*The present generation of nuclear reactors has had a good safety record, with the major exception of the Chernobyl-type reactors. Outside the former Soviet Union, about 8500 reactor-years of commercial nuclear power-plant operation have been realized until now, with no accident involving a large external release of radioactivity and only one accident with fuel melting: the 1979 accident at Three Mile Island (TMI).

These numbers suggest that the risk of an accident with fuel damage has averaged approximately 10 E-4 per reactor-year, corresponding under common assumptions to a large external release of radioactivity at a rate of 10 E-5 per reactor-year. But this performance would not suffice for a world with ~4000 reactors, because the expectation would then be for a TMI-scale nuclear accident every several years.

However, changes in equipment and operating procedures since TMI suggest considerably improved safety. The likelihood of an accident that proceeds all the way to core damage can be estimated by analyzing data on the occurrence of individual system malfunctions (precursor events). Such analyses of actual U.S. reactor performance show a drop of roughly a factor of 100 in the inferred core damage probability, when comparing the 1994-1998 record with that for the pre-TMI period of 1974-1978 (See T. E. Murley, Nucl. Saf. 31:1 (1990); T. E. Murley, "MIT safety course" (July 1999); and W. D. Travers, SECY-99-289, NRC, 1999).

There are also well-developed designs for a next generation of reactors, which promise still greater safety. Of these, the advanced boiling water reactor (ABWR) is the first to have been ordered, with two now operating in Japan. The probability of core damage is estimated by the ABWR designers to be 2 x 10 E-7 per reactor-year and by the staff of the U.S. Nuclear Regulatory Commission to be "on the order of 10 E-6 or less" if the plant is built and operated as specified (See The ABWR General Plant Description, GE Nuclear Energy, 1999; and NRC, "Final safety evaluation report related to the certification of the advanced boiling water reactor design," main report, NUREG 1503, vol. 1, 1994, p. 19-6).

Research is under way to design a further generation of advanced reactors that differ from previous generations in that they make greater use of passive safety systems, based on simple physical laws. Because they will require no immediate operator intervention in the case of malfunction, they are expected to operate with extremely low levels of risk to the public.

[Source: William C. Sailor et al., "A Nuclear Solution to Climate Change?", Science 288:1177, May 19, 2000]

* Probability is expressed as a number between 0 and 1 (0 to 100 percent likelihood of the occurrence of an event). The notation 3 × 10^-6 can be read 0.000003, which means that there are three chances in 1,000,000 that the associated result (for example, a fatal cancer) will occur in the period covered by the analysis.

Nuke Protect - Potassium Iodide / Selenium Blend
90 cap

* The International Nuclear Event Scale (INES) was developed jointly by the International Atomic Energy Agency (IAEA) and the Nuclear Energy Agency of the Organization for Economic Cooperation and Development.

* The NRC's safety goals are described in the Safety Goal Policy Statement, which was released in August 1986 (See 51 Federal Register 30028). The development of the Policy Statement began not long after the Three Mile Island accident, and was a first attempt by the Commission to come explicitly to grips with the integration of the quantitative assessment of risk into the regulatory system. A few years earlier, the NRC had funded the Reactor Safety Study, known as WASH-1400 and perhaps even better known as the Rasmussen study. That study represented the first use of probabilistic techniques to estimate the frequency of accidents and their ultimate consequences, thereby allowing a quantitative estimate of risk. The primary issue for the NRC in developing safety goals was to use these techniques to help articulate a level of acceptable risk -- in other words, to define "how safe is safe enough."

The Commission established two goals that are stated in terms of public health risk -- one addressing individual risk and the other addressing societal risk. The risk to an individual is based on the potential for death resulting directly from a reactor accident -- that is, a prompt fatality. The societal risk is stated in terms of nuclear power plant operations, as opposed to accidents alone, and addresses the long-term impact on those living near the plant. In both cases, the Commission based its acceptable level of risk on a comparison with other types of risk encountered by individuals and by society from other causes, applying the rule that the consequences of nuclear power plant operation should not result in significant additional risks to life and health. The goals were expressed in qualitative terms, perhaps so the philosophy could be understood by all.

In both cases, however, the Commission also expressed the qualitative goals for the safety of nuclear power plants in terms of individual and societal "quantitative health objectives" or "QHOs." These were established at one one-thousandth of the risk arising from other causes presenting the same type of risk.

It is important to note that the QHOs per se have never been directly reflected in the NRC's regulations, but were promulgated to provide guidance as to the level of "public protection which nuclear plant designers and operators should strive to achieve." They were also meant to provide guidance to the NRC staff to use in the regulatory decision-making process. However, the Commission was clear that the safety goals were not meant "to serve as a sole basis for licensing decisions." In fact, the Commission disclaimed an intent to use the goals in making plant-specific regulatory decisions.

While the safety goals provided a metric to address the question of "how safe is safe enough," practical implementation of the Commission's guidance proved to be difficult. This was the result of the large uncertainties involved in calculation of risk in the mathematical sense of probability times consequences. As a result, the NRC staff began looking for other metrics to use as surrogates for the QHOs in regulatory decision-making.

In 1990, the Commission provided additional guidance to the staff regarding the Safety Goals, endorsing surrogate objectives concerning the frequency of core damage accidents and large releases of radioactivity (see Staff Requirements Memorandum on SECY-89-102, ÒImplementation of the Safety Goals,Ó June 15, 1990). The numerical value of one-in-ten-thousand for core damage frequency (CDF) was cited as a "very useful subsidiary benchmark...." In addition, a conditional containment failure probability of one-tenth was approved for application to evolutionary light water reactor designs. This resulted in a large release frequency of one in one-hundred-thousand, since containment failure is necessary for a large release to occur. These values have evolved into the "benchmark" values of 10-4 for CDF and 10-5 for large early release frequency (LERF), as discussed in Regulatory Guide 1.174 for use in risk-informed regulatory decision-making.

The application of these goals as an underpinning of the regulatory system has evolved over time from the philosophical to the practical. Now they serve as the basis for many regulatory initiatives. An early example of explicit consideration of risk in a regulation is the NRC's Backfit Rule, originally issued in 1988 (10CFR50.109). But we have moved on to a much more comprehensive application of risk in our regulations, as most in this audience are undoubtedly aware. The aim, of course, is to use risk as the tool for dissecting and reforming our regulatory system so that the NRC focuses on risk-significant activities, thereby both enhancing safety and reducing needless regulatory burden. In implementing this approach we still adhere to many of the basic concepts discussed in the original Safety Goal Policy Statement, such as the use of risk as only one factor among many in making regulatory decisions.

In short, the development of a practical application of the safety goals and the ancillary tool of PRAs have taken many years, but they have growing significance as the foundation for the NRC's work. That being said, there are challenges that must be confronted. Let me mention a few.

First, we recognize that risk, at least for the foreseeable future, will be only one factor that can guide regulatory decisions. In this connection, I want to emphasize the relationship of risk insights to defense in depth. If one had complete confidence in the accuracy of PRAs, one might conclude that defense in depth could be ignored if the risk were sufficiently low. But the Commission is not prepared to jettison the deterministic processes and the defense-in-depth philosophy that are integral parts of the regulatory system. Defense in depth is to be applied at a high level -- that is, to require both prevention and mitigation -- and then as well at lower levels to compensate for uncertainty. There has been much discussion within the NRC and with the Advisory Committee on Reactor Safeguards as to how defense in depth should be incorporated into a risk-informed regulatory approach and this discussion will no doubt continue.

Second, we may need to reconsider the subsidiary objectives. Although the CDF and LERF goals have proven to be quite useful and valuable in implementing the Commission's safety philosophy, they do tend to skew the focus of attention to severe reactor accidents. While it is unquestionably true that the societal risk from nuclear power is dominated by accidents that have low frequencies and high consequences, the perception of risk on the part of the public is influenced by events of low consequence in terms of radioactive releases, but which have much higher frequencies. This is illustrated, for example, by the reaction following the steam generator tube failure at the Indian Point 2 station in February 2000. The event was widely reported to have involved a release of radioactivity to the environment, although the release was determined to be so slight that the monitoring equipment around the plant could not detect it. Nonetheless, there was an intense public reaction to the event, which continued for several months and has only recently begun to subside. The safety strategy should address plant operations, not just accidents, and should consider the full spectrum of events on a frequency/consequence continuum rather than just extreme events. That is, even a low-consequence event is of concern if its frequency of occurrence is high.

Finally, while we wrestle with incorporating risk insights into regulatory processes, we face other practical challenges as well. As you know, in the past few months there has strong interest in exploring new construction. We fully expect to see aggressive use of PRAs in connection with new reactor designs as means of satisfying the Commission's goal of assuring that advanced reactor concepts meet or exceed the level of safety provided by the current generation of reactors. Of course, PRAs are now used in the design process itself, to pinpoint and correct vulnerabilities based on risk insights. In this connection, we are grappling with the possibility that we may have to develop a new regulatory system that, unlike the focus of the current rules on light water reactors, will be independent of technology. The foundation of any such system must inevitably include compliance with the safety goals-or their subsidiary objectives-as demonstrated by PRAs.

Despite these many challenges, the NRC is clearly moving in the direction of greater reliance on quantitative tools and goals -- thereby achieving the promise first signaled by the Commission's Safety Goals nearly 15 years ago. I believe the next 15 years will see accelerated progress.