:

E I . S E V I E R

Reliability Engineering and System Safety 54 (1996) 113-118 ¢~) 1996 Elsevier Science Limited

Printed in Northern Ireland. All rights reserved P l l : S 0 9 5 1 - 8 3 2 0 ( 9 6 ) 0 0 0 6 8 - 3 0951-8320/96/$15.(10

When to separate uncertainties and when not to separate

Eduard Hofer Gesellschaft fiir Anlagen- und Reaktorsicherheit (GRS) mbH, Forschungsgel?inde, D-85748 Garching. Germany

A simple introductory example illustrates when to separate and when not to. The underlying principle is shown to also hold in situations of practical relevance. For several such situations it is discussed when, why and how to separate uncertainties. It is also pointed out how the outcome of this separation is used in practice.

Subsequently the relation to the terms 'epistemic' and 'aleatory' is briefly explained. © 1996 Elsevier Science Limited.

1 INTRODUCTION

Suppose there are two dice on the table. One, call it A, is being cast continuously. The other, call it B, is covered, left untouched and it is uncertain which side is up. At any instance the number shown by B and the number that will be shown by A are uncertain, and so is their sum. For simplicity, denote these uncertain quantities by A, B and .~. + B.

The mathematical concept of probability is used to quantify uncertainty. There is the classical frequcntis- tic (probability as the limit of relative frequency) and the subjectivistic (probability as a measure of degree of belief 1) interpretation of probability. With both interpretations the wealth of well-established concepts and tools of probability calculus and statistics is at one's disposal. Sample evidence can be used to update degrees of belief for parameters that govern probabilities in the frequentistic interpretation. In this sense the subjectivistic interpretation is an extension of the latter.

Both interpretations have their place in the example. The uncertainty of A is quantified using the frequentistic interpretation where one simply speaks of 'probability' while the subjectivistic interpretation, where one speaks of 'subjective probability', is used for B. Since B is constant, i.e., has only one true value, limits of relative frequencies don't make sense. Rather, degrees of belief are held for either of the six numbers on the die to t:,e up. They quantify the state of knowledge for B.

The question 'Which is the value of the sum A + B?' is incomplete and promptly causes problems. Firstly,

113

what does the sum refer to? Secondly, if 'probability' is used for A and 'subjective probability' for B, which is to be used for A + B? Tackling the first problem will also resolve the second. Since A is being cast continuously the question is ambiguous and needs to be supplemented by a reference unit. Examples of such supplements are:

'... in the next cast of die A?' '... in any cast of die A?'

If the next cast is concerned, does it make any difference whether dic A is being cast now or was cast in the past and covered so that one just needs to lift the dice-box? In both cases there is only one true but unknown value for A. The uncertainties of A and B, and consequently of A + B, are therefore quantified by subjective probability. Separation of uncertainties is not rcquired.

If the question refers to any cast, A does not have only one true value. Rather, a population of values applies such that for any cast A can be thought of as randomly selected from this population. There is uncertainty as to which value from the population to use in the sum. The variability within this population is summarized by the proportion of each value possible for A. This proportion is given by the respective limit of relative frequencies. The corres- ponding probability distribution summarizes the population variability. There is only one true probability distribution of A. Uncertainty of this distribution (for instance, due to uncertainty of whethcr die A is fair) is quantified by subjective probability.

114 E. Hofer

What about the sum A + B in this case? It too has a probability distribution. There is only one truc but unknown value B and only one true but more or less imprecisely known probability distribution of A. Consequently, A + B has only one true but unknown probability distribution. The uncertainty about which is the single true distribution of A + B is quantified by subjective probabilities derived from those for alternative values of B and for alternative probability distributions of A. Quite naturally, one has arrived at a separation of uncertainties. Going without separa- tion in this case would say that the population variability ranges from 2 to 12, which is clearly wrong.

This introductory example illustrates when and how to separate and when not to separate uncertainties. Docs the underlying principle also hold in situations of practical relevance? The examples of the next section will show.

To conclude this introduction other 'reference units" supplementing the incomplete question with respect to A + B should be considered.

For instance '... in the sequence of the next n casts of die A?" represents a case of when not to separate since it refers to n repetitions of the 'next cast' case.

Consequently, also '... summed over the next n casts of die A?' is answered by only one true but unknown value with the influence of all uncertainties quantified by a subjectivc probability distribution for the sum over the sums Ai + B, i = 1 ..... n.

However, the supplement '... summed over any n casts of die A?" does not specify the casts. This is therefore a case of when to separate. The answer is, as a sum of single, true, but unknown distributions of the sum A + B in each of the n unspecified casts, again a single, truc, but unknown probability distribution. Duc to the uncertainty of B and the limited knowledge of the distribution of A there is uncertainty about which distribution applies. This uncertainty is quantified by subjective probability.

2 THE NEED FOR SEPARATION OF UNCERTAINTIES AND ITS RELATION TO THE ASSESSMENT QUESTION IN SITUATIONS OF PRACTICAL RELEVANCE

The following will illustrate that the principles identified in the introductory example govern the decision when and how to separate and when not to separate also in practical situations like

--post-experiment calculation --Probabilistic Safety Assessment (PSA) --analysis of a Loss Of Coolant Accident (LOCA) --assessment of an accident management strategy - -waste disposal performance assessment - -dose reconstruction.

2.1 Post-experiment calculation

The experiment X was performed by pouring molten metal into a water pool and measuring the pressure in the experimental facility at various locations and over time. Subsequently, a calculation is performed using a computer model. It is used to answer the question: 'Which was the overall peak pressure increase in the experiment X? '

Numerous uncertainties are involved in this calculation.

The experiment X has a unique description and quantities needed for the calculation have single, true, but more or less imprecisely known values. This applies also to the functional relationships to be modeled and to the minimum requirements that need to be asked from numerical algorithms in order to still have sufficiently accurate numerical solutions of the underlying equations. Consequently, all uncertainties are quantified by subjective probability and the uncertainty of the computed peak pressure increase is expressed by the resulting subjective probability distribution.

Following the argumentation of the 'next cast' case in the introduction, the same applies to a pre- experiment calculation.

In the post-experiment case the overall peak pressure increase is known, subject to measurement error. The corresponding uncertainty is also expressed by a subjective probability distribution since the actual increase has only one true but unknown value. This distribution will differ from the one obtained for the computed peak pressure increase. The reason for this is the difference in the states of knowledge involved.

One may ask 'what about the measurement error in the initial temperature of the melt, for instance? Why is the associated uncertainty not to be separated?' Measurement errors typically exhibit stochastic variability which can be summarized by a probability distribution. The initial temperature is an uncertain input to the calculation. Its measurement error has a single, true, but unknown value. Therefore, there is no nccd for separation. If it can be thought of as randomly selected from the distribution of measure- ment errors, the distribution details can be used as those of a subjective probability distribution quantify- ing the respective state of knowledge.

2.2 A question from accident progression modelling in a PSA

An accident sequence is described up to some point in the accident progression and the question is asked: 'Which is the overall peak pressure increase from melt-water interaction in any occurrence of the described sequence in plant X?"

When to separate uncertainties 115

The description will be of limited resolution and sequences complying wilh it will differ in many details more or less relevant to peak pressure increase. Consequently, the question refers to sequences that are unspecified in many ways. For instance, if the description says nothing about the initial melt temperature then the .question refers to sequences with the melt exhibiting any technically feasible temperature value. Consequently, a population of values applies such that there is uncertainty as to which value to use in the computation of the peak pressure increase to the given sequence description. The associated uncertainty is quantified by a probability distribution summarizing the variability within this population of temperature values. Duc to the melt temperature, and other quantities of the same type of uncertainty, there is variability of the peak pressure increase among sequences of the given description. The answer to the question is therefore a probability distribution.

Interval probabilities from this distribution are needed as branch point probabilities in the event trees of the PSA. They ~tre conditional probabilities, applying under the conditions of the given sequence description.

On the other hand, the single true distributions, summarizing the variability of quantities contributing to the variability of peak pressure increase, can only be determined more or less imprecisely, just like quantities that do have. a single, true, but unknown value applying to any sequence of the given description. The emissivity coetficient of the corium melt might be considered as one of those. These uncertainties are quantified by subjective probability. As a consequence of this separation of uncertainties there are subjective probability distributions for each of the branch point probabilities. These subjective probability distributions are needed in the uncertainty analysis of the PSA. Knowing the branch point probabilities better doesn't make the plant safer. Reduction of the probabilities of branches to severe consequences does. A decision from separation may be to learn more about the branch point probabilities before taking action wi:h respect to their reduction.

Obviously, consistent separation of uncertainties is fundamental to the traditional way PSA questions are asked. Quantification of the first type of uncertainty is part of the answer to the question while quantification of the latter type says how well the answer can be known, given the present state of knowledge. This is particularly apparent in the risk assessment for five US nuclear power plants. 2 It expresses the first type of uncertainty by expected frequencies (per plant-year) of initiating events and by matrices of conditional transition probabilities (under the conditions of the initiating event) to arrive at the expected frequencies

(per plant-year) of described plant states etc. The influence of the latter type of uncertainty is captured by a set of alternative vectors of expected frequencies and sets of alternative matrices of transition probabilities with associated subjective probabilities.

If the question were: '... in the first occurrence of the described sequence in plant X?' separation would not be needed since all uncertainty would be due to quantities that have a single true but unknown value, just as in the previous example and in the 'next cast' case of the introduction. A quotation from the literature 3 is in place here:

'Since, when talking about a single event, the concepts of randomness and lack of knowledge become redundant, it should be possible to construct a framework in which questions take the form 'what is the (subjective) probability of, or what is the level of confidence in, the occurrence of core damage at plant x in the next y years' as opposed to 'what is the frequency of core damage at plant x and how well do we know it'.'

2.3 Assessment of an accident management strategy

A strategy was developed to reduce the potential for vessel failure under described conditions. Again, the description is of limited resolution.

The question: "Will vessel failure be prevented by the strategy, whenever the described conditions apply in plant X?' is answered by a discrete probability distribution assigning probability p to 'prevented' and ( 1 - p ) to 'not prevented'. The value of p quantifies the combined influence of relevant quantities that do assume different values whenever the described conditions are met in plant X. Their variability under the sequence description contributes to variability between 'prevented' and 'not prevented'. Limited knowledge of the single true probability distributions that summarize their variability, as well as uncertainty of those quantities that do have a single, true, but unknown value applicable to any sequence of the given description, lead to a subjective probability distribution for p. An example of the latter would be the uncertainty of the failure rate of a pump to run, if running the pump over a period of time is part of the strategy and the failure rate has the same value whenever the described conditions apply. On the other hand, the time to failure of the pump would be an example of the first type of uncertainty, that is to be separated, since it varies among sequences of the given description.

If there are no quantities that do assume different values whenever the described conditions are met in plant X then the strategy either always fails or never fails. The subjective probability distribution tells how confident one is that it always fails, given the present

116 E. llot~'r

state of knowledge. To use this subjective probability as branch point probability would be a mistake. The branch point probabilities are 0 and 1 in this case, which means no branching. There is, however, lack of knowledge of the single true outcome.

The situation of no variability is, as an approxima- tion, sometimes assumed when the uncertainty due to variability is judged to be negligible compared to the uncertainty of those quantities that do have single, true, but unknown values. An example would be variability that is negligible compared to uncertainty of its mean value.

Thc argumentation for the '... next time the conditions apply in plant X?' case is straightforward.

2.4 Licensing calculation for a specified LOCA scenario

In the licensing procedure for a nuclear power plant, a question of interest is: 'Which is the peak cladding temperature during the specified LOCA scenario in plant X?'

Assuming that the question refers to the first occurrence of the LOCA scenario in plant X, the answer is a single, true, but unknown temperature value. A computer model is used to predict this value. The influencc of all uncertainties is combined in a subjective probability distribution for this value. This includes the uncertainty of details of the initial and boundary conditions that are not part of the scenario description. It also includes uncertainties of the conceptual model, the corresponding mathematical model, of specifics of the numerical solution algorithms (like the minimum spatial and temporal resolution needed to still have sufficiently accurate results) just as uncertainties of parameter values. The 95% fractile of the resulting subjective probability distribution is compared to the safety limit laid down in a Regulatory Guide. 4

Sensitivity measures with respect to the involved uncertainties will indicate where the state of knowledge would need to bc improved primarily, in order to reduce uncertainty of the computed peak cladding tcmperaturc (as expressed by the subjective probability distribution) most effectively.

The peak cladding temperature is also of interest in the evaluation of the minimum requirements for safety systems in a PSA. Here the reference unit of the question is different: 'Which is the peak cladding temperature in any occurrence of LOCA scenario Y in plant X, given the specific failure combination of the safety systems'?'

Due to details (i.e., initial and boundary conditions from plant operation), that are not captured by the scenario description, there is not a single true peak temperature that would apply in all LOCAs of the given scenario description. The answer to the question needs to b c a probability distribution. This distribu-

tion has to summarize the variability due to all quantities that do not have the same single value for all LOCAs that comply with scenario Y. The uncertainty due to limited knowledge of their distributions, combined with the uncertainty in quantities that do have a single true but unknown value, lcad to a subjective probability distribution for the cumulative probability at any given peak cladding temperature value of interest. Examples of the latter quantities are the friction factor for pipes, the minimum film boiling temperature, the stable film boiling heat transfer model, etc., used in the thermal hydraulics calculation. While an example of the first would be the power level from plant operation if power level is not specified by the scenario description.

Interval probabilities for the peak cladding tem- perature, as well as for simultaneously computed time spans available for mitigating actions, are to be processed in a PSA while the associated subjective probability distributions are input to the uncertainty analysis of the PSA.

2.5 Waste disposal performance assessment

An assessment question of interest is: 'Which is the total release from repository X to the biosphere over the years tt to t,.~,l'?" T h e analogy to the question concerning the 'sum

over the next n casts' in the introductory example is evident. The combined influence of all uncertainties is expressed by a subjective probability distribution for the sum over the specified years. This includes uncertainty of the number, volume and location of brine pockets in the surrounding salt formation and of radionuclide specific sorption parameters just as uncertainty of whether, when, where and how many human intrusions are going to occur in the years t~ to lend.

The corresponding uncertainty statements say something about the 'possibility' that the total release by the year t,.,,,i exceeds given limit values. Comparing the complementary cumulative subjective probability distribution to a release limit, laid down in Environmental Standards, -~ will show whether there is a possibility that the limit is violated and what the subjective probability is, that it is violated. This is in analogy to the safety limit for the cladding temperature in the Regulatory Guide, referenced in the previous example.

The question 'Which is the release from repository X to the biosphere in any year?' presents problems. There is no single true probability distribution that would summarize the population of annual releases such that the release of any year could be thought of as randomly selected from this distribution. Immedi- ate examples are the first years, when corrosion of

When to separate uncertainties 117

waste containers is insufficiently progressed to have releases, and very late years, when depletion of the source reduces their magnitude. Due to such changes of the source over time there is no single distribution that could be given as an answer to the question.

2.6 Dose reconstruction

A hazardous substance (contaminant) was released some time ago, accidentally or continuously over a period of time, and the question is: ~Which is the dose received by any individual of the exposed population?'

There is a single, true, but more or less imprecisely known, local and temporal pattern of contaminant concentrations in the air, on the ground, in water, as well as in all relevant foodstuffs. The same applies to the temporal pattern of the locations, activities, food consumption habits and metabolic properties of each of the individuals in the exposed population. However, the question does not refer to a specific individual. Therefore, it is uncertain which individual's data to use from the latter pattern. This uncertainty is due to variability among individuals, and is to be separated from the uncertainty due to lack of knowledge of the pattern and of quantities that have single, true, but unknown values, applicable to all individuals. This latter set contains the local and temporal pattern of concentrations and thus all quantities needed to reconstruct it, like the charac- teristics of the contaminant release.

The answer to the question is a single, true, but unknown probability distribution summarizing the variability of dose among the individuals of the population. The quartification of the state of knowledge of both patterns leads to a subjective probability distribution for any fractile of the distribution of individuai doses. Such fractiles are dose values that are not exce~;ded by a given fraction of the exposed population. The subjective probability dis- tribution of the fractile tells how well this dose value can be determined, given the present state of knowledge. The same kind of information is available for fractions of the population to given dose values. The value of the fraction for a given dose limit and the information as to how well this fraction is known will feed into different decisions.

One will also need to answer questions like 'Which is the dose received by individual Z? '

This is a case of no separation of uncertainties since the question now refers to a specific individual. All its details have single, true, but unknown (or rather imprecisely known) values. The answer to the question is a single, true, but unknown dose value and the combined influence of all uncertainties leads to a subjective probability distribution for this dose value.

Following the argumentation of the 'next cast' case of the introductory example, the situation is the same

for the dose assessment in an emergency response calculation for an ongoing accidental release and for the occurrence of release scenario Y in facility X, with the understanding that it is the first occurrence.

Things would be different if the calculation were not for a specific accident but for any future occurrence of release scenario Y in facility X.

3 RELATION TO 'ALEATORY' AND ' EPISTEMIC ' U N C E R T A I N T Y

In the 'next cast' case of the introductory example the quantities B as well as A have single, true, but unknown values. The associated uncertainty has its origin in the nature and limits of knowledge and is therefore called 'epistemic'. 6

On the other hand, the uncertainty due to the fact that one cannot give a single value that would answer the question with the supplement '.., in any cast of die A?" has nothing to do with the nature and limits of knowledge. There simply is no such value but a population of values. ~Aleatory' (depending on luck or chance) 6 is the right term for this uncertainty insofar as, for any cast, the value of A can be thought of as randomly selected from the probability distribution that summarizes the variability within this population.

For instance, from the formulation of the first question in the waste disposal example it becomes readily apparent that one is interested in a quantity with only one true but unknown value. All uncertainty is thereforc epistemic. If one had perfect knowledge this value could be obtained, even if it meant waiting till the year t~n,~.

From the formulation of the first question in the dose reconstruction example, however, it is clear that one is interested in the dose received by many unspecified individuals. It is uncertain which value to give as an answer since there is no single dose value that would apply to every individual. In fact, a probability distribution summarizing the variability within the population needs to be provided as an answer. It quantifies aleatory uncertainty. To this end, quantities that vary among individuals need to be separated from those that do not, but are unknown. Uncertainty due to lack of knowledge of the single true probability distributions summarizing thc variabi- lity of the first and due to lack of knowledge of the single true values of the latter is epistemic.

4 CONCLUSIONS

Separation of uncertainties is costly since

- - t he re is effort involved in consistent separation -----expert judgement elicitation has to account for

separation

118 E. Hofer

- -propagat ion through the model needs to happen separately

- -presentat ion has to cater for two uncertainty dimensions

--sensitivity measures are of interest in both dimensions.

Whenever an assessment question is not fully specific there is uncertainty which value to provide as an answer. In fact, a population of values will apply in this situation. A probability distribution that sum- marizcs the variability within this population is the answer to the question.

Several quantities may contribute to this variability. A population of valucs applies for each. There is uncertainty which value to use from the respective population. This uncertainty is quantified by prob- ability distributions that summarize the variability. It is to be separated from uncertainty due to lack of knowledge of these distributions as wcll as due to lack of knowledge of quantities that do havc a single true but unknown value. These lack of knowledge uncertainties are quantified by subjective probability. Their combined influence quantifies the unccrtainty of the answer to the question.

Separation of uncertainties permits to summarizc

the variability of a population of values of interest, without specific reference to each element, and to quantify how this summary is influenced by lack of knowledge. These two pieces of information will be input to different decisions.

REFERENCES

1. Winkler, R. L. & Hays, W. L., Statistics. Probability. Inference and Decision, Holt, Rinehart and Winston, New York, 1975.

2. Sevcrc accident risks: an assessment for five US nuclear power plants. NUREG-II50, Vol. 2, US Nuclear Regulatory Commission, Washington, 1989.

3. Parry, G. W., Technical note: on the meaning of probability in probabilistic safety assessment. Reliab. Engng System Safety, 23 (1988) 3{)9-314.

4. Regulatory Guide 1.157 (Task RS 701-4), Best-Estimate Calculations of Emergency Core Cooling System Performance, US Nuclear Regulatory Commission, Office of Nuclear Regulatory Research, Washington, 1989.

5. Environmental standards for the management and disposal of spent nuclear fuel, high-level and transuranic radioactive waste: final rule. 40CFRI91, Federal Regis- ter, 50, 38066, 1985.

6. Webster's New World Dictionary of the American Language, The World Publishing Company, Cleveland and Ncw York, 1964.