Probabilistic safety targets

In accordance with the safety policy described before, EUR sets probabilistic quantitative design targets as follows  

These targets are associated with the scope, data, methods, assumptions and criteria for core damage which are defined in Chapter 2.17. In particular they include the risks in shutdown modes which have been shown to be a significant contributor in assessments of present reactor designs. 

The plant designer shall provide a PSA at both level 1 (determination of the frequency of events leading to core damage) and level 2 (determination of frequencies and magnitudes of radioactive release). 

---

Level F2 also includes safety functions needed in complex sequences up to 72 hours after onset of event. Level F2 shall also include the safety functions needed to reach and maintain a severe accident safe state (SASS).These functions shall be assigned to level F2 if critical to fulfil the overall probabilistic safety targets (see Section 2-1-2-6) or to assure the releases are kept within the targets set for certain DEC. This will be made on a case-by-case basis which can be design dependent. 

A deterministic approach to defence in depth does not explicitly consider the probabilities of occurrence of the challenges or mechanisms (an explanation of these terms is given in Section 3.1) nor does it include the quantification of the probabilities of success associated with the performance of features and systems for each level of defence. However, in the future this deterministic approach can be further complemented by probabilistic safety analysis (PSA) considerations (system reUabihty, probabilistic targets, etc.), to provide an adequate level of safety ensuring a well balanced design. 

The process for evaluating specific designs involves a careful balance of deterministic methods, probabilistic methods (including comparison to numerical safety targets), and the use of engineering judgment. 

More credibly, it may be possible to support a claim of perfection if the software is proved correct using formal methods [8]. In this case any failure rate target, even a stringent target like 10 per hour, would be achievable and the Probabilistic Safety Assessment (PSA) of the overall system could assume the software had a dangerous failure rate of zero. In practice however, few systems have been constructed using formal proof methods, and even these systems cannot be guaranteed to be fault free (e.g. due to errors in requirements or faults in the proof tools [6,20]). 

Once the technology, architecture, and periodic test intervals are defined, the designers do a reliability and safety evaluation (Ref. 14 and 15) to verify that the design has met the target safety integrity level and reliability requirements. In the past, this probabilistic evaluation has not been part of a conventional design process. The effort requires gathering failure rate data as a function of failure modes for each piece of equipment in the safety instrumented function. 

As a measure of the societal concerns that would result from a major accident, a representative target has been defined. It is based on an accident leading to immediate or eventual 100 or more fatalities, mainly from very low doses to very large populations that lead to stochastic deaths. The safety case needs to identify all accidents that result in source terms that could cause 100 or more deaths. The total probability of all such accidents should be calculated, taking account of the frequency distribution of the source terms together with probabilistic weather conditions, and including both on-site and off-site fatalities. 

The probabilistic analysis supports the deterministic analysis by providing confidence that the safety systems used to control faulted conditions are tolerant to a single failure of an active component. The PRA also shows that the AP 1000 risks are likely to be less than UK targets, recognising that a formal demonstration is still to be presented. This forms a sound basis for the ALARP argument. 

The top failure metrics officially called PMHF (Probabilistic Metric for random Hardware Failures) in ISO 26262. It represents a comparable metric such as PFH (Probabilistic Failure per Hour) of lEC 61508. The top failure metrics of ISO 26262 focuses on failure probabilities, with which a safety goal could be violated, whereas PFH according to lEC 61508 is all about the probability of a danger through the system. Both target values of the metrics are specified in failure per hour (failure in time, FIT = lOE-9 h). Also in this case we assume an exponential distribution of the basis failure rate. The key difference between PFH and PMHF is that the PMHF is per safety goal and PFH for a safety-related system. The PFH considers mainly the probability that the system reaches in case of failure a de-energized safe state. 

The basic safety objectives are defined in terms of a probabilistic target for radiological doses to workers, the public and the environment (see Section 2.1) ... 

The operational reliability and safety of computer and computer-based systems cannot be estimated using probabilistic approaches, at least when the targeted level is industrial. It is commonly accepted that so-called reliability growth approaches are unhelpful. For hardware, it is not reasonable to give by analogy a reliability rate for a software component (indiscriminately regrouping software and functional application systems). 

---