Risk Aggregation in Support of Risk-Informed Decision Making. Robert Boyer, Principal Engineer

Transcription

1 Risk Aggregation in Support of Risk-Informed Decision Making Robert Boyer, Principal Engineer

2 Background: Why Aggregate Risks? Aggregation of risk (CDF/LERF) across multiple hazard groups (internal events, internal flood, fire, high winds, seismic, external flood) is generally required in support of risk-informed decision making. Notices of Enforcement Discretion Risk-informed applications Surveillance Frequency Control Program Risk-Informed Completion Times Risk-Informed Categorization of SSC s 2

3 Defining Risk Aggregation for Decision-Making As used in EPRI * Risk aggregation is the process of combining all relevant information on the risk from the various contributors to provide an overall characterization of risk for use in risk-informed decisionmaking. *An Approach to Risk Aggregation for Risk-Informed Decision-Making, EPRI , April

4 What are the Concerns? Risk metrics for the different hazard groups have different degrees of realism Different levels of conservatisms in the methods Different levels of uncertainty in the data Simply summing the mean values for the individual hazard groups can result in: Distortion of the total risk profile Masking of contributors Risk-informed applications relying on importance measures can be skewed by aggregated results 4

5 Proposed Approach: Premises Purpose of aggregation is to assemble risk insights from all relevant contributors to support decision-making reflecting level of confidence assigned to each of these contributors Risk-informed decisions typically involve a quantitative assessment of risk metric relative to a risk criterion Overall risk calculated by summing contributions over all hazards Results must be incorporated into the larger framework of risk-informed decision-making Defense-in-depth assessment Evaluation of safety margins Performance monitoring Adding ALL Risks DECISION-MAKING 5

6 EPRI Framework 6

7 EPRI Process for Considering Realism How realistically are the important contributors treated? The cost associated with model refinement needs to be considered. Model refinements were not within the scope of the pilot work. 7

8 PWROG Pilot Applications Application Pilot Plant 1 Pilot Plant 2 Assess basecase risk ( Application 0 ) Significance Determination Process Evaluation of conditional core damage probability given actual condition or event Risk-managed technical specifications Identification of critical human actions Configuration risk management (Maintenance Rule) 8

9 Rubric Elements Purpose Purpose: provide risk information in the context of the decision at hand Graphical representation of important risk contributors with characterization of modeling approach and uncertainties relative to decision Characterization of defense in depth Characterization of safety margins Integrated decision accounts for Comparison to criterion Defense-in-depth Safety margins Performance monitoring Characterize the overall risk from plant operations with respect to the subsidiary safety of objective of CDF<1x10-4 /yr. Risk Information Contribution to Total CDF 1.2E-04/yr 1.0E-04/yr 8.0E-05/yr 6.0E-05/yr 4.0E-05/yr 2.0E-05/yr 0.0E+00/yr Subsidiary Objective BOUNDING VERY HIGH Shutdown External Flooding Seismic Internal Flooding Internal Fire Internal Events Legend Contribution Modeling Uncertainty Parametric Uncertainty Mean values represented in results Modeling Uncertainty Fire PRA methods result in a substantial overstatement of fire CDF. Important contributors associated with fires not observed in US operating experience. Completeness Uncertainty All relevant site hazards and operating modes considered except: o High winds design basis shown to protect to 1E 7/yr Overall Risk Characterization Computed total CDF exceeds subsidiary objective by ~10% Non realistic fire PRA methods are primary cause of this computed exceedance. However, fire PRA methods capable of producing a more realistic assessment are not available at this time. Defense-in-Depth Characterization No defense in depth vulnerabilities identified All fire scenarios confirmed to have at least one success path Safety Margin Characterization No vulnerabilities identified Performance Monitoring Annual average CDF monitoring performed as part of Maintenance Rule Routine PRA updates scheduled for every 4 years Integrated Decision-making Inputs Risk Defense-in-Depth Safety Margins Performance Monitoring Conservatism-driven Exceedence REALISTIC CONSERVATIVE REALISTIC CONSERVATIVE REALISTIC Confirmed Confirmed Annual Average CDF Monitoring Conclusion: Although the computed total CDF exceeds subsidiary objective by ~10%, no specific weaknesses in the plant design were identified. Exceedence driven by non realistic fire PRA methods. HIGH HIGH HIGH MODERATE LOW 9

10 Pilot Plant 2 - Basecase CDF Rubric 10

11 Pilot Plant 2 - SDP 11

12 Pilot Plant 2 Risk-Informed Completion Times 12

13 Pilot Plant 2 Critical Human Actions 13

14 Conclusions Both pilot plants identified cases where the insights were different depending on whether the risk information is considered on a singlehazard or aggregate basis. The EPRI rubrics were enhanced by the pilots to include uncertainty bounds on the hazard contributions and provide a visual representation of the ability of the PRA to quantify risk for the application. For conservative modeling assumptions not tied to a basic event, importance measures may not be amenable for ascertaining their impact on significant contributors. For those cases, a more holistic approach may be required. 14

15 Conclusions Some applications (e.g., component and operator action risk ranking) use importance measures for categorizing risk significance. However, the current guidance does address aggregation of importance measures. Having a robust uncertainty analysis is key to appropriately characterize the contribution of multiple hazards. Thus it is recommended that the recently published and upgraded uncertainty analysis NRC guidance, NUREG-1855, be piloted on using real applications. The pilot activity performed in this program provided both practical examples of the multi-hazard risk metric aggregation, which can benefit PWROG members in exercising this framework, along with valuable feedback for EPRI consideration. 15

16 Questions?