- Email: [email protected]
On the use of confidence levels in risk management
Journal of Hazardous Materials, 10 (1985) 263--278 Elsevier Science Publishers B.V., Amsterdam -- Printed in The Netherlands
263
ON T H E USE O F C O N F I D E N C E L E V E L S IN R I S K M A N A G E M E N T
WILLIAM E. KASTENBERG and KENNETH A. SOLOMON* Mechanical, Aerospace and Nuclear Engineering, School of Engineering and Applied Science, University o f California, Los Angeles, CA 90024 (U.S.A.)
(Received January 1984; accepted November 1984)
Summary A framework for incorporating uncertainty in risk management is developed and applied to two aspects of decision making: meeting standards or safety goals, and cost-benefit criteria. The framework is applied to several case studies including toxic chemicals in water, failure of civil engineering structures and nuclear power plants. The framework proposes that decisions be based on a level of confidence, in addition to comparing best estimate or point values with standards and goals.
Introduction A t the present time, t h e r e is h e i g h t e n e d interest in d e v e l o p i n g q u a n t i t a t i v e s t a n d a r d s f o r t e c h n o l o g i e s w h i c h pose a h a z a r d t o t h e public. As an e x a m p l e , t h e N u c l e a r R e g u l a t o r y C o m m i s s i o n ( N R C ) has published a p r o p o s e d p o l i c y s t a t e m e n t o n safety goals f o r nuclear p o w e r plants [ 1 ] . O t h e r U.S. governm e n t a l agencies such as the E n v i r o n m e n t a l P r o t e c t i o n A g e n c y (EPA) and the F o o d and Drug A d m i n i s t r a t i o n ( F D A ) m u s t regulate against q u a n t i t a t i v e standards set f o r t h in such legislation as the Clean Air Act, the Clean Water A c t and t h e D e l a n e y Clause. Because o f the statistical n a t u r e o f t e c h n o l o g i c a l risk, probabilistic risk assessment ( P R A ) plays an increasingly i m p o r t a n t role in risk m a n a g e m e n t . P R A is, h o w e v e r , limited b y u n c e r t a i n t y i n h e r e n t in the u n d e r l y i n g data, uncertainties in u n d e r s t a n d i n g various physical p h e n o m e n a , and u n c e r t a i n t i e s in t h e m e t h o d o l o g y itself. As a result o f u n c e r t a i n t y as well as t h e statistical n a t u r e o f risk, the results o f P R A s vary in their q u a l i t y o f i n f o r m a t i o n . T h e results o f some P R A s are given as m e a n or m e d i a n values, while o t h e r s are given as statistical distributions. S o m e p r o p a g a t e uncertainties, while s o m e p e r f o r m sensitivity studies to o b t a i n limiting cases. As a result, it is difficult to d e t e r m i n e t h e a p p r o p r i a t e q u a n t i t y f o r c o m p a r i s o n with a s t a n d a r d o r for use in a c o s t - - b e n e f i t c o n s i d e r a t i o n .
*Permanent address: The Rand Corporation, 1700 Main Street, Santa Monica, CA 90406, U.S.A. 0304-3894/85/$03.30
© 1985 Elsevier Science Publishers B.V.
264
In this paper, two aspects of risk management are considered: meeting standards or safety goals and cost--benefit criteria. The framework developed here aims to provide the risk manager with information on uncert ai nt y in addition to the use o f poi nt or best-estimate values in decision making. In particular, quantitative levels of confidence with which estimated risks meet standards or goals is examined. The f r a m ew o rk is also e x t e n d e d to cost-benefit considerations in an e f f or t to determine levels of confidence at which benefit exceeds cost as a prelude to regulatory action. Framework
Risk and uncertainty The co n cep t o f risk involves a mathematical combination of two components: the consequences resulting from an undesirable event and its freq u e n c y of occurrence. Such consequences m a y include the n u m b e r of injuries, an a m o u n t o f m o n e y lost, acute deaths, latent cancer deaths, and p r o p e r t y damage (e.g., occurrence of system failure, a m o u n t of land contaminated, etc.). F r e q u e n c y can be given as the n u m b e r of undesired events per year or exposure per year. For some events, such as those described by actuarial data, the risk m ay be obtained by simply multiplying the consequences and the frequency. It can be expressed as individual or societal risk. F o r others, the risk m a y be estimated and represented by either a mean value or a statistical distribution. These estimates are usually based on models and supported by empirical data. In h er en t in any probabilistic risk assessment (PRA) are various uncertainties. These uncertainties may be due to (a) the statistical nature of data, (b) insufficient understanding of physical and biological p h e n o m e n a , and (c) unpredictable events {e.g., natural, biological and hum an behavior). The statistical distributions t hat represent the risks o f hazardous material usually, b u t n ot extensively, include (a) and (b) above. The unpredictable events, such as sabotage, etc., are n o t easily quantified and represent " u n q u a n t i f i e d residuals" [ 2 ] . When statistical distributions are derived, mean and median values can be estimated. The relationship between mean value risk (best-estimate), degree of confidence and a safety goal can be described as follows. Consider a hypot het i cal PRA leading to a statistical distribution for some measure of risk given by p(x)dx. F o r example, if x represented the n u m b e r o f latent cancer deaths per year,
= ~ p(x)dx
(1)
0 would be the mean value of the risk of latent cancer death. If a safety goal f o r latent cancer death were given by Xg, then the probability of meeting this goal would be
265 Xg
Pr(x < Xg) = f
p(x)dx
(2)
0
This integral is the probability that the risk is less than the goal and is defined as the "degree of confidence" with which the risk in question meets the goal, when expressed as apercentile. Mathematically, it defines a point on a cumulative distribution function, and is determined by integration of the statistical distribution. The median value, Xm, is defined by Xm 0.5 = ;
p(x)dx
(3)
0
Before proceeding however, it is important to mention the following. If
p(x)dx were determined with great precision, eqn. (2) would, in fact, define the confidence level. Since p(x)dx is determined from models which are uncertain, eqn. (2) represents_an estimate of confidence. As mentioned in the Introduction, it is usually X or Xm that is compared with a standard or goal. When these values differ greatly from Xg, the risk manager's decision may be obvious; when they are close to Xg, and in the presence of uncertainty, eqn. (2) provides additional information upon which to base a decision.
Cost--benefit and confidence levels A second consideration facing the risk manager is the question of whether or not the risks posed by the presence of a hazardous material should be reduced. Such considerations are usually dealt with using cost--benefit tradeoffs. Within the context of PRA, costs are usually characterized in monetary terms and include both the direct cost of the change (e.g., equipment and labor) as well as indirect costs {e.g., increased operating costs, increased occupational health risks, etc.). If benefits (in terms of reduced risks) are to be compared directly with costs, t h e y must be expressed in equivalent monetary terms. Since equivalency is often controversial (e.g., placing a dollar value on a human life saved), surrogate benefits are often considered. An example is the use of population dose averted (with respect to radioactive material), valued at $1000 per person-rem averted. The population dose is used as a surrogate for all health effects, and sometimes property damage. In either case, the formalism outlined above can be extended to cost--benefit trade-offs as follows. The risk, Ri, corresponding to the ith consequence of interest (e.g., acute fatalities, acres of land contaminated, etc.), and reported at the Cth confidence level is defined as R c and is given by R?
C - Pr(R i < Re,) = f 'P(Ri)dR i 0
(4)
266 When changes are made to avert risk, the benefit, ARi can also be expressed at a given confidence level [3]
AR~ C - Pr(ARi < AR c) = f p(ARC)dRi 0
(5)
If the total cost of a given risk reduction strategy is Co (costs usually have much less uncertainty than risk, and hence can be considered point values), and L is the time span of the change, then the given strategy is "cost-effective" when AR i ~ ColL. The degree of confidence that the strategy is costeffective is just oo
Pr(ARi > Co/L) = J p(ARi)dR i Co/L
(6)
The annualized cost, Co~L, can account for the "time value" of m o n e y as well as other effects (e.g., escalation during construction, etc.) and can be discounted according to accepted accounting procedures. The benefit is assumed to be expressed in equivalent dollars as noted in the discussion above. When uncertainty in cost becomes important, it can also be accommodated by defining the " n e t b e n e f i t " as NB -= ARi - ColL. The risk reduction strategy will then be cost effective when oo
Pr(NB > O) = f P(NB)dNB
(7)
0
Inferring levels of confidence To ascertain the practicality of using levels of confidence to augment the risk management of hazardous materials, two questions should be considered: (1) to what extent can acceptable confidence levels be inferred over a variety of risk situations? and (2) how might these values be applied to decisions regarding the management of hazardous materials? Examples
Structural design standards In the design and analysis of civil engineering structures, "factors of safet y " are provided to account for the uncertain nature of the loads, the structural properties, and the models used. Traditionally, safety or load factors (numbers greater than one) were applied to the design load and resistance factors (numbers less than one) were applied to structural properties to insure conservatism. These factors were based on engineering judgments: experience, perception, and intuition. More recently, probabilistic distributions have been used to characterize uncertainties in loads and structural properties. As an illustration, consider
267
a single s t r u c t u r a l c o m p o n e n t a c t e d u p o n b y a r a n d o m load. T h e load ind u c e s a stress, S, w h i c h has a statistical d i s t r i b u t i o n . T h e yield stress o f t h e m a t e r i a l is also c o n s i d e r e d a r a n d o m variable, d e n o t e d b y R , a n d a n e w rand o m variable F = R - S can be d e f i n e d . When F < 0, failure o f t h e s t r u c t u r a l c o m p o n e n t occurs. N o t e t h a t if S a n d R w e r e d e t e r m i n i s t i c , i.e., a l w a y s h a d t h e s a m e value b e c a u s e o f c e r t a i n t y , failure w o u l d b e d e f i n e d b y t h e deterministic variable F = R - S < 0. In p r a c t i c e , R a n d S are usually d e f i n e d b y n o r m a l d i s t r i b u t i o n s w i t h parameters F --- R - S
(8)
and 2
oF
= o~ + o~
(9)
where the bar denotes expected value (mean or best-estimate) and o is the standard deviation. Hence, the probability of failure is just 0
Pf=Pr[F~<
0] = f
p(f)df
(10)
OO
w h e r e p(f) is a n o r m a l d i s t r i b u t i o n w h o s e p a r a m e t e r s are F a n d aF. B e f o r e discussing values o f P f or 1 - Pf, w h i c h is called t h e reliability, it is c o n v e n i e n t t o i n t r o d u c e t h r e e o t h e r useful p a r a m e t e r s . T h e c e n t r a l s a f e t y f a c t o r , Co, is d e f i n e d b y
Co - R / S
(11)
a n d m e a s u r e s t h e ratio o f m e a n strength to m e a n load. T h e c o e f f i c i e n t s o f v a r i a t i o n are d e f i n e d b y ~R ~
OR/R
~S -- ° s / S
(12)
a n d m e a s u r e t h e s p r e a d in t h e d i s t r i b u t i o n s . N o t e t h a t as a n y o a p p r o a c h e s zero, t h e l o a d or resistance b e c o m e s d e t e r m i n i s t i c . L a s t l y , t h e reliability i n d e x , 6, is d e f i n e d b y t h e n u m b e r o f s t a n d a r d deviat i o n s F is f r o m F = 0 F = 0 = F -/3o r or
(13) m
R-S
F
T h e reliability index,/3, is useful in t h a t it a c c o u n t s f o r t h e relative d i f f e r e n c e b e t w e e n R a n d S (as d o e s t h e s a f e t y f a c t o r ) , as well as t h e n a r r o w n e s s o f t h e d i s t r i b u t i o n (as d o e s t h e c o e f f i c i e n t s o f v a r i a t i o n ) . High values o f ~ can b e a t t r i b u t e d t o c o n s e r v a t i s m in design (R >> S) o r g o o d statistical d a t a (small OS).
268 Hart [4] gives plots of Pf, the failure probability, for various coefficients of variation as a function of the central safety factor. The question of acceptable values of Pf (and of ~) is resolved by examining current civil engineering practice. Hart [4] gives the following c o m m o n l y accepted values: strength failures: Pf = 10 -4,/3 -~ 3.5 serviceability failures: Pf = 10 -2,/3 -~ 2.0 For a number of different probability distribution functions, Pf values of the order of 10 -2 correspond to safety factors of 1.4--2.2 and Pf values of the order of 10 .4 to safety factors of 2.4--3.0 and above. Ellingwood and Galambos [5] give a range for the reliability index, /3, based on current criteria for the design of reinforced concrete and steel beams. Values of /3 range between 2.3 and 4.0 for a wide variety of conditions. (Coefficients of variation range from 0.10 to 0.30 for most cases.) For example, in geotechnical engineering, Meyerhoff [6] lists the following minimum safety factors: Category
Item
Safety factor
Loads
Dead loads Live loads Static water pressure Environmental loads
0.9--1.2 1.0--1.5 1.0--1.2 1.2--1.4
These values correspond to a 90% reliability; i.e., to have a confidence level of 0.9, the best-estimate load should be less than its limiting value by 20% and 50% for dead loads and live loads, respectively. For stability of earthen structures and foundations, safety factors of 1.9--3.3 were found to yield a reliability of 99%. Here, the goal is set at factors of 2--3 above the median value to achieve a confidence level of 0.99. These values can be used in one of two ways. In the first, one can say that the current practice of using safety factors {ratio of standard or goal to mean value of risk) of 1.0-1.5 and 1.9--3.3 yields confidence levels 0.90 and 0.99, respectively. In the second, one can make a statement concerning the narrowness of the distribution, namely, for a confidence level of 0.90, the standard and mean should be less than 50% apart. For a confidence level of 0.99, t h e y should be less than a factor of 3 apart. Toxic chemicals
A recent study by Solomon et al. [7] compared the risks posed by several selected chemical carcinogens with two standards. The comparisons were as follows. For each comparison, two measures were considered: some actual risk (defined as operational risk), determined empirically or assumed to occur at the regulated standard value and some specific or generic safety standard.
269 TABLE 1 Inferred confidence levels for selected toxic chemicals Chemical
DDT Dieldrin Vinyl chloride
Annual risk
1.5 x 10-7/yr 7.1 x 10-1°/yr 1.8 x 10-9/yr
Pr(Ri < R g) EPA goal (1.4 x 10-S/yr)
NRC goal (1.9 X 10-~/yr)
0.02 0.95 0.76
0.98 0.99 0.99
O f p a r t i c u l a r i n t e r e s t h e r e are t h e risks o f selected c a r c i n o g e n s in d r i n k i n g w a t e r a n d t h e i r c o m p a r i s o n w i t h E P A guidelines, as well as t h e N R C ' s prop o s e d guideline f o r l a t e n t c a n c e r deaths. F o r w a t e r b o r n e chemicals, t h e E P A guidelines designate a m e a n l i f e t i m e risk o f 1.0 X 10 -6 or 1.4 X 10 -8 p e r y e a r , a s s u m i n g a 7 0 - y e a r lifetime. T h e N R C , on t h e o t h e r h a n d , has suggested a goal f o r l a t e n t c a n c e r as 0.1% o f t h e b a c k g r o u n d c a n c e r risk or 1.9 X 10 -6 c a n c e r d e a t h s p e r year. D r i n k i n g w a t e r s a m p l e s w e r e o b t a i n e d f r o m an eleven-city s a m p l e , a n d a statistical s t u d y was p e r f o r m e d t o c o n v e r t these t o l i f e t i m e risks using t h e Safe D r i n k i n g Water c a n c e r risk e s t i m a t e s [ 8 ] . T h e s e risks w e r e t h e n c o n v e r t e d t o a n n u a l figures a n d , using a n o r m a l d i s t r i b u t i o n , levels o f c o n f i d e n c e w e r e i n f e r r e d w i t h r e s p e c t t o t h e E P A (1.4 X 10 -8 p e r year) a n d N R C (1.9 X 10 -6 p e r year) guidelines. T h e s e results are s h o w n in T a b l e 1. E x a m i n a t i o n o f T a b l e 1 s h o w s t h a t , f o r t h e selected chemicals, t h e estim a t e d level o f c o n f i d e n c e in m e e t i n g t h e p r o p o s e d N R C goal is q u i t e high (0.98 or greater) f o r e a c h case. As e x p e c t e d , t h e level o f c o n f i d e n c e in m e e t ing t h e E P A goal is smaller, b e c a u s e t h e goal is m o r e stringent. T h e confid e n c e level f o r D D T is v e r y small b e c a u s e t h e m e a n a n n u a l risk is g r e a t e r t h a n t h e E P A goal. H o w e v e r , it m e e t s t h e N R C goal. Levels o f c o n f i d e n c e in nuclear r e a c t o r s a f e t y T h e a s s e s s m e n t o f n u c l e a r r e a c t o r a c c i d e n t risks is carried o u t w i t h i n the f r a m e w o r k o f p r o b a b i l i s t i c risk assessment. In general, p r o b a b i l i s t i c risk a s s e s s m e n t ( P R A ) is a q u a n t i t a t i v e e s t i m a t e o f t h e c o n s e q u e n c e s a n d freq u e n c y ( p r o b a b i l i t y ) o f a set o f a c c i d e n t sequences, including an e s t i m a t e o f t h e i r u n c e r t a i n t y given as a statistical d i s t r i b u t i o n . A l t h o u g h W A S H - 1 4 0 0 [9] a t t e m p t e d to e s t i m a t e t h e a c c i d e n t risk at n u c l e a r p o w e r p l a n t s b y calculating t h e f r e q u e n c i e s o f various a c c i d e n t s e q u e n c e s f o r t w o t y p i c a l react o r s (a PWR a n d a BWR) a n d t h e i r a t t e n d a n t c o n s e q u e n c e s (at a c o m p o s i t e site), t h e t r e a t m e n t o f u n c e r t a i n t y was n o t e m p h a s i z e d . In t h e Z i o n [10] a n d I n d i a n P o i n t [11] P R A s , an a t t e m p t is m a d e to q u a n t i f y u n c e r t a i n t y . Results are p r e s e n t e d f o r various m e a s u r e s o f risk (in-
270 cluding core-melt frequency) and uncertainty given in terms of upper (90%) and lower (10%) confidence bounds. This uncertainty analysis includes both internal and external initiators, but n o t such things as sabotage. Because the results of these PRAs are well documented, t h e y are used extensively in this paper for illustrative purposes. It should be emphasized that no a t t e m p t was made to evaluate the m e t h o d o l o g y used in Obtaining these results, their confidence limits, or their completeness.
The N R C safety goals The policy statement and proposed numerical guidelines proposed by the NRC for nuclear power plants are composed of four basic parts [ 1] : (1) A criterion for the frequency of core-melt. (2) Limits on individual and societal risk of p r o m p t (acute) death. (3) Limits on individual and societal risk of latent (cancer) death. (4) A cost-effectiveness criterion in terms of cost per person-rem averted beyond compliance with the goals above. In this section, the core-melt criterion and the limits on societal risk for both p r o m p t and latent deaths are examined. Societal risk is chosen over individual risk because the available PRAs specify risks for the population in the 50-mile radius surrounding the site. The safety goals used in this analysb are: (1) The frequency of core-melt should not exceed 1.0 X 10 -4 per year. (2) The risk to the population in the vicinity of a nuclear power plant site of prompt fatalities that might result from reactor accidents should not exceed 0.1% of the sum of prompt fatility risks resulting from other accidents to which members o f the U.S. population are generally exposed. (3) The risk to the population in the area near a nuclear power plant site of cancer fatalities that might result from reactor accidents should not exceed 0.1% of the sum of cancer fatality risks resulting from all other causes. (4) Further risk reduction should be undertaken if the cost is less than $1,000 per person-rem averted (out to 50 miles). In applying this guideline, the Commission proposes that, for societal risk of p r o m p t death, the area within one mile of the plant site boundary be used. For latent (cancer) deaths, a 50-mile radius should be used to determine the latent risk limits, as follows: The individual risk of prompt fatality in the U.S., regardless of cause, is about 5.0 X 10 -4 per year [1]. Hence, the goal requires that the societal risk be less than 0.001 X 10 .4 per year X population within one mile of the site. The population within one mile of the 111 U.S. nuclear power plant sites ranges between 0 and 1400 persons, with 168 as an average. Using 168,500 and 1000 gives the limit for p r o m p t (acute) risk as 168 ~ 1.0 X 10 -4 d / y r 500 ~ 3.0 × 10 -4 d / y r 1000 ~ 5.0 × 10 -4 d / y r
271 Since the Zion and I n d i a n P o i n t sites are in densely p o p u l a t e d areas o f the c o u n t r y , 5.0 × 10 -4 d e a t h s per y e a r is c h o s e n as t h e limit for p r o m p t (acute) death. R o u g h l y 19 p e r s o n s per 1 0 , 0 0 0 U.S. p o p u l a t i o n die o f c a n c e r each y e a r [ 1 ] . H e n c e , t h e goal requires t h a t t h e societal risk o f l a t e n t d e a t h be less t h a n 0 . 0 0 1 × 19 X 10 -4 per y e a r × p o p u l a t i o n w i t h i n 50 miles o f the site. T h e p o p u l a t i o n w i t h i n 50 miles o f a nuclear p l a n t ranges b e t w e e n 7 7 0 0 and 17.5 million. Because the Zion and I n d i a n P o i n t sites are the m o s t p o p u l a t e d in the c o u n t r y , 17.5 million is used here, yielding a risk limit o f 33 c a n c e r d e a t h s per year. These n u m e r i c a l guidelines can be s u m m a r i z e d as follows for t h e Zion and I n d i a n P o i n t sites: Limit Limit Limit Limit
on on on on
core-melt frequency: 1.0 × 10 -4 events per y e a r societal risk o f p r o m p t (acute) d e a t h : 5.0 X 10 -4 d e a t h s per y e a r societal risk o f latent (cancer) d e a t h : 33 d e a t h s per y e a r cost effective risk r e d u c t i o n : 1000 per p e r s o n - r e m averted
The Zion/Indian point PRAs In o r d e r to illustrate the use o f the level o f c o n f i d e n c e c o n c e p t in risk m a n a g e m e n t f o r n u c l e a r p o w e r plants, estimates for core-melt f r e q u e n c y and the societal risk o f early (acute) and latent (cancer) d e a t h are derived f r o m t h e P R A s f o r Z i o n and I n d i a n Point. F o r I n d i a n P o i n t Units 2 and 3, t h e m e d i a n , m e a n and u p p e r 90% confid e n c e values o f c o r e - m e l t f r e q u e n c y are given. F o r t h e Zion plant, o n l y the m e a n value is given for t o t a l c o r e - m e l t f r e q u e n c y . H e n c e t h e m e d i a n a n d u p p e r 90% c o n f i d e n c e limit are estimated f r o m the p r o b a b i l i t y d i s t r i b u t i o n f u n c t i o n given f o r e x t e r n a l l y i n d u c e d c o r e - m e l t f r e q u e n c y . These are s h o w n in Table 2. F o r the Zion a n d I n d i a n P o i n t sites, the societal risk for five d a m a g e indices are given in t h e P R A s as a set o f c o m p l e m e n t a r y c u m u l a t i v e distribut i o n f u n c t i o n s ( C C D F ) . Moreover, for each d a m a g e index, the C C D F is s h o w n at the 1 0 t h , m e d i a n ( 5 0 t h ) and 9 0 t h percentile c o n f i d e n c e limits. T h e m e a n risk at each percentile can be o b t a i n e d b y calculating the area u n d e r t h e C C D F curve. These results are s h o w n in Table 3. TABLE 2 Core melt frequency for three plants Core-melt frequency (per year) Median Mean Upper 90%
Indian Point
Zion
Unit 2
Unit 3
4.0 X 10 -4 4.7 x 10 -4 1.0 x 10 -3
9.0 x 10 -s 1.9 x 10 -4 5.5 x 10 -4
2.2 x 10 -s 6.7 x 10 -s 2.0 x 10 -4
272 TABLE 3 Societal risks for three plants Confidence level
Risk of acute death (deaths per year) Indian Point 2
Indian Point 3
0.1
5 × 1 0 -7
5 × 1 0 -8
0.5
0.9
2 × 10 -~ 5 × 10 -4
7 × 10 -~ 4 × 10 -s
Confidence level
Risk of latent death (deaths per year) Indian Point 2
0.1 0.5 0.9
3 × 1 0 -3
1.5 10
Indian Point 3
Zion -
5 × 10 -7 5 × 10 -s
Zion
1 × 1 0 -3
1 × 1 0 -3
8 × 10 -2 1
5 × 10-: 5 × 10 -1
Estimate of level of confidence T o d e t e r m i n e the c o n f i d e n c e , the various measures ( c o r e - m e l t f r e q u e n c y , risk} s h o u l d be specified probabilistically. Since statistical d i s t r i b u t i o n s are n o t given, it is a s s u m e d f o r illustrative p u r p o s e s t h a t the various risk measures are l o g - n o r m a l l y distributed. Moreover, to test the sensitivity to an a s s u m e d d i s t r i b u t i o n , the Weibull d i s t r i b u t i o n is also used. It s h o u l d be n o t e d t h a t the log-normal a n d Weibull d i s t r i b u t i o n s used are t w o - p a r a m e t e r d i s t r i b u t i o n s and o n l y t w o d a t a p o i n t s are necessary for curve fitting. F o r a c u t e and l a t e n t deaths, t h r e e d a t a p o i n t s are given. Since the high c o n f i d e n c e e n d is o f interest, the m e d i a n (50%) and 90% values are used. If the d i s t r i b u t i o n s were t r u l y log-normal (or Weibull), the 10% values w o u l d be close t o the curve. Since this closeness o n l y o c c u r s in one case, t h e true d i s t r i b u t i o n is n o t l o g - n o r m a l l y distributed. The l o g - n o r m a l d i s t r i b u t i o n f u n c t i o n has t h e useful p r o p e r t y t h a t , w h e n the c u m u l a t i v e d i s t r i b u t i o n f u n c t i o n is p l o t t e d against the l o g a r i t h m o f the a r g u m e n t o n " n o r m a l c u r v e " graph paper, a straight line results. Moreover, the p o i n t w h e r e the ( c o m p l e m e n t a r y ) c u m u l a t i v e d i s t r i b u t i o n f u n c t i o n equals 0.5 o c c u r s w h e r e its a r g u m e n t is the m e d i a n value. Similarly, if a variable c o n f o r m s to a Weibull d i s t r i b u t i o n , it b e c o m e s a straight line w h e n p l o t t e d o n " e x t r e m e v a l u e " p r o b a b i l i t y paper. T h e degree o f c o n f i d e n c e is the o r d i n a t e o f t h e i n t e r s e c t i o n o f the c u m u l a t i v e d i s t r i b u t i o n f u n c t i o n with the N R C n u m e r i c a l guidelines (safety goals) calculated f o r this s t u d y . Table 4 d e m o n s t r a t e s t h e level o f c o n f i d e n c e f o r t h e t h r e e risk measures o b t a i n e d in this m a n n e r .
273 TABLE 4 Level of confidence for Zion and Indian Point Reactor
Median risk
Log-normal
Weibull
0.03 0.52 0.72
0.10 0.53 0.75
C o r e - m e l t f r e q u e n c y (Safety goal: 1 × 1 0 -4 p e r year)
IP No. 2 IP No. 3 Zion
4 x 10 .4 per year 9 x 10 -s per year 4 x 10 -s per year
Societal risk - - a c u t e d e a t h s ( S a f e t y goal: 5 x 10 -4 d e a t h s p e r year)
IP No. 2 IP No. 3 Zion
2 X 10 -6 deaths per year 7 x 10 -6 deaths per year 5 x 10 -7 deaths per year
0.900 0.999 0.970
0.9000 0.9999 0.970
S o c i e t a l risk - - l a t e n t d e a t h s ( S a f e t y goal: 32 d e a t h s p e r year)
IP No. 2 IP No. 3 Zion
1.5 deaths per year 0.08 deaths per year 0.05 deaths per year
0.980 0.999 0.9998
0.98 0.9999 0.99999
Results
If the risk estimates were, in fact, described b y t h e log n o r m a l or Weibull distributions, the level o f c o n f i d e n c e w o u l d be the c o n f i d e n c e with w h i c h t h e safety goal were met. F o r c o r e - m e l t f r e q u e n c y , this level o f c o n f i d e n c e is small f o r I n d i a n P o i n t 2 {3--10%), because n e i t h e r the m e a n n o r m e d i a n value m e e t t h e goal. F o r I n d i a n P o i n t 3, the c o n f i d e n c e level is a p p r o x i m a t e ly 52% because the m e d i a n and m e a n are o n b o t h sides o f t h e goal (0.9 X 10 -4 and 1.9 X 10 -4, respectively). F o r Zion, the c o n f i d e n c e in m e e t i n g t h e core-melt f r e q u e n c y goal level is b e t w e e n 72 and 75% d e p e n d i n g u p o n the distribution. F o r the societal risk goals, o n e w o u l d be 90% c o n f i d e n t t h a t I n d i a n P o i n t 2 m e t t h e safety goal for a c u t e (early) deaths; f o r I n d i a n P o i n t 3 and Zion, one w o u l d be 97% c o n f i d e n t or greater. F o r l a t e n t (cancer) d e a t h , o n e w o u l d be 98% c o n f i d e n t or greater t h a t the safety goal w o u l d be m e t f o r all t h r e e plants. The a b o v e results also d e m o n s t r a t e a p r o p e r t y o f these distributions: as t h e c o n f i d e n c e range gets greater (above 50%), t h e d i f f e r e n c e in the t w o d i s t r i b u t i o n s b e c o m e s negligible. A t the low end, t h e y t e n d to differ. T h e above analysis d e m o n s t r a t e s t h a t , in a d d i t i o n t o c o m p a r i n g a m e a n o r m e d i a n value ( p o i n t estimate) with a safety goal, o n e can d e t e r m i n e a level o f confidence if a d i s t r i b u t i o n is available. A t this p o i n t , it is o f interest t o c o m p a r e these results with t h e results p r e s e n t e d f o r t h e civil engineering s t r u c t u r e s and the t o x i c chemicals. F o r t h e societal risk measures ( b o t h a c u t e and latent), t h e high degree o f confid e n c e c o m p a r e s f a v o r a b l y with the risks d u e t o a range o f t o x i c c h e m i c a l species. F o r c o r e - m e l t f r e q u e n c y , the results are less c o m p a r a b l e . In a d d i t i o n
274 t o e x a m i n i n g t h e level o f c o n f i d e n c e , it is useful t o e x a m i n e o t h e r a s p e c t s o f t h e statistical d i s t r i b u t i o n o f c o r e - m e l t . F o r civil engineering s t r u c t u r e s , t h e use o f t h e s a f e t y f a c t o r a n d reliability i n d e x as o t h e r m e a s u r e s f o r including u n c e r t a i n t y was discussed. Recall t h a t t h e s a f e t y f a c t o r was d e f i n e d as t h e r a t i o o f t h e m e a n s t r e n g t h t o t h e m e a n load, a n d t h e reliability i n d e x as t h e d i s t a n c e in s t a n d a r d d e v i a t i o n s f r o m failure. In this case, the s a f e t y goal c a n be c o n s i d e r e d as the m e a n s t r e n g t h a n d is d e t e r m i n i s t i c w i t h no d e v i a t i o n . T h e load is c o r e - m e l t f r e q u e n c y w i t h mean deviation. O n e can c o n s t r u c t t h e f o l l o w i n g t a b l e f o r c o r e - m e l t f r e q u e n c y f r o m t h e d a t a available. Reactor
Median
One sigma value (84%)
Safety goal
IPNo. 2 IPNo. 3 Zion
4.0x 10 -4 9.0 x 10 -s 2.2 X 10 -s
8.0X 10 -4 3.7 X 10 -4 1.7 x 10 -4
1.0x 10 -4 1.0x 10 -4 1.0 x 10 -4
In e v e r y case, the value at o n e s t a n d a r d d e v i a t i o n (o) is g r e a t e r t h a n t h e s a f e t y goal. H e n c e / ~ , t h e reliability i n d e x , will always be less t h a n one, illust r a t i n g t h e relatively large degree o f u n c e r t a i n t y in t h e d i s t r i b u t i o n s f o r corem e l t f r e q u e n c y . This result is in c o n t r a s t to c o m m o n l y a c c e p t e d values f o u n d in t h e civil s t r u c t u r e s l i t e r a t u r e , w h e r e t h e m e d i a n plus 2o values are less t h a n t h e limiting c o n d i t i o n . O n e can e x a m i n e t h e r a t i o o f t h e u p p e r 90% c o n f i d e n c e b o u n d to t h e m e a n t o q u a n t i f y t h e n a r r o w n e s s o f t h e d i s t r i b u t i o n . In a d d i t i o n , t h e r a t i o o f the u p p e r 90% c o n f i d e n c e b o u n d t o t h e goal m e a s u r e s t h e closeness o f t h e d i s t r i b u t i o n to t h e goal. F o r t h e e s t i m a t e s o f c o r e - m e l t f r e q u e n c y t h e r e obtains t h e f o l l o w i n g table.
Reactor
90% value/mean
90% value/goal
IP No. 2 IP No. 3 Zion
2.1 2.9 2.9
10 5.5 2.4
T h e first c o l u m n is similar to t h e c o e f f i c i e n t o f variation, w h i c h f o r civil s t r u c t u r e s is usually less t h a n u n i t y ( 0 . 1 - - 0 . 6 ) . As an alternative, t h e s a f e t y f a c t o r c o n c e p t can be applied. I f t h e f r e q u e n c y specified b y t h e s a f e t y goal (1.0 X 10 -~ p e r r e a c t o r y e a r ) is divided b y t h e m e a n value ( b e s t - e s t i m a t e ) f o r c o r e - m e l t f r e q u e n c e , an a n a l o g o u s " s a f e t y f a c t o r " can be defined. This is s h o w n in t h e following table.
275 Confidence
Type
Safety factor (Goal/mean)
0.03--0.01 0.52--0.53 0.72--0.75 -0.90 --0.99
I.P. 2 a I.P. 3 a Zion a Soil load Soil stability
0.25 1.1 2.5 1.0--1.9 1.9--3.3
aRatio of safety goal to median core-melt frequency. By comparing these two results, it would appear that a safety factor of 3 c o r r e s p o n d s t o a c o n f i d e n c e in r i s k e s t i m a t e o f 0 . 9 f o r c o r e - m e l t f r e q u e n c y . H e n c e , in t h e a b s e n c e o f a d i s t r i b u t i o n f u n c t i o n , a r i s k m a n a g e r might employ a safety factor to insure some degree of confidence, or account f o r u n c e r t a i n t y t h a t is n o t q u a n t i f i e d . Cost--benefit considerations C o s t - - b e n e f i t t r a d e - o f f s a r e u s e d b y d e c i s i o n m a n a g e r s as a n a i d in d e t e r mining whether or not action should be undertaken. In most cases, costs h a v e m u c h less u n c e r t a i n t y t h e n b e n e f i t s w h e n t h e l a t t e r is e x p r e s s e d in terms of risk averted. As an example of the framework developed in this p a p e r , a r i s k r e d u c t i o n o p t i o n ( a f i l t e r e d v e n t e d c o n t a i n m e n t s y s t e m ) is c o n s i d e r e d f o r t h e b o i l i n g w a t e r r e a c t o r ( B W R ) c o n s i d e r e d in t h e R e a c t o r S a f e t y S t u d y [ 9 ] . S u c h a s y s t e m is a s s u m e d t o p e r f e c t l y e l i m i n a t e c o n t a i n m e n t failures due to overpressurization following a core melt accident. The Reactor Safety Study gives the frequency of each possible radioactive r e l e a s e c a t e g o r y a t t h e 5 t h , 5 0 t h a n d 9 5 t h p e r c e n t c o n f i d e n c e levels. T h e s e a r e s h o w n i n T a b l e 5. T h e c o n s e q u e n c e s c o r r e s p o n d i n g t o e a c h r a d i o a c t i v e r e l e a s e c a t e g o r y a r e g i v e n i n T a b l e 6. I f t h e r i s k r e d u c t i o n o p t i o n is i m p l e m e n t e d , it w i l l r e m o v e t h e B W R 2, B W R 3 a n d B W R 4 r e l e a s e c a t e g o r i e s . TABLE 5 BWR release categories reflecting uncertainty in frequencywith no FVC a Release category
Frequency 5%
BWR BWR BWR BWR BWR
1 2 3 4 5
1 1 5 5 1
x × × x ×
10 -7 10 -6 10 -6 10 -7 10 -5
aTaken from Draft WASH-1400 [9 ].
50%
95%
1 × 10 -6 6 × 10 -6 2 × 10 -s 2 X 10 -6 1 × 10 -4
8 3 8 1 1
× 10 -6 x 10 -s × 10 -s × 10 -s X 10 -s
276 TABLE 6 C o n s e q u e n c e s o f individual release categories ( c o m p o s i t e site) Average a Type BWR BWR BWR BWR BWR
I 2 3 4 5
M a n - r e m (X 10 6 )
A c u t e fatalities
D a m a g e ($ X 10 9)
2.2 1.8 0.89 0.42 0.19
1.7 48 3.0 3.9 1.1
1.2 1.2 0.61 0.28 0.10
aAverage over p o p u l a t i o n a n d m e t e r o l o g i c a l c o n d i t i o n s , a s s u m i n g a c c i d e n t o c c u r s w i t h u n i t p r o b a b i l i t y , i.e., given t h e a c c i d e n t .
TABLE 7 Risk r e d u c t i o n ( b e n e f i t ) for p e a c h b o t t o m using a filtered v e n t e d c o n t a i n m e n t C o n f i d e n c e level Risk averted
5%
50%
95%
Acute deaths per year Latent deaths per year Man-rein p e r y e a r a M a n - r e m per y e a r b Off-site p r o p e r t y d a m a g e p e r y e a r
65 × 10 -6 13 x 10 -4 6.5 60 $4.4 X 103
355 X 10 -6 59 X 10 -4 13.4 140 $20. x 103
172 X 10 -5 26 X 10 -3 129.0 1300 $8.8 X 104
a Draft, W A S H - 1 4 0 0 , T a b l e VI-21. Average site. b High p o p u l a t i o n site.
TABLE 8 P r o b a b i l i t y t h a t t h e b e n e f i t is greater t h a n t h e cost Risk a v e r t e d Man-rem ( d r a f t W A S H - 1 4 0 0 , using $ 1 0 0 0 / m a n - r e m a v e r t e d ) Man-rem (high p o p u l a t i o n site using $ 1 0 0 0 / m a n - r e m a v e r t e d ) Property damage (draft WASH-1400) T o t a l costs averted ( h e a l t h effects a n d p r o p e r t y d a m a g e ) a a D r a f t W A S H - 1 4 0 0 values.
pr( A R > Co/L )
0.40 0.95 0.45 0.55
277 The r e d u c t i o n in risk can then be det er m i ned as shown in Table 7. The results shown in Table 7 indicate t hat the d o m i n a n t contributors to benefit are man-rem averted and off-site p r o p e r t y damage averted. The costs fo r simple low and high volume vents (using the suppression pool as a scrubber} have been estimated at $0.9 X 106 and $1.2 X 106, respectively, by Benjamin [ 1 2 ] . Using a t hi r t y year effective life and the higher cost, CoIL is $40,000 per year. Using a log-normal distribution, eqn. (6) can be evaluated for each risk averted. The results are shown in Table 8. Table 8 indicates that, using the original RSS data, the probability t hat the total benefit is greater than the cost is 0.55. For the high population site, the probability is 0.95 when only man-rem is considered at the high population site. S u m m a r y and conclusions Most policy statements specifying standards or goals for hazardous material contain b o th qualitative goals and numerical guidelines. The numerical guidelines are singular values; limits on individual and societal risk of acute and latent death, limits on concent r a t i on of material, limits on core-melt fr e q u en cy ; and, possibly, limits on cost--benefit. R a t h er than trying to m e e t a goal or standard with a median or mean value, a mo r e appropriate question might be: How confident should one be that this guideline is met? In order to establish a quantitative response t o this question, PRAs should specify statistical distributions for each measure of risk (or at a minimum upper and lower confidence limits) so that a measure of confidence can be determined. If a quantitative level of confidence is to be determined, uncertainties which are quantifiable should be propagated through PRAs and the risk should be presented as statistical distributions rather than as median values. In an e f f o r t to address the practicality o f using levels of confidence, various risks were examined. Based on a limited survey, it appears t hat a high level o f confidence (90% or more) would reflect conservatism to account for uncertainties which are n o t easily quantified or m ay be unquantifiable. One may wish to consider ot he r parameters, such as a reliability index or a safety factor, which are related to the width of the statistical risk distribution. The data presented in this paper were limited, and can provide only a limited basis for making a quantitative r e c o m m e n d a t i o n . The reliability index is a useful quantity because it includes b ot h the relative width of the distribution and the separation between a goal and mean. For the nuclear cases examined, the reliability index was always less than unity, while c u r r e n t civil engineering practice yields values of the order of 2--4 for various structures. The safety factor, however, gives a relationship between a goal and the mean value i n d e p e n d e n t of the spread of variance. As such, one would expect, for safety situations whose variance in o u t c o m e is similar to structural failures following soil load and soil stability mishaps, t hat a safety factor of about
278 2 . 0 - - 3 . 0 m i g h t be reasonable. H o w e v e r , because t h e variance associated w i t h t h e f r e q u e n c y o f a c o r e - m e l t a c c i d e n t is higher*, a larger safety f a c t o r is exp e c t e d . While a precise value f o r this safety f a c t o r f o r c o r e - m e l t c a n n o t be selected at present, values b e t w e e n 2.5 a n d 5 a p p e a r to be c o m p a r a b l e t o 9 0 - - 9 9 % c o n f i d e n c e . S u p p o r t i v e l y , it t u r n s o u t t h a t the d a t a o n c o r e - m e l t f r e q u e n c y indicates t h a t the c o r e - m e l t risk as the 9 0 t h p e r c e n t c o n f i d e n c e level is always w i t h i n a f a c t o r o f 10 o f the goal and w i t h i n a f a c t o r o f 3 o f the mean. In the absence o f a statistical d i s t r i b u t i o n , u n c e r t a i n t y can be i n c l u d e d b y a safety f a c t o r ( r o u g h l y d e f i n e d as the ratio o f the safety goal t o the bestestimate o r m e a n risk). A t this p o i n t , sufficient i n f o r m a t i o n is lacking t o s u p p o r t a firm q u a n t i t a t i v e value f o r all measures o f risk. H o w e v e r , a safety f a c t o r o f 2 . 5 - - 5 . 0 appears t o be a p p r o p r i a t e f o r c o r e - m e l t f r e q u e n c y . In s u m m a r y , an alternative a p p r o a c h f o r the c o n s i d e r a t i o n o f a goal o r s t a n d a r d has been presented. It is based o n requiring t h a t a goal be m e t at a certain level o f c o n f i d e n c e . By e x a m i n i n g s o m e n o n n u c l e a r a n d n u c l e a r risks, it appears t h a t such an a p p r o a c h is practical providing sufficient inform a t i o n is given. Moreover, t h e r e appears t o be a basis f o r requiring t h a t goals be m e t at a high degree o f c o n f i d e n c e . References 1 United States Nuclear Regulatory Commission, Proposed safety criteria for nuclear power plants, NUREG-0880, 1982. 2 S.W. Heaberlin, A handbook for value/impact assessment, NUREG/CR-3568, Pacific Northwest Laboratory Report, December 1983. 3 F. Gazzitlo and W.E. Kastenberg, Risk reduction potential for a filtered vented containment system, Nucl. Eng. Des., 77(1984) 69--85. 4 G. Hart, Uncertainty Analysis, Loads, and Safety in Structural Engineering, PrenticeHall, Englewood Cliffs, 1982. 5 B. Ellingwood and T.V. Galambos, Probability based citeria for structural design, Struct. Saf., 1 (1982) 15--26. 6 G.G. Meyerhoff, Limit states design in geothermal engineering, Struct. Saf., 1 (1982) 67--71. 7 K.A. Solomon, W.E. Kastenberg and P. Nelson, Dealing with uncertainty arising out of probabilistic risk assessment, R-3045-ORNL, The Rand Corporation Report, September 1983. 8 K.A. Solomon, M. Meyer and P.F. Nelson, Management of risks associated with drinking water at the State and loal levels, UCLA School of Engineering and Applied Science, UCLA Eng.-8243, May 1982. 9 United States Nuclear Regulatory Commission, The reactor safety study, WASH1400, October 1975. 10 The Zion PRA, Commonwealth Edison Co., Chicago, Illinois, 1981. 11 The Indian Point PRA, Power Authority State of New York, 1982. 12 A. Benjamin and F. Harper, Cost--benefit considerations for filtered vented containment systems, Proceedings of the 17th DOE Nuclear Air Cleaning Conference, Denver, Colorado, August 1982. *That is to say, the uncertainty distribution for the core-melt situation is likely to be wider (flatter) than the corresponding distribution in the soil load and soil distribution cases.
263
ON T H E USE O F C O N F I D E N C E L E V E L S IN R I S K M A N A G E M E N T
WILLIAM E. KASTENBERG and KENNETH A. SOLOMON* Mechanical, Aerospace and Nuclear Engineering, School of Engineering and Applied Science, University o f California, Los Angeles, CA 90024 (U.S.A.)
(Received January 1984; accepted November 1984)
Summary A framework for incorporating uncertainty in risk management is developed and applied to two aspects of decision making: meeting standards or safety goals, and cost-benefit criteria. The framework is applied to several case studies including toxic chemicals in water, failure of civil engineering structures and nuclear power plants. The framework proposes that decisions be based on a level of confidence, in addition to comparing best estimate or point values with standards and goals.
Introduction A t the present time, t h e r e is h e i g h t e n e d interest in d e v e l o p i n g q u a n t i t a t i v e s t a n d a r d s f o r t e c h n o l o g i e s w h i c h pose a h a z a r d t o t h e public. As an e x a m p l e , t h e N u c l e a r R e g u l a t o r y C o m m i s s i o n ( N R C ) has published a p r o p o s e d p o l i c y s t a t e m e n t o n safety goals f o r nuclear p o w e r plants [ 1 ] . O t h e r U.S. governm e n t a l agencies such as the E n v i r o n m e n t a l P r o t e c t i o n A g e n c y (EPA) and the F o o d and Drug A d m i n i s t r a t i o n ( F D A ) m u s t regulate against q u a n t i t a t i v e standards set f o r t h in such legislation as the Clean Air Act, the Clean Water A c t and t h e D e l a n e y Clause. Because o f the statistical n a t u r e o f t e c h n o l o g i c a l risk, probabilistic risk assessment ( P R A ) plays an increasingly i m p o r t a n t role in risk m a n a g e m e n t . P R A is, h o w e v e r , limited b y u n c e r t a i n t y i n h e r e n t in the u n d e r l y i n g data, uncertainties in u n d e r s t a n d i n g various physical p h e n o m e n a , and u n c e r t a i n t i e s in t h e m e t h o d o l o g y itself. As a result o f u n c e r t a i n t y as well as t h e statistical n a t u r e o f risk, the results o f P R A s vary in their q u a l i t y o f i n f o r m a t i o n . T h e results o f some P R A s are given as m e a n or m e d i a n values, while o t h e r s are given as statistical distributions. S o m e p r o p a g a t e uncertainties, while s o m e p e r f o r m sensitivity studies to o b t a i n limiting cases. As a result, it is difficult to d e t e r m i n e t h e a p p r o p r i a t e q u a n t i t y f o r c o m p a r i s o n with a s t a n d a r d o r for use in a c o s t - - b e n e f i t c o n s i d e r a t i o n .
*Permanent address: The Rand Corporation, 1700 Main Street, Santa Monica, CA 90406, U.S.A. 0304-3894/85/$03.30
© 1985 Elsevier Science Publishers B.V.
264
In this paper, two aspects of risk management are considered: meeting standards or safety goals and cost--benefit criteria. The framework developed here aims to provide the risk manager with information on uncert ai nt y in addition to the use o f poi nt or best-estimate values in decision making. In particular, quantitative levels of confidence with which estimated risks meet standards or goals is examined. The f r a m ew o rk is also e x t e n d e d to cost-benefit considerations in an e f f or t to determine levels of confidence at which benefit exceeds cost as a prelude to regulatory action. Framework
Risk and uncertainty The co n cep t o f risk involves a mathematical combination of two components: the consequences resulting from an undesirable event and its freq u e n c y of occurrence. Such consequences m a y include the n u m b e r of injuries, an a m o u n t o f m o n e y lost, acute deaths, latent cancer deaths, and p r o p e r t y damage (e.g., occurrence of system failure, a m o u n t of land contaminated, etc.). F r e q u e n c y can be given as the n u m b e r of undesired events per year or exposure per year. For some events, such as those described by actuarial data, the risk m ay be obtained by simply multiplying the consequences and the frequency. It can be expressed as individual or societal risk. F o r others, the risk m a y be estimated and represented by either a mean value or a statistical distribution. These estimates are usually based on models and supported by empirical data. In h er en t in any probabilistic risk assessment (PRA) are various uncertainties. These uncertainties may be due to (a) the statistical nature of data, (b) insufficient understanding of physical and biological p h e n o m e n a , and (c) unpredictable events {e.g., natural, biological and hum an behavior). The statistical distributions t hat represent the risks o f hazardous material usually, b u t n ot extensively, include (a) and (b) above. The unpredictable events, such as sabotage, etc., are n o t easily quantified and represent " u n q u a n t i f i e d residuals" [ 2 ] . When statistical distributions are derived, mean and median values can be estimated. The relationship between mean value risk (best-estimate), degree of confidence and a safety goal can be described as follows. Consider a hypot het i cal PRA leading to a statistical distribution for some measure of risk given by p(x)dx. F o r example, if x represented the n u m b e r o f latent cancer deaths per year,
= ~ p(x)dx
(1)
0 would be the mean value of the risk of latent cancer death. If a safety goal f o r latent cancer death were given by Xg, then the probability of meeting this goal would be
265 Xg
Pr(x < Xg) = f
p(x)dx
(2)
0
This integral is the probability that the risk is less than the goal and is defined as the "degree of confidence" with which the risk in question meets the goal, when expressed as apercentile. Mathematically, it defines a point on a cumulative distribution function, and is determined by integration of the statistical distribution. The median value, Xm, is defined by Xm 0.5 = ;
p(x)dx
(3)
0
Before proceeding however, it is important to mention the following. If
p(x)dx were determined with great precision, eqn. (2) would, in fact, define the confidence level. Since p(x)dx is determined from models which are uncertain, eqn. (2) represents_an estimate of confidence. As mentioned in the Introduction, it is usually X or Xm that is compared with a standard or goal. When these values differ greatly from Xg, the risk manager's decision may be obvious; when they are close to Xg, and in the presence of uncertainty, eqn. (2) provides additional information upon which to base a decision.
Cost--benefit and confidence levels A second consideration facing the risk manager is the question of whether or not the risks posed by the presence of a hazardous material should be reduced. Such considerations are usually dealt with using cost--benefit tradeoffs. Within the context of PRA, costs are usually characterized in monetary terms and include both the direct cost of the change (e.g., equipment and labor) as well as indirect costs {e.g., increased operating costs, increased occupational health risks, etc.). If benefits (in terms of reduced risks) are to be compared directly with costs, t h e y must be expressed in equivalent monetary terms. Since equivalency is often controversial (e.g., placing a dollar value on a human life saved), surrogate benefits are often considered. An example is the use of population dose averted (with respect to radioactive material), valued at $1000 per person-rem averted. The population dose is used as a surrogate for all health effects, and sometimes property damage. In either case, the formalism outlined above can be extended to cost--benefit trade-offs as follows. The risk, Ri, corresponding to the ith consequence of interest (e.g., acute fatalities, acres of land contaminated, etc.), and reported at the Cth confidence level is defined as R c and is given by R?
C - Pr(R i < Re,) = f 'P(Ri)dR i 0
(4)
266 When changes are made to avert risk, the benefit, ARi can also be expressed at a given confidence level [3]
AR~ C - Pr(ARi < AR c) = f p(ARC)dRi 0
(5)
If the total cost of a given risk reduction strategy is Co (costs usually have much less uncertainty than risk, and hence can be considered point values), and L is the time span of the change, then the given strategy is "cost-effective" when AR i ~ ColL. The degree of confidence that the strategy is costeffective is just oo
Pr(ARi > Co/L) = J p(ARi)dR i Co/L
(6)
The annualized cost, Co~L, can account for the "time value" of m o n e y as well as other effects (e.g., escalation during construction, etc.) and can be discounted according to accepted accounting procedures. The benefit is assumed to be expressed in equivalent dollars as noted in the discussion above. When uncertainty in cost becomes important, it can also be accommodated by defining the " n e t b e n e f i t " as NB -= ARi - ColL. The risk reduction strategy will then be cost effective when oo
Pr(NB > O) = f P(NB)dNB
(7)
0
Inferring levels of confidence To ascertain the practicality of using levels of confidence to augment the risk management of hazardous materials, two questions should be considered: (1) to what extent can acceptable confidence levels be inferred over a variety of risk situations? and (2) how might these values be applied to decisions regarding the management of hazardous materials? Examples
Structural design standards In the design and analysis of civil engineering structures, "factors of safet y " are provided to account for the uncertain nature of the loads, the structural properties, and the models used. Traditionally, safety or load factors (numbers greater than one) were applied to the design load and resistance factors (numbers less than one) were applied to structural properties to insure conservatism. These factors were based on engineering judgments: experience, perception, and intuition. More recently, probabilistic distributions have been used to characterize uncertainties in loads and structural properties. As an illustration, consider
267
a single s t r u c t u r a l c o m p o n e n t a c t e d u p o n b y a r a n d o m load. T h e load ind u c e s a stress, S, w h i c h has a statistical d i s t r i b u t i o n . T h e yield stress o f t h e m a t e r i a l is also c o n s i d e r e d a r a n d o m variable, d e n o t e d b y R , a n d a n e w rand o m variable F = R - S can be d e f i n e d . When F < 0, failure o f t h e s t r u c t u r a l c o m p o n e n t occurs. N o t e t h a t if S a n d R w e r e d e t e r m i n i s t i c , i.e., a l w a y s h a d t h e s a m e value b e c a u s e o f c e r t a i n t y , failure w o u l d b e d e f i n e d b y t h e deterministic variable F = R - S < 0. In p r a c t i c e , R a n d S are usually d e f i n e d b y n o r m a l d i s t r i b u t i o n s w i t h parameters F --- R - S
(8)
and 2
oF
= o~ + o~
(9)
where the bar denotes expected value (mean or best-estimate) and o is the standard deviation. Hence, the probability of failure is just 0
Pf=Pr[F~<
0] = f
p(f)df
(10)
OO
w h e r e p(f) is a n o r m a l d i s t r i b u t i o n w h o s e p a r a m e t e r s are F a n d aF. B e f o r e discussing values o f P f or 1 - Pf, w h i c h is called t h e reliability, it is c o n v e n i e n t t o i n t r o d u c e t h r e e o t h e r useful p a r a m e t e r s . T h e c e n t r a l s a f e t y f a c t o r , Co, is d e f i n e d b y
Co - R / S
(11)
a n d m e a s u r e s t h e ratio o f m e a n strength to m e a n load. T h e c o e f f i c i e n t s o f v a r i a t i o n are d e f i n e d b y ~R ~
OR/R
~S -- ° s / S
(12)
a n d m e a s u r e t h e s p r e a d in t h e d i s t r i b u t i o n s . N o t e t h a t as a n y o a p p r o a c h e s zero, t h e l o a d or resistance b e c o m e s d e t e r m i n i s t i c . L a s t l y , t h e reliability i n d e x , 6, is d e f i n e d b y t h e n u m b e r o f s t a n d a r d deviat i o n s F is f r o m F = 0 F = 0 = F -/3o r or
(13) m
R-S
F
T h e reliability index,/3, is useful in t h a t it a c c o u n t s f o r t h e relative d i f f e r e n c e b e t w e e n R a n d S (as d o e s t h e s a f e t y f a c t o r ) , as well as t h e n a r r o w n e s s o f t h e d i s t r i b u t i o n (as d o e s t h e c o e f f i c i e n t s o f v a r i a t i o n ) . High values o f ~ can b e a t t r i b u t e d t o c o n s e r v a t i s m in design (R >> S) o r g o o d statistical d a t a (small OS).
268 Hart [4] gives plots of Pf, the failure probability, for various coefficients of variation as a function of the central safety factor. The question of acceptable values of Pf (and of ~) is resolved by examining current civil engineering practice. Hart [4] gives the following c o m m o n l y accepted values: strength failures: Pf = 10 -4,/3 -~ 3.5 serviceability failures: Pf = 10 -2,/3 -~ 2.0 For a number of different probability distribution functions, Pf values of the order of 10 -2 correspond to safety factors of 1.4--2.2 and Pf values of the order of 10 .4 to safety factors of 2.4--3.0 and above. Ellingwood and Galambos [5] give a range for the reliability index, /3, based on current criteria for the design of reinforced concrete and steel beams. Values of /3 range between 2.3 and 4.0 for a wide variety of conditions. (Coefficients of variation range from 0.10 to 0.30 for most cases.) For example, in geotechnical engineering, Meyerhoff [6] lists the following minimum safety factors: Category
Item
Safety factor
Loads
Dead loads Live loads Static water pressure Environmental loads
0.9--1.2 1.0--1.5 1.0--1.2 1.2--1.4
These values correspond to a 90% reliability; i.e., to have a confidence level of 0.9, the best-estimate load should be less than its limiting value by 20% and 50% for dead loads and live loads, respectively. For stability of earthen structures and foundations, safety factors of 1.9--3.3 were found to yield a reliability of 99%. Here, the goal is set at factors of 2--3 above the median value to achieve a confidence level of 0.99. These values can be used in one of two ways. In the first, one can say that the current practice of using safety factors {ratio of standard or goal to mean value of risk) of 1.0-1.5 and 1.9--3.3 yields confidence levels 0.90 and 0.99, respectively. In the second, one can make a statement concerning the narrowness of the distribution, namely, for a confidence level of 0.90, the standard and mean should be less than 50% apart. For a confidence level of 0.99, t h e y should be less than a factor of 3 apart. Toxic chemicals
A recent study by Solomon et al. [7] compared the risks posed by several selected chemical carcinogens with two standards. The comparisons were as follows. For each comparison, two measures were considered: some actual risk (defined as operational risk), determined empirically or assumed to occur at the regulated standard value and some specific or generic safety standard.
269 TABLE 1 Inferred confidence levels for selected toxic chemicals Chemical
DDT Dieldrin Vinyl chloride
Annual risk
1.5 x 10-7/yr 7.1 x 10-1°/yr 1.8 x 10-9/yr
Pr(Ri < R g) EPA goal (1.4 x 10-S/yr)
NRC goal (1.9 X 10-~/yr)
0.02 0.95 0.76
0.98 0.99 0.99
O f p a r t i c u l a r i n t e r e s t h e r e are t h e risks o f selected c a r c i n o g e n s in d r i n k i n g w a t e r a n d t h e i r c o m p a r i s o n w i t h E P A guidelines, as well as t h e N R C ' s prop o s e d guideline f o r l a t e n t c a n c e r deaths. F o r w a t e r b o r n e chemicals, t h e E P A guidelines designate a m e a n l i f e t i m e risk o f 1.0 X 10 -6 or 1.4 X 10 -8 p e r y e a r , a s s u m i n g a 7 0 - y e a r lifetime. T h e N R C , on t h e o t h e r h a n d , has suggested a goal f o r l a t e n t c a n c e r as 0.1% o f t h e b a c k g r o u n d c a n c e r risk or 1.9 X 10 -6 c a n c e r d e a t h s p e r year. D r i n k i n g w a t e r s a m p l e s w e r e o b t a i n e d f r o m an eleven-city s a m p l e , a n d a statistical s t u d y was p e r f o r m e d t o c o n v e r t these t o l i f e t i m e risks using t h e Safe D r i n k i n g Water c a n c e r risk e s t i m a t e s [ 8 ] . T h e s e risks w e r e t h e n c o n v e r t e d t o a n n u a l figures a n d , using a n o r m a l d i s t r i b u t i o n , levels o f c o n f i d e n c e w e r e i n f e r r e d w i t h r e s p e c t t o t h e E P A (1.4 X 10 -8 p e r year) a n d N R C (1.9 X 10 -6 p e r year) guidelines. T h e s e results are s h o w n in T a b l e 1. E x a m i n a t i o n o f T a b l e 1 s h o w s t h a t , f o r t h e selected chemicals, t h e estim a t e d level o f c o n f i d e n c e in m e e t i n g t h e p r o p o s e d N R C goal is q u i t e high (0.98 or greater) f o r e a c h case. As e x p e c t e d , t h e level o f c o n f i d e n c e in m e e t ing t h e E P A goal is smaller, b e c a u s e t h e goal is m o r e stringent. T h e confid e n c e level f o r D D T is v e r y small b e c a u s e t h e m e a n a n n u a l risk is g r e a t e r t h a n t h e E P A goal. H o w e v e r , it m e e t s t h e N R C goal. Levels o f c o n f i d e n c e in nuclear r e a c t o r s a f e t y T h e a s s e s s m e n t o f n u c l e a r r e a c t o r a c c i d e n t risks is carried o u t w i t h i n the f r a m e w o r k o f p r o b a b i l i s t i c risk assessment. In general, p r o b a b i l i s t i c risk a s s e s s m e n t ( P R A ) is a q u a n t i t a t i v e e s t i m a t e o f t h e c o n s e q u e n c e s a n d freq u e n c y ( p r o b a b i l i t y ) o f a set o f a c c i d e n t sequences, including an e s t i m a t e o f t h e i r u n c e r t a i n t y given as a statistical d i s t r i b u t i o n . A l t h o u g h W A S H - 1 4 0 0 [9] a t t e m p t e d to e s t i m a t e t h e a c c i d e n t risk at n u c l e a r p o w e r p l a n t s b y calculating t h e f r e q u e n c i e s o f various a c c i d e n t s e q u e n c e s f o r t w o t y p i c a l react o r s (a PWR a n d a BWR) a n d t h e i r a t t e n d a n t c o n s e q u e n c e s (at a c o m p o s i t e site), t h e t r e a t m e n t o f u n c e r t a i n t y was n o t e m p h a s i z e d . In t h e Z i o n [10] a n d I n d i a n P o i n t [11] P R A s , an a t t e m p t is m a d e to q u a n t i f y u n c e r t a i n t y . Results are p r e s e n t e d f o r various m e a s u r e s o f risk (in-
270 cluding core-melt frequency) and uncertainty given in terms of upper (90%) and lower (10%) confidence bounds. This uncertainty analysis includes both internal and external initiators, but n o t such things as sabotage. Because the results of these PRAs are well documented, t h e y are used extensively in this paper for illustrative purposes. It should be emphasized that no a t t e m p t was made to evaluate the m e t h o d o l o g y used in Obtaining these results, their confidence limits, or their completeness.
The N R C safety goals The policy statement and proposed numerical guidelines proposed by the NRC for nuclear power plants are composed of four basic parts [ 1] : (1) A criterion for the frequency of core-melt. (2) Limits on individual and societal risk of p r o m p t (acute) death. (3) Limits on individual and societal risk of latent (cancer) death. (4) A cost-effectiveness criterion in terms of cost per person-rem averted beyond compliance with the goals above. In this section, the core-melt criterion and the limits on societal risk for both p r o m p t and latent deaths are examined. Societal risk is chosen over individual risk because the available PRAs specify risks for the population in the 50-mile radius surrounding the site. The safety goals used in this analysb are: (1) The frequency of core-melt should not exceed 1.0 X 10 -4 per year. (2) The risk to the population in the vicinity of a nuclear power plant site of prompt fatalities that might result from reactor accidents should not exceed 0.1% of the sum of prompt fatility risks resulting from other accidents to which members o f the U.S. population are generally exposed. (3) The risk to the population in the area near a nuclear power plant site of cancer fatalities that might result from reactor accidents should not exceed 0.1% of the sum of cancer fatality risks resulting from all other causes. (4) Further risk reduction should be undertaken if the cost is less than $1,000 per person-rem averted (out to 50 miles). In applying this guideline, the Commission proposes that, for societal risk of p r o m p t death, the area within one mile of the plant site boundary be used. For latent (cancer) deaths, a 50-mile radius should be used to determine the latent risk limits, as follows: The individual risk of prompt fatality in the U.S., regardless of cause, is about 5.0 X 10 -4 per year [1]. Hence, the goal requires that the societal risk be less than 0.001 X 10 .4 per year X population within one mile of the site. The population within one mile of the 111 U.S. nuclear power plant sites ranges between 0 and 1400 persons, with 168 as an average. Using 168,500 and 1000 gives the limit for p r o m p t (acute) risk as 168 ~ 1.0 X 10 -4 d / y r 500 ~ 3.0 × 10 -4 d / y r 1000 ~ 5.0 × 10 -4 d / y r
271 Since the Zion and I n d i a n P o i n t sites are in densely p o p u l a t e d areas o f the c o u n t r y , 5.0 × 10 -4 d e a t h s per y e a r is c h o s e n as t h e limit for p r o m p t (acute) death. R o u g h l y 19 p e r s o n s per 1 0 , 0 0 0 U.S. p o p u l a t i o n die o f c a n c e r each y e a r [ 1 ] . H e n c e , t h e goal requires t h a t t h e societal risk o f l a t e n t d e a t h be less t h a n 0 . 0 0 1 × 19 X 10 -4 per y e a r × p o p u l a t i o n w i t h i n 50 miles o f the site. T h e p o p u l a t i o n w i t h i n 50 miles o f a nuclear p l a n t ranges b e t w e e n 7 7 0 0 and 17.5 million. Because the Zion and I n d i a n P o i n t sites are the m o s t p o p u l a t e d in the c o u n t r y , 17.5 million is used here, yielding a risk limit o f 33 c a n c e r d e a t h s per year. These n u m e r i c a l guidelines can be s u m m a r i z e d as follows for t h e Zion and I n d i a n P o i n t sites: Limit Limit Limit Limit
on on on on
core-melt frequency: 1.0 × 10 -4 events per y e a r societal risk o f p r o m p t (acute) d e a t h : 5.0 X 10 -4 d e a t h s per y e a r societal risk o f latent (cancer) d e a t h : 33 d e a t h s per y e a r cost effective risk r e d u c t i o n : 1000 per p e r s o n - r e m averted
The Zion/Indian point PRAs In o r d e r to illustrate the use o f the level o f c o n f i d e n c e c o n c e p t in risk m a n a g e m e n t f o r n u c l e a r p o w e r plants, estimates for core-melt f r e q u e n c y and the societal risk o f early (acute) and latent (cancer) d e a t h are derived f r o m t h e P R A s f o r Z i o n and I n d i a n Point. F o r I n d i a n P o i n t Units 2 and 3, t h e m e d i a n , m e a n and u p p e r 90% confid e n c e values o f c o r e - m e l t f r e q u e n c y are given. F o r t h e Zion plant, o n l y the m e a n value is given for t o t a l c o r e - m e l t f r e q u e n c y . H e n c e t h e m e d i a n a n d u p p e r 90% c o n f i d e n c e limit are estimated f r o m the p r o b a b i l i t y d i s t r i b u t i o n f u n c t i o n given f o r e x t e r n a l l y i n d u c e d c o r e - m e l t f r e q u e n c y . These are s h o w n in Table 2. F o r the Zion a n d I n d i a n P o i n t sites, the societal risk for five d a m a g e indices are given in t h e P R A s as a set o f c o m p l e m e n t a r y c u m u l a t i v e distribut i o n f u n c t i o n s ( C C D F ) . Moreover, for each d a m a g e index, the C C D F is s h o w n at the 1 0 t h , m e d i a n ( 5 0 t h ) and 9 0 t h percentile c o n f i d e n c e limits. T h e m e a n risk at each percentile can be o b t a i n e d b y calculating the area u n d e r t h e C C D F curve. These results are s h o w n in Table 3. TABLE 2 Core melt frequency for three plants Core-melt frequency (per year) Median Mean Upper 90%
Indian Point
Zion
Unit 2
Unit 3
4.0 X 10 -4 4.7 x 10 -4 1.0 x 10 -3
9.0 x 10 -s 1.9 x 10 -4 5.5 x 10 -4
2.2 x 10 -s 6.7 x 10 -s 2.0 x 10 -4
272 TABLE 3 Societal risks for three plants Confidence level
Risk of acute death (deaths per year) Indian Point 2
Indian Point 3
0.1
5 × 1 0 -7
5 × 1 0 -8
0.5
0.9
2 × 10 -~ 5 × 10 -4
7 × 10 -~ 4 × 10 -s
Confidence level
Risk of latent death (deaths per year) Indian Point 2
0.1 0.5 0.9
3 × 1 0 -3
1.5 10
Indian Point 3
Zion -
5 × 10 -7 5 × 10 -s
Zion
1 × 1 0 -3
1 × 1 0 -3
8 × 10 -2 1
5 × 10-: 5 × 10 -1
Estimate of level of confidence T o d e t e r m i n e the c o n f i d e n c e , the various measures ( c o r e - m e l t f r e q u e n c y , risk} s h o u l d be specified probabilistically. Since statistical d i s t r i b u t i o n s are n o t given, it is a s s u m e d f o r illustrative p u r p o s e s t h a t the various risk measures are l o g - n o r m a l l y distributed. Moreover, to test the sensitivity to an a s s u m e d d i s t r i b u t i o n , the Weibull d i s t r i b u t i o n is also used. It s h o u l d be n o t e d t h a t the log-normal a n d Weibull d i s t r i b u t i o n s used are t w o - p a r a m e t e r d i s t r i b u t i o n s and o n l y t w o d a t a p o i n t s are necessary for curve fitting. F o r a c u t e and l a t e n t deaths, t h r e e d a t a p o i n t s are given. Since the high c o n f i d e n c e e n d is o f interest, the m e d i a n (50%) and 90% values are used. If the d i s t r i b u t i o n s were t r u l y log-normal (or Weibull), the 10% values w o u l d be close t o the curve. Since this closeness o n l y o c c u r s in one case, t h e true d i s t r i b u t i o n is n o t l o g - n o r m a l l y distributed. The l o g - n o r m a l d i s t r i b u t i o n f u n c t i o n has t h e useful p r o p e r t y t h a t , w h e n the c u m u l a t i v e d i s t r i b u t i o n f u n c t i o n is p l o t t e d against the l o g a r i t h m o f the a r g u m e n t o n " n o r m a l c u r v e " graph paper, a straight line results. Moreover, the p o i n t w h e r e the ( c o m p l e m e n t a r y ) c u m u l a t i v e d i s t r i b u t i o n f u n c t i o n equals 0.5 o c c u r s w h e r e its a r g u m e n t is the m e d i a n value. Similarly, if a variable c o n f o r m s to a Weibull d i s t r i b u t i o n , it b e c o m e s a straight line w h e n p l o t t e d o n " e x t r e m e v a l u e " p r o b a b i l i t y paper. T h e degree o f c o n f i d e n c e is the o r d i n a t e o f t h e i n t e r s e c t i o n o f the c u m u l a t i v e d i s t r i b u t i o n f u n c t i o n with the N R C n u m e r i c a l guidelines (safety goals) calculated f o r this s t u d y . Table 4 d e m o n s t r a t e s t h e level o f c o n f i d e n c e f o r t h e t h r e e risk measures o b t a i n e d in this m a n n e r .
273 TABLE 4 Level of confidence for Zion and Indian Point Reactor
Median risk
Log-normal
Weibull
0.03 0.52 0.72
0.10 0.53 0.75
C o r e - m e l t f r e q u e n c y (Safety goal: 1 × 1 0 -4 p e r year)
IP No. 2 IP No. 3 Zion
4 x 10 .4 per year 9 x 10 -s per year 4 x 10 -s per year
Societal risk - - a c u t e d e a t h s ( S a f e t y goal: 5 x 10 -4 d e a t h s p e r year)
IP No. 2 IP No. 3 Zion
2 X 10 -6 deaths per year 7 x 10 -6 deaths per year 5 x 10 -7 deaths per year
0.900 0.999 0.970
0.9000 0.9999 0.970
S o c i e t a l risk - - l a t e n t d e a t h s ( S a f e t y goal: 32 d e a t h s p e r year)
IP No. 2 IP No. 3 Zion
1.5 deaths per year 0.08 deaths per year 0.05 deaths per year
0.980 0.999 0.9998
0.98 0.9999 0.99999
Results
If the risk estimates were, in fact, described b y t h e log n o r m a l or Weibull distributions, the level o f c o n f i d e n c e w o u l d be the c o n f i d e n c e with w h i c h t h e safety goal were met. F o r c o r e - m e l t f r e q u e n c y , this level o f c o n f i d e n c e is small f o r I n d i a n P o i n t 2 {3--10%), because n e i t h e r the m e a n n o r m e d i a n value m e e t t h e goal. F o r I n d i a n P o i n t 3, the c o n f i d e n c e level is a p p r o x i m a t e ly 52% because the m e d i a n and m e a n are o n b o t h sides o f t h e goal (0.9 X 10 -4 and 1.9 X 10 -4, respectively). F o r Zion, the c o n f i d e n c e in m e e t i n g t h e core-melt f r e q u e n c y goal level is b e t w e e n 72 and 75% d e p e n d i n g u p o n the distribution. F o r the societal risk goals, o n e w o u l d be 90% c o n f i d e n t t h a t I n d i a n P o i n t 2 m e t t h e safety goal for a c u t e (early) deaths; f o r I n d i a n P o i n t 3 and Zion, one w o u l d be 97% c o n f i d e n t or greater. F o r l a t e n t (cancer) d e a t h , o n e w o u l d be 98% c o n f i d e n t or greater t h a t the safety goal w o u l d be m e t f o r all t h r e e plants. The a b o v e results also d e m o n s t r a t e a p r o p e r t y o f these distributions: as t h e c o n f i d e n c e range gets greater (above 50%), t h e d i f f e r e n c e in the t w o d i s t r i b u t i o n s b e c o m e s negligible. A t the low end, t h e y t e n d to differ. T h e above analysis d e m o n s t r a t e s t h a t , in a d d i t i o n t o c o m p a r i n g a m e a n o r m e d i a n value ( p o i n t estimate) with a safety goal, o n e can d e t e r m i n e a level o f confidence if a d i s t r i b u t i o n is available. A t this p o i n t , it is o f interest t o c o m p a r e these results with t h e results p r e s e n t e d f o r t h e civil engineering s t r u c t u r e s and the t o x i c chemicals. F o r t h e societal risk measures ( b o t h a c u t e and latent), t h e high degree o f confid e n c e c o m p a r e s f a v o r a b l y with the risks d u e t o a range o f t o x i c c h e m i c a l species. F o r c o r e - m e l t f r e q u e n c y , the results are less c o m p a r a b l e . In a d d i t i o n
274 t o e x a m i n i n g t h e level o f c o n f i d e n c e , it is useful t o e x a m i n e o t h e r a s p e c t s o f t h e statistical d i s t r i b u t i o n o f c o r e - m e l t . F o r civil engineering s t r u c t u r e s , t h e use o f t h e s a f e t y f a c t o r a n d reliability i n d e x as o t h e r m e a s u r e s f o r including u n c e r t a i n t y was discussed. Recall t h a t t h e s a f e t y f a c t o r was d e f i n e d as t h e r a t i o o f t h e m e a n s t r e n g t h t o t h e m e a n load, a n d t h e reliability i n d e x as t h e d i s t a n c e in s t a n d a r d d e v i a t i o n s f r o m failure. In this case, the s a f e t y goal c a n be c o n s i d e r e d as the m e a n s t r e n g t h a n d is d e t e r m i n i s t i c w i t h no d e v i a t i o n . T h e load is c o r e - m e l t f r e q u e n c y w i t h mean deviation. O n e can c o n s t r u c t t h e f o l l o w i n g t a b l e f o r c o r e - m e l t f r e q u e n c y f r o m t h e d a t a available. Reactor
Median
One sigma value (84%)
Safety goal
IPNo. 2 IPNo. 3 Zion
4.0x 10 -4 9.0 x 10 -s 2.2 X 10 -s
8.0X 10 -4 3.7 X 10 -4 1.7 x 10 -4
1.0x 10 -4 1.0x 10 -4 1.0 x 10 -4
In e v e r y case, the value at o n e s t a n d a r d d e v i a t i o n (o) is g r e a t e r t h a n t h e s a f e t y goal. H e n c e / ~ , t h e reliability i n d e x , will always be less t h a n one, illust r a t i n g t h e relatively large degree o f u n c e r t a i n t y in t h e d i s t r i b u t i o n s f o r corem e l t f r e q u e n c y . This result is in c o n t r a s t to c o m m o n l y a c c e p t e d values f o u n d in t h e civil s t r u c t u r e s l i t e r a t u r e , w h e r e t h e m e d i a n plus 2o values are less t h a n t h e limiting c o n d i t i o n . O n e can e x a m i n e t h e r a t i o o f t h e u p p e r 90% c o n f i d e n c e b o u n d to t h e m e a n t o q u a n t i f y t h e n a r r o w n e s s o f t h e d i s t r i b u t i o n . In a d d i t i o n , t h e r a t i o o f the u p p e r 90% c o n f i d e n c e b o u n d t o t h e goal m e a s u r e s t h e closeness o f t h e d i s t r i b u t i o n to t h e goal. F o r t h e e s t i m a t e s o f c o r e - m e l t f r e q u e n c y t h e r e obtains t h e f o l l o w i n g table.
Reactor
90% value/mean
90% value/goal
IP No. 2 IP No. 3 Zion
2.1 2.9 2.9
10 5.5 2.4
T h e first c o l u m n is similar to t h e c o e f f i c i e n t o f variation, w h i c h f o r civil s t r u c t u r e s is usually less t h a n u n i t y ( 0 . 1 - - 0 . 6 ) . As an alternative, t h e s a f e t y f a c t o r c o n c e p t can be applied. I f t h e f r e q u e n c y specified b y t h e s a f e t y goal (1.0 X 10 -~ p e r r e a c t o r y e a r ) is divided b y t h e m e a n value ( b e s t - e s t i m a t e ) f o r c o r e - m e l t f r e q u e n c e , an a n a l o g o u s " s a f e t y f a c t o r " can be defined. This is s h o w n in t h e following table.
275 Confidence
Type
Safety factor (Goal/mean)
0.03--0.01 0.52--0.53 0.72--0.75 -0.90 --0.99
I.P. 2 a I.P. 3 a Zion a Soil load Soil stability
0.25 1.1 2.5 1.0--1.9 1.9--3.3
aRatio of safety goal to median core-melt frequency. By comparing these two results, it would appear that a safety factor of 3 c o r r e s p o n d s t o a c o n f i d e n c e in r i s k e s t i m a t e o f 0 . 9 f o r c o r e - m e l t f r e q u e n c y . H e n c e , in t h e a b s e n c e o f a d i s t r i b u t i o n f u n c t i o n , a r i s k m a n a g e r might employ a safety factor to insure some degree of confidence, or account f o r u n c e r t a i n t y t h a t is n o t q u a n t i f i e d . Cost--benefit considerations C o s t - - b e n e f i t t r a d e - o f f s a r e u s e d b y d e c i s i o n m a n a g e r s as a n a i d in d e t e r mining whether or not action should be undertaken. In most cases, costs h a v e m u c h less u n c e r t a i n t y t h e n b e n e f i t s w h e n t h e l a t t e r is e x p r e s s e d in terms of risk averted. As an example of the framework developed in this p a p e r , a r i s k r e d u c t i o n o p t i o n ( a f i l t e r e d v e n t e d c o n t a i n m e n t s y s t e m ) is c o n s i d e r e d f o r t h e b o i l i n g w a t e r r e a c t o r ( B W R ) c o n s i d e r e d in t h e R e a c t o r S a f e t y S t u d y [ 9 ] . S u c h a s y s t e m is a s s u m e d t o p e r f e c t l y e l i m i n a t e c o n t a i n m e n t failures due to overpressurization following a core melt accident. The Reactor Safety Study gives the frequency of each possible radioactive r e l e a s e c a t e g o r y a t t h e 5 t h , 5 0 t h a n d 9 5 t h p e r c e n t c o n f i d e n c e levels. T h e s e a r e s h o w n i n T a b l e 5. T h e c o n s e q u e n c e s c o r r e s p o n d i n g t o e a c h r a d i o a c t i v e r e l e a s e c a t e g o r y a r e g i v e n i n T a b l e 6. I f t h e r i s k r e d u c t i o n o p t i o n is i m p l e m e n t e d , it w i l l r e m o v e t h e B W R 2, B W R 3 a n d B W R 4 r e l e a s e c a t e g o r i e s . TABLE 5 BWR release categories reflecting uncertainty in frequencywith no FVC a Release category
Frequency 5%
BWR BWR BWR BWR BWR
1 2 3 4 5
1 1 5 5 1
x × × x ×
10 -7 10 -6 10 -6 10 -7 10 -5
aTaken from Draft WASH-1400 [9 ].
50%
95%
1 × 10 -6 6 × 10 -6 2 × 10 -s 2 X 10 -6 1 × 10 -4
8 3 8 1 1
× 10 -6 x 10 -s × 10 -s × 10 -s X 10 -s
276 TABLE 6 C o n s e q u e n c e s o f individual release categories ( c o m p o s i t e site) Average a Type BWR BWR BWR BWR BWR
I 2 3 4 5
M a n - r e m (X 10 6 )
A c u t e fatalities
D a m a g e ($ X 10 9)
2.2 1.8 0.89 0.42 0.19
1.7 48 3.0 3.9 1.1
1.2 1.2 0.61 0.28 0.10
aAverage over p o p u l a t i o n a n d m e t e r o l o g i c a l c o n d i t i o n s , a s s u m i n g a c c i d e n t o c c u r s w i t h u n i t p r o b a b i l i t y , i.e., given t h e a c c i d e n t .
TABLE 7 Risk r e d u c t i o n ( b e n e f i t ) for p e a c h b o t t o m using a filtered v e n t e d c o n t a i n m e n t C o n f i d e n c e level Risk averted
5%
50%
95%
Acute deaths per year Latent deaths per year Man-rein p e r y e a r a M a n - r e m per y e a r b Off-site p r o p e r t y d a m a g e p e r y e a r
65 × 10 -6 13 x 10 -4 6.5 60 $4.4 X 103
355 X 10 -6 59 X 10 -4 13.4 140 $20. x 103
172 X 10 -5 26 X 10 -3 129.0 1300 $8.8 X 104
a Draft, W A S H - 1 4 0 0 , T a b l e VI-21. Average site. b High p o p u l a t i o n site.
TABLE 8 P r o b a b i l i t y t h a t t h e b e n e f i t is greater t h a n t h e cost Risk a v e r t e d Man-rem ( d r a f t W A S H - 1 4 0 0 , using $ 1 0 0 0 / m a n - r e m a v e r t e d ) Man-rem (high p o p u l a t i o n site using $ 1 0 0 0 / m a n - r e m a v e r t e d ) Property damage (draft WASH-1400) T o t a l costs averted ( h e a l t h effects a n d p r o p e r t y d a m a g e ) a a D r a f t W A S H - 1 4 0 0 values.
pr( A R > Co/L )
0.40 0.95 0.45 0.55
277 The r e d u c t i o n in risk can then be det er m i ned as shown in Table 7. The results shown in Table 7 indicate t hat the d o m i n a n t contributors to benefit are man-rem averted and off-site p r o p e r t y damage averted. The costs fo r simple low and high volume vents (using the suppression pool as a scrubber} have been estimated at $0.9 X 106 and $1.2 X 106, respectively, by Benjamin [ 1 2 ] . Using a t hi r t y year effective life and the higher cost, CoIL is $40,000 per year. Using a log-normal distribution, eqn. (6) can be evaluated for each risk averted. The results are shown in Table 8. Table 8 indicates that, using the original RSS data, the probability t hat the total benefit is greater than the cost is 0.55. For the high population site, the probability is 0.95 when only man-rem is considered at the high population site. S u m m a r y and conclusions Most policy statements specifying standards or goals for hazardous material contain b o th qualitative goals and numerical guidelines. The numerical guidelines are singular values; limits on individual and societal risk of acute and latent death, limits on concent r a t i on of material, limits on core-melt fr e q u en cy ; and, possibly, limits on cost--benefit. R a t h er than trying to m e e t a goal or standard with a median or mean value, a mo r e appropriate question might be: How confident should one be that this guideline is met? In order to establish a quantitative response t o this question, PRAs should specify statistical distributions for each measure of risk (or at a minimum upper and lower confidence limits) so that a measure of confidence can be determined. If a quantitative level of confidence is to be determined, uncertainties which are quantifiable should be propagated through PRAs and the risk should be presented as statistical distributions rather than as median values. In an e f f o r t to address the practicality o f using levels of confidence, various risks were examined. Based on a limited survey, it appears t hat a high level o f confidence (90% or more) would reflect conservatism to account for uncertainties which are n o t easily quantified or m ay be unquantifiable. One may wish to consider ot he r parameters, such as a reliability index or a safety factor, which are related to the width of the statistical risk distribution. The data presented in this paper were limited, and can provide only a limited basis for making a quantitative r e c o m m e n d a t i o n . The reliability index is a useful quantity because it includes b ot h the relative width of the distribution and the separation between a goal and mean. For the nuclear cases examined, the reliability index was always less than unity, while c u r r e n t civil engineering practice yields values of the order of 2--4 for various structures. The safety factor, however, gives a relationship between a goal and the mean value i n d e p e n d e n t of the spread of variance. As such, one would expect, for safety situations whose variance in o u t c o m e is similar to structural failures following soil load and soil stability mishaps, t hat a safety factor of about
278 2 . 0 - - 3 . 0 m i g h t be reasonable. H o w e v e r , because t h e variance associated w i t h t h e f r e q u e n c y o f a c o r e - m e l t a c c i d e n t is higher*, a larger safety f a c t o r is exp e c t e d . While a precise value f o r this safety f a c t o r f o r c o r e - m e l t c a n n o t be selected at present, values b e t w e e n 2.5 a n d 5 a p p e a r to be c o m p a r a b l e t o 9 0 - - 9 9 % c o n f i d e n c e . S u p p o r t i v e l y , it t u r n s o u t t h a t the d a t a o n c o r e - m e l t f r e q u e n c y indicates t h a t the c o r e - m e l t risk as the 9 0 t h p e r c e n t c o n f i d e n c e level is always w i t h i n a f a c t o r o f 10 o f the goal and w i t h i n a f a c t o r o f 3 o f the mean. In the absence o f a statistical d i s t r i b u t i o n , u n c e r t a i n t y can be i n c l u d e d b y a safety f a c t o r ( r o u g h l y d e f i n e d as the ratio o f the safety goal t o the bestestimate o r m e a n risk). A t this p o i n t , sufficient i n f o r m a t i o n is lacking t o s u p p o r t a firm q u a n t i t a t i v e value f o r all measures o f risk. H o w e v e r , a safety f a c t o r o f 2 . 5 - - 5 . 0 appears t o be a p p r o p r i a t e f o r c o r e - m e l t f r e q u e n c y . In s u m m a r y , an alternative a p p r o a c h f o r the c o n s i d e r a t i o n o f a goal o r s t a n d a r d has been presented. It is based o n requiring t h a t a goal be m e t at a certain level o f c o n f i d e n c e . By e x a m i n i n g s o m e n o n n u c l e a r a n d n u c l e a r risks, it appears t h a t such an a p p r o a c h is practical providing sufficient inform a t i o n is given. Moreover, t h e r e appears t o be a basis f o r requiring t h a t goals be m e t at a high degree o f c o n f i d e n c e . References 1 United States Nuclear Regulatory Commission, Proposed safety criteria for nuclear power plants, NUREG-0880, 1982. 2 S.W. Heaberlin, A handbook for value/impact assessment, NUREG/CR-3568, Pacific Northwest Laboratory Report, December 1983. 3 F. Gazzitlo and W.E. Kastenberg, Risk reduction potential for a filtered vented containment system, Nucl. Eng. Des., 77(1984) 69--85. 4 G. Hart, Uncertainty Analysis, Loads, and Safety in Structural Engineering, PrenticeHall, Englewood Cliffs, 1982. 5 B. Ellingwood and T.V. Galambos, Probability based citeria for structural design, Struct. Saf., 1 (1982) 15--26. 6 G.G. Meyerhoff, Limit states design in geothermal engineering, Struct. Saf., 1 (1982) 67--71. 7 K.A. Solomon, W.E. Kastenberg and P. Nelson, Dealing with uncertainty arising out of probabilistic risk assessment, R-3045-ORNL, The Rand Corporation Report, September 1983. 8 K.A. Solomon, M. Meyer and P.F. Nelson, Management of risks associated with drinking water at the State and loal levels, UCLA School of Engineering and Applied Science, UCLA Eng.-8243, May 1982. 9 United States Nuclear Regulatory Commission, The reactor safety study, WASH1400, October 1975. 10 The Zion PRA, Commonwealth Edison Co., Chicago, Illinois, 1981. 11 The Indian Point PRA, Power Authority State of New York, 1982. 12 A. Benjamin and F. Harper, Cost--benefit considerations for filtered vented containment systems, Proceedings of the 17th DOE Nuclear Air Cleaning Conference, Denver, Colorado, August 1982. *That is to say, the uncertainty distribution for the core-melt situation is likely to be wider (flatter) than the corresponding distribution in the soil load and soil distribution cases.