Initially, nuclear safety was born together with nuclear engineering and the demonstration of the nuclear fission chain and became a dominant aspect of the design of reactors. Considering core damage or melt causing large radioactivity releases, with emergency systems, containment became unavoidable component of a nuclear power plant adding significant cost and licensing complexity. The intent was to reduce potential public radiation exposure, which became a massive mantra of requirements, physical modeling, probabilistic reasoning, complex calculations and national and international regulatory guidance.

These wide ranging and complex procedures within nuclear reactor safety and risk (NRSR) still did not avoid or prevent the unfortunate nuclear, political and financial disasters of Three Mile Island, Chernobyl and Fukushima. Nuclear safety benefitted from technological development, in some cases preceded and imposed that development, USAEC (1990), and the word “risk” became popular after the Rasmussen report, USNRC (1975), being the possibility of exposure to harm. Nowadays Nuclear Reactor Safety and Risk (NRSR) still strictly controls the design, the construction and the operation of nuclear reactors and the supporting research.

Severe initiating events, detailed failure sequences, complicated event trees, procedural human actions, and postulated failure probabilities are combined in producing endless regulations and paper safety cases often far removed from the realities of daily operational requirements and the demands of the commercial market place. The nuclear “scene” quickly became overlaid with well-meaning national energy policies, socio-economic industrial strategies, subsidized power market distortions, commercial and investor self-interests, anti-nuclear factions and continued non-proliferation postures that overshadow truly competitive innovation. Via bi-lateral “technical exchange” or cooperation agreements, the struggle for market share intensified between existing or modified large designs or differing “domestic” variants (e.g. in USA, France, Russia, China, South Korea, Japan, Canada and India, primarily) and multiple small reactor concepts appeared (over 50 at the last count) all vying for government funding and political support as cheap natural gas rendered them uncompetitive.

Fear of the “unknown and invisible” leads to the equally false hope of risk elimination, while how to place real risk in its correct context is a vitally important, and widespread societal issue. Nuclear radiation risk has a perfect parallel and a key analogy with viral infection risk especially if we require any potential exposure to harm - no matter how small - is to be avoided or minimized at any cost. Simply compare the reactions to societal and personal exposure to unseen viruses and radiation when the personal risk is actually quite low, except if having pre-existing conditions, co-morbidities or weak immune system response.

During the recent COVID-19 pandemic, the fear of any small but finite risk of exposure to the virus lead the medical profession and political decision makers to require or recommend desperate countermeasures even when the chance of personal harm or adverse consequences was and is extremely low (e.g. imposing stay in or “lockdown” rules, banning travel and certain societal activities, limiting most gathering sizes, restricting outdoor activities, quarantine and testing requirements, and sometimes symbolic public face-masking). These measures are now known to be largely ineffective against the inevitable spreading of viral mutations and societally embedded global infections, as was also the case in the 1918 flu epidemic. Similarly, the fear of any small but finite exposure to radiation leads the medical profession and political decision makers to require or recommend countermeasures, even when the risk of personal harm or adverse consequences was and is extremely low (e.g. also by imposing evacuations or stay in rules, banning travel, limiting exposure times and amounts, plus assuming an arbitrarily linear exposure risk and regulations). Despite the precise countermeasures being different, the parallels are startling, and show the impact of societal risk perceptions, beliefs and psychological reactions, due to the key role of the fear of the unknown reflected in reactive governmental and political decision-making implemented via regulatory rules and restrictions.

Such “public safety” examples become unduly restrictive and distort the scientific facts by incorrectly justifying excessive prudence and risk avoidance, with the well-intended but misguided simplification is to attain the nirvana of “zero’ or “tolerable” risk. The protocols, agencies or committees provide “evidence based” guidance for decision-makers allowing public bureaucracies not to be accused of permitting undue or unknown risk exposure; or of not promoting or enforcing all possible or even symbolic remedial risk reduction measures. The resulting fear of the unknown then trumps, indeed emotionally overwhelms any purely rational response. Typical policies and goals invariably avoid using or explicitly mentioning nuclear power as a major contributor, while knowing that adding several thousand Gigawatt reactors by 2050 would be needed just to help stabilize – not even reduce – future atmospheric emissions and CO2 concentrations, Miller et al. (2005).

Therefore, what is wrong with NRSR and the coupled societal risk perception? The key answer is a fact: the production of electricity by nuclear fission is on decline in the countries that originally contributed to its development because of unnecessary fears and unexpected failures – given the availability of alternate fuels like natural gas, and the ability to sub-contract or outsource industrial manufacturing to “cheap labor” sources. This generated lack of attention by young generations and consequent crystallization of decisional structures within (NRSR) organizations, literally resulted in formation of splendid and rigid arrangements like carbon atoms in a diamond. The interaction with the nuclear industry became both standard and weak, i.e. without the impulse and the strength generating the documents USAEC (1971) and USNRC (1975). Hereafter, we cannot refrain to enter trivial reflections (the expert Novak Zuber would call these ‘kaffe klatch’, Zuber 2010) that spotlight the analysis and contribute a deeper basis for our conclusions.

First, terminology is important; however, fashionable changes in nomenclature and revisionist language are not based upon technical investigation or quantitative research and have the potential to bring confusion rather than innovation. The example here is the substitution of: (a) the half-a-century old acronyms Design Basis Accident and Beyond DBA (BDBA) terminology with the terminology Design Basis Conditions (DBC) and Design Extension Conditions (DEC); (b) as an option for safety analysis, of Best Estimate Plus Uncertainty with ‘realistic’ which is not equivalent; (c) replacing deterministic Hypothetical Core Disruptive Accidents (HCDA) with probabilistic Core Damage Frequency (CDF); and (d) reformulating engineering or expert judgment with fashionable risk-informed decision making (RIDM) schemes as proposed and used in conjunction with PSA/PRA for all existing, advanced or new system safety evaluations supporting licensing decisions, GIF (2011, 2014), USNRC (2004a, 2007a, 2020), CNSC (2008) and Apostolakis et al. (2012). An authoritative institution, e.g. International Atomic Energy Agency (IAEA), even has proposed, or accepted many of those new terms, IAEA (2019a). Adaptation to such new nomenclature may seem ridiculously easy, but ‘design’ and ‘design extension’ are a prerogative of country regulatory bodies and not of an international institution. Even worse, ‘realistic’ is a term embedded into the old ‘BEPU’, D’Auria (2019), and now is substituting the old term, ‘option 4’ for safety analysis; the term BEPU remains for ‘option 3’.

Second, performance of virtual but not real safety improvement activities happened in the immediate aftermath of the Fukushima accident. Communication media emphatically reported that ‘stress tests’ confirm the safety of reactors against the sequence of failures that occurred as a consequence of the earthquake and the unanticipated flooding. The concerns are as follows:

• The frequency of the natural event hitting Fukushima was considered too unlikely to require an immediate-urgent and incomplete action. Based on prior data, severe earthquakes and Tsunamis [higher ‘amplitude’ than the North-East Japan Fukushima ones], were measured since 1960s, and big tectonic fault [the biggest in the world] was known to exist at the location of the Fukushima earthquake; so, inexplicably countermeasures were not undertaken. Geoscientists and informed technicians knew of this, just as technicians knew the weaknesses of the fallen viaduct in Genoa, Italy in August 2018, but no countermeasures were taken until after the event.
• Stress tests of existing operating plants did not imply any physical check of component status. Strictly this could have been of some benefit, e.g. testing capability of diesel generator to survive for 40 plus hours of station blackout, after 40 years of permanence in the reactors buildings, but only documentation control (i.e. paper safety) was performed. The ‘stress test’ process was aimed at assuring the public, just as imposed on banking and insurance system reserves after the Great Financial Crisis of 2011, but further damaged the seriousness of the people involved and the thrust toward the nuclear technology. The stress tests did not actually ‘test’ anything: they were just a double check of paper-procedures and QA documents, which are obviously very well done by industry … and very well known that those documents were well written. This was disappointing as actual failure rates were not determined even after the event.

The third consideration has its origins in the 1960’s, when design and construction of reactors materialized without a deep understanding of accident consequences, so systematic planning of research according to needs then filled the knowledge gap. Ironically, once suitable knowledge became available, i.e. nowadays possibly since around the year 2000, the erection of new reactors stopped or slowed down in many countries except by China, Russia and India with their continued state support and preferential funding for large reactors and improved designs. Furthermore, fashionable topics hitting the attention of policy makers and investors and the exigency to keep nuclear laboratory staff working, drove the research in NRSR; available budgets or funding sources rather than needs, then, determine the objective for research and the (presumed) innovation targets. But most R&D today is still focused on so-called “advanced” reactor concepts ideas that, like fusion, have basically existed for 50 years and have not successfully ever penetrated the energy or electricity marketplaces; or on specialized (and expensive) military-type micro-units unsuitable for bulk power systems; or modules and co-generation options that cannot compete with natural gas without subsidies, guaranteed price contracts, and/or emissions credits. This does not prevent the existence of oases of technical progress, like material science and computational methods, useful for many technologies other than nuclear, but does result in wasting ill-directed resources and entrepreneurial funds where enthusiastic but inexperienced concept promoters vie for government development, FOAK and demonstration support funding.

Fourthly, the dramatic events of Three Mile Island, (TMI 1979), Chernobyl (CHE 1986) and Fukushima (FMA 2011) hugely negatively affected the deployment of fission energy, where reactor failures became an emblem for the disaster [here we do not wish to rewrite the history or replace dozens of books and thousands of documents related to each accident]. All were avoidable accidents but only afterwards, compounded by human error and insufficient safety margins. Inadequate operating and emergency procedures, plus lack of attention to a number of minor precursors having little or no connection with the nuclear process itself (e.g. minor valve leakage, misleading water level indication, insufficient safety test data, flooded emergency power sources, inadequate containment buildings, …). TMI occurred because of the operators not being aware of a small leak and then misinterpreting the water content and hence deliberately turning off the ECCS and causing the core to overheat. The CHE situation framework resembles the case of a driver crashing a bus against a wall as once shutdown, restart of fission reactions in any core is difficult because of Xenon build-up as the operators tried to restart. The FMA accident lies in the same picture of a broad natural disaster causing 20000+ deaths but the reactors had inadequate back-up ECCS and cooling systems, so causing the core(s) to overheat.

The benefits and lesson learned after TMI triggered important researches for improvement of NRSR and nuclear technology but also lead to the demise of designs using once-through steam generators, and abandonment of nuclear in many parts of Europe. Similarly, CHE started questionable roadmaps for an extended use of passive systems and the complete abandonment of the graphite moderated – channel type – design. FMA led to intensification of researches to understand what should not happen in a highly safety conscious society, but also possibly to the effective abandonment of the BWR pressure-suppression type of containment design and caused even more expensive BDEE requirements and plant shutdowns.

Like studying the death process of passengers following the failure of an airplane, our fourth consideration is the emotional and policy-driven reactions rather than rational and technology-driven consequences that are the follow-up of TMI, CHE and FMA dramatic events. These largely contributed to the nowadays situation. Safety benefit is even “quantified” by incremental changes to the CDF (a “Delta CDF”) even when far outweighed by the overall dominant uncertainties inherent in human performance particularly when using current PRA/HRA/HEP methods for modeling unpredictable “human performance’.

Fifthly, consideration is given to two key statements in a recent article [Stakeholder coordination essential for nuclear to innovate, April 6, 2021, Reuters Events, Nuclear]. The first is “From the utilities, innovation must mean improved safety and lower cost while the regulator considers new technology as something that must be categorized and quantified before it’s given the green light amid concerns surrounding the risks of changing a legacy safety system”. The second [attributed to Kemal Pasamehmetoglu, Associate Director at Idaho National Laboratory], asserts “The issue is not that we don’t have ideas. The issue, as we found out, is that getting those ideas to the finish line is difficult in nuclear. It is expensive and quite often people with innovative ideas don’t have access to the facilities to test their ideas”. An obvious note is the difference of society and technological contexts compared with late 40’s and 60’s of the previous century. Today, both nuclear industry proponents and existing regulators appear to be addressing new non-PWR challenges by introducing generalized “technology neutral” and “risk informed” criteria for so-called “advanced” or non-specific “modular” designs but without actually demanding or fully funding the complex technology background, prototype demonstrations and experience necessary for new commercial deployments. As a consequence, researchers (with and without innovative ideas) can get funding to continually perpetuate the current technological status; well-meaning (wealthy) entrepreneurs are persuaded to invest in re-packaged but already known/proven developmental and commercial dead ends; while sincere nuclear business and political supporters provide influence, access and high-level contacts but themselves obviously cannot provide anything new technology. The result is a critical waste of time and resources, avoiding the needed reforms of the embedded fundamental processes.

Sixthly, in principle the modern RIDM concept allows “safety” assessments to nominally encompass uncertainties using some formulation of expert judgment that must be informed by relevant data. The specific Risk Informed Decision Making (RIDM) requirement is ensuring a negligible or “tolerable” probability of core damage for the multitude of possible or potentially different initiating events or hazards forming the finite BDEE collection or set {flood, fire, hurricane, ice storm, typhoon, earthquake, cyber-attack …}. Quantitative evaluation must include the reliability of ‘active’ and ‘passive’ emergency back-up systems to supply or restore power and cooling using applicable and “exchangeable” data for nuclear and non-nuclear systems for a wide range of known catastrophic events. Unfortunately, the risks and uncertainties (both aleatory and epistemic) of core damage caused by prolonged loss of power and cooling may be underestimated in RIDM, today. The governing paradigm used by nuclear plant regulators for quantifying or assessing risk consequence up to now is standard PRA/PSA methods (also promulgated as ASME and ANS “standards”) using multiple event trees and Boolean logic sequences, and are deemed “complementary to deterministic analyses”, WENRA (2009, 2013). These analyses have not used prior real event information directly, but proscribe and postulate a host of separately classified Beyond Design Basis Extreme Events, BDEE (floods, fires, hurricanes, ice storms, earthquakes etc.) constituting a “hazard group” initiating system failures provoking radiation release and some level of public harm for quantifying or assessing risk consequence. The subsequent probabilities of core damage for differing designs are actually all (directly or indirectly) dominated by the chance and risk of core damage following loss of power and cooling and/or of the ultimate heat sink (LUHS).

In general, the existing RIDM paradigm develops hypothetical F-C risk-informed boundaries or “performance based” activity release “targets”. The implication of any such “limit” or region (whether risk-informed or not), is small, or incremental changes in postulated annual frequency, ΔF, with a large consequence, C, have equivalent relative acceptable incremental safety improvement, risk significance, or decisional “value” as small consequences, ΔC, with large frequency, F. The NEI proposed an allowable “risk significant” annual frequency-consequence evaluation “target” using regulatory public dose exposure limits measured in rem exposure, USNRC (2007b) and NEI (2018). But for core damage with some probability of even negligible activity release, the major fiscal, societal and commercial consequences and risk exposure are really entire plant loss, corporate/company bankruptcy, job termination, clean-up and power replacement costs (as demonstrated by, say, the prior reactor events) . So the existing paradigm indeed should protect “public health and safety” but does not protect against any other major risks not within the regulatory focus, purview or duty.

As presently constituted, the NRSR basis can be synthesized as a set of overlapping but complementary principles that provide a complete whole but are themselves interleaved as shown in Fig. 1. These are complementary but separate elements of the overall safety construct and ideally are independent of the design, technology, methods and processes.

Figure 1. 

The selected overlapping NRSR elements and principles.

ALARA is an operational goal and a foundational principle. As Low As Reasonably Achievable (ALARA) is the translation and use of the good engineering practice driving human civilization, and is equivalent to ‘the best one can do’. Cost-benefit studies, Best Estimate Plus Uncertainty (BEPU) approach and Integrated Risk Informed Decision Making (IRIDM) strategy are examples of technology driven or oriented by ALARA.

LNT is an unobtainable aspiration. The Linear No Threshold (LNT) is the principle issued by International Commission for Radiation Protection (ICRP) effectively stating that even very low radiation exposure is harmful. Even though not necessarily mentioned, this principle has the potential to enforce or to stay behind any acceptance threshold within the framework of NRSR. In effect, LNT is the competitor and the alternative of ALARA where the emissions equivalent would be ‘even a microgram of CO2 damages the environment’ for the automotive industry; or ‘any one gram of methane affects climate change’ for livestock raising. Radiation hormesis and non-linear effects need proper consideration.

The Safety Goal is a design target. The Safety Goal (SG) is the practical bridge between ALARA and LNT, although it does not mention any of those, e.g. IAEA formulation in IAEA (2006), recently recalled in IAEA (2019b). The current Safety Goal, i.e. to protect humans and environment from ionizing radiations, appears correct provided it refers (explicitly) to ALARA and not to LNT. The Safety Goal is at the origin of Safety Requirements for the design of reactors.

Fail-to-Safe is the desirable end state. The target behind the Fail-to-Safe (FS) principle-concept is ensuring that failure of any structure and/or component adopted for safety purpose shall not aggravate the evolution, complexity and consequences of any accident. In the past, the relatively small number of components made check of compliance of any nuclear reactor unit against the concerned principle easier. Nowadays, the targets of minimizing planned and unplanned outages, refining operating margins and improving the overall efficiency and performance of the system led to the increase in the sophistication and number of Instrumentation and Control (I & C) components. These unavoidably interact among each other, create a huge number of paths for failure and make difficult the demonstration of fulfillment for the principle, as in the recent crash of Boeing 737-Max, Duffey and D’Auria (2020).

Defense-in-Depth (DiD) is simply a recognition that mistakes and accidents do occur. DiD is the correct way to establish a conceptual and dynamic distance between harmful radiations and the environment, being the interface between Safety Requirements and design-construction features of reactors (the terminology derives from the military field where the objective is to protect the defense force). Prevention and mitigation are part of DiD, where traditionally, multiple levels are distinguished, both physically and probabilistically. A correct application of DiD shows, among other things, the positive safety impact of utilizing diversity and redundancy, defense against common mode failures, and the usefulness of only adding a limited array of specific “engineered” systems because of the dominant contribution of human performance and reliability to real outcomes and accidents. The term DiD is sometimes used improperly in literature, specifically when perspective research activities are concerned with innovative fission and fusion reactors.

Safety Functions (SF), Safety Barriers (SB) and Safety Margins (SM) concepts are to minimize the potential dangers from inadequacies in design or operation. NRSR makes wide use of the SF, SB and SM concepts, bringing to the design, among other things, of Emergency Cooling Systems (ECCS), the wider category of Emergency Safety Features (ESF) and to the need for a containment building. Related to SF and SB, SM constitute a deeper feature for NRSR: SM are the target of analyses; performing of analyses needs suitable computational tools, design details of the system (including SF and SB) and acceptance limits (set by regulators). Containment deserves two comments: a) venting is a proper design feature, though competing with LNT, or better, limited by LNT; b) additional use of containment strength appears necessary, e.g. discussed in section 3.

Independent Assessment (IA) is a means to ensure rigorous review of all these prior elements and claims. IA implies the capability to perform analysis by regulators independent of industry, going ahead particularly as embodied in “concept-neutral” and “performance based”, e.g. USNRC (2020). In terms of competencies, IA is a principle stated at the beginning of nuclear era and easy to achieve when, specifically in US, regulators were proposing and leading the research in nuclear technology (i.e. until about 1970’s). Complexity has been added to nuclear systems (see also discussion of Fail-to-Safe) and the data being proprietary with methods claimed as Intellectual Property (IP): regulators not ‘understanding’ the importance of non-disclosed data upon safety evaluations, notwithstanding the theoretical accessibility of all plant data, prevents the fulfillment of this principle (see further discussion in section 5).

The Liability and Responsibilities of the Owner/Operator is a fundamental risk tenet related to the overall risk and managerial structure. The liability, i.e. the legal responsibility arising from the possession and safe operation of an asset, must fall on the owner and is a well-understood principle, e.g. commonly applied to vehicles even if the Owner is not the Operator. This is valid notwithstanding the presence of a regulator that, among the other things, has the responsibility to fix proper rules to make the risk from the asset societally acceptable. The financial investment and anticipated income from the operation of any large nuclear reactor are of the order of 10 Billion USD; however, a nuclear disaster may cause a damage and related costs in the order of Trillion USD. No private (owning) industry can survive the market and social consequences when a massive amount of radiation diffuses into the environment following an accident, as only normal decommissioning funds are set aside and Nuclear Liability Laws do not cover investor risk exposure. Therefore, in nuclear technology, as in other fully licensed cases like inadvertent oil and chemical spills, assigning blame, responsibility and penalties ends up in court, so limiting the financial liability-of-the-owner principle needs a change, discussed more in section 5.

How can extreme event prior data and non-nuclear specific information be used in a ‘concept neutral’ regulatory and safety system design process? There is well established risk informed guidance already available: ‘…it is very certain that, when it is not in our power to determine what is true, we ought to act according to what is most probable’, Rene Descartes, 1596–1650.

The problems we now face are how to make prior rare and other “failure” knowledge useful and applicable for predicting - and indeed anticipating - the quantitative probability of future events, with the intent to reinforce and validate the extensive “paper” bottom-up PRA/PSA calculations and submissions, so we can quantify, accept and believe the predictive uncertainties and reduce intolerable financial risks. What do we expect from the implementation and consideration of NRSR principles and requirements? The not-in-depth answer is as follows:

1. From the side of the owner-industry: the efficient operation of nuclear facilities including affordable design, construction and operation costs and an acceptably small probability of loss of investment.
2. From the side of regulators and public: the safe and efficient operation of nuclear facilities coincide following the tight links between NRSR and design.
3. The trust of the public towards nuclear technology and the evolution of the interaction between industry, operators, owners, investors and regulators.
4. As a result, many more numbers of units built for meeting the necessary global environmental preservation, societal development, and financial investment returns and infrastructure needs (i.e. several thousand GWe units by 2050).

Public trust as well as costs, being different in different regions of the world, contribute to determining and defining the current situation for nuclear technology.

The survey of NRSR is incomplete without mentioning the way to implement and check from principles (section 3.1) to achievements (section 3.2), which occurs within the licensing process of individual nuclear units and imply the interaction between industry and regulators. Tools, procedures and related applications within Deterministic Safety Analysis (DSA) and Probabilistic Safety Analysis (PSA) provide the desirable interconnection between principles and achievements. The key aspect is the qualification for those tools and procedures, as well as for the application modalities.

Furthermore, very low probability accidents with large consequences occur in any technology and industry (space, military, chemical, oil, transport, etc.) particularly at the dawn of development; these are unavoidable and are inherently part of the process to progress in civilization.

Detailed discussions of those topics are beyond the scope for the present paper and provided elsewhere, e.g. Duffey and D’Auria (2020). We limit ourselves to note that suitable tools and procedures exist, consistent with current knowledge; however, application of those tools lags (sometimes too much) behind their development and qualification proof, e.g. D’Auria (2019).

For new “non-LWRs”, the NEI proposed an allowable “risk significant” annual Frequency-Consequence, F-C, evaluation “target” using regulatory public dose exposure limits measured in rem, USNRC (2007a), and NEI (2019). For PRA/PSA frequencies within nominal “5–95% uncertainty” bounds, NEI (2018), there is an arbitrary “anchor” at 1 rem, with a constant minimum below a frequency of 5.10^-7 per annum². The suggestion is that there are statistical uncertainty bounds on input probabilities derived from sensitivity to failure rate uncertainties; however, this is itself subject to unknown uncertainty given there are no comparisons to prior (deemed as non-exchangeable) NPP event data. Note that for infinitesimal releases, the implied allowable target is more than one event per year per reactor even if the core damage causes total investment loss but negligible societal disruption or public harm.

Implementation of safety rule is the prerogative of regulators only who are not formally concerned about financial losses and risks. Therefore, we submit the proposal below, with the support of the diagram in Fig. 2, to the attention of regulators, well recognizing that it has not any robustness, completeness and self-consistency characteristic. Exploiting the containment strength, introducing specific consideration of residual risk and locating LOCA and BDEE (and additional ‘similar’ events) constitute targets and attributes for the newly proposed ESF RIDM rule.

Figure 2. 

The proposed ‘ESF RIDM Rule’.

We qualitatively report selected parameters in the vertical axis versus decreasing values of the probability of accidents. Corresponding to nominal (or normal) operation, one may infer LOCA occurrence and ultimate probability, i.e. the RIDM limit, or PU Nominal operation is the ‘probability’ event during the operating life of any reactor. Reactor-dependent value for the LBLOCA probability of occurrence, eventually extended to the entire spectrum of DBA, constitutes the intermediate value. What is currently reported as severe accident (SA) or BDEE probability might involve towards Large Releases (LR) of radioactivity to environment (i.e. sum of probabilities of occurrence for all SA-LR events) and constitutes the smallest value on the right of the horizontal axis.

The expected containment response and the ECCS rule originated by USAEC (1971) constitute the vertical axis; one may add the BEPU (e.g. CSAU supported) domain, not shown in the diagram, to predict the events and associated uncertainties until the occurrence of BDEE-LR under the condition of (nearly) intact core geometry.

Containment protects the environment, should an accident occur having probability lower than PU. However, the amount of radiation in the containment is substantially different for accident having probabilities larger or smaller than PLOCA/BDEE (because of unavoidable containment leakages one may also expect different releases to environment). Containment bypass, or LR condition, constitutes the residual risk. The graded approach characterizes the current ECCS rule: acceptability thresholds are more stringent for most probable events. The proposed ESF RIDM rule keeps the same ECCS rule, USAEC (1971), within the domain <normal operation – PLOCA/BDEE >; step relaxation occurs at PLOCA/BDEE until PU. In the domain <PLOCA/BDEE – PU > the current ECCS rule is not necessarily fulfilled. Summarizing, the key features for the proposed ESF RIDM rule are:

1. The definition of PU.
2. The adoption of current ECCS rule, USAEC (1971), or similar rule modified based on RG 1.224, USNRC (2018), and RG 1.200, USNRC (2020), until PLOCA/BDEE.
3. The exploitation of containment strength in the domain < PLOCA/BDEE – PU > (e.g. allowing massive release of radioactivity in the containment should a LOCA occur).

Rough definitions unavoidably characterize the parameters in Fig. 2. Furthermore, the BEPU use in the region <PLOCA/BDEE – PU> implies the calculation (and the assessment) of radiological releases from the failure of individual fuel rods and tracking of radiation transport from the core to the containment and from containment to environment through unavoidable leakages. Current acceptability thresholds apply for radiation release to the environment, i.e. for accidents having probability greater than PU.

Connected with the ESF RIDM rule, regulators could allow the reduction of liability of NPP owner for accidents having probability lower than PU.The NPP owner could contribute a maximum value for damages in such conditions.