We formally introduce the notion of random escalation of incident severity. We then develop a class of models that views accidents of high severity as members of a subpopulation of incidents of lower severity; a random escalation model (REM) uses Bayesian methods to update unobservable failure rates and other model parameters. The priors for failure rates are based on extensive engineering judgment about the probabilities of core melt. Predictive distributions for time to time to core melt are calculated from the model, based on operational experience and accident data accumulated to date; the results are compared with those of N. C. Rasmussen, H. W. Lewis, P. C. Groer and others. The paper includes three theorems that reveal the structure of separable densities for parameter updating, the invariane of REMs under severity level classification and the reproducibility of Poisson-Binomial REMs. In an appendix, we examine the special assumptions that are required to specify the current U.S. Nuclear Regulatory Commission risk model.