Hazard screening in PSA: exclusion rationale, bounding and combined events

Define the endpoint before screening the hazard

Consider a fictional coastal equipment-service station. The endpoint is loss of a specified service for more than 1 h during an 8 h mission. The exposure basis is an operating year under one documented configuration. Personnel harm, environmental release and other services would need their own endpoints. An event irrelevant to this service might remain important to those other questions.

The example register is a teaching subset, not a claim of complete site coverage. Its purpose is to show what a defensible row contains: a named source, an effect pathway, affected targets, the decision status, evidence or assumptions, and a condition that reopens the decision. A familiar hazard name by itself supplies none of those links.

Identify combinations before deleting single hazards

IAEA’s revised PSA guide treats single and combined hazards together and calls for documented screening and conservative impact assessment. Its nuclear endpoints and quantitative criteria are not imported here. The transferable question is whether the full physical pathway has been considered before a hazard leaves detailed modelling.

Wind W and coastal flooding S can occur in one storm. Wind may remove power while water obstructs access to equipment that otherwise could restore the service. The combined WS case is retained even if either effect alone appears manageable. Build combination candidates from the unscreened source list. A list already stripped of individually modest hazards may hide the very interaction that matters.

Keep three different statuses in the register

Retained means that the scenario needs explicit analysis in the chosen model. Bounded means that a conservative contribution remains represented without an equally detailed scenario calculation. Excluded means that the stated pathway has a documented reason for being inapplicable within the boundary. These are different claims; a low estimated frequency is not evidence that a physical source is absent.

The cryogenic row is deliberately narrow. In this fictional configuration there is no cryogenic storage, handling, supply connection or external ingress source for that local release. It does not exclude every toxic, cold-temperature or nearby industrial hazard. A new delivery activity or neighbouring source changes the premise and triggers a fresh applicability check before the exclusion is reused.

Make a bound cover the entire stated case

For hail H, stipulate an occurrence-frequency upper bound of 0.002 per operating year and a conditional endpoint-probability upper bound of 0.04. Their product is 0.00008 per operating year. For road-borne debris D, the corresponding stipulated bounds are 0.0015 and 0.02, giving 0.00003 per operating year. These are invented inputs for an algebraic example, not local observations or generic maritime failure rates.

Each conditional bound must cover the intensity, duration, target configuration and operating states assigned to its row. Here it is explicitly assumed also to cover relevant co-occurrences within that row. A benign-weather damage probability would not bound a severe storm combination. If that coverage cannot be demonstrated, retain the uncovered combination rather than quietly extending the number beyond its evidence.

Carry the bounded contribution into the result

The sum 0.00008 + 0.00003 = 0.00011 per operating year is a conservative upper bound on the added H-or-D endpoint contribution. It need not equal the actual contribution. Overlap between H, D or already retained events can make the addition smaller. The sum does not require independence, but it does require valid bounds for all events being added.

Suppose the separately analysed, overlap-corrected union of retained cases is 0.004 per operating year. Holding that result fixed, the represented hazard family lies between 0.004 and 0.00411 per operating year. The upper addition is 0.0275 of the retained result. This interval isolates screening incompleteness within the stated family; it excludes uncertainty in the retained analysis and hazards outside this illustrative register.

Do not count a storm three times

W, S and WS are three register rows but not automatically three disjoint initiating-event populations. The detailed analysis can partition storms into wind-only, water-only and joint-challenge states, or use a union model that explicitly removes overlap. A combined-hazard entry is an instruction to preserve the mechanism, not permission to add the same physical storm again.

Likewise, a hazard subsumed by another row needs a cross-reference to where its source, targets and outcomes are represented. “Covered elsewhere” is testable only when the receiving model really includes the relevant intensity and support losses. A bounding row should remain traceable through any later partition so that the same contribution is neither silently dropped nor counted twice.

Test the bound against the actual decision

Suppose two proposed configurations differ by a nominal retained frequency of 0.00006 per operating year. Each has an unknown additional contribution anywhere between zero and 0.00011 under its own valid bounds. The improvement after these additions can therefore lie between −0.00005 and 0.00017 per operating year. The sign of the improvement is unresolved by this deliberately broad comparison.

A contribution that looks modest beside a total can dominate a small difference between alternatives. Shared physical evidence might tighten the difference bound, but it must be demonstrated rather than assumed. Screening should therefore be revisited for the intended ranking, sensitivity or vulnerability question. No universal numerical cutoff is created by the percentage in this example.

Attach evidence and reopening conditions to each row

For a real assessment, link the wind and water rows to the relevant hazard characterization, elevations, drainage paths, support-system layout and functional criteria. Link an absence claim to the reviewed inventory and configuration. Record what was checked, by whom, when, and which version of the evidence supports the conclusion. A missing document remains a gap, not an implied favourable finding.

Reopening can follow a new road route, changed traffic, roof modification, relocated equipment, revised hazard tail, extended mission or new stored material. Recheck combinations as well as the changed single row. Slow development is not by itself grounds for exclusion: any credited response needs a feasible warning, access, available resources and a demonstrated effect on the endpoint under the same hazard.

Keep physical screening separate from numerical pruning

Hazard screening decides which physical sources and scenarios enter the assessment and at what resolution. Cut-set truncation later controls how combinations inside an existing numerical model are generated or retained. Lowering a cut-set threshold cannot recover an omitted flood route, absent operating state or unexamined interaction between wind and loss of access.

Maintain separate records for physical exclusions, conservative model simplifications and numerical omission. They have different evidence needs and different reopening triggers. An exact solver only establishes the answer to the model supplied. Conversely, a conservative screen can be useful without detailed simulation if its endpoint, coverage and aggregate bound are genuinely justified.

Report what the screening decision preserves

A useful screening report includes the full candidate list, retained combinations, the compact register, supporting evidence, the bounded contribution and unresolved cases. Show the endpoint and exposure basis beside the numerical result. Preserve excluded rows so their premises can be reviewed after changes; deletion from a working spreadsheet would destroy that audit trail.

In this example, three rows are retained, two remain bounded and one narrowly defined source is excluded. The retained total alone is insufficient for the small alternative comparison, so the next useful analysis would tighten the relevant bounds or model those cases explicitly. The lesson is a reversible, evidence-linked scope decision that preserves difficult interactions rather than an arbitrary small-number test.

Sources

1. IAEA — Development and Application of Level 1 PSA, SSG-3 (Rev. 1), 2024.