Probabilistic Risk Assessment - Criticism

Criticism

Theoretically, the probabilistic risk assessment method suffers from several problems:

Nancy Leveson of MIT and her collaborators have argued that the chain-of-event conception of accidents typically used for such risk assessments cannot account for the indirect, non-linear, and feedback relationships that characterize many accidents in complex systems. These risk assessments do a poor job of modeling human actions and their impact on known, let alone unknown, failure modes. Also, as a 1978 Risk Assessment Review Group Report to the NRC pointed out, it is "conceptually impossible to be complete in a mathematical sense in the construction of event-trees and fault-trees … This inherent limitation means that any calculation using this methodology is always subject to revision and to doubt as to its completeness."

In the case of many accidents, probabilistic risk assessment models do not account for unexpected failure modes:

At Japan's Kashiwazaki Kariwa reactors, for example, after the 2007 Chuetsu earthquake some radioactive materials escaped into the sea when ground subsidence pulled underground electric cables downward and created an opening in the reactor's basement wall. As a Tokyo Electric Power Company official remarked then, "It was beyond our imagination that a space could be made in the hole on the outer wall for the electric cables."

When it comes to future safety, nuclear designers and operators often assume that they know what is likely to happen, which is what allows them to assert that they have planned for all possible contingencies. Yet there is one weakness of the probabilistic risk assessment method that has been emphatically demonstrated with the Fukushima I nuclear accidents -- the difficulty of modeling common-cause or common-mode failures:

From most reports it seems clear that a single event, the tsunami, resulted in a number of failures that set the stage for the accidents. These failures included the loss of offsite electrical power to the reactor complex, the loss of oil tanks and replacement fuel for diesel generators, the flooding of the electrical switchyard, and perhaps damage to the inlets that brought in cooling water from the ocean. As a result, even though there were multiple ways of removing heat from the core, all of them failed.

However, a PRA analysis that assumed an initiating event of a beyond design basis tsunami of the magnitude that occurred would have identified most, if not all, of the above consequences. In this case, the challenge is not with the PRA method but with the selection of initiating events. For any given design, a low probability high magnitude initiating event can be assumed for which the design will fail. However, selecting an unrealistically severe initiator defeats the purpose of the analysis, as potential vulnerabilities to realistic scenarios will be masked.