Erratum to ‘‘Empirical Risk Analysis of Severe Reactor Accidents in Nuclear Power Plants after Fukushima’’

In the paper an error occurred in the calculation of the cumulative reactor years from the data of IAEA report RDS2/31 (2011 edition). It affects Figure 1 and Table 2 of the original paper.Minor implications in the following sections:Materials and Methods, Results, and Discussion, have been corrected below. The main results of the paper are derived with the correct value of C W (2010) = 14097 cumulative reactor years for the Fukushima accident. In the Acknowledgment section there, is also a change.


Introduction
Electricity generation by nuclear power plants (NPPs) is an important source of the world's energy.According to the International Atomic Energy Agency (IAEA) 441 nuclear power reactors were connected to the grid by the end of 2010.They are distributed over 30 countries and provided a total capacity of 375,000 MWe or 14% of the world's electricity [1,2].
After the series of accidents at the Fukushima-Daiichi facility in March 2011, a new appraisal of risks arising from nuclear power generation has begun, notably in countries which operate or plan to construct NPPs [1].A reexamination of the risks will influence decisions on the continuation of national programs for electricity generation.A substantial gain of safety is counted among the important reasons to shut down NPPs, because severe accidents become less probable.As a side effect, public interest in research fields such as preparedness for nuclear emergencies or radioecology, which are concerned with the repercussions of severe accidents, is waning.
The present short study aims to provide updated information for the discussion on the future of nuclear power generation with a simple empirical approach to risk assessment.The occurrence probability and related risk quantities such as the estimated time to the next accident are derived based on data of commercial nuclear facilities for electric power production from the late 1960s to the Fukushima accidents.From the worldwide recorded data [2] a hazard for severe reactor accidents is estimated and used for a speculative analysis of future risks.For three scenarios concerning the developing of reactor numbers in the next twenty years the risk for an accident in one of the world's reactor is investigated.The scenarios assume a constant number of reactors and moderate rates of increase or reduction.
Accidents in nuclear facilities are classified by the International Nuclear and Radiological Event Scale (INES) in a scheme of levels ranging from 0 (no safety significance) to 7 (major accident) [3].Three accidents with level 5 (accident with wider consequences) or above at Three Mile Island, Chornobyl, and Fukushima (see Table 1) have received worldwide attention and are in the focus of the present analysis.The selection of accidents with levels ≥ 5 is mainly based on the notion that "to the public at large, the history of nuclear power is mostly a history of (these three) accidents" [4].Thus, they have a major impact on political decision making.
In contrast to the present simple top-down approach probabilistic safety assessment (PSA) has been developed as an international standard procedure for risk quantification.In the more systematic bottom-up (and completely independent) approach of a PSA a reactor accident is modeled with different pathways leading to component failures which are defined by nuclear engineers.PSA is generally performed in three levels.In level 1 initiating events and the event chains to system damages and to more serious core damages are analysed.Level 2 is concerned with the processes from beginning core damage (i.e., of the fuel cladding tubes) to core meltdown with containment failure.It also includes the estimation of the source term for release of radioactivity into the environment.Off-site consequences such as land and food contamination are studied at level 3 [5,6].The level 1 PSA of internal events has been completed for all NPPs worldwide but until 2009 a consideration of external threats such as earthquakes and tsunamis was still missing for some plants [7,8].Events with very uncertain occurrence probabilities like terrorist attacks and wars are generally not included in a PSA analysis.Recently, the PSA approach has been criticised for underestimating the hazard because it might be unable to consider all possible pathways to a severe reactor accident [9].This concern is addressed here by checking the compatibility of the present results with the results of a PSA study for a typical pressurised water reactor in Germany [10].

Materials and Methods
Three accidents of commercial nuclear facilities with INES level ≥ 5 have been chosen for the analysis, see Table 1 for a short characterisation.Other accidents of levels 6 such as the Kyshtym disaster (Russia, 1957), and 5 such as the Windscale fire (United Kingdom, 1957), the Lucens reactor (Switzerland, 1969), and the Goiânia accident (Brazil, 1987) are not considered, since they are not related to commercial power generation.In level 6 accidents a significant amount of radioactivity is released into the environment.In level 5 accidents the amount is limited but the reactor core is already severely damaged.The level 4 accidents at the Bohunice NPP (Czechoslovakia, 1977) and at the Saint Laurent NPP in Orléans (France, 1980) induced limited core damage.At the Chapelcross NPP (Scotland, 1967) a partial meltdown occurred but an INES level is not available.The level 4 accident in the Ibaraki Prefecture (Japan, 1999) occurred at a reprocessing facility [11,12].The records for accidents and incidents with levels ≤ 4 are difficult to interpret which is the main reason for their exclusion.
The analysis is completely based on data of IAEA report RDS2/31 (2011 edition) [2] with a reporting period from 1954 to the end of 2010 which lies close to the date of the Fukushima accident.The period between end of 2010 and March 2011 is neglected in the calculations.In Figure 1 the cumulative number of reactors operating since 1967 for commercial power generation and the corresponding cumulative reactor years of experience (RY) are given ([2], Figure 5).In the 15 years before 1986 about 18 reactors went into service each year.Beginning from the mid-1990s only 4 reactors per year were completed possibly due to political decisions in the aftermath of the Chornobyl accident.
At the end of 2010 441 reactors were connected to the grid and accumulated 11399 RY.Additionally, the cumulative reactor years C W (2010) since 1967 must include contributions from the 130 reactors in long-term or permanent shutdown before 2011 ( [2], Table 4).C W (2010) is calculated to 14097 RY by subtracting 256 RY for the period between 1954-1966 ([2], Tables 7 and 16) from the total number of 14353 RY ( [2], Table 4) for the period between 1954-2010.Of all 125 permanently closed reactors, 70% were shut down after 1986.Thus, the cumulative reactor years C W (1979) and C W (1986) are well approximated by the data of Figure 1.The uncertainty of the value for 2010 is negligible.Table 2 summarises the cumulative reactor years C W since 1967 for all three accidents.
The hazard is defined as the instantaneous rate at which accidents occur for reactors that are surviving at a given calendar year T cy since 1967 [13].For severe accidents the worldwide hazard h W T cy no. of reactor accident events since 1967 cum.reactor years C W since 1967 (1) is shown in Table 2.The numerator in the hazard definition is determined by the number of events among the commercial reactors of the world.The denominator pertains to the total time of risk given by the cumulative reactor years of these commercial reactors.Although in Fukushima more than one reactor suffered severe core damages, only a single event is counted.
Reactor accidents are treated here as Poisson point processes [14].These processes arrive independently in time  and are Poisson distributed, so that the total hazard for all reactors worldwide (1) is a sum over the worldwide total of R W individual hazards h i that pertain to single reactors at risk.Different operating regimes, regulatory environments, or safety cultures may constitute important explanatory variables, but their influence cannot be modelled due to insufficient statistical power.The present top-down approach is completely based on recorded events.Time dependences in the hazard caused by "infant mortality" or wear-out failures have not been considered.All scenario calculations were done with the most recent h W -value at the end of 2010.For speculative predictions to the future h W is assumed to be constant for the next twenty years.The assumption is supported by the remarkable agreement of all three values for h W (see Table 2).Since the reactor-specific hazards h i are additive in (2), the conditional survival probability S(T) = Π i S i (T), that is, the probability that all reactors remain intact during the time period T, is formed as a product of probabilities S i (T) pertaining to the individual reactors.Then the occurrence probability of at least one reactor accident within 1967 and a calendar year T cy is obtained by (see [13], chapter 1)

P T cy =
Tcy 1967 h(t)S(t)dt. ( With the above assumptions and relations other quantities such as the time to the next accident and the expected number of accidents within a given time interval are easily computed.The corresponding formulas are derived in the Appendix. Three scenarios concerning the development in numbers of reactors are considered for a time frame of twenty years.First it is assumed that the number of reactors remains constant while retired reactors are replaced by new ones.The second scenario assumes a growth of 3.7 reactors per year motivated by the growth rate between 1995 (386 reactors) and 2010 (441 reactors).The third scenario considers a reduction rate of about 1.7 reactors per year inspired by the decision of the German Federal Government to phase out all 17 German NPPs (connected to the grid in March 2011) within the next ten years.It is assumed that other countries will follow so that in total 34 reactors are shut down in 20 years and no new reactors are taken into service.The last scenario is unlikely given the fact that more than 60 reactors are currently under construction [1].
The PSA study [10] considered both system damages and core damages as endpoints.But no reference has been made to the INES classification.System damages still allow a controlled cooling of the nuclear fuel elements and are considered here as incidents of level ≤ 3.For accidents with core damage a level ≥ 4 is assigned.A point estimate of 2.5 ×10 −6 accidents per RY (95% CI 0.44 ×10 −6 ; 7.3 ×10 −6 ) for the corresponding hazard h PSA is reported in Table 5.22 of [10].
To facilitate a comparison with the reactor-specific estimate of h PSA the empirical hazard is assigned to all reactors worldwide independent of their design.This simplification seems justified if the individual hazards h i show only little variation, but it is not needed to derive risk quantities such as time to the next accident (see Table 3).

Results
The number of reactor years between the three events at Three Mile Island, Chornobyl, and Fukushima remained notably constant.After about 4-5 ×10 3 RY a severe accident occurred (see Table 2).In hindsight, one is tempted to argue that the time of occurrence for another event some twenty years after Chornobyl appears not entirely unexpected.
In Table 3 the point estimates for the time to the next severe accident and the number of expected accidents within 20 years are shown.The results are very similar for all three scenarios.Under the present safety conditions in about ten years another severe accident is to be expected two accidents are likely to happen within twenty years.
The occurrence probability of a reactor accident worldwide is 2.1 (95% CI 0.4; 6.2) × 10 −3 for the next 10 years.CIs for the Poisson distribution are calculated with a standard method [15].Numerical values are available in tables [16], from commercial software [17] or on the Internet [18].If one assumes implicitly that the mix of reactor types in Germany is similar to the worldwide mix with respect to safety aspects, the occurrence probability for Germany alone is reduced by a factor of 17/441 ≈ 1/26 to 8.2 (95% CI 1.7; 24) × 10 −5 .The corresponding time to the next accident increases markedly to 7.4 (95% CI 2.5; 36) × 10 3 yr.Note, that it depends quadratically on the number of reactors at risk (see (A.4) in the Appendix).

Discussion
The present analysis is limited by very low statistical power and by many simplifying assumptions.Therefore, it is important to note that all presented estimates must be taken with great caution.Because events in the early experimental phase of nuclear power generation have not been included, the worldwide hazard may be underestimated.On the other hand, the empirical reactor-specific hazard h emp (see ( 4)) decreases by a factor of three over thirty years which may reflect safety improvements.Moreover, an upper bound for h emp is given by the frequency estimate of the German PSA study which considered a larger number of possible events.Thus, the estimated risk quantities of the present study appear plausible and may at least indicate the right order of magnitude.The latter proposition is substantiated by similar values for the ratios of the 95% CI from the empirical estimate of h W (Table 2) and from the PSA estimate of h PSA ([10], Table 5.22), which come out as 14 and 17, respectively.
A brief comparison with other risks to human life helps to put the involved time scales and occurrence probabilities into perspective.However, for a comprehensive risk assessment the occurrence probability of any endpoint must be weighted with the expected damage.In contrast to other cases, the damage from nuclear reactor accidents can rise out of any proportions.Thus, insurance companies refuse to issue policies for nuclear power generation.Given the experience from past accidents, this attitude is understandable and unlikely to change.
Other complex technical systems such as aircraft must also obey the highest safety standards.The statistics for US general aviation counted 2.14 fatalities aboard an air plane per 100,000 flight hours in 2010 [19].The probability to die in a transatlantic flight of 8 hours is around 1.7 × 10 −4 which is similar to the occurrence probability for a severe reactor accident in Germany within twenty years.
In the US the age-adjusted mortality rate of colorectal cancer was 17.6 per 100,000 persons per year for the period 2003-2007 [20].It almost equals the worldwide hazard for severe reactor accidents.The fraction of persons dying of colon cancer is roughly estimated to around one percent in the US population.For an assumed lifetime of fifty years a similar fraction of reactors would have severe accidents.Thus, four to five accidents are expected among the existing reactors.

Conclusions
The scenario calculations showed that moderate changes in reactor numbers have negligible impact on the risk of an accident anywhere in the world.Neither will the expected nuclear renaissance increase the risk dramatically, nor will more safety be gained from retiring a limited number of plants.
Nevertheless, the prospect of another severe accident in the foreseeable future is worrying.To ensure services of general interest for the citizen (Daseinsvorsorge in German) a continuation of dedicated research programs on national and international levels remains indispensable in the two fields of nuclear emergency preparedness to remediate shortterm effects, and of radioecology, which focuses on the radiological long-term consequences of accidental releases of radionuclides into the environment.
More important is a substantial reduction of the threat.It can be expected from the expansion of the time horizon for another accident from about ten years to hundred years or more, well above the typical life cycle of an NPP.This can be achieved by two extreme options: either by a huge phase-out of some 300 reactors or by increasing safety standards so that reactor-specific hazards are reduced by a factor of ten.Since PSA produces credible hazard estimates, this approach is suited to test technical proposals for safety improvement.An observed falling trend for the reactorspecific hazard and evidence from the operation of other complex technical systems suggest that such improvements are actually achievable.But they require the intensification of reactor safety research.A prudent strategy probably entails both options with some moderation.Older and less secure NPPs are retired and the safety for the remaining ones and those under construction is improved.

)Figure 1 :
Figure 1: Cumulative number and cumulative years of experience for reactors connected to the grid until the end of 2010: reactor numbers in the years 1979, 1986, and 2011 with accidents of INES levels ≥ 5 are annotated.

Table 3 :
Point estimates for the time to the next reactor accident with INES level ≥ 5 and the number of expected accidents within 20 yr for three scenarios concerning the change of the world's reactor numbers (95% CI in brackets).

Table 1 :
NPP reactor accidents with INES level ≥ 5, reactor age denotes time since grid connection.

Table 2 :
Worldwide number R W of reactors at the time of accident, cumulative reactor years since 1967 and hazard for NPP reactor accidents with INES level ≥ 5 (95% CI in brackets are calculated only for the latest value based on three events).