While the radiation protection principles were originally formulated for dealing with protection against ‘certain’ exposures, namely against expo­sures that will occur with some degree of certainty, they may, mutatis mutandi, be used against ‘potential’ exposures as well, namely against situ­ations having the capacity to develop into real exposures in the future. Namely, the principles described heretofore can be used not only for ‘radia­tion protection’ but also for ‘radiation safety’ in general and for nuclear safety in particular. Nuclear safety has been treated in Chapter 10.

Proposals for safety criteria for NPPs founded on the underlying radia­tion protection principles were suggested very early (Gonzalez, 1974, 1982, 1986). The basic proposal was to use available probabilistic assessment tools, such as event and fault trees, for a priori overall safety analyses. A comparison could, therefore, be performed between the probability of occurrence of a hypothetical chain of events leading to an unexpected human exposure, along with its consequences in terms of doses incurred, and a regulatory criterion based on the radiation protection principles. The relevant regulatory authorities would then be able to judge safety levels on the basis of a rational approach sharing the same principles of radiological protection.

A conceptual framework for the protection from potential exposure and how to apply the conceptual framework to selected radiation sources has been recommended internationally (ICRP, 1993, 1997b).

There is at least one practical regulatory application of the radiation protection principles to a nuclear safety criterion (CNEA, 1979, 1980; ARN, 2010), which was discussed at various international meetings (Gonzalez, 1982, 1986). The aim of the regulatory criterion is to require applicants for a NPP licence to identify the failure sequences which, in the case of occur­rence, will deliver a radiation dose to members of the public, and make their probability of occurrence sufficiently low to be coherent and consistent with the radiological protection principles. The probability of occurrence of each failure sequence, as well as the corresponding activity of released radionu­clides, should be assessed by using event and fault tree analyses, which must comply with the following criteria:

1. The failure analysis shall systematically encompass all foreseeable fail­ures and failure sequences, including the common-mode failures, the failure combinations and the situations exceeding the design basis (failure in this context means an aleatory event preventing a component from performing its safety function, as well as any other event which may additionally occur as a necessary consequence of such deficiency; failure sequence, on the other hand, means a sequential series of failures which can, although not necessarily, occur after an initiating event.

2. A failure or a failure sequence may be selected as representative of a group of failures or of failure sequences (in such a case, the failure or failure sequence to be selected from the group shall be that delivering the worst consequences and the analysis shall take into account the sum of the probabilities of the failure or failure sequences in the group).

3. The analysis shall consider that a protection function may have lost operativeness either before the occurrence of the failure or of the failure sequence or as a result of such occurrence.

4. The analyses of failures, of failure sequences or of any part thereof shall be based on experimental data as far as possible (if this cannot be done, the valuation methods must be validated through appropriate tests).

5. The levels of failure rate assigned to the safe-related components, in the evaluation of the failure probability of systems, shall be justified. In the case that justifiable values were not available for some of the compo­nents, the applicant shall use levels of failure rate prescribed by the licensing authority (if a given failure rate is justified on the basis of quality assurance, this must be specified in detail).

6. The failure analyses shall consider the maintenance and testing proce­dures, and the time interval between successive maintenance and testing actions.

7. Failure rates postulated for human actions shall be justified taking into account the complexity of the task, the stress involved and any other factors which might influence that failure rate.

Thus annual probability of occurrence of any failure sequence, when plotted as a function of the resulting effective dose, shall result in compli­ance with a criterion that is coherent and consistent with the principles of radiological protection enunciated above. The implicit basic safety goal is a risk limit derived from the dose limitation system used for radiation protec­tion purposes, which — as seen before — includes four principles: two of them are source-related (e. g. justification and optimization) and the other two are individual-related (e. g. individual limitation and intergenerational pro­tection). These latter principles entail that the risk committed by individual sources should be low enough as to be automatically disregarded. The cur­rently recommended dose limit of 1 mSv per year implies an annual risk limit of around 10-5 for any individual, even for the highest exposed one, as a result of performing all practices involving radiation exposure. However, since the dose limits relate to individuals, appropriate constraints for indi­vidual doses should be selected for each source of exposure. The dose constraint must be sufficiently lower than the relevant dose limit, so as to prevent individual exposure due to several sources from exceeding such limit. Therefore, the de facto annual limit of individual risk would become lower that the limit of around 10-5. On the basis of the above limit and taking into account the uncertainties usually involved in probabilistic safety assessments, an annual risk limit for accidental exposures from nuclear installations should not exceed an order of 10-6. This would be consistent with the principles involved in the currently enforced system of dose limita­tion. Moreover, accidental exposures may arise from a theoretically infinite number of accidental sequences, each one having a given probability of occurrence and delivering a given expected dose to the most exposed indi­vidual. The actual risk incurred by this individual will then result from the integration of the tail distribution of doses (i. e., the complement of the probability function of doses) times the probability of death provided the dose is incurred. The safety constraint should therefore be that the value of this integral be lower than 10-6 per annum.

The assessment of all possible accidental sequences involving radiation exposure is extremely difficult and practically impossible. Therefore, the regulator may be satisfied if around a tenth of the most relevant sequences are identified, assigning them an annual risk limit of 10-7. Since each sequence may result in different doses, a criterion curve may be adopted, which is a relationship between the annual probability of sequence occur­rence and the expected individual dose, each point of the curve representing a constant level of risk. This criterion curve is shown in Fig. 11.7 (Failure of a point to be under the criterion curve does not necessarily mean that the risk constraint is not met, because even in this case, the integral of the tail distribution could be lower than 10-6 annum.)

The logic behind the criterion curve is as follows. For the range of doses from which only stochastic effects of radiation can be incurred, the criterion curve must show a constant, negative, 45° slope in a log annual probability versus log individual dose coordinate axis plane. This would ensure that the annual probability of incurring the dose times the probability of death provided the dose is incurred (the latter being in the order of 10-2 per Sv) will be kept constant. One of the coordinate points in this part of the curve would obviously be {annual probability = ~10-7 annum-1; individual dose = 1 Sv}, because the product 10-5 annum-1 x 1 Sv x 10-2 Sv-1 results in an annual risk of 10-7 annum-1. In the dose range where non-stochastic effects of radiation may occur (i. e., for individual doses higher than around 1 Sv), the slope of the curve should increase in order to take account of the higher risks of death at these levels of dose. For doses higher than approximately 6 Sv, the probability of death approaches unity. From this level to higher doses, the criterion curve should remain constant at an annual probability of 10-7 (because the exposed individual would inevitably die regardless of the level of the dose). Between the coordinate points defined by {annual probability = 10-5 annum-1; individual dose = 1 Sv} and {annual probability = 10-7 annum-1; individual dose = 6 Sv}, the criterion curve should show a shape similar to that of the relationship between the individual dose and

the frequency of death (which, at that range, is approximately S-shaped but, for the sake of simplification, the Authority has decided to approximate these two points by means of a linear-shaped relationship. Finally, the cri­terion curve has been truncated at an annual probability level of 10-2, because the occurrence of incidents having a higher annual probability (regardless of the dose) should reasonably be expected to be unacceptable for any regulator.

It should be emphasized that the criterion curve is individual-related; i. e., it is intended to limit the risk-rate on the individual incurring the highest risk, but does not take into account the overall expected impact from acci­dental situations. The criterion assures a level of safety which is sufficient to ensure that an individual risk constraint, compatible with the philosophy of the dose limitation system, will not be exceeded. It fails, however, to answer positively the old question of the safety engineers, i. e. is such a safety level safe enough as to preclude further safety improvements? An installa­tion complying with the criterion would equally consider whether it is imposing risks (lower than the ‘acceptable’ one) to few individuals, or whether many individuals would incur such risks. If an accident does occur, however, the overall radiological impact will be very different in each case, suggesting that the overall safety level might be lower in the second case than in the first one. Optimization may require further safety improvements in the second case. But, is this really necessary, providing the individual — related criterion is met? And, if so, on what basis can optimization be implemented? These questions are not simple to answer but a logical response would allow for complementing the probabilistic criterion based on individual risk considerations alone.

Radiation protection assessments use the concept of radiation detriment, namely the mathematical expectation of harm, to quantify the impact from a source of radiation exposure. The detriment is an extensive quantity that estimates the combined impact of deleterious effects resulting from expo­sure to a given radiation source. It is defined as the expectation of the harm to be incurred, taking into account the expected frequency and severity of each type of deleterious effect. The detriment incurred by one individual receiving a dose in the range of stochastic effects is proportional to the effective dose incurred, the proportionality factor being the probability that the individual will incur a deleterious effect as a result of the exposure. Therefore, in cases of actual exposures to low levels of dose, the total detri­ment is proportional to the sum of all the individual effective doses incurred,

i. e., to the collective dose commitment (this latter quantity results from the time integration of the collective dose rate, which, in turn, results from the integral of the population spectrum in terms of effective dose rate incurred). It was therefore tempting to use a similar concept for measuring the expected impact from accidental exposures (Beninson and Gonzalez, 1981). For potential accidental exposures, the concept of detriment may keep its theoretical meaning, although it would become a quantity of a second order of stochasticity. In such case, the probability of a given exposure, i. e., the combined probabilities of both an accidental release and an environmental condition (dispersion, deposition), should be introduced in the formulation and integrated over all possibilities. Then, if low doses were expected, the detriment should be proportional to the resulting mathematical expectation of the collective dose commitment. For higher doses, another component of the detriment should be added in order to take into account the non­stochastic effects of radiation.

This idea of using the detriment of a second order of stochasticity, and the related mathematical expectation of collective dose commitment, for quantifying the impact from accidental exposures is really appealing, as the concept would allow for optimizing safety, increasing it to a sufficiently high level that further improvement would not be worthwhile taking into account both the benefits achieved in terms of expected collective dose commitment reduction and the cost of obtaining such reduction. However, unfortunately, it was demonstrated (Beninson and Lindell, 1981) that, at very low prob­abilities, the detriment will lose its usefulness as a basis for decision-making.

In fact, in such cases the standard deviation of the result may be orders of magnitude higher than the actual expectation and the coefficient of variabil­ity would become very large. The detriment is then no longer a central measure of the distribution of harm and, in addition, the uncertainty of the detriment becomes too large to make it meaningful, even if the probability as such could be estimated by safety assessments with an accurate degree of certainty. At very low failure probabilities, the inherent uncertainty of the product of probability and consequences makes the use of this quantity rather doubtful. For these reasons, for potential accidental exposures the principles of justification and optimization are implemented in a less quan­titative manner. The value assigned to the variables follows a utility function of probability and consequence. The utility function usually gives more weight to larger accidents than would be implied by the direct product of probability times consequence.

It must be emphasized that the proposals for using probabilistic safety criteria were never aimed at performing a posteriori ‘confirmatory’ studies of the risk being incurred. Rather, they are aimed to check a priori that the prevention of accidents is coherent and consistent with the radiation protec­tion principles. It should also be underlined that a priori probabilistic analy­sis allows firmly grounded anticipation, when there are frequency data that allow classical statistical treatment, and (with the help of Bayes’s theorem) solidly founded inference when only professional judgement is available.

In sum, an approach to nuclear safety based on the radiation protection principles has a uniqueness: its coherence and consistency vis-a-vis both actual radiation safety situations and potential nuclear safety situations. This exceptionality is at the root of its claim that it is based on a common ethical approach.