integrated decision-making process include deterministic consideration, e.g.,
defense in depth, good practices, operating experiences, and organizational considerations [5], some of which are discussed briefly below.
Uncertainty due to lack of knowledge, e.g. uncertainty related to modeling or
insufficient amount of data, is called “epistemic uncertainty”, which is distinguished
from inherent randomness, i.e. aleatory uncertainty. Appropriate methodologies to
analyze risk depend on the magnitude of epistemic uncertainty. Epistemic uncertainty is related to the amount of knowledge about accident scenarios and their
consequences as well as their probability.
It has been discussed, e.g. by Stirling [6], that decision makers who receive the
results of risk assessment as well as engineers who provide the results of risk
assessment have a tendency to simplify and trivialize the characteristics of risk so as
to make them easier to analyze and evaluate. However, when considering the basic
purpose of risk analysis, i.e. to contribute to rational decision making, the result of
such simplified risk assessment may be one of reasons that the decision is wrongly
distorted. To avoid this distortion, it is recommended to use various methodologies
in addition to probabilistic risk analysis, e.g., sensitivity analysis, deliberation
among experts, and enhancement of diversity as well as resilience capacity, to
tackle the entire range of risk including ignorance.
3.3 Defense in Depth
“Defense in depth” is an approach to designing and operating nuclear facilities that
prevents the occurrence and mitigates the consequences of accidents. The approach
consists of multiple levels of defense to compensate for potential failures [7].
Table 1 shows the objectives and essential means for each of five levels of defense
defined by IAEA INSAG [8]. Defense in depth is considered to be the fundamental
concept to achieve nuclear safety under uncertainty, especially for installation of
nuclear power plants, and is regarded still important after the Fukushima
Daiichi NPP accident. Meanwhile, it is sometimes said that the Fukushima
Daiichi NPP accident, which occurred due to a severe natural event, is a challenge
to the defense in depth concept. It was conventionally considered that natural
hazard risks can be avoided through appropriate siting criteria and conservative
design, i.e. up to the first level of defense in depth, without much consideration of
higher levels of defense in depth, though it is discussed in IAEA INSAG-25 that the
concept of defense in depth includes consideration of external hazards. A typical
example is that the accident management introduced at NPPs in Japan was prepared
mainly for accidents from internal event, i.e., random failure of components, and
consideration of external events in case of accident management was not discussed
before the Fukushima Daiichi NPP accident. It can be said that there was no
effective mechanism to evaluate and reduce the risk from both internal and external
events continuously in Japan.
70
T. Itoi and N. Sekimura
defense in depth, good practices, operating experiences, and organizational considerations [5], some of which are discussed briefly below.
Uncertainty due to lack of knowledge, e.g. uncertainty related to modeling or
insufficient amount of data, is called “epistemic uncertainty”, which is distinguished
from inherent randomness, i.e. aleatory uncertainty. Appropriate methodologies to
analyze risk depend on the magnitude of epistemic uncertainty. Epistemic uncertainty is related to the amount of knowledge about accident scenarios and their
consequences as well as their probability.
It has been discussed, e.g. by Stirling [6], that decision makers who receive the
results of risk assessment as well as engineers who provide the results of risk
assessment have a tendency to simplify and trivialize the characteristics of risk so as
to make them easier to analyze and evaluate. However, when considering the basic
purpose of risk analysis, i.e. to contribute to rational decision making, the result of
such simplified risk assessment may be one of reasons that the decision is wrongly
distorted. To avoid this distortion, it is recommended to use various methodologies
in addition to probabilistic risk analysis, e.g., sensitivity analysis, deliberation
among experts, and enhancement of diversity as well as resilience capacity, to
tackle the entire range of risk including ignorance.
3.3 Defense in Depth
“Defense in depth” is an approach to designing and operating nuclear facilities that
prevents the occurrence and mitigates the consequences of accidents. The approach
consists of multiple levels of defense to compensate for potential failures [7].
Table 1 shows the objectives and essential means for each of five levels of defense
defined by IAEA INSAG [8]. Defense in depth is considered to be the fundamental
concept to achieve nuclear safety under uncertainty, especially for installation of
nuclear power plants, and is regarded still important after the Fukushima
Daiichi NPP accident. Meanwhile, it is sometimes said that the Fukushima
Daiichi NPP accident, which occurred due to a severe natural event, is a challenge
to the defense in depth concept. It was conventionally considered that natural
hazard risks can be avoided through appropriate siting criteria and conservative
design, i.e. up to the first level of defense in depth, without much consideration of
higher levels of defense in depth, though it is discussed in IAEA INSAG-25 that the
concept of defense in depth includes consideration of external hazards. A typical
example is that the accident management introduced at NPPs in Japan was prepared
mainly for accidents from internal event, i.e., random failure of components, and
consideration of external events in case of accident management was not discussed
before the Fukushima Daiichi NPP accident. It can be said that there was no
effective mechanism to evaluate and reduce the risk from both internal and external
events continuously in Japan.
70
T. Itoi and N. Sekimura