The public and the media (perceptions) The industry: understanding the accident and

(1)

“Recalibrating” Risk:

Reactions to Three

Reactions to Three--Mile Island,

Mile Island,

Chernobyl and Fukushima

Elisabeth

Elisabeth Pat

Paté

é--Cornell

Cornell

Elisabeth

Elisabeth Pat

Paté

é--Cornell

Cornell

Management Science and Engineering Management Science and Engineering

Stanford University Stanford University Duke University Duke University September 20, 2013 September 20, 2013

(2)

Three reaction levels to

nuclear accidents (

nuclear accidents (post facto

post facto))

The public and the media (perceptions)

The industry: understanding the accident and

taking corrective measures (technical and taking corrective measures (technical and organizational)

The government: new regulations, systems’

improvements and requirements for risk analysis (PRA)

[Intergovernmental reactions (e.g., through the World

(3)

Outline

Common factors to the three situations

(Three-Mile Island, Chernobyl and Fukushima Daiichi)

For each of the three accidents: a brief

description and post facto reactions description and post facto reactions

Main lessons. “Recalibration” can mean either

new perception of the same risk or systematic risk updating based on new data. Discussion of the role of quantitative risk analysis to explain what happened and to move forward

(4)

Focus on the role of risk analysis and

damage assessment

If perception is reality, trying to inject some

reality into perception

– In evaluation of damage after an accident – In evaluation of the risks looking forward

The risk of no risk analysis: e.g., Fukushima

Future risks given current construction program.

Currently 68 nuclear plants under construction, e.g., 28 in China, 10 in Russia, 7 in India, 5 in South Korea (WANO). What to do about it?

(5)

A major safety problem

How to help the world nuclear industry and

their governmental agencies to improve, based on the lessons from accidents?

No amount of Western rhetoric is likely to No amount of Western rhetoric is likely to

change decisions to build nuclear reactors

worldwide. Main reasons: a large and growing need for energy; pollution by burning carbon.

(6)

Three

Three--Mile Island, Chernobyl,

Mile Island, Chernobyl,

Fukushima: three different stories

Different types of plants

– TMI: pressurized-water reactor (Babcock & Wilcox)

– Chernobyl: graphite-moderated RBMK. No secondary containment. Positive void coefficient (increase in steam

leads to increase in reactivity=> more heat, more steam in a leads to increase in reactivity=> more heat, more steam in a positive loop)

– Fukushima Daiichi: six boiling-water reactors (GE)

Different causes of accidents

– Three-Mile Island, Pennsylvania 1979: misunderstanding of

the system (e.g., poor design of the control panel)

– Chernobyl, Ukraine, 1986: a criminal decision

(7)

Several levels of specificity of PRA’s

The common levels (apply to types of plants)

– Level 1 estimates the frequency of accidents that

cause damage to the nuclear reactor core => core damage frequency (CDF).

– Level 2 starts with Level 1 results, estimates the – Level 2 starts with Level 1 results, estimates the

frequency of accidents that release radioactivity from the nuclear power plant.

The site-specific level: (often the missing one)

Level 3 starts with the Level 2 radioactivity release accidents (source term), estimates consequences in terms of public injury and environmental damage

(8)

The difficulties of PRA

Does not hold on a tee-shirt: costly and requires

a lot of expertise that industry does not always have (more people talk about it that know how to do it…)

Generic models now available

Site-specific models require a lot of expertise

(e.g., seismic hazard)

Second-level of uncertainty done when

necessary (methods exist and are applied) but complex and time consuming (Ref. for example: Jonathan Helton, SANDIA)

(9)

What has changed (and still changing)

Maturation of technology: examples

– Few RBMK’s left (10, all in Russia.) Some

retrofitting (e.g., some secondary protection) Replaced by pressurized-water reactors

Replaced by pressurized-water reactors

– More generally: digital controls (e.g., of feed

water injection in the secondary circuits) and increase of reliability over analogs

Greater exchange of information about

(10)

Maturation of organizations

Major organizational changes: the Institute of

Nuclear Operations (INPO) in the US. Industry self-regulatory body, created after TMI, has

serious influence on industry (INPO has “teeth”)

The World association of Nuclear Operators

(WANO). Weaker: no real power since many countries have different safety criteria often guided by local economics, politics and

competences (no teeth). But WANO provides mechanisms for sharing lessons learned.

(11)

Part 2: (a)Three

Part 2: (a)Three--Mile Island

Mile Island

Pressurized water reactor in Pennsylvania

Partial meltdown (1979); small amount of

radio-active gases and iodine in the atmosphere; no know victim.

know victim.

Accident sequence: failure in the non-nuclear

secondary system (loss of coolant); stuck-open valve that took a while to detect. H2 bubble?

Authorized release of some radioactive water in the Susquehanna river. 1B cleanup costs

(12)

Huge impact on the public

A poorly known technology (too complex?)

A movie (“China syndrome”) that exacerbate

public intense fears

Miscommunication and bad information Miscommunication and bad information

A political climate in which there was little

incentive for a rational discussion.

Over-evacuation and presidential over-reaction Intellectual reaction: “Normal accidents” and

(13)

Huge impact on the industry

Decline in the number of nuclear reactors Decline in the number of nuclear reactors

(Source IAEA) (Source IAEA)

(14)

In the US

Cancellation of 51 nuclear reactor projects:

effectively stopped the growth of the

nuclear program (there are 103 at this time)

Already in 1975: stopped the re-processing Already in 1975: stopped the re-processing

of fuel => keep the wastes on site in pools

But increase in the safety of existing plants The Nuclear Regulatory Commission (NRC)

stepped in and the Institute for Nuclear Power Operations (INPO) was created

(15)

Changes initiated by the NRC

Upgrading and strengthening plant design and

equipment requirements (e.g., auxiliary feed-water system)

Focus on human performance (culture, training) Enhancing emergency preparedness

Setting programs for early identification of

potential problems

Expanding international activities to share info Supported (more or less) the industry’s effort to

(16)

The Institute for Nuclear

Power Operations (INPO)

Industry organization approved by NRC for

self-regulation, training and accreditation

Sets safety objectives, criteria and guidelines

Conducts regular evaluations of nuclear power

plants, communicates the results to industry. INPO ratings influence insurance rates

Provides a forum for candid exchange of

information regarding operations and safety

(17)

“Recalibration” and safety

improvements

Great uncertainties regarding nuclear safety at the

time, and political climate => large increase in risk perception

Measures taken after that, both from NRC and INPO

were beneficial to improvements of nuclear safety were beneficial to improvements of nuclear safety

TMI however was a large setback to the nuclear

power industry and decreased the use of an

alternative generation of electricity (instead: burning coal, oil and gas)

It also accelerated investments in renewable energies

(18)

(b) The most severe accident: Chernobyl

RBMK (graphite moderated) in the Ukraine under

the jurisdiction of the Soviet Union

An experiment going wrong in an unstable system.

Operator error: disarming of safety systems and violation of all safety rules (04/86) to prove safety!

– Steam to the turbines was shut off (disconnection of – Steam to the turbines was shut off (disconnection of

protection systems)

– Power spike => rapid increase in steam pressure – A sequence of explosions severing coolant lines – Steam explosion of the reactors and the plant – Huge fire and graphite dispersion (fought with

(19)

Consequences and losses

31 deaths (Russian evaluation). About 150 later on.

Probably more later but impossible to track down (dispersion of population)=> no possibility of

epidemiological study (dispersion of people and too many confounding factors) but probably additional many confounding factors) but probably additional thyroid cancers and birth defects. UN assessment:

4,000 based on toxicology, linear, no-threshold models

Evacuation of a large zone and a whole town (Pripyat).

135,000 people displaced

Anxieties and degradation of social fabric

(20)

Public reactions

Huge but variable: realization of the facts (not

only the risks) of a massive explosion in a

nuclear reactor. Skepticism about loss reports

Large initial over-evaluations of the losses The Russians: slow to respond and

The Russians: slow to respond and

acknowledge losses. Closure of most RBMK’s under intense international pressures

Europe: fear of fall out and food contamination US: increase awareness of nuclear reactor

dangers (no RBMKs), of the dangers of poorly trained operators and risks of human errors

(21)

NRC reactions (

Source NRC

))

Determining facts, assessing implications for

regulating U.S. nuclear power plants; longer-term studies (much less reaction than after TMI)

But the US does not have RBMK’s and this was a

clear case of violation of all safety rules and disarming of safety systems

of safety systems

Some changes in reactor design, construction and

maintenance

Mostly: review of procedures and controls for normal

operations and emergencies

Competence/motivation of management & staff Ensuring availability of backup safety systems

(22)

Increased use of PRA

“Risk-informed regulations”: increased use of

PRA on all regulatory matters to complement deterministic methods and defense-in-depth

Three areas: nuclear reactors, wastes, and

materials safety materials safety

Implement safety goals with appropriate

considerations of uncertainties to reduce excessive conservatisms

A complement to deterministic method; not a

(23)

“Recalibration” of risk

Another piece of evidence of catastrophic

risk of nuclear power plants accident

Initial overestimation of the losses and large

increase in risk perception

But a known dangerous type of reactor But a known dangerous type of reactor

(RBMK), unstable and without secondary containment

New assessment of the risk of quasi-criminal

behaviors and actions (challenging the

system beyond capabilities and shut down of safety features in spite of orders not to do it)

(24)

(c) Fukushima Daiichi nuclear plant

Six boiling-water nuclear reactors designed by GE

and operated by TEPCO

A magnitude 9 subduction-plate earthquake in the

Senriku area => 14-meter tsunami that struck the

plant and disarmed the diesel generators. Loss of all electric power and of all related safety features.

electric power and of all related safety features.

The fundamental problems: bad design criteria given

the site. A 5.7 m tsunami design criterion and an

undersea water coolant inlet that got clogged in the tsunami. Then: poor emergency management.

Partial meltdown and explosions. Failure to flood the

(25)

Losses and damage

Most (all?) casualties associated with the event

were from the tsunami: up to 25,000 including injuries.

Additional casualties due to the reactors? Hard

to tell. West winds blowing towards the ocean to tell. West winds blowing towards the ocean => relatively low radiation to the population.

No death so far attributed to radiation exposure.

About 40 people injured.

But increased risk of thyroid cancer and birth

(26)

People’s reactions to Fukushima

Huge! In part due to confusion (including in the

press and in academia) between the victims of the tsunami and the potential victims of the

nuclear reactor accident

Loss of confidence in the Japanese authorities Loss of confidence in the Japanese authorities Evacuation of a large zone

Destabilization of the area and its social fabric

(but mostly due to the tsunami)

Drastic reduction of the Japanese electric

(27)

Variable repercussions in the world

A mix of political and technical reactions.

Generally a review of existing and new plants

Germany’s decision to close its nuclear power

plants based in part on risk perception (if not plants based in part on risk perception (if not actual change)

France not to do so, except for the aging ones

like Fesseiheim that was to be shut anyway

China, Russia, India and others not to cancel

but to revisit some features of their ambitious program. But is there any risk analysis there?

(28)

Reaction of the USNRC

New emphasis on site-specific risks: Level 3

PRA, which industry finds expensive (and there are few experts)

Huge effort in terms of emergency

preparedness and response. More detailed preparedness and response. More detailed analysis of load combination

Probable slow down of the nuclear program,

but mostly for economic reasons (inexpensive natural gas -$4 per million btus) -at least as

(29)

The risk of no risk analysis

Back to Fukushima: the deterministic choice of

tsunami design criterion (5.7m), based mostly on the 1960 event from Chili (ε raise in 2002)

Interviews at NRC and EPRI: no PRA for Fukushima.

Japanese excuse: “too complicated”; “data were too Japanese excuse: “too complicated”; “data were too old” => totally ignored the long-term record

Yet, INPO states that TEPCO estimated that

p(Ts.>6m)<10-2 _{in next 50 yrs (based on what?)}

First full probabilistic risk analysis of earthquakes

and tsunamis was published by Epstein in April 2011 (Tokyo Institute of Technology. Ninokata laboratory)

(30)

A partial history of

A partial history of subductionsubduction--plate plate earthquakes and tsunamis along the

earthquakes and tsunamis along the SanrikuSanriku and Sendai coasts (Epstein)

and Sendai coasts (Epstein)

Year Magnitude Interval in years

869 8.6 1611 8.1 742 1611 8.1 742 1793 8.2 182 1896 8.5 103 1933 8.1 37 1960 8.5 27

(31)

The Epstein study and results

Two Bayesian analyses of tsunami>8m starting with

flat priors and including 6 events in 1,171years.

– The first assuming ergodocity – The second not

Results: Ergodic model ~ 1/730 per year, ~4.3% in 30

years. Non-ergodic model: ~ 1/430 per year, ~ 7% in 30 years

Note: the regulation in Japan for large, early release

factors is 10-6/year, smaller than both calculated bounds => an organizational, cultural, economic problem?

(32)

“Recalibrating” the risk

The Japanese invoked an “Act of God” and “Black

swans”. Considered closing their nuclear program but had to change their mind. Still struggling with the site

The German “Ethics commission report”: “The risk The German “Ethics commission report”: “The risk

has not changed but the perception has”. And “risk is the product of probability and consequences”

(insufficient for a good PRA)

My concern: are nations such as China that

construct nuclear power plants in seismic/tsunami areas doing a serious site-specific risk analysis and using it in their design?

(33)

Conclusions

The three accidents triggered different reactions and “recalibrations” because

– They were of fundamentally different natures: a lack

of understanding of clarity of some mechanisms at TMI, a criminal “experiment” at Chernobyl, an absurd choice of design criterion at Fukushima Daiichi.

choice of design criterion at Fukushima Daiichi.

– There were increased levels of experience,

competence and global response in the last 40 years

– Economic circumstances have changed (decrease in

costs of other energy sources)

– New perception of the environmental and health risks

(34)

If perception is reality, we need to

inject some reality in perception!

PRA is an imperfect method (no “prediction”) but

provides invaluable information reflecting state of knowledge

It does not hold on a tee-shirt: risk is NOT the

product of probability and consequences of failure product of probability and consequences of failure (importance of distribution and especially tail of it)

In the end, risk taking and acceptance choices are

political decisions. But some comparisons may put these choices in perspective (understanding that thousands of deaths, one at a time, from coal or oil burning are more acceptable than nuclear accidents)

(35)

“Recalibrating” risk

In general, there was an overestimation of the losses

(and great fears fanned by the media) at least in the first years following the three accidents.

Risk/loss amplification phenomenon: a poorly known

technology, complex and not easy to understand.

Great societal disruptions followed the three accidents

Great societal disruptions followed the three accidents Delayed, poorly known potential effects (cancers)

PRA helps assessing and communicating uncertainties

and can make plants safer, especially the 68 under construction … provided that it is done

And especially for these, exchange of information

(36)