Perspective Chapter: PRA and Protective System Maintenance

Abstract

The processes used to manage protective system equipment failures as they relate to Probabilistic Risk Assessment (PRA) in the commercial nuclear power setting are reviewed. Efficacy of protection is governed by maintenance policy that includes system modification, maintenance inter-arrivals as a function of time, and upset inter-arrivals as a function of time. Such a maintenance policy is the one used in nuclear power plant protective systems. Observations described in this article include the impact of time-dependent activities associated with maintenance policy as they relate to endogenous and exogenous upset inter-arrival times. Methods evaluating maintenance policy reliant on combinatorial logic, such as PRA, fault trees, or event trees, may lead to ineffective maintenance policy decision-making for protective system efficacy. Recommendations for maintaining effective protections, and connections to engineering maintenance practice and regulations are made based on the implications that come from our observations. The importance of the issues described herein is that the relationship of design, maintenance, and repair policies must be properly understood and taken into account by process owners, operators, and investors, as well as regulators who specify and enforce protections in hazardous processes.

1. Introduction

On March 28, 1979 the United States commercial nuclear power program experienced its first major accident; the reactor core in Unit 2 at the Three Mile Island nuclear plant site in Harrisburg, Pennsylvania had overheated and melted down. Even considering this accident, it can be said, based on the safety record of commercial nuclear power in the United States, that the Nuclear Regulatory Commission (NRC) has successfully produced a regulatory structure that effectively manages risk of radioactive releases, especially from commercial nuclear power plants.¹ With the benefit of hindsight, this accident would help inform stakeholders to better manage risk from nuclear power plant accidents. Within the nuclear power industry, the Three Mile Island accident motivated development of the predictive modeling methods and risk analytics commonly in use today. Thus, before exploring the details of reactor protection risk analytics, it is important to review key engineering insights gained following the Three Mile Island accident. Only then can we understand how these insights are either accommodated or fail to be accommodated in risk analysis methods such as PRA.

1.1 The benefit of hindsight

As described by Kemeny (see [1], p. 43) and Rogovin (see [2], vol. 1, p. 12), the core melt accident at Three Mile Island started when an operator tried to clear a plugged system that supplied water to the primary reactor heat removal system used in electricity production (see [3], for decay heat process details). The operator became involved when a valve installed for the purpose of bypassing around the plugged system was not open ([1], pp. 47–48). Although the actions taken by the operator to clear the plugging were unsuccessful, the heat removal system was supplied with a backup protective system using a completely separate water supply. Unfortunately, the backup system’s valves were inadvertently left shut, rendering it ineffective ([1], p. 47). The NRC requirements imposed through regulation and designed by the plant owners and investors anticipated such a loss of cooling sequence so a fourth separate protective system was supplied that would directly inject cooling water into the reactor core to keep it cool. Up to this point, the reactor system had begun heating up causing a relief valve to open, as designed, to reduce pressure.² Unfortunately, the relief valve failed to close when the pressure dropped back to normal, a malfunction that went unrecognized by the operators. However, the fourth method provided to keep the reactor core from overheating started automatically and began cooling the reactor core. Thus far in the accident sequence, the status of the reactor core protections could be summarized as: (a) main water supply—plugged up, (b) bypass protection of main supply—valve shut, (c) third water supply system—valve shut, (d) reactor system relief valve—stuck open, (e) fourth cooling system—working and cooling.

Because the relief valve stayed open too long, the reactor pressure kept dropping and the water around the core began expand as it boiled. Water from the reactor core was then pushed into a surge volume where the reactor system water level is measured. Although water was actually being continuously lost from the core through the stuck relief valve, the operators were under the impression, based on the surge volume level, that the reactor system was filling up by the fourth (and final) cooling system and they shut it off. At this point, the plant entered a state where it would lose the ability to prevent the reactor core from melting and releasing radioactive material. An interesting detail is that even the malfunction of the relief valve sticking open was also anticipated and therefore a shutoff valve was provided; temperature measurements were put in place so the operators could understand if the relief valve was stuck open and they would know when the shutoff valve should be closed. The operators failed to close the valve even though the temperature measurement indicated they should ([1], p. 46).

Although the several protections put in place would make it almost unimaginable the reactor core could melt, the NRC required a final protective system designed to protect the public in accidents releasing radioactive material from the reactor core. This final protection was a building that could withstand a very high pressure burst and remain effectively airtight. This building is called the “containment building” and it is the final barrier to release of radioactive material in the event of a serious accident.³ Because the containment building was able to contain the radioactive materials until they could be properly managed, the public was not exposed to excessive radioactive material. The following considers what went wrong at Three Mile Island, what went right, and why?

1.1.1 What went wrong?

A complete description of the accident leading to core melt is given by Kemeny, but the main events could be summarized as: (a) the main cooling water supply was plugged up, (b) the backup system to keep the main water supply flowing was shut off, (c) the third backup system cooling water supply systems’ valves were shut, (d) the reactor pressure relief system (itself a protection against overpressure) caused the reactor system to lose water due the valve sticking open and, (e) the fourth backup water system was shut off due to factors such as: incorrect data interpretation; unobserved data or; misunderstanding the thermodynamics of isenthalpic expansion.

Actions by the operator working on the main water supply system caused the main flow path to shut off (an “initiating event”, see Sections 1.4, 3.2 and 5.3 and definition 5.2). The system that plugged up is added for chemical cleanup of the main water flow (see [1], p. 94). Although the possibility the chemical cleanup system could clog up was anticipated and protection had been added, the protective system failed to work because its bypass valve was not open; (see [1], p. 47–48), (see [2], vol. 1). The backup system with its valves shut (third main cooling system) did not operate for at least 8 min after it was needed. However this may not have directly made a difference in the core melt outcome (see [1], pp. 47, 91, 94). The reactor system relief valve opened at the right time but failed to close when the pressure had returned to normal; as a consequence, water continued to be released from the reactor system (see [1], pp. 28–29, 90–94). The fourth backup system that could have prevented the melt sequence started automatically and was working well but it was shut off by the operators (see [1], pp. 28, 89, 91, 93–94).

1.1.2 What went right?

As the accident progressed to melt, radioactivity monitors inside the plant began to show increasing levels of radiation. The radiation levels plus indications of increasing levels of water inside the reactor containment building gave the operators indications that an abnormal condition was present and worsening. Other indications, although working properly, were not seen or interpreted incorrectly by the operators thereby allowing the sequence to progress to core melt. By properly interpreting indications and taking appropriate actions in response, the operators may have kept the event from progressing. Even though instrument indications were “pointing” them to the possibility a dangerous event was in progress, the operators consistently failed to interpret critical indications correctly. It can be said that despite several backup systems and indications, the final most important element that went right was the NRC required a containment building acting as the final, in this case the fifth, barrier against radioactive material exposure to the public.

1.1.3 Why?

The things that went wrong at Three Mile Island were mostly attributable to human errors of commission or errors of omission brought on by equipment breakdowns: (a) error of commission, the failed attempt to unplug the main water line, (b) error of omission, the failure to open the bypass valve, (c) error of omission, leaving the emergency water line valves shut, (d) error of commission, turning off the fourth protective system, (e) the reactor system relief stuck open and, (f) the main water supply plugged up. That is, the operators either took action that was wrong, error of commission, or did not take action when required, error of omission. These errors can be attributed to causes such as lack of training, lack of engineering insight, carelessness, or simply not following procedures. These kinds of errors are difficult to eliminate even when attempts are made to overcome them. For example, a second check of the required valve position would have been a good idea for the emergency valves; however this method is not always effective.⁴

1.2 Probability, reality, and maintenance policy

One may be tempted to look back at the Three Mile Island accident and argue the probability for the accident was extremely unlikely. Acting on such temptations that is, applying ex-ante probabilities to ex-post observations, is improper. The accident at Three Mile Island Unit 2 actually happened rendering the ex-post probability irrelevant. Prior to the accident some experts would say that the probability was very small, possibly on the order of 1 chance in a million. Of the many scenarios anticipated in experts’ analyses of an ex-ante probability, the exact scenario that unfolded was unanticipated making their analyses irrelevant. Personnel misinterpreting indications, the actions taken due to the particular relief valve failure, and errors of commission were unanticipated as a scenario. The procedure for working on the chemical system could have required the operator to place the second protective system in service before starting the work as noted by Kemeny on page 47 of his report. In fact there are effectively limitless scenarios that may play out in the future. Solberg and Njå [4] state in their article “Reflections on the ontological status of risk”, only one of the many (truly infinite) possible scenarios can play out to produce a current “state of affairs”:

An important observation when we consider change or events is that when an event (a specified state of affairs) is manifested (when it happens) all other logically possible states of affairs are simultaneously excluded from manifestation. For this to be the case it would imply that there exists a whole range of possible future states of affairs, but only one of these would manifest at some point in time (the present).

(Solberg and Njå, 2012)

The discussion above is meant to point out why the accident at Three Mile Island happened even though the NRC and the plant design engineers endeavored to put in place protective systems intended to prevent progression to core melt. Before the accident occurred, a concerned citizen might question the design engineer in a conversation like the following:

Citizen, “What if the main cooling system gets plugged up?”

Engineer, “We thought of that and put in a bypass valve”.

Citizen, “What if the bypass valve doesn’t work?”

Engineer, “We also thought of that possibility and added a separate system to pump water in. We also know that if this happens, the reactor system will heat up causing pressure to increase. But before you ask, we added relief valves for this possibility”

Citizen, “What if the relief valve doesn’t work, will the system over pressurize?”

Engineer, “We thought of that too and added extra safety valves that would prevent overpressure”

Citizen, “But even so, there is no more cooling system left”

Engineer, “We put in yet another separate system to pump water in the reactor system just in case the other systems don’t work”

At this point the citizen might reasonably stop asking questions, satisfied the NRC and the plant engineers had really thought of everything that could go wrong in the future.

It is clear that when a substantial hazard is present in a technological system, many questions need to be asked and answered, and many scenarios considered in detail. At Three Mile Island, the particular hazard was the need to remove decay heat from the reactor system over a relatively long period of time. Even though many questions may be asked and answered, once a technological system is started, we take a leap into the unknown. No one can say for sure what future scenarios may play out. Some may lead to great loss, injury, or even death. The maximum level of harm that could result from various failures in a technological system is almost certainly known by the engineers who design it. On the other hand, unless large datasets are available, the numerical probability value they would would occur cannot be known. Depending on the value of the technological system to the social welfare, those valuable enough to be allowed by law are most likely subject to regulation designed to protect citizens’ safety and health.

1.3 Protective systems

Technological systems required by regulation are referred to as “protective systems”. Such protective systems overlay technological systems operated for the purpose of maximizing profit. They differ from production systems in that they do not create products with a utilitarian purpose. Instead, protective systems function to reduce the probability that citizens would need to backstop losses from risks taken in owner and investor activities that exceed the investors’ asset value. No one, not those maximizing profit, not the regulator, not the engineers, and not any independent scientific authority can know the probability or likelihood that a technological system in use will or will not cause harm with exactitude.

Protective systems add to the cost of goods and services. In so doing, they will generally balance the reduction of profit margins against the price citizens are willing to pay for the goods and services produced. In competitive markets, profit maximizers will look for opportunities to reduce costs imposed by protective systems. A subtlety created by the process of cost reduction is that profit maximizers will tend to look at all costs that go against their revenue including production costs in maintenance and operation. A reasonable question would be “does it matter to citizens if the maintenance and operational costs of the production systems are reduced if citizens require the regulator to make sure the protective systems are maintained up to standards?” The subtlety created by reducing costs in technological systems other than protective systems is that protective systems are required to protect against harms more often than if the production systems were operating smoothly. Regarding the Three Mile Island accident, Kemeny points out that,

Review of equipment history for the 6 months prior to the accident showed that a number of equipment items that figured in the accident had had a poor maintenance history without adequate corrective action. These included . . . the condensate polishers.

(Kemeny, 1979)

Failure of the condensate polishers at Three Mile Island triggered the sequence of events leading up to the core melting.⁵ This “trigger” is commonly referred to as an “initiating event”; the first event in a series of events that may end with unpleasant consequences. he importance of these initiating events is that the more often they occur, the more often the protective systems will be called upon to operate and because their failure probability can not be known, citizens should be concerned if the maintenance and operational costs of the production systems are reduced to the point more triggers occur.

Whenever a protective system allows an initiating event to progress to harm, it is made obsolete by revision that would address the root cause of its failure. The NRC made substantial changes to protective system requirements in the nuclear reactors it regulates following the Three Mile Island accident. No one can know the probability a technological system that has the potential for harm will, or will not, cause harm over its useful lifetime in the absence of substantial data sets where harm has occurred. This well-known principle is classically described by Cardano and Wilks [5] and more formally by Bernoulli [6].⁶ As technological systems are operated, protective systems that overlay them should be revised as necessary in light of new information to the point the technological systems are judged to be less harmful than the harms they are designed to overcome. Because protective systems add cost to the production of goods and services produced by technological systems, there is a balance, driven largely by market forces, to be struck among the cost of production, profit margin, and protection.

1.4 Predictive modeling for safety: critical protections

The concept of PRA is introduced in here at a very high level. In practice, PRA and other methods used to quantify probabilities and frequencies, are fundamentally derived from logical descriptions of a technological system’s response to an “upset”, or initiating event. Figure 1 is an example of such a logical description that envisions a technological system that “operates”, Z, on an initiating event input, I, to produce “outputs”, O. Z creates at least $2^n$ outputs by assigning probabilities that split I at each of n devices. The splits are conditional such that if $P_{\left(\cdot \right)}$ is the probability for failure of the device, one branch of the split is assigned $P_{\left(\cdot \right)}$, and the other ${\overline{P}}_{\left(\cdot \right)}$.

Figure 1.

A primitive event sequence logic for a protective system having three devices in parallel (1/3 logic).

Such probability models, with various levels of sophistication, are used to characterize the efficacy of safety-critical protections.⁷ Understanding protective system modeling discussed here necessarily assumes a postgraduate familiarity with stochastic processes distinguishing it from the treatment PRA practitioners use. Stochastic dynamics of safety-critical protections are defined in a general setting allowing treatment of efficacy analysis in a top-down manner starting at general predictive modeling followed by exploration of consequences inherent in the simplifying assumptions required of popular risk quantification methods such as PRA, Quantitative Risk Assessment (QRA), and Probabilistic Safety Assessment (PSA).

Models of efficacious protective system design and management cannot be informed by “probability numbers”—such numbers are unavailable as a practical matter. This is to say, the condition “safe enough” is almost never expressible as a numerical probability as argued by Hansson (see [7, 8, 9], for perspectives on safety). Hence, efficacy of protective systems should rightly be explored in terms of insights from the mathematical structure of stochastic processes serving as predictive models. To this end, the following develops models at a level of abstraction sufficient to capture stochastic structures that agree with practical engineering understandings. Most importantly, a top-down exposition leads to straightforward identification of the particularizing assumptions necessary to calibrate reactor protective system stochastic predictive models with observational data. In other words, the engineering physics that must hold to compute valid statistical estimates of risk metrics can be identified. Hansson in ([10], Section 4) sets the stage where statistical models can be calibrated and where they cannot.

Clearly, hazardous technologies and their protections are engineered systems that operate according to laws of physics, and their operational behaviors are governed by ongoing design, maintenance, and management decisions. These systems are carefully monitored over time so that information gained can direct re-designs and maintenance intended to improve productivity and safety. Of course, our uncertainty regarding how protections might perform in the future is, at best, a reflection of our historical understanding of physical behaviors, both technological and environmental. For example, we cannot forecast the future arrival of possible operational problems, the possibility of which we are a priori unaware.⁸ Thus, any understanding of the efficacy of protections must connect physics with a time-dependent state of knowledge about that physics. In this regard, filtered probability spaces are indispensable when exploring engineered protective system efficacy.

System physics are approached in here from an operations perspective to establish the analytical framework within which physical features can be mathematically described as time dependent functionals. This framework will be sufficiently general to accommodate most hazardous production systems. Analytical modeling of operations is concerned with characterizing a system’s temporal dynamics as the evolution of a system’s “state” over time. Almost always, operations is concerned with predicting, up to probability law, transitions among particular sets of system states given certain observable historical behaviors. Such transition dynamics are captured as stochastic processes.

The theory of stochastic processes is mature and provides a valid framework for understanding operations—derivations or detailed explanations of the central results applied in here are found in the widely accessible literature. Avoiding repetition, operation of hazardous systems and their protections are modeled in here by a stochastic point process and cited in the appropriate literature without proof.

2. Construction of accident counting processes for reactor risk analysis

Consider Figure 2 showing how causality is aggregated from the underlying physics of nature, through the limitations of engineering understanding of the physics, up to the operational level where the physics is collapsed to observations functional or failed or, more succinctly, [0,1]. Risk quantification is done on observations whereby probabilities are assigned to events. Such probabilities are assumed in a probability space with events in sets of failure outcomes, $o_{\left(\cdot \right)},$ taking place at the level of the underlying physics shown in Figure 2.

Figure 2.

Concept of knowledge aggregation from the underlying physics (both known and unknown) up to the operational level of observation.

2.1 Physics: based modeling in a general stochastic setting

Protective systems safeguard against future accidents. The design of protective systems necessarily relies on deterministic physical laws (physics) embedded within a stochastic framework that analytically captures uncertainty about future protection behaviors. This stochastic setting yields predictive models useful for understanding the efficacy of given protection designs. We establish the following:

Definition 2.1 (Object). A collection of devices, subsystems, systems, and environments enclosed within a specified logical control volume.

Definition 2.2 (State). The unique numerical assignment to specific features of an object’s physical condition (typically in SI units).

Definition 2.3 (State Space). The set of all possible object states.

Definition 2.4 (State Variable). A mapping from the domain of an object’s physical condition into its state space.⁹ Typically, state variables are indexed by time.

Definition 2.5 (State Trajectory). The evolution of an object’s state over a collection of specific time intervals.

Definition 2.6 (Predictive Models). Probability laws with an object’s state variables indexed by time. Predictive models typically include a time $t=0$ that delineates future from past.

Remark 1 Predictive models do not predict the future. Rather, they frame uncertainty about future physical behaviors in terms of the present state of knowledge.

Objects of modeling interest can be comprised of subordinate objects; that is, an object can be the logical union of other objects. An object is atomic if it is not composed of subordinate objects. It follows that, an object’s state space is defined on the union of its subordinate atomic object state spaces. The state of an object typically evolves over time. Hence, predictive modeling requires not only specifying the state variable mappings that assign state values to material and environmental conditions, but also crafting a mathematical characterization of the interaction of an object’s state variables over time. The control volume defining any object connects its features with the laws of physics that govern its evolution, and it is our understanding of physics that allows us to mathematically characterize the time dependent interaction among an object’s state variables. The time dependent behavior of an object’s state is referred to as a state trajectory. The physical laws that govern state trajectories are, of course, specific to the object being modeled. Inasmuch as one’s interests lie with establishing a mathematical framework within which predictive models for hazardous technologies can be crafted, they need only make reference to specific physics where application dictates.

Remark 2 Valid predictive models must respect two practical engineering constraints: 1) State trajectories are never physically observable beyond the present, and 2) Engineers are not clairvoyants. Valid predictive models are strictly informed by historical information, while allowing for the acquisition of additional information as the object’s future unfolds (see [11], for an interesting perspective). The evolution of information history cannot be omitted from valid predictive models.

2.1.1 Life cycle, state trajectories, and the state process

The terminology life cycle is used when referring to object state trajectories that are defined over the entire open time interval $\left(-\infty ,+\infty \right)$, giving a complete history of an object’s state over time. In predictive modeling, an object’s life cycle is rarely, if ever, identifiable with certainty at any finite time, and one must must be satisfied with expressing the likelihood that an observed state trajectory belongs to a specified collection of possible life cycles.

Clearly, an object’s life cycle is determined by the physics within its control volume. In the usual manner, let the domain of an object’s state variables be $\mathrm{\Omega }$, the collection of possible physical outcomes the object can experience. Further, let $\mathcal{F}$ be a $\sigma$-algebra on $\mathrm{\Omega }$ such that $\left(\mathrm{\Omega },\mathcal{F}\right)$ forms a measurable space.

Elements of $\mathcal{F}$ are subsets of possible physical outcomes with a defined probability measure expressing the likelihood that a given subset of measurable outcomes contains an outcome of specific interest. P is a set function $P:\mathcal{F}\to \left\{0,1\right\}$, the triple $\left(\mathrm{\Omega },\mathcal{F},P\right)$ forms a standard probability space (see [12], for a formal development).

Now, if $Z_t$ is the object’s state at time t, where $Z_t:\left(\mathrm{\Omega },\mathcal{F}\right)\to \left(S,\mathcal{B}\left(S\right)\right)$, for $t\in \mathbb{R}$, then $Z_t$ is a measurable state variable mapping.¹⁰ If A is a measurable subset of $\mathbb{R},Z_t\left(\omega \right):{\mathbb{R}}_{+}\to S,$ and $t\in A$, then fixed $\omega \in \mathrm{\Omega }$, forms a state trajectory under physical outcome $\omega$. When $A=\mathbb{R},Z_t\left(\omega \right)$ becomes the object’s life cycle under outcome $\omega$. Now, without loss of generality, require that for all $\omega \in \mathrm{\Omega }$ and $t\in \mathbb{R},Z_t\left(\omega \right)$ be right-continuous with left-hand limits. It then follows that the collection of random variables $\left\{Z_t;t\ge 0\right\}$ forms a stochastic process, with state space S. $\mathbf{Z}=\left\{Z_t;t\ge 0\right\}$ is referred to as an object’s state process.

2.1.2 Probability law and validation

Predictive modeling requires framing uncertainty about an object’s state through a probability law${\mathrm{ℒ}}_{\mathbf{Z}}:\mathcal{B}\left(S\right)\to \left[0,1\right]$ on its state process. Here, for each n-sequence two-tuple ${\underset{¯}{B}}_{{\underset{¯}{t}}_n}=\left(\left(t_1,B_1\right),\dots ,\left(t_n,B_n\right)\right)$ such that $t_i\in {\mathbb{R}}_{+}$ and $B_i\in \mathcal{B}\left(S\right),i=1,\dots ,n<\infty ,$

$${\mathrm{ℒ}}_{\mathbf{Z}}\left({\underset{¯}{B}}_{{\underset{¯}{t}}_n}\right)\equiv P\left(\bigcup _{i=1}^n{Z}_{t_i}^{-1}\left(B_i\right)\right)=P\left\{\omega \in \mathrm{\Omega }:Z_{t_1}\left(\omega \right)\in B_1,\dots ,Z_{t_n}\left(\omega \right)\in B_n\right\}.$$E1

The measurability of all state variables in Z ensures that its probability law ${\mathrm{ℒ}}_{\mathbf{Z}}$ defines a probability measure on the measurable space $\left(S,\mathcal{B}\left(S\right)\right)$. Hence, uncertainty associated with any physics-based predictive model is captured on the probability space $\left(S,\mathcal{B}\left(S\right),{\mathrm{ℒ}}_{\mathbf{Z}}\right)$.

Definition 2.7 (Predictive Model). For an object with state processZdefined on$\left(\mathrm{\Omega },\mathcal{F},P\right)$, the probability space$\left(S,\mathcal{B}\left(S\right),{\mathrm{ℒ}}_{\mathbf{Z}}\right)$is the object’s predictive model.

Validity of a specific predictive model $\left(S,\mathcal{B}\left(S\right),{\mathrm{ℒ}}_{\mathbf{Z}}\right)$ requires that it agree with both the physics underlying Z and historical observations of physical behaviors of the object that Z represents. Without crawling deeply into the weeds of model validation, it is easily reasoned that the degree of difficulty in proving validity is greatly influenced by the cardinality of both S and $\mathcal{B}\left(S\right)$. Suffice it to say that large state spaces associated with complicated object trajectories and large information bearing $\sigma$-algebras $\mathcal{B}\left(S\right)$ require vast amounts of observational data to prove model validity. In fact, validating $\mathcal{B}\left(S\right)$ is almost always a practical impossibility, since quantifying the probability law ${\mathrm{ℒ}}_{\mathbf{Z}}$ stands among the most challenging aspects of stochastic modeling. However, careful stochastic analysis provides a direct means of identifying invalid models.

Observation 1 A necessary condition for an object’s state process to be valid is that it must be congruent with well-understood physics. Conversely, in circumstances where Z is not congruent with well-understood physics, it immediately follows that the object’s predictive model $\left(S,\mathcal{B}\left(S\right),{\mathrm{ℒ}}_{\mathbf{Z}}\right)$ must be invalid.

Observation 1 reveals the importance of stochastic modeling in a general setting where an object’s physics–based behaviors are mapped into time–dependent state trajectories. While proving validity of a predictive model is rarely an achievable engineering objective, it is often straightforward to recognize invalidity of specific models. The following Section 2.2 points out how popular risk modeling methodologies for protective system operations can easily obscure underlying physics and can result in a failure to recognize model invalidity.

2.2 Stochastic modeling: production, protection and environment

When concern lies with the efficacy of protections, Z is understood to model an object representing a hazardous production system protections with S as the object state space, onto which all underlying physics is mapped. Designate three subordinate objects as: a production system, a protective system, and an environment.¹¹ Without loss of generality, assume that these three subordinate objects are mutually exclusive (i.e., their respective control volumes do not intersect); mutual exclusivity does not imply that production, protection, and environment operate independently.

The mutual exclusivity of production, protection, and environment ensures that state space S is formed as the cross product of the subordinate object states. Here,

$$S=S^X\times S^R\times S^Y,$$E2

where

$S^X$ is the subspace of production system states,

$S^R$ is the subspace of protection system states, and.

$S^Y$ is the subspace of environment states.

Take the subspaces identified in Eq. (2) to each be a manifold with boundary. By definition, any element of $S^X$ numerically characterizes a production state. Similarly, elements of $S^R$ quantify protection states, while subsets of $S^Y$ describe an environmental state within which production and protection exist. Now,

$$\begin{array}{l}\mathbf{X}=\left\{X_t:t\ge 0\right\},\text{is\hspace{0.17em}\hspace{0.17em}the\hspace{0.17em}\hspace{0.17em}production\hspace{0.17em}\hspace{0.17em}state\hspace{0.17em}\hspace{0.17em}process},\text{where}\\ X_t:\left(\mathrm{\Omega },\mathcal{F}\right)\to \left(S^X,\mathcal{B}\left(S^X\right)\right)\text{is\hspace{0.17em}\hspace{0.17em}the\hspace{0.17em}\hspace{0.17em}production\hspace{0.17em}\hspace{0.17em}system\hspace{0.17em}\hspace{0.17em}state}\mathrm{at}\text{time}t;\end{array}$$

$$\begin{array}{l}\mathbf{R}=\left\{R_t:t\ge 0\right\},\text{is\hspace{0.17em}\hspace{0.17em}the\hspace{0.17em}\hspace{0.17em}protection\hspace{0.17em}\hspace{0.17em}system\hspace{0.17em}\hspace{0.17em}state\hspace{0.17em}process},\text{where}\\ R_t:\left(\mathrm{\Omega },\mathcal{F}\right)\to \left(S^R,\mathcal{B}\left(S^R\right)\right)\text{is\hspace{0.17em}\hspace{0.17em}the\hspace{0.17em}\hspace{0.17em}protection\hspace{0.17em}\hspace{0.17em}system\hspace{0.17em}\hspace{0.17em}state}\mathrm{at}\text{time}t;\text{and}\end{array}$$

$$\begin{array}{l}\mathbf{Y}=\left\{Y_t:t\ge 0\right\},\text{is\hspace{0.17em}\hspace{0.17em}the\hspace{0.17em}\hspace{0.17em}environment\hspace{0.17em}\hspace{0.17em}state\hspace{0.17em}\hspace{0.17em}process},\text{where}\\ Y_t:\left(\mathrm{\Omega },\mathcal{F}\right)\to \left(S^Y,\mathcal{B}\left(S^Y\right)\right)\text{is\hspace{0.17em}\hspace{0.17em}the\hspace{0.17em}\hspace{0.17em}protection\hspace{0.17em}\hspace{0.17em}system\hspace{0.17em}\hspace{0.17em}state}\mathrm{at}\text{time}t.\end{array}$$

And, by construction $\mathbf{Z}=\left(\mathbf{X},\mathbf{R},\mathbf{Y}\right)$, and for all $t\ge 0$

$$Z_t=\left(X_t,R_t,Y_t\right):\left(\mathrm{\Omega },\mathcal{F}\right)\to \left(S,\mathcal{B}\left(S\right)\right)$$E3

where

$$\mathcal{B}\left(S\right)=\mathcal{B}\left(S^X\right)\otimes \mathcal{B}\left(S^R\right)\otimes \mathcal{B}\left(S^Y\right).$$E4

2.2.1 Dependency among production, environment, and protection

By convention, take all trajectories of X, R, and Y to be càdlàg (right-continuous with left-hand limits). S partitioned with $S^X,S^R,$ and $S^Y$ allows framing the interaction among production, protection and environment over time. It is understood that the temporal dynamics of these three stochastic state processes are not mutually independent. Here, with the $\sigma$-algebras respectively generated by the processes X, S, Y, and Z written as

$${\mathcal{F}}^X\equiv \sigma \left(\mathbf{X}\right)=\underset{t\to \infty }{lim}{\mathcal{F}}_t^X=\sigma \left\{X_u;-\infty <u\le t\right\},$$E5

$${\mathcal{F}}^R\equiv \sigma \left(\mathbf{R}\right)=\underset{t\to \infty }{lim}{\mathcal{F}}_t^R=\sigma \left\{R_u;-\infty <u\le t\right\},$$E6

$${\mathcal{F}}^Y\equiv \sigma \left(\mathbf{Y}\right)=\underset{t\to \infty }{lim}{\mathcal{F}}_t^Y=\sigma \left\{Y_u;-\infty <u\le t\right\},$$E7

$${\mathcal{F}}^Z\equiv \sigma \left(\mathbf{Z}\right)=\underset{t\to \infty }{lim}{\mathcal{F}}_t^Z=\sigma \left\{Z_u;-\infty <u\le t\right\}.$$E8

There can exist some $B_Z=B_X\cup B_R\cup B_Y\in {\mathcal{F}}^Z$, where $B_X\in {\mathcal{F}}^X,B_R\in {\mathcal{F}}^R$ and $B_Y\in {\mathcal{F}}^Y$ such that

$$P\left(B_X\cap B_R\cap B_Y\right)\ne P\left(B_X\right)\cdot P\left(B_R\right)\cdot P\left(B_Y\right).$$E9

Dependence among X, R, and Y is intuitively clear: The production state X and the protection state R both depend on Y, the common environment within which they operate. So, there is some $B\in S$ such that the likelihood that production and protection are in B at time $t\ge 0$ must as a matter of physics depend on the evolution of their common operating environment. For example the arrival of natural disasters and the wear-out rate of equipment are physics-based environmental influences on both production and protection. Thus,

$$\begin{array}{l}P\left(X_t\in B|Y_u;u\le t\right)\ne P\left(X_t\in B\right)\\ P\left(R_t\in B|Y_u;u\le t\right)\ne P\left(R_t\in B\right),\end{array}$$E10

and, consequently, X, R are not generally independent. However, the future environment process Y is typically uninfluential on the histories of production and protection; we call this the Lack of Anticipation Property (LAP).

Definition 2.8 (Lack of Anticipation Property). For all $t,s\ge 0$ and $B\in \mathcal{B}\left(S\right)$,

$$P\left(Y_{t+s}\in B|X_u,R_u:u\le t\right)=P\left(Y_{t+s}\in B\right)$$E11

The LAP plays a central role in predictive modeling of safety-critical protections, and is represented schematically in Figure 3.

Figure 3.

Schematic of dependence among production, protection, and environment trajectories.

2.2.2 Information flow and filtrations

Time and state dependencies among X, R and Y are informed by the flow of historical information. Information is characterized in a time indexed collection of sub-$\sigma$-algebras ${\left\{{\mathcal{F}}_t\right\}}_{t\ge 0},$ often called a history, forming a filtration augmenting the standard probability space on which state variables are defined. Here, the filtered probability space $\left(\mathrm{\Omega },\mathcal{F},{\left\{{\mathcal{F}}_t\right\}}_{t\ge 0},P\right)$ is such that the state variables $Z_t=\left(X_t,R_t,Y_t\right)$ are ${\mathcal{F}}_t$-measurable for all $t\ge 0$. This filtration has the standard properties where,

Property 1${\mathcal{F}}_0$ contains all P–null sets (completeness).

Property 2${lim}_{s\downarrow 0}{\mathcal{F}}_{t+s}\triangleq {\cap }_{s>t}{\mathcal{F}}_s={\mathcal{F}}_t$ (right–continuity).

Property 3${\mathcal{F}}_t\subseteq {\mathcal{F}}_{t+s}$ (monotonicity).

Property 4${lim}_{t\to \infty }{\mathcal{F}}_t{\triangleq \vee }_{t\ge 0}{\mathcal{F}}_t=\mathcal{F}$ (convergence).

The first property is an easily satisfied technical requirement from measure theory. The remaining three properties are normative and intuitively understandable. Property 2 indicates that the acquisition of engineering information is not necessarily smooth, with no information acquired in certain time intervals, while large amounts can be acquired at certain points in time. Property 3 asserts that information gained through discovery is not lost over time. Property 3 and Property 4 acknowledge that one cannot be convinced that all useful modeling information will be revealed prior to the end of lifecycles.

All information (engineering design, maintenance, operations, weather, management, etc.) associated with all possible object life cycles is contained in $\mathcal{F}$. Information available at time $t<\infty$ is limited to the sub-$\sigma$-algebra ${\mathcal{F}}_t$. Note that information represented in ${\mathcal{F}}_t$ is not necessarily limited to ${\mathcal{F}}_t^Z$, the $\sigma$-algebra generated by $\left\{Z_u;u\le t\right\}$ (for example, maintenance schedules are not directly represented in ${\mathcal{F}}_t^Z$, but they are extremely useful in predictive modeling). Thus, in general, ${\mathcal{F}}_t^X,{\mathcal{F}}_t^R,$ and ${\mathcal{F}}_t^Y$ are each sub-$\sigma$-algebras of ${\mathcal{F}}_t^Z$, and ${\mathcal{F}}_t^Z\subset {\mathcal{F}}_t$, for all $t\ge 0$.

Remark 3 Predictive modeling must rely on presently available information. With $t=0$ taken as the beginning of all lifecycles in $\mathrm{\Omega }$, the sub-$\sigma$-algebra ${\mathcal{F}}_t$ contains all modeling information acquirable by time $t\ge 0$. The filtration ${\left\{{\mathcal{F}}_t\right\}}_{t\ge 0}$ contains all acquirable information flows over all possible complete lifecycles. ${\left\{{\mathcal{F}}_t\right\}}_{t\ge 0}$ is indispensable in predictive modeling because it enables modelers to represent the current state of knowledge. Omitting filtrations from predictive modeling implies that all possible modeling information is available at time $t=0$; that is, one assumes that ${\mathcal{F}}_t=\mathcal{F}$ for all $t\ge 0$. The filtered probability space $\left(\mathrm{\Omega },\mathcal{F},{\left\{{\mathcal{F}}_t\right\}}_{t\ge 0},P\right)$ allows modelers to characterize their uncertainty about state variable values as a conditional (on available information) probability. For example with $t,s\ge 0,P\left(Z_{t+s}\in B\right)\mid {\mathcal{F}}_t)$ is the likelihood that the state of a reactor and its protection will be in condition $B\in \mathcal{B}\left(S\right)$ at time $t+s$, given the information available at time t.

2.2.3 Calibrating probability law

In recent years, Uncertainty Quantification (UQ) has emerged as a topic of considerable interest in risk analysis and safety engineering. Generally as the name suggests, UQ explores means to measure or judge the size of uncertainty. In the context of a nuclear reactor with regulated safeguards, operators and regulators are concerned with the efficacy of protection, and the predictive model $\left(S,\mathcal{B}\left(S\right),{\mathrm{ℒ}}_{\mathbf{Z}}\right)$ provides them a functional relationship between life cycle physics and uncertainty. Without exception, any useful UQ metric $m\left(\cdot \right)$ maps probability law into a real-valued n-vector; that is, $m:{\mathrm{ℒ}}_{\mathbf{Z}}\to {\mathbb{R}}^n,n\ge 1.$ With $B\in S$ taken as the support of m, it is required that m be $\mathcal{B}\left(B\right)$-measurable. This mild measurability restriction admits UQ metrics that might not require a complete characterization of the probability law ${\mathrm{ℒ}}_{\mathbf{Z}}$. Nonetheless, all UQ metrics require that (if not all) at least some part of ${\mathrm{ℒ}}_{\mathbf{Z}}$ be calibrated. Calibrating ${\mathrm{ℒ}}_{\mathbf{Z}}$ is generally quite challenging.

Recall from the Kolmogorov Extension Theorem that specifying the probability law ${\mathrm{ℒ}}_{\mathbf{Z}}$ is equivalent to specifying all finite joint distributions on the state process $\mathbf{Z}=\left\{Z_t;t\ge 0\right\}$ [13]. Of course, there is generally an uncountable number of finite joint distributions on stochastic processes that evolve over continuous time. So, unless the state process Z exhibits very special independence properties (e.g., regeneration, stationarity, ergodicity) in combination with a small support for the UQ metric m, the amount of historical data required to statistically calibrate elements of ${\mathrm{ℒ}}_{\mathbf{Z}}$ is staggering.

Intuitively, crafting UQ metrics on predictive models that are useful for informing the efficacy of reactor protections boils down to:

1. Deciding how much detail a predictive model must include to support UQ metrics that modelers believe are useful in supporting reactor operation and public policy decisions.

2. Calibrating the needed elements of ${\mathrm{ℒ}}_{\mathbf{Z}}$ using historical information.

In practice, when particularizing Z to a specific reactor and safety–critical protective system, choosing a fine granularity on the support of any UQ metric $m:{\mathrm{ℒ}}_{\mathbf{Z}}\to {\mathbb{R}}^n$ introduces a model calibration burden for ${\mathrm{ℒ}}_{\mathbf{Z}}$ that is typically insurmountable. Section 4 reviews a collection of very strong underlying modeling assumptions required to calibrate Core Damage Frequency (CDF), the widely used UQ metric that is integral to the popular PRA methodology. The bottom line, here, is that UQ can never escape the challenges of calibrating ${\mathrm{ℒ}}_{\mathbf{z}}$; thus, UQ metrics applied to reactor protective system efficacy analysis should be evaluated with a healthy engineering mistrust.

3. Operations modeling

Operations generally refers to the study of stochastic point processes that are embedded within an object’s state process Z. It follows that in operations modeling and analysis time is the only physical variable of interest. An operations point process is typically embedded within Z and generates an increasing sequence of random times $\left\{T_n;n\in \mathbb{N}\right\}$ identifying the times of occurrence of a particular non-quantitative feature of Z that is identifiable through observable state changes. In principle, the state space S is covered with a partition $G\in \mathcal{B}\left(S\right)$, where G is an at most countable collection of sets. The elements of G correspond to important non-quantitative features on the state space S, and the random variable $T_n$ marks the time of the nth occurrence of a state transition from one particular element of G to another.

In operations modeling there are practical measurability issues that must be considered when examining transitions among elements of the state space G by the trajectories of state process Z (which is, of course, adapted to the filtration ${\left\{{\mathcal{F}}_t\right\}}_{t\ge 0}$ of the filtered probability space $\left(\mathrm{\Omega },\mathcal{F},{\left\{{\mathcal{F}}_t\right\}}_{t\ge 0},P\right)$).

1. In principle, $Z_t^{-1}\left(G\right)$ must be $\mathcal{F}$-measurable for all $t\ge 0$.

2. There is no guarantee that $Z_t^{-1}\left(G\right)\in {\mathcal{F}}_t^Z$.

3. There is no guarantee that $Z_t^{-1}\left(G\right)\in {\mathcal{F}}_t$ (even when $Z_t^{-1}\left(G\right)\in \mathcal{F}$).

If $Z_t^{-1}\left(G\right)\notin {\mathcal{F}}_t$, then for all $t\ge 0$ there can exist important, and as yet undiscovered, operations events that may be observed in the future. The very practical circumstances where $Z_t^{-1}\left(G\right)$ is not ${\mathcal{F}}_0$-measurable are explored in Section 4.

In the remainder of this section, except where otherwise noted, the typical development of operations modeling where random quantities are defined on a standard probability space $\left(\mathrm{\Omega },\mathcal{F},P\right)$, free from the information flow dynamics characteristic of filtered probability spaces, is followed.

Remark 4 Operations modeling is common in engineering practice. For example in reliability analysis $G=\left\{B,B^c\right\}$ partitions the state space S such that B is the collection of all reliable states. The standard indicator mapping $1_B:\left(S,\mathcal{B}\left(S\right)\right)\to \left(\left\{0,1\right\},\sigma \left(\left\{0,1\right\}\right)\right)$ of physical states into the set {0, 1} defines a unit-less random variable on the probability space $\left(S,\mathcal{B}\left(S\right),{\mathrm{ℒ}}_{\mathbf{Z}}\right)$. The object’s availability process $\mathbf{A}\triangleq \left\{A_t;t\ge 0\right\}$, where $A_t=1_B\left(Z_t\right),$ has trajectories that proceed only in jumps (up or down) of magnitude one.¹² When $T_n$ is taken as the time of the nth downward jump of A, the sequence $\mathbf{T}\triangleq \left\{T_n;n\in \mathbb{N}\right\}$ corresponds to a stochastic point process marking time epochs of object state transition from working to failed. The failure-time process T is clearly subordinate to the state process Z. It is the point processTthat characterizes object failures from an operations perspective.

An operations point process T is often analyzed through its corresponding counting process Q. Here,

$$\mathbf{Q}\triangleq \left\{Q_t;t\ge 0\right\},$$E12

where,

$$Q_t=\sum _{n=1}^{\infty }{1}_{\left[0,t\right]}\left(T_n\right)$$E13

counts the number of operations epochs appearing in the closed time interval [0, t]. There is an obvious one-to-one correspondence between the sequence $\left(T_n\left(\omega \right);n\in \mathbb{N}\right)$ and the trajectory $Q_t\left(\omega \right),t\ge 0)$ for each $\omega \in \mathrm{\Omega }$ – a plot of one directly reveals the other. It easily follows that, for all $n\in \mathbb{N}$ and $t\ge 0,\left\{Q_t\le n\right\}=\left\{T_n\ge t\right\}$ which directly implies the distributional relationships

$$\begin{array}{l}P\left(Q_t\le n\right)=1-P\left(T_n<t\right)\\ E\left[Q_t\right]=\sum _{n=1}^{\infty }P\left(T_n\le t\right).\end{array}$$E14

The operations point process T analysis is approached through its corresponding counting process Q which is accessible through the martingale calculus.

3.1 Classification of states for reactor operations with protections

Consider now an object representing a nuclear reactor, its regulated protections, and the environment within which the reactor and protections operate. The state process Z is defined, as before, in Section 2.2.2. Operations modeling and analysis begins with partitioning the state space S according $G=\left\{G_p,G_p^c\right\}$ where $G_p\in \mathcal{B}\left(S\right)$ is the set of all persistent states and its complement $G_p^c$ is called the transient states. The set $G_p$ is closed under all trajectories. That is, for all $s\in G_p$ and $\omega \in \mathrm{\Omega }$

$$\underset{t\to \infty }{lim}\sum _{0<u\le t}{1}_{G_p}\left(Z_u\left(\omega \right)\right)\cdot 1_{G_p^c}\left(Z_{u-}\left(\omega \right)\right)=0;$$E15

thus, once entering the set of all persistent states $G_p$, a trajectory $Z_t\left(\omega \right)$ cannot depart the set. $s\in G_p$ is an absorbing state if for all $\omega \in \mathrm{\Omega }$

$$\underset{t\to \infty }{lim}\sum _{0<u\le t}{1}_{\left\{s\right\}}\left(Z_u\left(\omega \right)\right)\cdot 1_{{\left\{s\right\}}^c}\left(Z_{u-}\left(\omega \right)\right)=0.$$E16

Clearly, absorbing states are persistent.

As a practical matter, require that all trajectories $Z_t\left(\omega \right),\omega \in \mathrm{\Omega }$ and $t\ge 0$, of the state process terminate with retirement.¹³ Retirement occurs as either, (1) an inconsequential cessation of production, or (2) the consequence of an accident from which the reactor cannot recover. Once the reactor trajectory enters a retirement state, production terminates forever. All retirement states are taken as absorbing. Thus the absorbing states, designated $R\subset S$, and transient states designated $R^c$, partition S. The transients states $R^c$ can themselves be partitioned such that N are normal operating states and D distressed operating states. Clearly, the sets {N, D, R} also partition S. The possible state transitions among the elements of this partition are shown in Figure 4.

Figure 4.

Partitioned state transition diagram for state process Z.

3.2 The initiating event counting process

Recall that state variables are the three-tuple formed by $Z_t\triangleq \left(X_t,R_t,Y_t\right)$. Thus, when a trajectory $X_t\left(\omega \right),\omega \in \mathrm{\Omega }$ and $t\ge 0$, of the production state process leaves the normal operating states $N\cap S^X$ and enters the distressed states $D\cap S^X$, an initiating event has occurred. Recalling that by convention all state trajectories are right-continuous and thus càdlàg, all initiating events occur at the exact instant of transition from $N\cap S^X$ to $D\cap S^X$. Arrival of an initiating event indicates that the reactor protective system should engage so as to mitigate potential harm that might arise with the reactor operating in the distressed states. In practice, initiating events are often (although not always) observable.

For all $\omega \in \mathrm{\Omega }$ and $t\ge 0$, define

$${\mathit{dQ}}_t\left(\omega \right)\triangleq 1_{\left\{D\cap S^X\right\}}\left(X_t\left(\omega \right)\right)\cdot 1_{\left\{N\cap S^X\right\}}\left(X_{t-}\left(\omega \right)\right).$$E17

Clearly for $t>0,{\mathit{dQ}}_t:\mathrm{\Omega }\to \left\{0,1\right\}$ is a random variable on the measurable space of possible life cycles $\left(\mathrm{\Omega },\mathcal{F}\right)$. For all $\omega \in \mathrm{\Omega }$ and $t\ge 0$, it follows that

$$Q_t\left(\omega \right)={\int }_{\left(0,t\right]}{\mathit{dQ}}_u\left(\omega \right)\triangleq \sum _{0<u\le t}{1}_{\left\{D\cap S^X\right\}}\left(X_u\left(\omega \right)\right)\cdot 1_{\left\{N\cap S^X\right\}}\left(X_{u-}\left(\omega \right)\right)$$E18

form the trajectories of the stochastic process $\mathbf{Q}=\left\{Q_t;t\ge 0\right\}$ inherit the càdlàg property. We call Q the initiating event counting process. Here, as a practical consideration, we will require that $Q_0\left(\omega \right)=0$ for all $\omega \in \mathrm{\Omega }$. That is, we assume that reactor production should be in a normal operating state at time $t=0$ at the beginning of lifecycle $\omega$.¹⁴

It is a straightforward matter to construct the operations point process $\mathbf{T}=\left\{T_n;n\in \mathbb{N}\right\}$ which captures the arrival times of initiating events. T is referred to as the initiating event process, and for each $\omega \in \mathrm{\Omega }$ and $n\in \mathbb{N}$,

$$T_n\left(\omega \right)\equiv \underset{t>0}{inf}\left\{{\int }_{\left[0,t\right]}{\mathit{dQ}}_s\left(\omega \right)=n\right\}\le \infty .$$E19

The initiating event counting process Q plays a central role in our treatment of operations modeling and efficacy analysis of safety-critical reactor protections. Understanding the construction of Q provides important insights (to be discussed in subsequent sections) into the relationship between hazard, risk, and the efficacy.

Remark 5 When assuming that $Z_t^{-1}\left(G\right)\in {\mathcal{F}}_0$ and with $Q_t:\left(\mathrm{\Omega },{\mathcal{F}}^Z\right)\to \left(\mathbb{N},\mathcal{B}\left(\mathbb{N}\right)\right)$, by construction it is ensured that $Q_t$ is ${\mathcal{F}}_t$–measurable for all $t\ge 0$; hence, the initiating event process Q is adapted to the filtration ${\left\{{\mathcal{F}}_t\right\}}_{t\ge 0}$ which contains the history generated by the state process Z. It is preferable to model operations processes on the filtered probability space $\left(\mathrm{\Omega },\mathcal{F},{\left\{{\mathcal{F}}_t\right\}}_{t\ge 0},P\right)$, because its filtration contains all available information ... not simply the natural filtration ${\left\{{\mathcal{F}}_t^Q\right\}}_{t\ge 0}$ of Q. When PRA, QRA and PSA are used for risk analysis, they implicitly and strictly rely on the natural filtration

$${\left\{{\mathcal{F}}_t^Q\right\}}_{t\ge 0}\triangleq {\left\{\sigma \left(Q_t\right)\right\}}_{t\ge 0}\subset {\left\{{\mathcal{F}}_t\right\}}_{t\ge 0}$$E20

which contains only information about the occurrence times of initiating events, while ignoring all history of the state process Z, maintenance activity, weather, etc.

3.3 The accident counting process

When safety-critical protections function properly a distressed reactor (i.e., $X_t\in \left\{D\cap S^X\right\}$) will avoid an accident and return to the set of normal operating states in N. Accidents are events influencing states of nature outside the control volume within which a nuclear reactor’s state process Z develops. Accidents are always a consequence of protection failure that causes collateral harm.¹⁵ For our purposes, when an initiating event leads to any level of collateral harm, then that event becomes an epoch of an accident.¹⁶ Possible time delays are allowed for between the arrival of an initiating event and any eventual collateral harm.¹⁷ To this end, distressed state $D\subset S$ is partitioned into those states C that impact physics outside the system control volume causing collateral harm and $E=D/C$ those distressed states that do not cause collateral harm. Partitioning D allows an operations characterization of an accident:

Definition 3.1. An Epoch of accident occurs when the trajectory $\left(X_t,R_t\right)\left(\omega \right),\omega \in \mathrm{\Omega }$ is such that the production state process X enters $\left\{C\cap S^X\right\}\subset D\subset S$ while the state of the protection process R is in $\left\{D\cap S^R\right\}$.

Guided by the transition diagram of Figure 5, a modification of Figure 4, showing the partitioning of distressed states D into C and E, the accident counting process and the accident point process can be constructed.

Figure 5.

Partitioned state transition diagram for the state process Z with the distresses states D decomposed into C (catastrophic states) and E non-catastrophic distressed states.

Remark 6 Note that in the interval following an initiating event indicating that the state process has moved into distress, the system state can possibly transition many times between accident states in C and non-accident distressed states in E before either returning to normal or being retired. In practical modeling scenarios, state transitions across the partition of distressed states might take months (or even years). Thus, the initiating event leading to distress might not exceed to an accident for quite some time. In such situations, knowing that an initiating event has just occurred does not necessarily reveal whether or not the system state is on a trajectory of accident.

Now, define

$$\begin{array}{ll}{\mathit{dQ}}_t^C\left(\omega \right)& \triangleq Q_t^C\left(\omega \right)-Q_{t-}^C\left(\omega \right)\\ & =1_{\left\{C\cap S^X\right\}}\left(X_t\left(\omega \right)\right)\cdot 1_{\left\{D\cap S^R\right\}}\left(R_t\left(\omega \right)\right)\cdot 1_{\left\{N\cap S^X\right\}}\left(X_{t-}\left(\omega \right)\right).\end{array}$$E21

Note that the time $T_m\left(\omega \right)$ of the mth arriving epoch of an accident is given by

$$T_m^C\left(\omega \right)\triangleq \underset{t>0}{inf}\left\{{\int }_{\left(0,t\right]}{\mathit{dQ}}_u^C\left(\omega \right)=m\right\}\le \infty .$$E22

When m is the index of the last arriving epoch of an accident before retirement, all subsequent accidents are taken by convention to occur at infinity. Clearly, the random sequence $\left\{T_m^C;m\in \mathbb{N}\right\}$ is a thinning of the initiating event process T. The point process ${\mathbf{T}}^{\mathbf{C}}\triangleq \left\{T_m^C;m\in \mathbb{N}\right\}$ is the accident process.¹⁸

With $Q_t^C$ being the number of arriving accidents in the interval (0, t], it follows that for each $\omega \in \mathrm{\Omega },t\ge 0,$ and $m\in \mathbb{N}$

$$Q_t^C\left(\omega \right)=Q_{T_m^C\left(\omega \right)}\left(\omega \right),t\in \left[T_m^C\left(\omega \right),T_{m+1}^C\left(\omega \right)\right),$$E23

and, in practice with $Q_t^C\left(\omega \right)=0$ for all $\omega \in \mathrm{\Omega }$,

$$\begin{array}{ll}{Q}_t^C\left(\omega \right)& ={\int }_{\left[0,t\right]}{\mathit{dQ}}_u^C\left(\omega \right)\\ & \triangleq \sum _{0<u\le t}{1}_{\left\{C\cap S^X\right\}}\left(X_u\left(\omega \right)\right)\cdot 1_{\left\{D\cap S^R\right\}}\left(R_u\left(\omega \right)\right)\cdot 1_{\left\{N\cap S^X\right\}}\left(X_{u-}\left(\omega \right)\right).\end{array}$$E24

${\mathbf{Q}}^{\mathbf{C}}\triangleq \left\{Q_t^C;t\ge 0\right\}$ is called the accident counting process. By construction, ${\mathbf{Q}}^{\mathbf{C}}$ is adapted to the filtration of $\left(\mathrm{\Omega },\mathcal{F},{\left\{{\mathcal{F}}_t\right\}}_{t\ge 0},P\right)$.

Remark 7 When assuming that $Z_t^{-1}\left(G\right)\in {\mathcal{F}}_0$, the accident counting process ${\mathbf{Q}}^{\mathbf{C}}$ is, clearly, subordinate the initiating event counting process Q. That is, each epoch of arrival in ${\mathbf{Q}}^{\mathbf{C}}$ is also an epoch of arrival in Q. It is important to note, however, that while both ${\mathbf{Q}}^{\mathbf{C}}$ and Q are adapted to the natural filtration ${\left\{{\mathcal{F}}_t\right\}}_{t\ge 0},{\mathbf{Q}}^{\mathbf{C}}$is not adapted to the natural filtration ${\left\{{\mathcal{F}}_t^Q\right\}}_{t\ge 0}$ of the initiating event process Q. Thus, the history of initiating events alone contains insufficient information to construct the accident thinning—a physics-based insight often overlooked in popular quantitative risk methodologies.

Finally, as a notational convenience, define for all $\omega \in \mathrm{\Omega }$ and $t\ge 0$

$$A_t\left(\omega \right)\triangleq 1_{\left\{N\cap S^R\right\}}\left(R_t\left(\omega \right)\right),$$E25

where $A_t:\left(S,\mathcal{B}\left(S\right)\right)\to (\left\{0,1\right\},\mathcal{B}\left(\left\{0,1\right\}\right)$ is a random variable of the filtered probability space $\left(\mathrm{\Omega },\mathcal{F},{\left\{{\mathcal{F}}_t\right\}}_{t\ge 0},P\right)$. Clearly,

$$A_t=\left\{\begin{array}{ll}1,& \text{protections}\mathrm{are}\text{available}\mathrm{at}\text{time}t\\ 0,& \text{otherwise}.\end{array}\right.$$E26

We call $\mathbf{A}=\left\{A_t;t\ge 0\right\}$ the protection availability process, which inherits càdlàg properties from R. Substituting Eq. (17) and Eq. (25) into Eq. (24) gives

$$\boxed{Q_t^C\left(\omega \right)={\int }_{\left[0,t\right]}\left(1-A_u\left(\omega \right)\right){\mathit{dQ}}_u\left(\omega \right)}$$E27

for all $\omega \in \mathrm{\Omega }$ and $t\ge 0$. And, it follows directly from Eq. (22) and Eq. (27) that for all $m\in \mathbb{N},\omega \in \mathrm{\Omega }$ and $t\ge 0$

$$\boxed{T_m^C\left(\omega \right)\triangleq \underset{t>0}{inf}\left\{{\int }_{\left(0,t\right]}\left(1-A_u\left(\omega \right)\right){\mathit{dQ}}_u\left(\omega \right)=m\right\}\le \infty .}$$E28

The importance of Eq. (27) is that it gives the dynamic relationship between the number of accidents over time in terms of arriving initiating events and the reliability of protections. It should be clear from the construction of Eq. (27) from trajectories of the state process Z that the stream of arriving initiating events and the reliability of protections are not generally independent since both random phenomena are stochastically dependent on the dynamics of the environment process Y. Further, Eq. (22) establishes the relationship between the accident time point process ${\mathbf{T}}^{\mathbf{C}}$ and initiation event arrivals and protection reliability where, again, stochastic dependence between initiating event arrivals and protection reliability cannot be ignored. Eqs. (22) and (27) play a central role in the developments presented in Sections 4 and 5.

4. Unknown-unknowns

When designing nuclear reactor protections, it is impossible to foresee and design for every circumstance that might lead to an accident. Such design deficiencies are often called unknown-unknowns.¹⁹ Unknown-unknown design deficiencies are routinely discovered, documented, and corrected. It can be shown that uncertainty about the consequences of as yet undiscovered design deficiencies cannot be quantified. Thus, Probability Quantification (PQ) methodologies without exception overlook the influence of unknown-unknowns on initiating events, protection reliability, and ultimately epochs of accidents. Overlooking unknown-unknowns can only bias predictive accident metrics such as CDF optimistically, presenting an unavoidable pitfall for quantitative methodologies including PRA, QRA and PSA that make no use of filtered probability spaces.

Unknown-unknown failure modes in protective systems will be the focus of analytical developments in the following.²⁰ Clearly, the possibility of undiscovered failure modes in reactor protections is a matter of great concern to both operators and regulators. The NRC has established rigorous reporting and operation protocols focused on the discovery of newly discovered protection design flaws.

The analytical consequences of unknown-unknowns are revealed only when the system state process Z is defined on the filtered probability space $\left(\mathrm{\Omega },\mathcal{F},{\left\{{\mathcal{F}}_t\right\}}_{t\ge 0},P\right)$, where all predictive assertions must be addressed in the context of information currently available in the filtration ${\left\{{\mathcal{F}}_t\right\}}_{t\ge 0}$. In particular suppose that in the design of protections there exists protection failure modes that are undiscovered at the time of deployment. These design inadequacies will only be discovered during operations and are then incorporated into the existing body of information. Thus, protection failure modes unknown at time $t=0$ will enter into the filtration ${\left\{{\mathcal{F}}_t\right\}}_{t\ge 0}$ at some time $t>0$ upon discovery.

By construction as shown in Sections 2 and 3 the protection availability process A is adapted to the filtration ${\left\{{\mathcal{F}}_t\right\}}_{t\ge 0}$ (i.e., $A_t$ is ${\mathcal{F}}_t$-measurable). When for example examining the likelihood that protections are not in a normal condition at any time $t\ge 0$, it follows that

$$\begin{array}{l}P\left(A_t=0\right)=1-E\left[A_t\right]\\ =1-E\left[E\left[A_t|{\mathcal{F}}_t\right]\right],\end{array}$$E29

because the random variable $E\left[A_t|{\mathcal{F}}_t\right]$ is well-defined.²¹

In predictive modeling, it is often the case that the condition of protections at some random time $A_{\tau }$, where $\tau :\mathrm{\Omega }\to {\mathbb{R}}^{+}$, is of great interest. Here, care must exercised because Eq. (29) does not necessarily hold when substituting $A_{\tau }$ for $A_t$. Let $G_f\subset S$ be the set of all states where protections are unavailable (protections can be either failed or out of service due to maintenance). Now for t taken at the present time, let $\tau$ be the time of the next arriving initiating event in the initiating event process T. It follows that

$$\tau =T_{Q_t+1}>t,$$E30

with $Q_t$ being the number of initiating events arriving in the interval [0, t]. Now consider two cases: (1) $A_t^{-1}\left(G_f\right)$ is ${\mathcal{F}}_0$-measurable, and (2) $A_t^{-1}\left(G_f\right)$ is not${\mathcal{F}}_0$-measurable.

4.1 Case 1: $A_t^{-1}\left(G_f\right)\in {\mathcal{F}}_0$

By definition, $G_f\in \mathcal{F}$ is the collection of all states in S where protection is unavailable. Thus, any failure mode for protection must be reflected as a state $s\in G_p\subset S$. When $G_p\in {\mathcal{F}}_0$, it follows that every possible failure mode must be known at time $t=0$ since the pre-image of $G-f$ through the random variable $A_t$ appears in ${\mathcal{F}}_0$. By definition the filtration ${\left\{{\mathcal{F}}_t\right\}}_{t\ge 0},{\mathcal{F}}_0\subset {\mathcal{F}}_t$ for all $t>0$ implies that $A_t^{-1}\left(G_p\right)\in {\mathcal{F}}_t$ for all $t\ge 0$. It now follows that for any $u>0A_{t+u}^{-1}\left(G_p\right)\in {\mathcal{F}}_t$ and, since $\tau$ is an ${\mathcal{F}}_t$ stopping time, $\tau >t,A_{\tau }^{-1}\left(G_p\right)\in {\mathcal{F}}_t$. In other words, when all possible states where protection is unavailable (including protection failure modes) are understood at time $t=0$, then

$$\begin{array}{l}P\left(A_{\tau }=0\right)=1-E\left[A_{\tau }\right]\\ =1-E\left[E\left[A_{\tau }|{\mathcal{F}}_t\right]\right]\end{array}$$E31

gives the likelihood that the next arriving initiating event will result in an accident.

4.2 Case 2: $A_t^{-1}\left(G_f\right)\notin {\mathcal{F}}_0$

Suppose now that there exist protection failure modes that are unknown at time $t=0$. This implies that $A_t^{-1}\left(G_f\right)\notin {\mathcal{F}}_0$. When $A_t^{-1}\left(G_f\right)$ is not ${\mathcal{F}}_0$-measurable there can be no guarantee that $A_t^{-1}\left(G_f\right)$ will be ${\mathcal{F}}_t$-measurable for any $0<t<\infty$. That is, for any $u>0$, we cannot ensure that $A_{t+u}$ is ${\mathcal{F}}_t$-measurable. And, because $\tau >0$, we cannot ensure that $A_{\tau }$ is ${\mathcal{F}}_t$-measurable even though $\tau$ is an ${\mathcal{F}}_t$ stopping time. In fact there will always be some $t>0$ where $A_{\tau }\notin {\mathcal{F}}_t$ which implies that $E\left[A_{\tau }|{\mathcal{F}}_t\right]$ is not well-defined. From the failure of $E\left[A_{\tau }|{\mathcal{F}}_t\right]$ to satisfy the definition of a random variable on $\mathrm{\Omega }$, it can be concluded that when there are undiscovered protection failure modes, Eq. (31) cannot hold.

4.3 The practical implications of undiscovered protection failure modes

It is reasonable at this juncture to consider the extent to which protection failure modes not identified in ${\mathcal{F}}_0$ are problematic. Let ${\tau }_d$ be the time of first discovery of a heretofore undiscovered protection failure mode. Some observations that can be normatively understood are:

• The discovery time ${\tau }_d$ of a specific heretofore undiscovered failure mode is random and measurable with respect to probability space $\left(\mathrm{\Omega },\mathcal{F},P\right)$.

• ${\tau }_d$ is not an ${\left\{{\mathcal{F}}_t\right\}}_{t\ge 0}$ stopping time. Clearly, ${\left\{\tau \le t\right\}}^c\notin {\mathcal{F}}_t$.

• Any protection failure mode will almost surely be found over the lifecycle of protections.

• It is possible that a failure mode is first discovered through accident postmortem analysis (i.e., the failure mode caused an accident upon its first appearance).

• For any time $t\ge 0$ a non-clairvoyant cannot rule out the possibility of remaining undiscovered protection failure modes.

• If undiscovered failure modes are in play, the filtration ${\left\{{\mathcal{F}}_t\right\}}_{t\ge 0}$ has not yet converged and all predictive PQ metrics must be formed conditioned on the current information represented in filtration ${\left\{{\mathcal{F}}_t\right\}}_{t\ge 0}$ ... which does not include all information represented in $\mathcal{F}$.

• Nearly all historical nuclear reactor accidents have been attributed to heretofore unanticipated protection failures.

If there is sufficient confidence in a non-clairvoyant belief that that all protection failure modes have been discovered, then all information impacting protection design will be found in the tail $\sigma$-algebra $\mathcal{T}$, where

$$\mathcal{T}\triangleq \underset{t\ge 0}{\cap }\sigma \left(\left\{A_u;u\ge t\right\}\right).$$E32

By definition, $\mathcal{T}\subset \mathcal{F}$ and characterizes design information in the remote future of A. In the remote future of protections, there can be no undiscovered failure modes.

Typically, PQ methodologies (e.g., PRA, QRA, PSA) implicitly rely on the assumption that events associated with protections are $\mathcal{T}$-measurable, because this assumption guarantees the existence of

$$A=\underset{t\to \infty }{lim}{A}_t\text{and}\overline{A}=\underset{t\to \infty }{lim}\frac{1}{t}{\int }_0^t{A}_u\left(\omega \right)\mathit{du},\omega \in \mathrm{\Omega }.$$E33

The expected value E[A] and its statistical estimator $\overline{A}$ play essential roles in PRA, QRA and PSA, and they are only practically accessible under the assumption that all available information is in the tail $\sigma$-algebra $\mathcal{T}$. The estimator $\overline{A}$, when computed with data collected other than in $\mathcal{T}$ will always underestimate the true value of E[A], a dangerous bias.

5. The hierarchy of modeling assumptions supporting PRA

PRA appears, today, in regulatory language, NRC directives and even in federal legislation. PRA methodology relies on very strong modeling assumptions that are rarely (if ever) explicitly qualified in practice. Owing to the wide acceptance and application of PRA in the civilian nuclear industry, it is useful to identify and explain the assumptions underlying this popular risk analysis methodology. These modeling assumptions are best explained hierarchically so as to reveal a sequence of increasingly strong and necessary conditions leading to the computation of CDF ... the central risk metric derived from PRA. These assumptions are difficult to justify in practice and failure to satisfy any of them leads to optimistically biased estimates for CDF.

Begin again with the state process Z characterizing the time dependent behavior of a reactor’s production, protections, and common surrounding environment defined on the filtered probability space $\left(\mathrm{\Omega },\mathcal{F},{\left\{{\mathcal{F}}_t\right\}}_{t\ge 0},P\right)$, where the state variables are mapped onto the measurable state space $\left(S,\mathcal{B}\left(S\right)\right)$. The state space S is partitioned according to Figure 5 in Section 3.

Now identify seven modeling assumptions that must be enforced in order to calibrate CDF using historical data.

Assumption 1 There are no unknown-unknowns.

Assumption 2 There are no absorbing states.

Assumption 3 CDF is well-defined.

Assumption 4 Arriving initiating events see the time average of protection availability.

Assumption 5 Arriving initiating events form a Poisson process.

Assumption 6 The protection availability process is stationary and ergodic.

Assumption 7 Protection unavailability is independent of all initiating events.

Assumptions 1–7 are numbered such that each implicitly enforces all lower numbered assumptions. Assumptions 6 and 7 are required in order to calibrate CDF with historical data. The consequence of these cumulative assumptions are examined one-at-a-time and in order.

5.1 Cumulative assumption: there are no unknown-unknowns

As discussed in Section 4, assuming that there are no as yet undiscovered states requires that

$$Z_t^{-1}\left(B\right)\in {\mathcal{F}}_0,$$E34

for $B\in \mathcal{B}\left(S\right)$ and $t\ge 0$. Recall that by definition of the filtration ${\left\{{\mathcal{F}}_t\right\}}_{t\ge 0}$${\mathcal{F}}_t$-measurability is also ensured. This modeling assumption cannot be verified so long as a reactor is not retired. Obviously, with the random time $\tau :\mathrm{\Omega }\to \left(0,\infty \right)$ taken as the time of discovery of the last heretofore undiscovered state, $\tau$ is not ${\mathcal{F}}_t$-measurable for any $t<\infty$, which implies that there cannot be an observable condition confirming that there are not more undiscovered states. Clearly, the no unknown-unknowns assumption reflects a (believed) near clairvoyant understanding of the technologies being modeled.

5.2 Cumulative assumption: there are no absorbing states

The absence of absorbing states implies that either all $s\in S$ are transient, or there exists at least one non-singular collection of persistent states $B_{\alpha }\in S,\alpha \in \mathcal{A}$ such that

$$P\left(\underset{t\to \infty }{lim}{Z}_t\in B_{\alpha }\right)>0,$$E35

and when a state trajectory enters $B_{\alpha }$ it never exits, visiting each state $s\in B_{\alpha }$, infinitely often. Further,

$$P\left(\underset{t\to \infty }{lim}{Z}_t\in \bigcup _{\alpha \in \mathcal{A}}{B}_{\alpha }\right)=1,$$E36

which implies that each state trajectory must eventually enter a non-singular collection of persistent states that it visits infinitely often.

The PRA methodology implicitly rejects the possibility that all states in S are transient, and therefore accepts that all state trajectories visit some collection of states infinitely often. Further, PRA some of the states visited infinitely often are accidents (else there would be no reason to perform PRA). It follows that accepting the assumption that reactors are never retired (either through an accident or cessation of operations), there will be accidents ad infinitum.

5.3 Cumulative assumption: CDF is well defined

Accepting Assumptions 1 and 2, it is feasible to investigate CDF. Here, as before, $Q_t^C$, counts the number of core damage events a reactor suffers in the interval [0, t]. CDF is a frequency and thus is the limiting number of core damage events per unit time. That is,

Definition 5.1 (Core Damage Frequency).

$$\mathrm{CDF}=\underset{t\to \infty }{lim}\frac{1}{t}{Q}_t^C$$E37

whenever convergence to a constant occurs a.s.

CDF is treated as a numerical constant. However, convergence of Eq. (37) is not guaranteed. Further, even when CDF converges, there is no guarantee that its limit is a constant; convergence to a random variable is a completely plausible circumstance. It must be emphasized that CDF is a numerical constant, estimates of which are used to gauge the risk of suffering a core damage event.

The existence of CDF is determined in part on the dynamics of initiating event arrivals. The limiting arrival rate $\lambda$ of initiating events is defined as follows.

Definition 5.2 (Initiating Event Frequency).

$$\lambda =\underset{t\to \infty }{lim}\frac{1}{t}{Q}_t$$E38

convergence occurs a.s. In general $\lambda$ can be a random variable, and convergence to a constant occurs only when $\lambda =E\left[\lambda \right]$.

Recall that ${\mathbf{Q}}^{\mathbf{C}}$ and Q are right-continuous. It follows directly from definitions 5.1 and 5.2 that when $\lambda$ is a constant,

$$\mathrm{CDF}\stackrel{\mathrm{a}.\mathrm{s}.}{=}\underset{t\to \infty }{lim}\frac{Q_t^C}{Q_t}\frac{Q_t}{t}=\mathit{p\lambda }$$E39

where, often the split fraction is

$$p\triangleq \underset{t\to \infty }{lim}\frac{Q_t^C}{Q_t}.$$E40

Thus, CDF is the product of the initiating event frequency with the proportion of initiating events that exceed to core damage. Typically, estimating $\lambda$ is straightforward. Estimating p is more challenging. Note that while p takes values in the interval [0, 1], it is defined as the limiting value of a ratio of random variables. However, under certain circumstances p can be interpreted as the probability that an arriving initiating event will exceed to core damage. One such circumstance occurs when initiating events form an ordinary Poisson process. Then, the well-known Poisson Arrivals See Time Averages (PASTA) result applies, and p can be computed as the limiting unavailability of reactor protections (see [14]). Unfortunately, the assumptions needed to justify PASTA defy practical justification. Consequently, estimating p is quite difficult in practice.

There are a variety of approaches for crafting estimators of p that incorporate the joint histories of initiating event arrivals, protection maintenance activity, environmental conditions, etc. Monte Carlo methods, owing to their adaptability to complex engineering models, have gained acceptance and popularity for estimating p and other statistics. These methods are not, however, a panacea because they require characterizing probability laws on subordinate stochastic processes that must be mapped into the dynamics of protection availability in order to build useful estimators. Characterizing probability laws on stochastic processes is often impractical due to the intensive data support required for all but the most stylized processes.

In order to better appreciate the manner in which CDF jointly depends on the arrival of initiating events and the efficacy of reactor protections, we will appeal to the martingale characterization of stochastic point processes (see [15]). For practical considerations, we require that initiating events occur one at a time a.s.

Since the trajectories of Q are nonnegative non-decreasing and proceed in jumps of size one a.s., clearly $E\left[Q_{t+u}|{\mathcal{F}}_t\right]\ge Q_t$ for all $t,u\ge 0$. Thus, Q forms a sub-martingale on the filtered probability space $\left(\mathrm{\Omega },\mathcal{F},{\left\{{\mathcal{F}}_t\right\}}_{t\ge 0},P\right)$. Appealing to the standard results from the martingale calculus (see [16]), it now follows from the Doob-Mayer Decomposition Theorem that

$$Q_t=M_t+{\mathrm{\Lambda }}_t,$$E41

where the process $\mathbf{M}\triangleq \left\{M_t;t\ge 0\right\}$ forms an ${\mathcal{F}}_t$–martingale with compensator $\left\{{\mathrm{\Lambda }}_t;t\ge 0\right\}$. Hence,

$$E\left[M_{t+u}|{\mathcal{F}}_t\right]=M_t=0$$E42

for all $t,u\ge 0$, and ${\mathrm{\Lambda }}_t$ is increasing a.s. and ${\mathcal{F}}_t$–predictable, with

$${\mathrm{\Lambda }}_t={\int }_{\left[0,t\right]}{\lambda }_u\mathit{du}.$$E43

Here, ${\lambda }_t$ is well-defined whenever for all nonnegative, $\left\{{\mathcal{F}}_t\right\}$-predictable ${\left\{C_t\right\}}_{t\ge 0}$

$$E\left[{\int }_{\left[0,\infty \right]}{C}_t{\mathit{dQ}}_t\right]=E\left[{\int }_{\left[0,\infty \right]}{C}_t{\lambda }_t\mathit{dt}\right]$$E44

is satisfied. M is called the initiating event martingale.

When well defined, ${\lambda }_t$ is a unique Radon-Nikodym derivative defined on the usual equivalence class, with the stochastic intensity process $\left\{{\lambda }_t;t\ge 0\right\}$ adapted to ${\left\{{\mathcal{F}}_t\right\}}_{t\ge 0}$ and predictable. Informally, ${\lambda }_t=E\left[{\mathit{dQ}}_t|{\mathcal{F}}_{t-}\right]$ and can be understood as the propensity for an initiating event to arrive in the next instant of time given the history of initiating events and reactor protections.

Now, consider the martingale transform $M_t^C$ of protection unavailability $\left(1-A_t\right)$ with respect to $M_t$ of Eq. (41), where $M_t^C\stackrel{\mathrm{def}}{=}{\int }_{\left[0,t\right]}\left(1-A_u\right){\mathit{dM}}_u={\int }_{\left[0,t\right]}\left(1-A_u\right){\mathit{dQ}}_u-{\int }_{\left[0,t\right]}\left(1-A_u\right)d{\mathrm{\Lambda }}_u.$

Proposition 1 (Core Damage Martingale)${\mathbf{M}}^{\mathbf{C}}\triangleq \left\{M_t^C;t\ge 0\right\}$ is a martingale whenever the stochastic intensity process of arriving initiating events ${\left\{{\lambda }_t\right\}}_{t\ge 0}$ exists.

Proof: Since $A_t$ is ${\mathcal{F}}_t$–predictable and $0\le A_t\left(\omega \right)\le 1$ for all $\omega \in \mathrm{\Omega }$ and $t\ge 0$, it follows that ${\left\{M_t^C\right\}}_{t\ge 0}$ is also an ${\mathcal{F}}_t$–martingale (see [17]), and noting that $Q_t^C={\int }_{\left[0,t\right]}\left(1-A_u\right){\mathit{dQ}}_u$ counts the number of core damage events in the interval [0, t], we have that

$$M_t^C=Q_t^C-{\int }_{\left[0,t\right]}\left(1-A_u\right)d{\mathrm{\Lambda }}_u$$E45

and, substituting from Eq. (43) gives

$$M_t^C=Q_t^C-{\mathrm{\Lambda }}_t^C.$$E46

We refer to ${\mathbf{M}}^{\mathbf{C}}$ as the Core Damage Martingale and its compensator is given by

$${\mathrm{\Lambda }}_t^C={\int }_{\left[0,t\right]}{\lambda }_u^C\mathit{du}={\int }_{\left[0,t\right]}\left(1-A_u\right){\lambda }_u\mathit{du}.$$E47

Remark 8Eq. (46) stands as the most general available expression characterizing the relationship among core damage events, the arrival of initiating events, and the efficacy of reactor protections. It is important to keep in mind that, for all $t\ge 0,M_t^C,Q_t^C,{\lambda }_t^C,A_t,$ and (in particular) ${\lambda }_t$ are all random variables. Hence, Eq. (46) is nontrivial and must be examined in the context of stochastic integration.

Consider now, the following proposition:

Proposition 2 (Existence of CDF) If

$$\underset{t\to \infty }{lim}\frac{M_t^C}{t}\stackrel{\mathrm{a}.\mathrm{s}.}{=}0,$$E48

then ${\lambda }^C$ exists (and is possibly a random variable) and for almost (a.a.) $\omega \in \mathrm{\Omega }$

$${\lambda }^C\left(\omega \right)=\underset{t\to \infty }{lim}\frac{Q_t^C\left(\omega \right)}{t}=\underset{t\to \infty }{lim}\frac{1}{t}{\int }_{\left[0,t\right]}\left(1-A_u\left(\omega \right)\right){\lambda }_u\left(\omega \right)\mathit{du}$$E49

where, $0<{\lambda }^C\left(\omega \right)<\infty$. That is,

$$\begin{array}{l}\underset{t\to \infty }{lim}\frac{M_t^C}{t}\stackrel{\mathrm{a}.\mathrm{s}.}{=}0\text{if}\text{and}\text{only}\text{if}\\ \underset{t\to \infty }{lim}\frac{Q_t^C}{t}\stackrel{\mathrm{a}.\mathrm{s}.}{=}{\lambda }^C\text{and}\\ \underset{t\to \infty }{lim}\frac{1}{t}{\int }_{\left[0,t\right]}\left(1-A_u\right){\lambda }_u\mathit{du}\stackrel{\mathrm{a}.\mathrm{s}.}{=}{\lambda }^C.\end{array}$$E50

Proof: Proposition 2 is an obvious consequence of Definition 5.1 and Eq. (46).

Remark 9 Clearly, CDF exists only if

$$\frac{M_t^C}{t}\stackrel{\mathrm{a}.\mathrm{s}.}{\to }0\text{and}{\lambda }^C\stackrel{\mathrm{a}.\mathrm{s}.}{=}E\left[{\lambda }^C\right]<\infty .$$E51

Proposition 2 reveals the challenge in estimating CDF. In the absence of observed core damage events, predictive estimates of CDF must be formulated in terms of phenomena that can be observed. To this end, analysts must rely on observations of initiating event arrival times, and reactor protection performance (principally in the form of maintenance records and failure data). These observations are, of course, insufficient to capture the joint dynamics of $\left\{\left(A_t,{\lambda }_t\right);t\ge 0\right\}$ needed to directly employ the strong law relationship of Proposition 2, where,

$${\lambda }^C\stackrel{\mathrm{a}.\mathrm{s}.}{=}\underset{t\to \infty }{lim}\frac{{\mathrm{\Lambda }}_t^C}{t}=\underset{t\to \infty }{lim}\frac{1}{t}{\int }_{\left[0,t\right]}\left(1-A_u\right){\lambda }_u\mathit{du}.$$E52

Monte Carlo methods do not escape the difficulty of computing ${\lambda }^C$. A and $\left\{\lambda ;t\ge 0\right\}$ are not mutually independent (even when Q is Poisson with rate $\lambda$) and ${\lambda }_t$ is not directly observable. Since this dependence requires a Monte Carlo model to rely on an accurate characterization of the probability law on the joint stochastic process $\left\{\left(A_t,{\lambda }_t\right);t\ge 0\right\}$, it is clear that the data requirements to support accurate estimation of this probability law are beyond the practical reality of reactor unit operations records.

5.4 Cumulative assumption: arriving initiating events see time averages

Important insights regarding CDF are revealed by exploring the expectation of ${\mathbf{M}}^{\mathbf{C}}$. In particular, we are interested in the consequences of the stochastic dependence the state of system protections ${\left\{A_t\right\}}_{t\ge 0}$ and the arrival of initiating events ${\left\{Q_t\right\}}_{t\ge 0}$ and consequently ${\left\{{\lambda }_t\right\}}_{t\ge 0}$. Consider now,

Proposition 3 (Moment Convergence) Suppose that

$$\frac{M_t^C}{t}\stackrel{\mathrm{a}.\mathrm{s}.}{=}0.$$E53

Then,

$$\begin{array}{l}\underset{t\to \infty }{lim}E\left[\frac{M_t^C}{t}\right]=0\text{if}\text{and}\text{only}\text{if}\\ \underset{t\to \infty }{lim}E\left[\frac{Q_t^C]}{t}\right]=E\left[{\lambda }^C\right]\text{and}\\ \underset{t\to \infty }{lim}E\left[\frac{1}{t}{\int }_{\left[0,t\right]}\left(1-A_u\right){\lambda }_u\mathit{du}\right]=E\left[{\lambda }^C\right].\end{array}$$E54

And, with the additional condition that ${\lambda }^C=E\left[{\lambda }^C\right]<\infty$,

$$\mathrm{CDF}=\underset{t\to \infty }{lim}\frac{1}{t}{\int }_{\left[0,t\right]}E\left[\left(1-A_u\right){\lambda }_u\right]\mathit{du}.$$E55

Proof: Recall that almost sure convergence implies convergence in expectation (see [18]). Hence, Eq. (54) follows directly from Proposition 2. Nonnegativity of the integrand in Eq. (54) allows a routine application of Tonelli’s Theorem to exchange the order of expectation and integration to show Eq. (55) (see [19]). Finally, ${\lambda }^C=E\left[{\lambda }^C\right]<\infty$ implies that

$$\frac{Q_t^C}{t}\stackrel{\mathrm{a}.\mathrm{s}.}{\to }E\left[{\lambda }^C\right]<\infty ,$$E56

thus, ensuring the existence of CDF.

Recalling the definition of covariance, it immediately follows that.

Corollary 1 When ${\lambda }^C=E\left[{\lambda }^C\right]<\infty$, then

$$\mathrm{CDF}\stackrel{\mathrm{a}.\mathrm{s}.}{=}\underset{t\to \infty }{lim}\frac{1}{t}{\int }_{\left[0,t\right]}\mathit{cov}\left(\left(1-A_u\right),{\lambda }_u\right)\mathit{du}+\underset{t\to \infty }{lim}\frac{1}{t}{\int }_{\left[0,t\right]}E\left[\left(1-A_u\right)\right]E\left[{\lambda }_u\right]\mathit{du}.$$E57

Proof: Simply apply the definitions of CDF and covariance.

Corollary 2 When ${\lambda }^C=E\left[{\lambda }^C\right]<\infty$,

$$\mathrm{CDF}\stackrel{\mathrm{a}.\mathrm{s}.}{=}\underset{t\to \infty }{lim}\frac{1}{t}{\int }_{\left[0,t\right]}E\left[\left(1-A_u\right)\right]E\left[{\lambda }_u\right]\mathit{du}$$E58

if and only if $E\left[{\lambda }_t|{\mathcal{F}}_t\right]=E\left[{\lambda }_t\right]$ for all $t\ge 0$.

Proof: It need only be shown that $\mathit{cov}\left(\left(1-A_t\right),{\lambda }_t\right)=0$ if and only if $E\left[{\lambda }_t|{\mathcal{F}}_t\right]=E\left[{\lambda }_t\right]$. First, assume that $E\left[{\lambda }_t|{\mathcal{F}}_t\right]=E\left[{\lambda }_t\right]$ for all $t\ge 0$ for all $t\ge 0$. Note that

$$\begin{array}{ll}E\left[\left(1-A_t\right){\lambda }_t\right]& =E[E\left[\left(1-A_t\right){\lambda }_t|{\mathcal{F}}_t\right]\\ & =E[E\left[\left(1-A_t\right)E\left[{\lambda }_t\right]|{\mathcal{F}}_t\right]\\ & =E\left[{\lambda }_t\right]E[E\left[\left(1-A_t\right)|{\mathcal{F}}_t\right]\\ & =E\left[{\lambda }_t\right]E\left[\left(1-A_t\right)\right].\end{array}$$E59

Thus, it follows from the definition of covariance that $\mathit{cov}\left(\left(1-A_t\right),{\lambda }_t\right)=0$. With $\mathit{cov}\left(\left(1-A_t\right),{\lambda }_t\right)=0$ it follows trivially that

$$E\left[\left(1-A_t\right){\lambda }_t\right]=E\left[{\lambda }_t\right]E\left[\left(1-A_t\right)\right].$$E60

Corollary 3. When, $E\left[{\lambda }_t|{\mathcal{F}}_t\right]=E\left[{\lambda }_t\right]=\lambda <\infty$ and $A_t\stackrel{\mathrm{a}.\mathrm{s}.}{\to }A$, then

$$\mathrm{CDF}\stackrel{\mathrm{a}.\mathrm{s}.}{=}\lambda \underset{t\to \infty }{lim}\frac{1}{t}{\int }_{\left[0,t\right]}\left(1-A_u\right)\mathit{du}.$$E61

Proof: It follows from Eq. (58) that when $E\left[{\lambda }_t|{\mathcal{F}}_t\right]=E\left[{\lambda }_t\right]=\lambda <\infty$,

$$\mathrm{CDF}\stackrel{\mathrm{a}.\mathrm{s}.}{=}\lambda \underset{t\to \infty }{lim}\frac{1}{t}{\int }_{\left[0,t\right]}E\left[\left(1-A_u\right)\right]\mathit{du},$$E62

and when $A_t\stackrel{\mathrm{a}.\mathrm{s}.}{\to }A$,

$$\lambda \underset{t\to \infty }{lim}\frac{1}{t}{\int }_{\left[0,t\right]}\left(1-A_u\right)\mathit{du}\stackrel{\mathrm{a}.\mathrm{s}.}{=}\lambda \underset{t\to \infty }{lim}\frac{1}{t}{\int }_{\left[0,t\right]}E\left[\left(1-A_u\right)\right]\mathit{du},$$E63

Eq. (61) follows.

Remark 10 It is important to appreciate that Corollary 3 does not imply that the state of reactor protections A is independent of initiating event arrivals Q. The condition $E\left[{\lambda }_t|{\mathcal{F}}_t\right]=\lambda$ is simply congruent with the lack of anticipation property of $A_t$.²² The conditions establishing Corollary 3 allow for the possibility that initiating events can cause a failure of system protections (in addition to the possibility protections were already failed immediately prior to arrival).

Recall Eq. (38). Perhaps the most important consequence of assuming that arriving initiating events see time averages is:

Corollary 4. When $E\left[{\lambda }_t|{\mathcal{F}}_t\right]=\lambda$, then

$$\boxed{p\triangleq \underset{t\to \infty }{lim}\frac{Q_t^C}{Q_t}=E\left[A\right].}$$E64

Proof: Substitute Eq. (61) into Eq. (39).

5.5 Cumulative assumption: initiating events form a Poisson process

Eq. (61) admits, as a special case, the condition that the initiating event counting process Q forms an ordinary Poisson process of rate $\lambda$. By the Watanabe characterization, it is well known that the stochastic intensity of a counting process is a fixed constant if and only if that counting process forms an ordinary Poisson process. Thus, when Q forms an ordinary Poisson process of rate $\lambda$, its intensity ${\lambda }_t=\lambda$ for all $t\ge 0$, where $\lambda$ is a positive valued constant. Returning to Eq. (46), it follows that the constant $\lambda$ can be moved outside the integral, giving

$${\mathrm{\Lambda }}_t^C={\int }_{\left[0,t\right]}\left(1-A_u\right){\lambda }_u\mathit{du}=\lambda {\int }_{\left[0,t\right]}\left(1-A_u\right)\mathit{du}.$$E65

With the elements of the compensator of the core damage martingale a.s. constant for all $t\ge 0$ as given by Eq. (65), a special case of Corollary 3 is created. The condition $E\left[{\lambda }_t|{\mathcal{F}}_t\right]=\lambda$ given in Corollary 3 is more general (and difficult to calibrate with historical data) than under the Poisson initiating event assumption (see [20]).

Remark 11 The Poisson initiating event assumption does not imply independence between A and Q; on the contrary, A and Q remain dependent since there is the possibility that arriving initiating events will disrupt protections and lead to an accident. Wolff gives a full development of Poisson arrivals see time averages, (see [14]).

An obvious benefit gained when Q is assumed Poisson is that statistical calibration of $\lambda$ becomes accessible using historical data. Since all Poisson processes are stationary and ergodic, the parameter $\lambda$ is easily estimated since

$$\lambda =\underset{t\to \infty }{lim}\frac{1}{t}{Q}_t\left(\omega \right)$$E66

for a.a. $\omega \in \mathrm{\Omega }$.

Assuming that Q is Poisson does not change Eq. (61). But, all Poisson processes implicitly carry the very strong independent increments requirement, meaning here that the number of initiating events appearing in any collection of disjoint time intervals are mutually independent. In practice, the independent increments condition is an extremely difficult to justify.

5.6 Cumulative assumption: the protection process is stationary and ergodic

Returning to Corollary 3 with $A={lim}_{t\to \infty }{A}_t$, it is clear that for a.a. $\omega \in \mathrm{\Omega }$ the split fraction p is given by

$$p=E\left[A\right]=\underset{t\to \infty }{lim}\frac{1}{t}{\int }_{\left[0,t\right]}\left(1-A_u\left(\omega \right)\right)\mathit{du}.$$E67

Calibrating p with historical data, as is preferred with PRA, is generally inaccessible in the limit. However, assuming that the protection availability process A is both stationary and ergodic guarantees that A is measurable with respect to its tail $\sigma$-algebra for all $t\ge 0$, and thus

$$p=E\left[A\right]=E\left[A_t\right]=P\left(A_t=0\right),$$E68

for any fixed $t>0$. Clearly, the best available estimate of the split fraction p along the (only) historically available $\omega$ is given by

$$p\approx \frac{1}{t}{\int }_{\left[0,t\right]}\left(1-A_u\left(\omega \right)\right)\mathit{du}.$$E69

Typically, practitioners rationalize stationarity and ergodicity of A by claiming knowledge of a long history of protection operations augmented with an extensive observed history of initiating events and equipment maintenance activity. Based on a experience they will designate where to establish time $t=0$, in Eq. (69). However, the approximation Eq. (69) suffers a bias that is a consequence of well designed protections: The speed of convergence of Eq. (67) depends on observing initiating events that will cause protections to fail. Obviously, well designed reactor protections will experience few (if any) such events. This implies that even under the assumption that A is stationary and ergodic the Eq. (69) will be positively biased for all $t<\infty$.

5.7 Cumulative assumption: protection unavailability is independent of all initiating events

The optimistic bias of Eq. (69) disappears under the additional assumption that A and Q are independent stochastic processes. Under this circumstance, since both the initiating event process T and the protection availability process A are adapted to the filtration ${\left\{{\mathcal{F}}_t\right\}}_{t\ge 0}$ as described in Section 2, it follows that

$$E\left[A_{T_n}\right]=E\left[A_t\right]$$E70

for all $t\ge 0$ and $n\in \mathbb{N}$. Independence of A and Q is congruent with the belief that reactor protections are so robust as to never fail due to the impact of an initiating event. Or, equivalently, an initiating event will induce an accident only if it finds protections already out of service upon arrival.

Of course, the model assumption that A and Q are independent stochastic processes is very strong and hardly justifiable in practice. That said, PRA methodology relies directly on the cumulative assumptions leading to Eq. (69). The assignment of the split fraction value p appeals to ad hoc analysis (e.g., penetration factor) where little or no observed historical calibration data can be found.

6. Summary: reasonableness assumptions and the consequences of making them

Numbers such as CDF or Large Early Release Frequency (LERF) are intended to inform engineers, regulators, and other citizens on the quantitative level of risk posed by a commercial nuclear power plant. Risk in this context is against the Atomic Energy Act of 1954 as amended (AEA) requirement for “adequate protection” of the health and safety of the public.²³ Protection contemplated in the AEA is to help prevent harm to the public from uncontrolled release of radioactive material. Such harms can come from accident scenarios involving reactivity control and loss of core cooling following reactor shutdown. Protective systems are put in place under regulation to minimize the likelihood of such scenarios.

Sections 3–5 review counting of consequential outcomes in hazardous processes such as commercial nuclear power plant technologies as they relate to “unknown-unknowns” (Section 4) and the assumptions required to obtain a numerical result where data are sparse (Section 5), particularly with respect to CDF. In the review, it is shown that PQ on robust protective systems, where little or no data are available for calibration and validation, will produce optimistic estimates for risk of protection breakdowns leading to disastrous consequences. The progressive introduction of assumptions required to obtain quantitative levels of risk and their relationship to nuclear power plant processes in current popular methods based on PQ include: (a) there are no unknown-unknowns, (b) there are no absorbing states, (c) CDF is well-defined, (d) arriving initiating events see the time average of protection availability, (e) arriving initiating events form a Poisson process, (f) the protection availability process is stationary and ergodic, and (g) protection unavailability is independent of all initiating events. The implications of such assumptions, when adopted, is that the number obtained will underestimate the frequency of an accident by an unknowable amount.

Commercial nuclear power, as currently regulated by Western standards, is arguably the most safe energy source (see again [7], on “safe” and “safety”) of all other energy technologies currently available. Regulatory standards, regulatory inspection and enforcement, management oversight, and engineering practice implement available engineering solutions against “unknown unknowns” that include safety margins, defense in depth, root cause analysis, and corrective action to mitigate the consequence of “unknown unknown” events as they actually appear or are imagined to appear. Investors, regulators, design engineers, operators, and the public can best review efficacy of protection using PQ up to the point of risk quantification. Such fundamental engineering processes as design, testing, maintenance, operation, and design revision are supported by PQ that produces and holds out hope for categorizing breakdown scenarios for example, by the level of support they afford. Risk management in modern fission reactor technologies is best managed when the acquisition of knowledge from observations during ongoing operations is applied to protection going forward. This implies a strong organizational commitment to efficacious root cause analysis and corrective action throughout an asset’s lifetime.