A HK$180 million diesel generator justified by a 14% CDF reduction
Your utility's Level 1 PSA for a two-unit PWR gives a baseline internal-events core damage frequency (CDF) of 4.2×10⁻⁶ per reactor-year. A proposed modification adds a third air-cooled emergency diesel generator at a cost of HK$180 million; the model predicts a CDF reduction of 6×10⁻⁷ per reactor-year. The submission describes this as a significant risk reduction. You notice that 38% of the baseline CDF comes from a single common-cause failure of the two existing air-cooled EDGs, modelled with a beta factor of 0.05, and that the new EDG is assumed to be fully independent, with beta 0.05 applied only within the new pair. Operating experience from similar plants suggests a beta of 0.12 for identical EDGs. The PSA excludes fire and seismic events. The licensee's internal procedure requires any modification above HK$50 million to demonstrate that the risk reduction is reasonably practicable.
1. Evaluate the claimed CDF reduction and recommend whether the modification should proceed on that basis.
Read the worked answer
The reduction is real in model terms, but the justification as written is weak.
Step 1 - check the arithmetic: 6×10⁻⁷ / 4.2×10⁻⁶ = 14% relative reduction in CDF. That is not trivial, but it is not obviously 'significant' either, and it sits within the model's own uncertainty band.
Step 2 - convert to a risk metric that can be compared with cost. CDF is not a risk endpoint and cannot be used directly in a cost-benefit test. Propagate the change through the Level 2 model: a 14% change in CDF gives at most about 14% in LERF, often less if the EDG sequences are not dominant for early release. If the conditional large-early-release probability for the affected sequences is 0.1 and offsite consequences are of order 10 latent fatalities per release, the averted risk is roughly 6×10⁻⁷ × 0.1 × 10 ≈ 6×10⁻⁷ fatalities per year, before population and meteorological weighting.
Step 3 - apply the reasonably practicable test. HK$180 million for that reduction is an implied cost of order HK$10¹⁴ per CDF-year averted - an extremely high figure that would normally fail a gross-disproportion test. But the test is not purely arithmetic: a cliff-edge in the analysis, a sequence that dominates LERF, a defence-in-depth benefit, or the absence of a cheaper alternative can make the measure reasonably practicable.
Recommendation: do not accept the submission as written. Require the Level 2 propagation and a comparison of alternatives - a cross-tie between units, a portable generator, battery extension - before recommending HK$180 million. If EDG sequences are not LERF-dominant, the case should rest on station-blackout coping or defence-in-depth, stated explicitly, not on a bare CDF delta.
2. Advise on the beta factor and the independence assumption, and quantify the effect on both the baseline and the claimed benefit.
Read the worked answer
The beta factor and the independence claim are the crux, and both need challenge.
Quantify roughly. With a single EDG failure probability of about 0.01 and β = 0.05, the CCF term for the pair is of order β/(1−β) × Q² ≈ 0.05/0.95 × 10⁻⁴ ≈ 5×10⁻⁶; this is comparable to the independent term, which is why CCF dominates. If operating experience supports β = 0.12, the CCF term rises by a factor of about 0.12/0.05 ≈ 2.4. A CCF contribution of 1.6×10⁻⁶ becomes ≈3.8×10⁻⁶, and the total CDF becomes ≈6.4×10⁻⁶ instead of 4.2×10⁻⁶. That changes the baseline, not merely the delta, and the cutset ranking changes with it.
The independence assumption is the second problem. A third identical air-cooled machine on the same site shares failure sources: fuel quality, lube-oil supply, cooling-air intake, starting batteries, the same maintenance crew, the same typhoon-driven debris or dust, and potentially the same design defect. A separate beta group is defensible only if the new EDG differs in design, location, fuel source and maintenance organisation - and even then a cross-group CCF term is normally retained. If a common beta of 0.12 applies across all three, the CCF term does not fall in proportion to the number of machines, and the benefit of the third EDG is far smaller than modelled.
Action: re-run with the higher beta, with and without the new EDG, and with a cross-group term. Report the effect on CDF, on LERF and on the cutset ranking. If the benefit depends on the independence assumption, the case collapses.
3. What are the limits of a CDF-only justification, and what else would you require before a decision?
Read the worked answer
Limits:
- CDF is not risk. Two plants with the same CDF can differ by orders of magnitude in LERF and offsite consequence; a modification that reduces CDF but not LERF may be worth less than a cheaper one that protects containment.
- The PSA excludes fire and seismic events, which at many plants contribute as much as or more than internal events. A 14% internal-events delta may be insignificant against total risk.
- Model uncertainty: beta factors, CCF grouping, human reliability and success criteria can each shift the result by more than the modification does. A 14% delta is inside the uncertainty band.
- Defence-in-depth and margins are not captured. A third EDG may be justified because it removes a single-point vulnerability or improves coping with an extended loss of offsite power, even where the PSA delta is small.
I would require: the Level 2/LERF propagation; fire and seismic sensitivity studies; an uncertainty analysis on the delta itself, not only the baseline; a documented basis for each beta factor and CCF group; a comparison of alternatives including non-hardware measures; and a decision record stating whether the recommendation rests on quantified risk reduction or on defence-in-depth. The difference matters because it determines what evidence would later overturn the decision.