Developing probabilistic safety performance margins for unknown and underappreciated risks

• Most of the safety risk for complex new systems may be unknown or underappreciated.
• Robust margins should therefore be applied to loss probabilities calculated by PRA.
• A review of historical data and past PRAs indicates how large the margin should be.
• The size of the margin depends on organizational, programmatic, and design factors.
• The results apply consistently across space, nuclear reactor, and other programs.

Probabilistic safety requirements currently formulated or proposed for space systems, nuclear reactor systems, nuclear weapon systems, and other types of systems that have a low-probability potential for high-consequence accidents depend on showing that the probability of such accidents is below a specified safety threshold or goal. Verification of compliance depends heavily upon synthetic modeling techniques such as PRA. To determine whether or not a system meets its probabilistic requirements, it is necessary to consider whether there are significant risks that are not fully considered in the PRA either because they are not known at the time or because their importance is not fully understood. The ultimate objective is to establish a reasonable margin to account for the difference between known risks and actual risks in attempting to validate compliance with a probabilistic safety threshold or goal. In this paper, we examine data accumulated over the past 60 years primarily from the space program, and secondarily from nuclear reactor experience, aircraft systems, and human reliability experience to formulate guidelines for estimating probabilistic margins to account for risks that are initially unknown or underappreciated. The formulation includes a review of the safety literature to identify the principal causes of such risks.