constraints, such as positive skewness and fitting distributions based on the same main parameters. 3.4. Basics recap
3.3. Properties shared by all distributions The expected value of any dependent variable of an algebraic expression is derived by using the expected value (or the mean) of the individual input (independent) variables, irrespective of the specific distributions of each random variable. This is a general distributive property of the mean/expected value. Means are greater than the medians for positively skewed distributions, such as the lognormal, which is the distribution used most often in nuclear safety applications to ensure conservatism. When symmetric distributions such as the normal distribution are used, truncation of negative values turns them into positively skewed distributions [3]. Furthermore, the mean tends toward higher percentiles as the degree of uncertainty increases. This property is the principal reason that the mean is informally but generally regarded as the “reasonably conservative” estimate in
The lognormal distribution is often used for representation of parameter uncertainties in nuclear safety-related calculations. Reasons include: (a) mathematical basis such as those derived from the central limit theorem and geometric symmetry, (b) convenient properties for analytical manipulations, (c) insignificant level of impact on results from choices of other distributions, and (d) because of the previous 3 reasons, lognormal distributions should be used when there is any lack of evidence to the contrary.
4. Example calculations The example calculations below evaluate a measure of public consequence and risk for a specific postulated scenario in a fictitious nuclear facility.
K. Jamali / Reliability Engineering and System Safety 137 (2015) 112–119
115
Any measure of consequence of interest can be chosen. One measure of public consequence used in reactor Safety Analysis Reports for Design Basis Accident consequences [17], and in DOE DSAs is the dose to the hypothetical maximally exposed offsite individual (MOI).
The product of these factors is the ratio of the product of the upper-bounds to the product of the best-estimates and is greater than 100,000. Using this product the extreme value of Rm is calculated at:
4.1. Example risk calculation
As shown below in comparison with the derived 95th percentile as the generally accepted definition for upper-bound Rm, this extreme Rm value reflects the common practice in DOE DSAs. Note that there is equal likelihood that both the extreme upperand lower-bounds (which is smaller than the best-estimate by the same 5 orders of magnitude) are the valid representation (however low the associated percentile may be) of the actual value of this output parameter. In order to appreciate how far this product of the upper-bounds strays from reality as dictated by mathematics, we will employ the properties of the lognormal distribution to derive the needed quantities in closed form. These calculations could be performed for any distribution using widely available computer programs. As discussed earlier and shown later in this paper, results and conclusions are not limited by the use of lognormal distribution. Using the designations:
A typical group of accident scenarios in nuclear facilities in general, and DOE facilities in particular (because of the lack of decay heat as a post-accident source of energy in DOE facilities), with highest potential consequences are those initiated by a seismic event. The MOI risk from inhalation for this scenario may be represented by a minimum of 11 variables, such as: Rm ¼ Is Pf 1 Pf 2 MAR DR ARF RF LPF X=Q Br DCF ð2Þ where the variables and their assumed point-estimate values are: ¼MOI risk (rem/yr) ¼frequency of exceeding the Design Basis Earthquake initiating event (/yr) ¼1E 4 Pf1 ¼conditional probability of a safety function failure ¼0.1 Pf2 ¼conditional probability of confinement/containment failure ¼0.2 MAR ¼amount of material-at-risk (g)—a single equivalent radionuclide is used ¼100,000 DR ¼damage ratio, which is the fraction of MAR that is actually affected by the conditions generated by the accident ¼0.2 ARF ¼airborne release fraction ¼0.001 RF ¼respirable fraction ¼0.1 LPF ¼leak-path factor ¼0.2 X/Q ¼relative concentration for MOI (s/m3) ¼1E 3 Br ¼breathing rate (m3/s) ¼3.0E 4 DCF ¼dose conversion factor (rem/g)—a single equivalent radionuclide is used ¼2E þ7
Rm Is
ð4Þ
X m ¼ mean; X 50 ¼ median; X 95 ¼ 95thpercentile; X 05 ¼ 5thpercentile; UF ¼ Uncertainty Factor;
σ ¼ standard deviation of the associated normal distribution The following relationships hold for lognormal distributions: ð5Þ X m ¼ X 50 exp 0:5σ 2
σ¼
lnðUFÞ 1:645
ð3Þ
ð6Þ
X 50 ¼ ðX 95 X 05 Þ0:5
ð7Þ
X 95 ¼ X 50 eð1:645 σ Þ
ð8Þ
X 05 ¼ X 50 eð 1:645 σ Þ
ð9Þ
UF ¼
Note: The individual point-estimates used in this example and the next have no bearing on the relevant results and conclusions of this paper. Therefore, the point-estimate value for the risk to the MOI for this scenario is: Rm ¼ 4:8E 6 rem=yr
Rmextreme bound ¼ 0:5 rem=yr
X 95 X 50 ¼ X 50 X 05
ð10Þ
As discussed earlier, Rm is lognormally distributed with a mean value that is the product of the individual means and a median that is the product of the individual medians. Thus, equating the point-estimate values with the best-estimate/median values for each variable, the median of Rm would be the product of the point-estimates/medians as in Eq. (4). The mean value of Rm is derived from multiplying the individual mean values. Each mean value is calculated by using Eq. (5), which yields the following mean to median ratios for each variable(denoted by subscripted R’s): RIs ¼ 2:66;
RPfi ¼ 1:25;
RDR ¼ 1:09;
RARF ¼ 2:66;
RX=Q ¼ 1:25;
RBr ¼ 1:006;
RPfs ¼ 1:09;
RMAR ¼ 1:09;
RRF ¼ 1:09; RLPF ¼ 1:25; RDCF ¼ 1:09
Thus, the ratio of the mean to median risk is: Rmm =Rm50 ¼ 2:66 1:25 1:09 1:09 1:09
We can insert an UF for each variable in Eq. (2) to get an estimate of the ratio of the product of the upper-bound to the best/ realistic/median estimate for any portion or the entirety of Eq. (2). These UF values are somewhat arbitrary values, and possibly under-estimates compared with typical application values:
Therefore, the mean value of Rm is greater than its median or the best-estimate by:
UFIs ¼ 10;
UFPf1 ¼ 3;
Rmm ¼ Rm50 21:7
UFRF ¼ 2;
UFLPF ¼ 3;
UFPf2 ¼ 2;
UFMAR ¼ 2;
UFX=Q ¼ 3;
UFDR ¼ 2;
UFBr ¼ 1:2;
and
UFARF ¼ 10;
UFDCF ¼ 2:
2:66 1:09 1:25 1:25 1:006 1:09 ¼ 21:7 ð11Þ
¼ 1E 4 rem=yr
ð12Þ
116
K. Jamali / Reliability Engineering and System Safety 137 (2015) 112–119
4.2. Example consequence calculation
The UF for Rm is derived by using Eqs. (5) and (6): σ ¼ 2 ln X m =X 50 2
σ ¼ 2:48
ð13Þ
Using the same methodology, the consequence portion of Eq. (2) would yield the following: Cm ¼ MAR DR ARF RF LPF X=Q Br DCF ð16Þ
ð14Þ
where Cm is the MOI dose consequence (rem); Cm50 ¼2.4 rem; Cmm/Cm50 ¼5.97; Cmm ¼14.3 rem; UFcm ¼22.4; Cm95 ¼ 53.8 rem; Cmextreme-bound ¼Cm50 1728¼4.15Eþ 3 rem. This derivation of the extreme value of Cm reflects the common practice in DOE DSAs. The extreme-bound for the MOI dose corresponds to a z-value of:
and UFRm ¼ eð1:645σ Þ ¼ 59:2 Therefore, the 95th percentile of Rm is given as: Rm95 ¼ Rm50 UF
z ¼ lnð1728Þ=1:89
¼ 2:8E 4 rem=yr
ð15Þ
This means that the extreme-bound, as the product of the upper-bounds, is:
1750 times greater than the 95th percentile, 4770 times greater than the mean, and 104,000 times greater than the median as the best/realisticestimate.
¼ 3:94 which corresponds to the 0.99996 percentile, or a chance of 1 in 25,000 of exceeding the hypothetical calculated dose. The extreme-bound is:
77 times larger than the 95th percentile, 289 times larger than the mean, and 1728 times larger than the best/realistic-estimate (median) of Cm.
These ratios demonstrate the degree of conservatism in the mean and the extreme conservatism in the extreme-bound. Since the mean is almost 22 times larger than the best/realisticestimate and less than 3 times smaller than the 95th percentile, it should be defined as the reasonably conservative estimate. Furthermore, the upper-bound is generally associated with the 95th percentile that is only derived through propagation of parameter uncertainties. In order to determine the percentile that corresponds to the value of the extreme-bound of Eq. (4), tables of unit-normal distributions are used. We look for the value of z such that: Area to z in unit normal table ¼ lnðfactor above medianÞ=σ ¼ lnð103; 680Þ=2:48 ¼ 4:65 This percentile is so high that it exceeds the ranges of values generally provided in unit-normal tables. The highest z value found is 4.00, which corresponds to the 0.99997 percentile, or a chance of 3 in 100,000 of exceeding. Therefore, this z value corresponds to percentiles below about 1 in 100,000.
Again, this is why the mean is proposed as the reasonably conservative estimate of the output variable, or any variable subject to parameter uncertainties. The distribution of Cm is shown in Fig. 1 for a visual illustration of the above relationships. Note that the mode, the most likely value, is about the same as the 5th percentile (0.07 versus 0.1 rem, respectively). This means that only the tail portion of the lognormal drives quantification results. The key three parameters are, however, the median, the mean, and the 95th percentile, which always reside on the tail portion (after the mode) of the lognormal. Finally, using Eqs. (5)–(10) it can be shown that for a lognormal random variable with an uncertainty factor of 1000 the mean is greater than the 95th percentile by a factor of nearly seven. Note that, in all of these examples, the ratios between all of the key parameters discussed were independent from the individual parameter point-estimates and only dependent on the degree of uncertainty expressed by the UF’s/σ’s. As mentioned earlier, based on anecdotal evidence from numerous calculations of uncertainties in several PRAs, the effects of using other distributions (with certain constraints) for some or all of the
Lognormal Distribution of MOI Dose, Cm (rem)
Probability Density Function (Cm)
0.6 Mode = 0.07 5% = 0.1
0.5 0.4 0.3 0.2 0.1 0 1.0E-04
Median = 2.4 1.0E-03
1.0E-02
1.0E-01
Mean = 14.3 95% = 54
1.0E+00 1.0E+01 MOI Dose, Cm (rem)
1.0E+02
Extreme-Bound = 4,150 1.0E+03
1.0E+04
Fig. 1. Lognormal probability density function (PDF) of dose consequence (rem) to the maximally exposed offsite individual (MOI).
K. Jamali / Reliability Engineering and System Safety 137 (2015) 112–119
input parameter uncertainties is insignificant on the distributions and key parameters of the final output variables. In other words, the key conclusions of the calculations in Sections 4.1 and 4.2 remain valid even though they are based on using lognormal distributions for all variables. Section 4.3 provides further evidence for insignificant impact from the specific type of underlying distributions as well as an independent verification for the lognormal results. 4.3. Example consequence calculation using other distributions Calculations of Section 4.2 can be repeated for other distributions using computer programs. The PRA code “SAPHIRE” developed by Idaho National Laboratory [3] was used for this paper. Two-parameter distributions are required to ensure the preservation of two key attributes of an uncertain variable, such as the point-estimate and the degree of uncertainty. Of the twoparameter distributions supported by SAPHIRE, the gamma and normal distributions were chosen for comparison with lognormal results for the following reasons:
Other than lognormal distributions, gamma and beta distribu-
tions are the most often used distributions in PRA applications because of certain properties associated with conjugate noninformative prior distributions in Bayesian data analysis. Beta distributions are commonly used for representation of uncertainty in failure probability on demand. Gamma distributions are typically used for representation of uncertainty in failure rates with units of inverse time. Beta and gamma distributions approximate each other with the same shape and scale parameters in applicable ranges [18]. A beta-distributed variable has the limited 0–1 range, so beta distribution cannot be used for some of the variables of this paper’s example calculations. Normal distribution is the maximum entropy distribution, if two of its parameters are known (e.g., mean and standard deviation), as is the case for all of this paper’s variables. The example with normal distribution is only included in this paper for illustrative purposes, even though the parameter range of minus infinity to plus infinity makes it unsuitable for the variables used in this paper. Uniform distribution provides equal likelihood of assuming any value between the minimum and maximum. This type of variability is inconsistent with the subjective belief on the nature of the uncertainty generally associated with these parameters (e.g., upper- or lower-bounds should be less likely than the bestestimate). Triangular distribution yields unacceptable negative numbers for the lower-ends for the typical magnitudes of the means and 95th percentiles used in this example. This happens when magnitudes of uncertainties are represented by factors rather than percentages.
4.3.1. Gamma distribution Since there are no simple correlations between the shape and the scale parameters of the gamma distribution and its various key parameters, both parameters must be estimated using indirect methods such as those in [18]; or manipulations of both SAPHIRE inputs, and outputs of uncertainty runs for individual parameters. SAHPIRE always requires the mean value as the point-estimate and one of the other parameters for a two-parameter distribution. For gamma distribution, the second parameter is the shape parameter. For normal distribution, it is the standard deviation; and for lognormal distribution, it is the UF (referred to as the error factor in SAPHIRE). The gamma distribution fits were derived by fixing the mean and deriving a shape parameter that gave the same 95th
117
percentile using the uncertainty analysis module. It is of interest to note that earlier attempts to use Excel for deriving the shape parameter for a gamma distribution with a given mean and 95th percentile values, and for generating the probability density function of a lognormal distribution had yielded incorrect results. Furthermore, since SAPHIRE allows parameter values greater than 1.0 for the initiating event (IE) frequency, the product of MAR and DCF were combined into a new variable denoted as MD, which was input as an IE in the SAPHIRE model for Eq. (16). SAPHIRE parameter inputs for gamma distribution for all input variables are shown in Table 1. Note that the fitted gamma distribution is J-shaped and dissimilar to the lognormal fit for the shape factor value less than 1. Otherwise, it is unimodal. Since SAPHIRE uses the mean value inputs as the “pointestimates” and propagates them through all calculations, it allows for an accuracy check for a model that uses only independent random variables, as is done in this paper. The point-estimate of the output must be equal to the output mean within the MonteCarlo sampling error.
4.3.2. Normal distribution SAPHIRE parameter inputs for normal distribution are shown in Table 2. Again, the mean was fixed, and the standard variation was manipulated to yield the correct 95th percentile generated through Monte-Carlo trials. SAPHIRE reconstructs the normal distribution input with truncation of negative numbers for probability inputs as positive variables. The problem with this option is that the three key parameters of the truncated distribution (pointestimate, mean, and 95th percentile) can no longer match the original input. The new mean and 95th percentile after truncation would be significantly higher than the original values depending on the degree of uncertainty in each case. Another option is to allow negative values during the sampling process. While these values are meaningless for actual variations of positive numbers, their impact on constructing the probability distribution for showing the nature of variability of the parameter while assuming positive numbers is small.
4.3.3. Summary of results SAPHIRE results are summarized in Table 3. Lognormal distribution was run as further confirmation for the accuracy of handcalculations. Hand-calculations provide “exact” results (within round-offs) for lognormally distributed inputs. Conversely, handcalculations show the statistical accuracy of SAPHIRE with a given Monte-Carlo sample size (5000 for these runs) for lognormal distribution. Gamma and lognormal results show very close agreement for all key output values with the exception of the 5th percentile, Table 1 Key parameters for each variable, including the SAPHIRE shape factors for gamma distribution.
DR ARF RF LPF X/Q (s/m3) Br (s/m3) MAR DCF ¼MD (rem)
Shape factor
Meana
95th SAPHIRE Monte-Carlo Percentile generated 95th percentile
5.0 0.6 5.0 1.8 1.8 80 1.2
2.18E 01 2.66E 03 1.09E 01 2.50E 01 1.25E 03 3.03E 04 2.36E þ 12
4.00E 01 1.00E 02 2.00E 01 6.00E 01 3.00E 03 3.60E 04 5.16E þ12
4.01E 1 9.60E 3 2.00E 3 6.05E 1 3.03E 3 3.60E 4 5.18E þ 12
a Note that the product of the mean values is 14.1 versus 14.3 from hand calculations because of round-offs.
118
K. Jamali / Reliability Engineering and System Safety 137 (2015) 112–119
which is not a key output parameter when conservative results are sought. Normal distribution results show more deviation from lognormal results as expected from a distribution that is not a proper representation of the range and the nature of the variability of each of the inputs. The 95th percentile of the output of all normal distribution inputs is larger than the lognormal 95th by only a factor of about two. The factor of two is quite insignificant compared with the ratio of the extreme-bound to the 95th percentile (i.e., 77) that was derived in Section 4.2. The 5th percentile is actually a negative number, as truncation of the input distributions was not allowed. Negative numbers are not true representations of the variability of the output. Again, the normal distribution inputs were only used as further illustration of the insignificant impact from possible choices of distributions, even those that are as non-representative as the normal distribution for this worked example.
Table 2 Key parameters for each variable and manually derived standard deviation in SAPHIRE for normal distribution.
DR ARF RF LPF X/Q (s/m3) Br (s/m3) MAR DCF ¼MD (rem)
Standard deviation
Mean
95th SAPHIRE Monte-Carlo Percentile generated 95th percentile
1.10E 1 4.46E 3 5.50E 2 2.13E 1 9.40E 4 8.90E 4 1.70Eþ12
2.18E 01 2.66E 03 1.09E 01 2.50E 01 1.25E 03 3.03E 04 2.36E þ12
4.00E 01 1.00E 02 2.00E 01 6.00E 01 3.00E 03 3.60E 04 5.16E þ 12
4.02E 1 1.00E 2 1.99E 2 6.06E 1 3.01E 3 3.60E 4 5.13E þ 12
Table 3 Comparison of the key parameters of the distribution of the output variable (dose to the MOI in rem). Hand calculation resultsa—using lognormal input variables
14.3 Pointestimate MOI dose (rem) Mean MOI 14.3 dose (rem) 2.4 Median MOI dose (rem) 53.8 95th Percentile MOI dose (rem) 0.11 5th Percentile MOI dose (rem)
SAPHIRE output— using normal input variables
SAPHIRE output—using lognormal input variables
SAPHIRE output—using gamma input variables
14.1
14.1
14.1
14.2
14.1
14.1
2.3
2.2
53.6
55.2
0.14
0.02
0.82
107
39.3b
a Exact results. The difference between 14.3 and 14.1 is due to round-off. Monte-Carlo based SAPHIRE results are also subject to statistical uncertainties of 5000 trials that did not improve noticeably with increasing number of trials. b Negative numbers are possible for low percentiles because the range for a normally distributed variable is from minus infinity to plus infinity.
These results confirm the earlier assertion that the choice of the underlying distribution does not have a significant effect on the outputs. Similarly, it does not change the overall conclusions of this paper regarding the extreme degree of conservatism that would result from making multiple conservative assumptions in a nuclear safety analysis model.
5. Conclusions The uncertainty in an output variable increases when the input variables are multiplied (divisions and exponents are special forms of multiplications). However, mathematics and therefore reality, restricts the growth in uncertainty to levels far below those obtained from bounding-value inputs used in some applications. Thus, the upper-bound of the example risk calculation equated with its 95th percentile, is more than 3 orders of magnitude smaller than the product of the upper-bounds. Some nuclear safety practitioners argue that in order to ensure conservative results in cases where data on individual parameters are not sufficient, selected values should be chosen at or near their most conservative extremes. While this can be done for very few and select parameters in an input model, on a scale larger than one or two parameters, the resulting conservatism can be so large that the results can arguably be considered as disjoint from reality. Reviewing the results of the example calculations above, we can reach the following conclusions: It seems reasonable to define the best-/realistic-estimate as the mid-point or the geometric center (median) of the variability of an uncertain variable. Alternatively, the best-estimate can be thought of as the mean value, as it is the only parameter of the distribution of an input variable that propagates through all steps of a complex calculation for an output variable (for independent input variables). The mean also tends to the higher percentiles of its underlying distribution with increasing uncertainty for positively skewed distributions that are generally used in nuclear safety applications to ensure conservatism. Furthermore, if one or two select input parameters (e.g., MAR and ARF/RF) are taken at their bounding values the results are expected to surpass the actual, but generally underived 95th percentile with significant margin. In the example consequence calculation above, the mean risk is 6 times larger than the median, and only 3 times smaller than the 95th percentile. What is hardly subject to debate is whether it would make sense to compound the level of conservatism in calculations by using multiple variables at their bounding estimates. The above examples show that the results would quickly become highly skewed representations of reality. The absolute upper-bound risk was 1750 times larger than the 95th percentile, and that of the MOI consequence was about 80 times larger than the 95th percentile. The methodology for calculation of the absolute upper-bound MOI dose is the common practice within DOE DSAs. The upper-bound is generally associated with the overall 95th percentile of the output when parameter uncertainties are fully propagated. It is seen that mathematics dictates that the 95th percentile of the output would be orders of magnitude below the product of the upper-bounds in both of the above examples. They both represent lower uncertainties than many actual calculations in nuclear safety. A seemingly strong case does exist for using the mean values for nearly all input parameters. This approach ensures that the results are both a reasonable and conservative representation of the output of interest. It also ensures that the effects of uncertainties are incorporated into a simplified analytical model. More complex approaches can be used to fully and explicitly account for parameter uncertainties by using other distributions
K. Jamali / Reliability Engineering and System Safety 137 (2015) 112–119
for nearly all input parameters and propagating these uncertainties throughout the analysis to the final outputs of interest. These more complex models, however, are more cumbersome, expensive, and time-consuming to use and are not suitable for many applications. In the absence of full propagation of uncertainties, using mean values for nearly all input parameters, in combination with bounding values for one or two variables ensures an output magnitude that is comparable to the actual 95th percentile. This approach offers the best alternative to complex uncertainty calculations for incorporation of parameter uncertainties, while providing reasonably conservative results. References [1] US NRC. WASH-1400. Reactor safety study, an assessment of accident risks in U.S. commercial nuclear power plants; October 1975. [2] US NRC. NUREG-1150. Severe accident risks: an assessment for five US nuclear power plants; December 1990. [3] Curtis Smith, et al. Idaho National Laboratory. Advanced SAPHIRE 8; February 2012. [4] US NRC. Regulatory Guide 1.174. An approach for using probabilistic risk assessment in risk-informed decisions on plant-specific changes to the licensing basis; May 2011. [5] US DOE. DOE-STD-3009. Preparation guide for U.S. department of energy nonreactor nuclear facility documented safety analyses; March 2006.
119
[6] US NRC. NRC News. Realism and conservatism, remarks by Chairman Nils J. Diaz at the 2003 nuclear safety research conference; October 20, 2003. [7] American Nuclear Society. ANS committee report. Fukushima Daiichi; March 2012. [8] US NRC. Regulatory Guide 1.208. A performance-based approach to define the site-specific earthquake ground motion; March 2007. [9] US NRC. NUREG/CR-5249. Quantifying reactor safety margins, application of code scaling, applicability, and uncertainty evaluation methodology to a largebreak, loss of coolant accident; December 1989. [10] Zhao Haihua, Mousseau Vincent A. Idaho National Laboratory. INL/CON-0918088, Use of forward sensitivity analysis method to improve code scaling, applicability, and uncertainty (CSAU) methodology; October 2010. [11] US DOE. DOE-NA-STD-3016. Hazard analysis reports for nuclear explosive operations; May 2006. [12] Norman J McCormick. Reliability and risk analysis. Academic Press, Inc.; 1981. [13] 〈http://en.wikipedia.org/wiki/Lognormal_distribution〉 (last access Jun 2014); 2014. [14] NUS Corporation. NUS report 4161. Limerick generating station—severe accident risk assessment, prepared for Philadelphia Electric Company; April 1983. [15] Ringhals 2 Probabilistic Safety Study. Prepared for the Swedish State Power Board. NUS report 4409; September 1984. [16] Parry GW. Use of judgment in representing uncertainty in PRAs. Nucl Eng Des 1986;93(2-3):135–44 (May 2). [17] US NRC. NUREG-0800. Standard review plan for the review of safety analysis reports for nuclear power plants: LWR Edition, 〈http://www.nrc.gov/read ing-rm/doc-collections/nuregs/staff/sr0800/〉 (last access Jun 2014); 2014. [18] Mosleh G Apostolakis. Some properties of distributions useful in the study of rare events. IEEE Trans Reliab 1982;R-31(1) (April).
Contents lists available at ScienceDirect
Reliability Engineering and System Safety journal homepage: www.elsevier.com/locate/ress
Achieving reasonable conservatism in nuclear safety analyses Kamiar Jamali Office of Nuclear Safety, Associate Administrator for Safety and Health, National Nuclear Security Administration, United States Department of Energy, 19901 Germantown Road, Germantown, MD 20874, USA
art ic l e i nf o
a b s t r a c t
Article history: Received 13 August 2014 Received in revised form 22 December 2014 Accepted 14 January 2015 Available online 23 January 2015
In the absence of methods that explicitly account for uncertainties, seeking reasonable conservatism in nuclear safety analyses can quickly lead to extreme conservatism. The rate of divergence to extreme conservatism is often beyond the expert analysts’ intuitive feeling, but can be demonstrated mathematically. Too much conservatism in addressing the safety of nuclear facilities is not beneficial to society. Using certain properties of lognormal distributions for representation of input parameter uncertainties, example calculations for the risk and consequence of a fictitious facility accident scenario are presented. Results show that there are large differences between the calculated 95th percentiles and the extreme bounding values derived from using all input variables at their upper-bound estimates. Showing the relationship of the mean values to the key parameters of the output distributions, the paper concludes that the mean is the ideal candidate for representation of the value of an uncertain parameter. The mean value is proposed as the metric that is consistent with the concept of reasonable conservatism in nuclear safety analysis, because its value increases towards higher percentiles of the underlying positively skewed distribution with increasing levels of uncertainty. Insensitivity of the results to the actual underlying distributions is briefly demonstrated. Published by Elsevier Ltd.
Keywords: Nuclear Safety analysis Probabilistic risk assessment (PRA) Uncertainty analysis Reasonable Conservatism
1. Introduction Safety analyses are performed to ensure that a nuclear facility’s design and operational controls provide assurance that the public, workers, and the environment are protected from all nuclear hazards. Since there are many sources of uncertainties within the analyses, the assurance of “adequate protection” is provided through conservatisms applied throughout all related analyses, supporting disciplines (e.g., Quality Assurance), and the resulting design provisions (e.g., incorporation of defense-in-depth and appropriate safety margins) and operational controls. This highly desirable conservative philosophy in nuclear safety can predispose nuclear safety professionals to seek everincreasing levels of conservatism in all areas of nuclear safety assurance. The downside of this approach is that in the absence of methodologies that explicitly account for uncertainties, including what, a priori, may appear to be reasonable conservatism can in fact lead to extreme conservatism. The divergence to extreme conservatism occurs far more rapidly than is generally recognized as shown through examples in this paper. This phenomenon is often beyond the expert analysts’ intuitive feeling, but it can be demonstrated mathematically. When complex analyses are used to derive the distributions of output variables for representation of uncertainties in analysis
E-mail address: [email protected] http://dx.doi.org/10.1016/j.ress.2015.01.008 0951-8320/Published by Elsevier Ltd.
results, the 95th percentile is generally associated with the upperbound [1–3]. While it is well known that the use of multiple conservative assumptions can lead to extremely conservative results, the rate and the degree of this divergence have not been widely demonstrated in the past. This paper shows that when several input parameters are taken at their bounding values, the obtained result dwarfs the derived 95th percentile of the output by orders of magnitude. Extreme conservatism is often intentionally exercised in safety analyses because it can pay dividends in simplified analysis and review efforts. However, the search for increased conservatism cannot be pursued without consequences. Extreme conservatism can lead to safety conclusions and decisions with significantly higher safety costs, which can make nuclear facilities, even those with very low hazard and risk profiles, prohibitively expensive. This can deprive the public from the benefits derived from the operations of these facilities, from nuclear power to medical isotopes and national security needs. It can also lead to overall higher risks to the public in mission delays (e.g., waste processing), cancellation of programs resulting in continued reliance on older facilities, or unnecessary expenditure of funds and resources that might have been used in more effective projects for risk reduction. In order to strike a balance between competing objectives of safety versus cost (including mission impacts) and to ensure a judicious use of resources, a reasonable degree of conservatism must be sought in nuclear safety analyses. However, recognizing
K. Jamali / Reliability Engineering and System Safety 137 (2015) 112–119
the threshold for a reasonable level of conservatism in a given application is difficult in the absence of a detailed treatment of uncertainties, including what is referred to as the “full propagation” of input parameter uncertainties. This paper explores the impact of input parameter uncertainties on selected outputs from a nuclear safety analysis. Input parameter uncertainty is a specific but important type of uncertainty among several [4]. It has a significant impact in many areas of nuclear safety analyses and calculations including Documented Safety Analyses (DSAs) [5], Safety Analysis Reports, Integrated Safety Analyses, and Probabilistic Risk Assessments (PRAs). The concept of reasonable conservatism in this paper is synonymous with the Nuclear Regulatory Commission (NRC) Chairman Diaz’s speech on “Realistic Conservatism” given at the 2003 Nuclear Safety Research Conference [6]. In that speech, the Chairman stated that: Neither under-regulation nor over-regulation serves anyone’s interests. Under-regulation puts the public safety at risk; overregulation diminishes the value to society of the regulated activity. Over-regulation could also be counter-productive to safety by diverting resources from the important safety issues. … public policy should not be based on worst case scenarios and that we have to deal with probabilities and not with all possibilities. So called ‘worst case scenarios’ are only good as vehicles to achieve the proper bounding of realistic scenarios early in the process. Nuclear policies and regulations are necessarily conservative, but should not be driven by nonphysical or unrealistic assumptions. Worst case assumptions are often considered as a first step and are used because they are simple. But, the unfortunate consequences of using worst case assumptions is that they often continue to propagate and eventually become part of the established framework. And, frankly, no one wants to appear as ‘non-conservative,’ or ‘less conservative;’ it is always easier to add to conservatism than to bring realism. But realism is what could be in the best interest of the public well-being. Rather than using worst case scenarios, we should be using realistic conservatism – based on the right science, engineering and technology – so that the end product is recognizable and useable. I believe we should avoid the ‘worst case’ syndrome… and seek out ‘realistic conservatism.’ … Sprinkling unrealistic conservatisms, even if they are small but compounding conservatisms, throughout an analysis or study can skew the results significantly. They do add up, or even multiply. How can a safety-conscious decision maker, in the broadest sense of the term, use a study that is filled with unrealistic assumptions? Who pays for unnecessary conservatism? Society does. Some may argue that in the aftermath of the Fukushima events, no degree of conservatism in nuclear safety is too much conservatism. In this context, it should suffice to note that those location-dependent plant designs for protection against natural phenomena hazards did not meet the long-held deterministic design requirements as a minimum expected set of standards [7,8]. In other words, Fukushima reactors simply did not meet current, well-established location-specific NPH requirements for safety system designs (safety system performance goals in the range of 1E 4 to 1E 5/yr) applicable in the United States and other countries. The NRC has long recognized the problem of over-conservatism in safety analyses and sought to establish methods for addressing it. Code Scaling, Applicability, and Uncertainty (CSAU) is one such methodology [9,10]. In the CSAU approach, the licensees can
113
provide the best-estimate analysis results along with an estimation of uncertainty of the calculations. This paper concludes that, in the absence of full propagation of parameter uncertainties, using mean values for nearly all input parameters (the use of bounding values may be unavoidable in a few cases) in many safety analysis disciplines is the best approach for addressing the effects of parameter uncertainties. The typical levels of conservatism when using mean values is also consistent with the concept of “reasonable conservatism” as promoted in the Department of Energy (DOE) standard DOE-NA-STD-3016-2006 [11] and elsewhere.
2. Background Nuclear safety practitioners use different terms for the value of an input or an output variable as the desired choice among different options for parameter estimations. These include best-estimate, point-estimate, mean value, median value, upper/lower-bound, or specific percentiles of a distribution (e.g., 95th percentile) as the parameter of choice. Best-estimates and point-estimates are sometimes used interchangeably, while in certain applications the former is associated with the median- and the latter with the mean-values of the underlying distributions. Point-estimate is often a substitute for any one of the single numerical estimates that could have been chosen in the specific analysis, such as the only known value, the mean, median, the upper-bound, etc. A key characteristic of nuclear safety analyses is that uncertainties in individual input parameters are generally large and represented by factors rather than percentages. For example, a typical input (such as the initiating event frequency) may have a factor of three, 10, or higher as the ratio between the mid-range/ best-/point-/realistic-estimate and the upper- and/or lower-bound estimates. This ratio is often referred to as the uncertainty (or error) factor (UF) in PRA applications.
3. Some basics 3.1. Representation of parameter uncertainty Any uncertain quantity, such as the probability of the occurrence of a failure, an airborne release fraction, or the height of people in a population, can be represented by a random variable. Random variables can be discrete or continuous. A random variable takes on a specific value (for a discrete distribution) or a range of values (for a continuous distribution) with an associated probability that is derived from the underlying distribution defining its variability. 3.2. Central limit theorem and lognormal distribution The central limit theorem states that, given certain conditions, the distribution of the sum (or average) of a large number of independent, identically distributed variables will tend to the normal distribution, regardless of the underlying distribution. Therefore, if Y is the product of n random variables X1,…,Xn with an arbitrary distribution, then the logarithm of Y is: log Y ¼
n X
log X i
ð1Þ
i¼1
And the distribution of “log Y” will tend toward a normal distribution with an increasing value of n. In addition, given that “log Y” is normally distributed, the distribution of Y will be lognormal by definition [12,13]. Since division and exponentiation are special forms of multiplication,
114
K. Jamali / Reliability Engineering and System Safety 137 (2015) 112–119
and many complex relationships can be approximated through series expansions, for many mathematical models used in safety analysis regimes, the distribution of the output variable would usually be well-represented by a lognormal distribution. Examples include the frequency of an accident scenario or the magnitude of a source term, each of which are mathematically represented by the product of several variables. Lognormal distributions possess three unique properties: (1) The median value of the product of lognormally distributed independent random variables is equal to the product of the medians, (2) The distribution of the product of lognormally distributed independent random variables is also lognormal, and (3) Geometric symmetry, in the sense that it assigns equal likelihood (i.e., in terms of symmetric percentiles such as 5th and 95th) that the actual value of a random variable is above or below the best-estimate/median by the same factor. In other words, the 20th and 80th percentiles have the same ratio below and above the 50th percentile. The last property is extremely important in modeling of rare events where there is a lack of evidence of bias for the actual parameter value being above or below the best-estimate (median value). In other words, if it is believed that it is equally likely for the actual parameter value to be higher or lower than the median by the same factor, lognormal is the only proper representation of the uncertainty. The UF for the lognormal distribution is generally defined [1–3] as the ratio of the 95th percentile (equated with the upper-bound) to the median—the 50th percentile. As mentioned above, the UF is therefore also equal to the ratio of the median to the 5th percentile (generally equated with the lower-bound). Lognormal is a positively skewed distribution with a high tail (i.e., often all key parameters fall on the tail portion of the probability density function after the mode, as shown in Fig. 1) that makes its use as a conservative representation of the variability of an input parameter more desirable. This property is demonstrated in this paper by the comparison of lognormal and gamma distribution results. Two parameters define a specific lognormal distribution:
A point-estimate—which is often associated with a mean or a median, and
An UF, or instead of an UF, a limiting value associated with a specific percentile. The use of lognormal distribution dominates all other distributions in a majority of PRAs [1,2,14,15].
the PRA community. This association is explicit in DOE-STD-30162006 [11], Section 8 that states “… the mean of the distribution as the representative and reasonably conservative point-estimate…” The median is more often associated with the “best-estimate” as it rests on the geometric half-way point between the highest and lowest bounds. However, many consider the mean or the expected value as a literal “best” single-parameter representation of an uncertain input parameter precisely because of its dual desirable qualities of propagation through most mathematical manipulations (involving independent random variables) while retaining reasonably conservative characteristics, as discussed below. Relative uncertainties in the output variables decrease when random variables are summed, but they increase when random variables are multiplied. The latter property is explicitly shown in this paper, while the former is simply mentioned for general background information and is based on experience from several PRAs [1,2,13,14]. Individual nuclear reactor accident scenario frequency distributions are calculated in PRAs. Results of methodologies such as Monte-Carlo techniques that allow for full propagation of parameter uncertainties [14] have shown that these accident frequencies can sometimes span four orders of magnitude between the 5th and 95th percentiles (as is the case for some seismically initiated accident scenarios) for Core Damage Frequency (CDF) and significantly higher uncertainties for public risk. The latter is shown in [14,16] to span as many as 15 orders of magnitude. Even then, the total CDF may have uncertainty factors that are less than ten in many cases because they are summations of accident frequencies of thousands of accident scenarios [1,2,14–15]. Distributions on the variability of a specific quantity, such as the failure probability of a pump on demand or operator failure probability to perform a specific step are almost never constructed from detailed statistical data. Rather, limited data is often fit into distributions based on limited information, some observations, and mathematical properties such as those discussed above. In PRAs for nuclear power plants, semi-quantitative information on the range of variability of a parameter are combined with estimates on the central tendency and assumptions on the nature of the underlying distribution (e.g., lognormal, beta, gamma, uniform, etc.). For lognormal distributions, two key parameters, such as the median and the upper-bound or the uncertainty factor, must be selected to construct the entire distribution that describes the expected variability of the parameter of interest. Finally, as demonstrated through personal experience with different distributions using computer programs, such as [14–16], and the example calculations provided in this paper, the specific forms of the assumed underlying distributions have relatively small impacts on the results of uncertainty analyses. This observation is subject to certain constraints, such as positive skewness and fitting distributions based on the same main parameters. 3.4. Basics recap
3.3. Properties shared by all distributions The expected value of any dependent variable of an algebraic expression is derived by using the expected value (or the mean) of the individual input (independent) variables, irrespective of the specific distributions of each random variable. This is a general distributive property of the mean/expected value. Means are greater than the medians for positively skewed distributions, such as the lognormal, which is the distribution used most often in nuclear safety applications to ensure conservatism. When symmetric distributions such as the normal distribution are used, truncation of negative values turns them into positively skewed distributions [3]. Furthermore, the mean tends toward higher percentiles as the degree of uncertainty increases. This property is the principal reason that the mean is informally but generally regarded as the “reasonably conservative” estimate in
The lognormal distribution is often used for representation of parameter uncertainties in nuclear safety-related calculations. Reasons include: (a) mathematical basis such as those derived from the central limit theorem and geometric symmetry, (b) convenient properties for analytical manipulations, (c) insignificant level of impact on results from choices of other distributions, and (d) because of the previous 3 reasons, lognormal distributions should be used when there is any lack of evidence to the contrary.
4. Example calculations The example calculations below evaluate a measure of public consequence and risk for a specific postulated scenario in a fictitious nuclear facility.
K. Jamali / Reliability Engineering and System Safety 137 (2015) 112–119
115
Any measure of consequence of interest can be chosen. One measure of public consequence used in reactor Safety Analysis Reports for Design Basis Accident consequences [17], and in DOE DSAs is the dose to the hypothetical maximally exposed offsite individual (MOI).
The product of these factors is the ratio of the product of the upper-bounds to the product of the best-estimates and is greater than 100,000. Using this product the extreme value of Rm is calculated at:
4.1. Example risk calculation
As shown below in comparison with the derived 95th percentile as the generally accepted definition for upper-bound Rm, this extreme Rm value reflects the common practice in DOE DSAs. Note that there is equal likelihood that both the extreme upperand lower-bounds (which is smaller than the best-estimate by the same 5 orders of magnitude) are the valid representation (however low the associated percentile may be) of the actual value of this output parameter. In order to appreciate how far this product of the upper-bounds strays from reality as dictated by mathematics, we will employ the properties of the lognormal distribution to derive the needed quantities in closed form. These calculations could be performed for any distribution using widely available computer programs. As discussed earlier and shown later in this paper, results and conclusions are not limited by the use of lognormal distribution. Using the designations:
A typical group of accident scenarios in nuclear facilities in general, and DOE facilities in particular (because of the lack of decay heat as a post-accident source of energy in DOE facilities), with highest potential consequences are those initiated by a seismic event. The MOI risk from inhalation for this scenario may be represented by a minimum of 11 variables, such as: Rm ¼ Is Pf 1 Pf 2 MAR DR ARF RF LPF X=Q Br DCF ð2Þ where the variables and their assumed point-estimate values are: ¼MOI risk (rem/yr) ¼frequency of exceeding the Design Basis Earthquake initiating event (/yr) ¼1E 4 Pf1 ¼conditional probability of a safety function failure ¼0.1 Pf2 ¼conditional probability of confinement/containment failure ¼0.2 MAR ¼amount of material-at-risk (g)—a single equivalent radionuclide is used ¼100,000 DR ¼damage ratio, which is the fraction of MAR that is actually affected by the conditions generated by the accident ¼0.2 ARF ¼airborne release fraction ¼0.001 RF ¼respirable fraction ¼0.1 LPF ¼leak-path factor ¼0.2 X/Q ¼relative concentration for MOI (s/m3) ¼1E 3 Br ¼breathing rate (m3/s) ¼3.0E 4 DCF ¼dose conversion factor (rem/g)—a single equivalent radionuclide is used ¼2E þ7
Rm Is
ð4Þ
X m ¼ mean; X 50 ¼ median; X 95 ¼ 95thpercentile; X 05 ¼ 5thpercentile; UF ¼ Uncertainty Factor;
σ ¼ standard deviation of the associated normal distribution The following relationships hold for lognormal distributions: ð5Þ X m ¼ X 50 exp 0:5σ 2
σ¼
lnðUFÞ 1:645
ð3Þ
ð6Þ
X 50 ¼ ðX 95 X 05 Þ0:5
ð7Þ
X 95 ¼ X 50 eð1:645 σ Þ
ð8Þ
X 05 ¼ X 50 eð 1:645 σ Þ
ð9Þ
UF ¼
Note: The individual point-estimates used in this example and the next have no bearing on the relevant results and conclusions of this paper. Therefore, the point-estimate value for the risk to the MOI for this scenario is: Rm ¼ 4:8E 6 rem=yr
Rmextreme bound ¼ 0:5 rem=yr
X 95 X 50 ¼ X 50 X 05
ð10Þ
As discussed earlier, Rm is lognormally distributed with a mean value that is the product of the individual means and a median that is the product of the individual medians. Thus, equating the point-estimate values with the best-estimate/median values for each variable, the median of Rm would be the product of the point-estimates/medians as in Eq. (4). The mean value of Rm is derived from multiplying the individual mean values. Each mean value is calculated by using Eq. (5), which yields the following mean to median ratios for each variable(denoted by subscripted R’s): RIs ¼ 2:66;
RPfi ¼ 1:25;
RDR ¼ 1:09;
RARF ¼ 2:66;
RX=Q ¼ 1:25;
RBr ¼ 1:006;
RPfs ¼ 1:09;
RMAR ¼ 1:09;
RRF ¼ 1:09; RLPF ¼ 1:25; RDCF ¼ 1:09
Thus, the ratio of the mean to median risk is: Rmm =Rm50 ¼ 2:66 1:25 1:09 1:09 1:09
We can insert an UF for each variable in Eq. (2) to get an estimate of the ratio of the product of the upper-bound to the best/ realistic/median estimate for any portion or the entirety of Eq. (2). These UF values are somewhat arbitrary values, and possibly under-estimates compared with typical application values:
Therefore, the mean value of Rm is greater than its median or the best-estimate by:
UFIs ¼ 10;
UFPf1 ¼ 3;
Rmm ¼ Rm50 21:7
UFRF ¼ 2;
UFLPF ¼ 3;
UFPf2 ¼ 2;
UFMAR ¼ 2;
UFX=Q ¼ 3;
UFDR ¼ 2;
UFBr ¼ 1:2;
and
UFARF ¼ 10;
UFDCF ¼ 2:
2:66 1:09 1:25 1:25 1:006 1:09 ¼ 21:7 ð11Þ
¼ 1E 4 rem=yr
ð12Þ
116
K. Jamali / Reliability Engineering and System Safety 137 (2015) 112–119
4.2. Example consequence calculation
The UF for Rm is derived by using Eqs. (5) and (6): σ ¼ 2 ln X m =X 50 2
σ ¼ 2:48
ð13Þ
Using the same methodology, the consequence portion of Eq. (2) would yield the following: Cm ¼ MAR DR ARF RF LPF X=Q Br DCF ð16Þ
ð14Þ
where Cm is the MOI dose consequence (rem); Cm50 ¼2.4 rem; Cmm/Cm50 ¼5.97; Cmm ¼14.3 rem; UFcm ¼22.4; Cm95 ¼ 53.8 rem; Cmextreme-bound ¼Cm50 1728¼4.15Eþ 3 rem. This derivation of the extreme value of Cm reflects the common practice in DOE DSAs. The extreme-bound for the MOI dose corresponds to a z-value of:
and UFRm ¼ eð1:645σ Þ ¼ 59:2 Therefore, the 95th percentile of Rm is given as: Rm95 ¼ Rm50 UF
z ¼ lnð1728Þ=1:89
¼ 2:8E 4 rem=yr
ð15Þ
This means that the extreme-bound, as the product of the upper-bounds, is:
1750 times greater than the 95th percentile, 4770 times greater than the mean, and 104,000 times greater than the median as the best/realisticestimate.
¼ 3:94 which corresponds to the 0.99996 percentile, or a chance of 1 in 25,000 of exceeding the hypothetical calculated dose. The extreme-bound is:
77 times larger than the 95th percentile, 289 times larger than the mean, and 1728 times larger than the best/realistic-estimate (median) of Cm.
These ratios demonstrate the degree of conservatism in the mean and the extreme conservatism in the extreme-bound. Since the mean is almost 22 times larger than the best/realisticestimate and less than 3 times smaller than the 95th percentile, it should be defined as the reasonably conservative estimate. Furthermore, the upper-bound is generally associated with the 95th percentile that is only derived through propagation of parameter uncertainties. In order to determine the percentile that corresponds to the value of the extreme-bound of Eq. (4), tables of unit-normal distributions are used. We look for the value of z such that: Area to z in unit normal table ¼ lnðfactor above medianÞ=σ ¼ lnð103; 680Þ=2:48 ¼ 4:65 This percentile is so high that it exceeds the ranges of values generally provided in unit-normal tables. The highest z value found is 4.00, which corresponds to the 0.99997 percentile, or a chance of 3 in 100,000 of exceeding. Therefore, this z value corresponds to percentiles below about 1 in 100,000.
Again, this is why the mean is proposed as the reasonably conservative estimate of the output variable, or any variable subject to parameter uncertainties. The distribution of Cm is shown in Fig. 1 for a visual illustration of the above relationships. Note that the mode, the most likely value, is about the same as the 5th percentile (0.07 versus 0.1 rem, respectively). This means that only the tail portion of the lognormal drives quantification results. The key three parameters are, however, the median, the mean, and the 95th percentile, which always reside on the tail portion (after the mode) of the lognormal. Finally, using Eqs. (5)–(10) it can be shown that for a lognormal random variable with an uncertainty factor of 1000 the mean is greater than the 95th percentile by a factor of nearly seven. Note that, in all of these examples, the ratios between all of the key parameters discussed were independent from the individual parameter point-estimates and only dependent on the degree of uncertainty expressed by the UF’s/σ’s. As mentioned earlier, based on anecdotal evidence from numerous calculations of uncertainties in several PRAs, the effects of using other distributions (with certain constraints) for some or all of the
Lognormal Distribution of MOI Dose, Cm (rem)
Probability Density Function (Cm)
0.6 Mode = 0.07 5% = 0.1
0.5 0.4 0.3 0.2 0.1 0 1.0E-04
Median = 2.4 1.0E-03
1.0E-02
1.0E-01
Mean = 14.3 95% = 54
1.0E+00 1.0E+01 MOI Dose, Cm (rem)
1.0E+02
Extreme-Bound = 4,150 1.0E+03
1.0E+04
Fig. 1. Lognormal probability density function (PDF) of dose consequence (rem) to the maximally exposed offsite individual (MOI).
K. Jamali / Reliability Engineering and System Safety 137 (2015) 112–119
input parameter uncertainties is insignificant on the distributions and key parameters of the final output variables. In other words, the key conclusions of the calculations in Sections 4.1 and 4.2 remain valid even though they are based on using lognormal distributions for all variables. Section 4.3 provides further evidence for insignificant impact from the specific type of underlying distributions as well as an independent verification for the lognormal results. 4.3. Example consequence calculation using other distributions Calculations of Section 4.2 can be repeated for other distributions using computer programs. The PRA code “SAPHIRE” developed by Idaho National Laboratory [3] was used for this paper. Two-parameter distributions are required to ensure the preservation of two key attributes of an uncertain variable, such as the point-estimate and the degree of uncertainty. Of the twoparameter distributions supported by SAPHIRE, the gamma and normal distributions were chosen for comparison with lognormal results for the following reasons:
Other than lognormal distributions, gamma and beta distribu-
tions are the most often used distributions in PRA applications because of certain properties associated with conjugate noninformative prior distributions in Bayesian data analysis. Beta distributions are commonly used for representation of uncertainty in failure probability on demand. Gamma distributions are typically used for representation of uncertainty in failure rates with units of inverse time. Beta and gamma distributions approximate each other with the same shape and scale parameters in applicable ranges [18]. A beta-distributed variable has the limited 0–1 range, so beta distribution cannot be used for some of the variables of this paper’s example calculations. Normal distribution is the maximum entropy distribution, if two of its parameters are known (e.g., mean and standard deviation), as is the case for all of this paper’s variables. The example with normal distribution is only included in this paper for illustrative purposes, even though the parameter range of minus infinity to plus infinity makes it unsuitable for the variables used in this paper. Uniform distribution provides equal likelihood of assuming any value between the minimum and maximum. This type of variability is inconsistent with the subjective belief on the nature of the uncertainty generally associated with these parameters (e.g., upper- or lower-bounds should be less likely than the bestestimate). Triangular distribution yields unacceptable negative numbers for the lower-ends for the typical magnitudes of the means and 95th percentiles used in this example. This happens when magnitudes of uncertainties are represented by factors rather than percentages.
4.3.1. Gamma distribution Since there are no simple correlations between the shape and the scale parameters of the gamma distribution and its various key parameters, both parameters must be estimated using indirect methods such as those in [18]; or manipulations of both SAPHIRE inputs, and outputs of uncertainty runs for individual parameters. SAHPIRE always requires the mean value as the point-estimate and one of the other parameters for a two-parameter distribution. For gamma distribution, the second parameter is the shape parameter. For normal distribution, it is the standard deviation; and for lognormal distribution, it is the UF (referred to as the error factor in SAPHIRE). The gamma distribution fits were derived by fixing the mean and deriving a shape parameter that gave the same 95th
117
percentile using the uncertainty analysis module. It is of interest to note that earlier attempts to use Excel for deriving the shape parameter for a gamma distribution with a given mean and 95th percentile values, and for generating the probability density function of a lognormal distribution had yielded incorrect results. Furthermore, since SAPHIRE allows parameter values greater than 1.0 for the initiating event (IE) frequency, the product of MAR and DCF were combined into a new variable denoted as MD, which was input as an IE in the SAPHIRE model for Eq. (16). SAPHIRE parameter inputs for gamma distribution for all input variables are shown in Table 1. Note that the fitted gamma distribution is J-shaped and dissimilar to the lognormal fit for the shape factor value less than 1. Otherwise, it is unimodal. Since SAPHIRE uses the mean value inputs as the “pointestimates” and propagates them through all calculations, it allows for an accuracy check for a model that uses only independent random variables, as is done in this paper. The point-estimate of the output must be equal to the output mean within the MonteCarlo sampling error.
4.3.2. Normal distribution SAPHIRE parameter inputs for normal distribution are shown in Table 2. Again, the mean was fixed, and the standard variation was manipulated to yield the correct 95th percentile generated through Monte-Carlo trials. SAPHIRE reconstructs the normal distribution input with truncation of negative numbers for probability inputs as positive variables. The problem with this option is that the three key parameters of the truncated distribution (pointestimate, mean, and 95th percentile) can no longer match the original input. The new mean and 95th percentile after truncation would be significantly higher than the original values depending on the degree of uncertainty in each case. Another option is to allow negative values during the sampling process. While these values are meaningless for actual variations of positive numbers, their impact on constructing the probability distribution for showing the nature of variability of the parameter while assuming positive numbers is small.
4.3.3. Summary of results SAPHIRE results are summarized in Table 3. Lognormal distribution was run as further confirmation for the accuracy of handcalculations. Hand-calculations provide “exact” results (within round-offs) for lognormally distributed inputs. Conversely, handcalculations show the statistical accuracy of SAPHIRE with a given Monte-Carlo sample size (5000 for these runs) for lognormal distribution. Gamma and lognormal results show very close agreement for all key output values with the exception of the 5th percentile, Table 1 Key parameters for each variable, including the SAPHIRE shape factors for gamma distribution.
DR ARF RF LPF X/Q (s/m3) Br (s/m3) MAR DCF ¼MD (rem)
Shape factor
Meana
95th SAPHIRE Monte-Carlo Percentile generated 95th percentile
5.0 0.6 5.0 1.8 1.8 80 1.2
2.18E 01 2.66E 03 1.09E 01 2.50E 01 1.25E 03 3.03E 04 2.36E þ 12
4.00E 01 1.00E 02 2.00E 01 6.00E 01 3.00E 03 3.60E 04 5.16E þ12
4.01E 1 9.60E 3 2.00E 3 6.05E 1 3.03E 3 3.60E 4 5.18E þ 12
a Note that the product of the mean values is 14.1 versus 14.3 from hand calculations because of round-offs.
118
K. Jamali / Reliability Engineering and System Safety 137 (2015) 112–119
which is not a key output parameter when conservative results are sought. Normal distribution results show more deviation from lognormal results as expected from a distribution that is not a proper representation of the range and the nature of the variability of each of the inputs. The 95th percentile of the output of all normal distribution inputs is larger than the lognormal 95th by only a factor of about two. The factor of two is quite insignificant compared with the ratio of the extreme-bound to the 95th percentile (i.e., 77) that was derived in Section 4.2. The 5th percentile is actually a negative number, as truncation of the input distributions was not allowed. Negative numbers are not true representations of the variability of the output. Again, the normal distribution inputs were only used as further illustration of the insignificant impact from possible choices of distributions, even those that are as non-representative as the normal distribution for this worked example.
Table 2 Key parameters for each variable and manually derived standard deviation in SAPHIRE for normal distribution.
DR ARF RF LPF X/Q (s/m3) Br (s/m3) MAR DCF ¼MD (rem)
Standard deviation
Mean
95th SAPHIRE Monte-Carlo Percentile generated 95th percentile
1.10E 1 4.46E 3 5.50E 2 2.13E 1 9.40E 4 8.90E 4 1.70Eþ12
2.18E 01 2.66E 03 1.09E 01 2.50E 01 1.25E 03 3.03E 04 2.36E þ12
4.00E 01 1.00E 02 2.00E 01 6.00E 01 3.00E 03 3.60E 04 5.16E þ 12
4.02E 1 1.00E 2 1.99E 2 6.06E 1 3.01E 3 3.60E 4 5.13E þ 12
Table 3 Comparison of the key parameters of the distribution of the output variable (dose to the MOI in rem). Hand calculation resultsa—using lognormal input variables
14.3 Pointestimate MOI dose (rem) Mean MOI 14.3 dose (rem) 2.4 Median MOI dose (rem) 53.8 95th Percentile MOI dose (rem) 0.11 5th Percentile MOI dose (rem)
SAPHIRE output— using normal input variables
SAPHIRE output—using lognormal input variables
SAPHIRE output—using gamma input variables
14.1
14.1
14.1
14.2
14.1
14.1
2.3
2.2
53.6
55.2
0.14
0.02
0.82
107
39.3b
a Exact results. The difference between 14.3 and 14.1 is due to round-off. Monte-Carlo based SAPHIRE results are also subject to statistical uncertainties of 5000 trials that did not improve noticeably with increasing number of trials. b Negative numbers are possible for low percentiles because the range for a normally distributed variable is from minus infinity to plus infinity.
These results confirm the earlier assertion that the choice of the underlying distribution does not have a significant effect on the outputs. Similarly, it does not change the overall conclusions of this paper regarding the extreme degree of conservatism that would result from making multiple conservative assumptions in a nuclear safety analysis model.
5. Conclusions The uncertainty in an output variable increases when the input variables are multiplied (divisions and exponents are special forms of multiplications). However, mathematics and therefore reality, restricts the growth in uncertainty to levels far below those obtained from bounding-value inputs used in some applications. Thus, the upper-bound of the example risk calculation equated with its 95th percentile, is more than 3 orders of magnitude smaller than the product of the upper-bounds. Some nuclear safety practitioners argue that in order to ensure conservative results in cases where data on individual parameters are not sufficient, selected values should be chosen at or near their most conservative extremes. While this can be done for very few and select parameters in an input model, on a scale larger than one or two parameters, the resulting conservatism can be so large that the results can arguably be considered as disjoint from reality. Reviewing the results of the example calculations above, we can reach the following conclusions: It seems reasonable to define the best-/realistic-estimate as the mid-point or the geometric center (median) of the variability of an uncertain variable. Alternatively, the best-estimate can be thought of as the mean value, as it is the only parameter of the distribution of an input variable that propagates through all steps of a complex calculation for an output variable (for independent input variables). The mean also tends to the higher percentiles of its underlying distribution with increasing uncertainty for positively skewed distributions that are generally used in nuclear safety applications to ensure conservatism. Furthermore, if one or two select input parameters (e.g., MAR and ARF/RF) are taken at their bounding values the results are expected to surpass the actual, but generally underived 95th percentile with significant margin. In the example consequence calculation above, the mean risk is 6 times larger than the median, and only 3 times smaller than the 95th percentile. What is hardly subject to debate is whether it would make sense to compound the level of conservatism in calculations by using multiple variables at their bounding estimates. The above examples show that the results would quickly become highly skewed representations of reality. The absolute upper-bound risk was 1750 times larger than the 95th percentile, and that of the MOI consequence was about 80 times larger than the 95th percentile. The methodology for calculation of the absolute upper-bound MOI dose is the common practice within DOE DSAs. The upper-bound is generally associated with the overall 95th percentile of the output when parameter uncertainties are fully propagated. It is seen that mathematics dictates that the 95th percentile of the output would be orders of magnitude below the product of the upper-bounds in both of the above examples. They both represent lower uncertainties than many actual calculations in nuclear safety. A seemingly strong case does exist for using the mean values for nearly all input parameters. This approach ensures that the results are both a reasonable and conservative representation of the output of interest. It also ensures that the effects of uncertainties are incorporated into a simplified analytical model. More complex approaches can be used to fully and explicitly account for parameter uncertainties by using other distributions
K. Jamali / Reliability Engineering and System Safety 137 (2015) 112–119
for nearly all input parameters and propagating these uncertainties throughout the analysis to the final outputs of interest. These more complex models, however, are more cumbersome, expensive, and time-consuming to use and are not suitable for many applications. In the absence of full propagation of uncertainties, using mean values for nearly all input parameters, in combination with bounding values for one or two variables ensures an output magnitude that is comparable to the actual 95th percentile. This approach offers the best alternative to complex uncertainty calculations for incorporation of parameter uncertainties, while providing reasonably conservative results. References [1] US NRC. WASH-1400. Reactor safety study, an assessment of accident risks in U.S. commercial nuclear power plants; October 1975. [2] US NRC. NUREG-1150. Severe accident risks: an assessment for five US nuclear power plants; December 1990. [3] Curtis Smith, et al. Idaho National Laboratory. Advanced SAPHIRE 8; February 2012. [4] US NRC. Regulatory Guide 1.174. An approach for using probabilistic risk assessment in risk-informed decisions on plant-specific changes to the licensing basis; May 2011. [5] US DOE. DOE-STD-3009. Preparation guide for U.S. department of energy nonreactor nuclear facility documented safety analyses; March 2006.
119
[6] US NRC. NRC News. Realism and conservatism, remarks by Chairman Nils J. Diaz at the 2003 nuclear safety research conference; October 20, 2003. [7] American Nuclear Society. ANS committee report. Fukushima Daiichi; March 2012. [8] US NRC. Regulatory Guide 1.208. A performance-based approach to define the site-specific earthquake ground motion; March 2007. [9] US NRC. NUREG/CR-5249. Quantifying reactor safety margins, application of code scaling, applicability, and uncertainty evaluation methodology to a largebreak, loss of coolant accident; December 1989. [10] Zhao Haihua, Mousseau Vincent A. Idaho National Laboratory. INL/CON-0918088, Use of forward sensitivity analysis method to improve code scaling, applicability, and uncertainty (CSAU) methodology; October 2010. [11] US DOE. DOE-NA-STD-3016. Hazard analysis reports for nuclear explosive operations; May 2006. [12] Norman J McCormick. Reliability and risk analysis. Academic Press, Inc.; 1981. [13] 〈http://en.wikipedia.org/wiki/Lognormal_distribution〉 (last access Jun 2014); 2014. [14] NUS Corporation. NUS report 4161. Limerick generating station—severe accident risk assessment, prepared for Philadelphia Electric Company; April 1983. [15] Ringhals 2 Probabilistic Safety Study. Prepared for the Swedish State Power Board. NUS report 4409; September 1984. [16] Parry GW. Use of judgment in representing uncertainty in PRAs. Nucl Eng Des 1986;93(2-3):135–44 (May 2). [17] US NRC. NUREG-0800. Standard review plan for the review of safety analysis reports for nuclear power plants: LWR Edition, 〈http://www.nrc.gov/read ing-rm/doc-collections/nuregs/staff/sr0800/〉 (last access Jun 2014); 2014. [18] Mosleh G Apostolakis. Some properties of distributions useful in the study of rare events. IEEE Trans Reliab 1982;R-31(1) (April).