ML19331D027
| ML19331D027 | |
| Person / Time | |
|---|---|
| Issue date: | 01/28/1980 |
| From: | Harold Denton Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML19331D025 | List: |
| References | |
| NUDOCS 8008270135 | |
| Download: ML19331D027 (7) | |
Text
Prescntation by Harold R. Denton:
\\
b~
" Regulatory Needs Which Might be Met by Probabilistic Safety Analysis or Reliability Techniques" I think Dr. Hendrie has covered almost all the areas in which we are presently using risk assessment.
I think what I'd like to do is dwell on two areas as concrete examples of the kinds of things we're doing.
I told Saul (Levine) many years ago that what I would really like to have in the Phillips Building would ha a risk simulator panel in which, when you walk into your room each morning, you've got all the accident scenarios listed along one col-umn and you see what the major contributors to risk are in each plant that day and you pick those out and you go to work on those.
It would be somewhat paral-lel to the I&E efforts to get the data link back to the plants on thegual It would be nirvana if NRR could have a realYisplay of operating cond,itions.
^
theceafse./dcontributors to risk each day. But lacking that, we are using risk g~
assessment more thad.*./er in NRR; and theh reas that I t""
- w. N e
touch on wic 75L l'-It haven't been mentioned so farets &Let's start with new plants.
One of the things that I think is missing fr m our 5, resent Standard Lae w ~L pu-,
Review Plan is what I call the yholistic Dacach he rather deterministic, tM-look at single-failure, safety-grade equipme th y $ _look meeb at test-A*
ing or procedures, the human factor element. [
- r%
The very next plant down the line - Sequoyah-g ing to,be andled quite differently than plants in the past. That plant'f kf and when thhy reccfvc :
licensed will probably be a low-power license W u wm 5
- lice = c =1y to conduct a certain number of t'ests such as natural circulation with loss of off-sitepower,,andThist-testwouldberunnotonetime,butoneveryshift. Gee +
measurements would be made of plant performance during these off-normal condi-tions and compared to predictions, b really get some feedback as to how well the plant matches the predicted behavior. We4 also intend to follow very closely how the plant performed during this time and make a decision on going to full power rem &y based on hast:**m plant perform [d ring these low-power testing phases. Mit I see the development of these low-power tests as a way to resMy debug the plant before making a decision about full power.
This means that gef g can actually put the plant through some of the scegrios that we think arhhigh WeSe also requiring that the cgtyibutors to risk and see how it pqrforms.
l'icenk-anbill probably be is for all licensees - conductswhat% 85 called a mini-IREP. This will be discussed with you later today but it's part of the effort to make sure every plant has looked at the principal contributors to risk to try to find outigers, the ones that weren't identified in our Standard 8008270/ [
_g.
.).A 1
Review Plan approach, and have a possibility of fixMb %ese before the decision g
is made that the plant can go to full power operation. ? I think you will find that gr all new plant licenses 7that+il' be i;;ud, we're going to be using risk assessment techniques more than everk*
v$ d-Let me go now to existing plants and mention en e're-"'le there tMt I think is a good example of what we will be using in the future for old plants, such as Indian Point 2 and 3 and Zion, and any other high-population sites. When you compare the risks from those sites to the risks from average sites, you find that they dominate the public risk.
You can also look at the evacuation times and find that it's much more difficult to evacuate people from 4Ae high-population site than from the average site in the U.S.
In cooperation with Research,wehaveidentifiedabyr os,eg (tjogs g,could be taken to re-duce the risks from h typ: Of plants 4 We've asked them to look at filtered containment venting, g core ladles, c hydrogen control systems, W increased m
off-site power availability,'aR have developed a plethora of actions that we%
asking tMsc liceaeae, or will be asking tigre licensees, to take in the near W
future ha i to compensate for the high risk due to the, population.
I think this is an example of using risk assessment to identify what the real contributors to risk are and how thev might.be minimized.
I think, in g s7 m
>4s a more formal approach to getting the requirements met. As t%se-ef yce %=,
about half the utilities did meet the short-term les-sons learned by the end of December of last year -- the other half wanted various extentions that ran off into August to coincide with refueling, and we decided that wasn't an acceptable situation and issued orders for everyone to comply eitherduringJanuaryorwithin30gysafteygttingtheequipment. There were,h ",
a few plants +cetmd that we M dight tut, depending on power supply and MJ
/Ja.ATW5 m
their availability. Butyou,lookbackatsomeareagwherewehaveusedrisk assessment 44keJTWS. That's a ten-year-old history.
It hasn't ever come l
to a closure between the industry and ourselves and I think that while risk assessment will help lay the issues out, there's still a need for developing a decision-making mechanism t: = ;; when there are disagreements among experts.
Question:
I wonder if you could amplify on the philosophy or criteria you have on reducing the risks on sites like Indian Point snd Zion.e W.^* g ;
Answer:
The goal is to make the risks from those sites kek liitejthe risks from an average site in the U.S.
I think I mentioned, depending on how you look at a
risks, the total risk from a plant like Indian Point or Zion murt M at least ten times the risk from say the average site in the U.S s-ih r : ju S based on popu-lation density alone. Then you've got to look at evacuation times and compare either acute health effects or latent health effects and this sort of l
l v
thing, btttThe real intent would be through changes either in design legislative 4
procedures that the plant operates under, management systems to make those plants look like the average plant.
Did I interpret your question properly?
Question:
I was wondering if you could put numbers on that.
Last Friday we were talking with Con. Ed. and Commormealth Edison and I think you --
Answer: Well, I think I'm looking for a factor of 3 to 10 in risk reduction, somewhere in that range at those sites.
Question:
I wonder if you'd comment on whether you think the state of the art of the reliability analysis is extensive enough to make this sudden switch from a more systematic evaluation to the risk assessment evaluation...
Answer: Well, that's why I wouldn't want to use the word switch.
I think we've got to preserve the present way of doing it - the standard review plan, the deterministic approach, but supplement it with risk assessment techniques.
$ I'm not proposing et::stH to abandon the traditional way of review] plants but rather to picgtggep as failure of auxiliary feedwater4 loss of off-site power You know, you can come to the conclusion quickly that the best g
designed plants already exist and this is something i. hat other people have observed)but when we did the loss of feedwater probabilistic analysis and the A
loss of off-site power analysis, Wt ym' find ie t ha +
wh]jvgy ggajt*1-was looked at met our deterministic single-failure riteria..,the reliability of j
those systems varies markedly from plant to plant, -W"$ that some engineers had 1.na a better job of designing systems that met our deterministic criteria than others. So there is already out there somewhere a good design of auxiliary feedwater systems, a good design for loss of power, and I was really surprised to find that you can meet our deterministic criteria in an area like this and still differ in reliability or probability of performance by almost two orders of magnitude. Some engineers have really done a much better job in designing some systems that meet our criteria than other engineers.
Question: What is being done to improve the data base, particularly with respect to operator action, which appears to be a really weak link.
Answer:
I guess I'm not the right person today to talk about the data base.
That's an area that I've stayed out of recently and I'll defer to someone else.
Maybe the operational data people that are setting up that new group may want to address that. But you know, that's an old issue:
Failure modes and effects analysis. You've got to collect the successes as well as the failures. When we first began to look at some of these areas we had assumeghat the systems were tested only as often as the tech specs called for.,ab you dividedthe number of reported failures by the number of times that the tech specs had called for the system to be tested, and we came to the conclusion they were much more unreliable than we had thought. Then when we met with the licensees, we found that in some cases they tested these systems far more frequently than the tech specs called for. So obviously in order to have a good data base our old way W 4.,ve also got to get the num-W of getting failures reported was not good enough.
Y^"
ber of successes - the number of tests reported in order to come up with a reli-able data base. One of the lessons I think I've learned from my brief forray into this --atly has been the importance of the balance of plant systems.
We tend to think about the nuclear steam supply system as the dominant contrib-utor to risk and what should be looked at closely, but the way these plants are coupled to the balancc. of plant is very important and, in fact, may be the real driving contributor to risk.
Question:
Looking down the road, do you envision that if we use risk assessment in the licensing process, would we ever reach a point that we would set quanti-tative reliability goals?
Answer:
I would hope so. N5w we've got to get over those hurdles of defining acceptable methodology and the data base arguments in order to et to that sort of nirvana. We'll probably get there sooner in some fields s me types of sys-tems, than others. But certainly the important thing and the reason I'm very enthusiastic A m t today is, we've got to make this first start. We talked about this far tod long. What's needed is action, and th g w g g ou are here today is to begin to learn more about how to ap ly and to take it back, and in our day-to-day deci,sions, begin to incorporate as a way of thought.
You know, if you look at om my perspective, we have somehow increasingly be-come a group of specialists,aM the system kind of forces us that way, and I think that what risk assessment provides is the way to back off and be sure l
you're thinking the broad picture and you put everything in the equation, not just maybe the particular area that you are normally interested in. And I would hope down the road that we'd see a much bigger focus on g:+ m systems engineer-ing, and I see risk assessment as being an integral part of assessments of any systems perfonnance.
Question:
You said there is quite a difference in risks, or reliability just between equal systems designed by different designers; is it possible that we might be arriving at a point where we license designers, rather than systems?
Answer: We sure need to find a better way to do business. We're all strapped for resources to continue down the traditional route.
If you could somehow license designers and provide the control that society demands, it would be a possibility.
But I don't quite see how we'd get to that in the near future.
Do you have an idet af how we'd appl
- that sort of thing? Well, you know we could require that all the designs be done by a former member of NRC, combined with a member of the ACRS and a couple of investigation commission members; that might be the only way to assure a high-quality product (laughter).
Question:
Is any thought being given to requiring the reactor manufacturers to perform fault / event tree analyses, and risk assessments for their plants?
Answer:
Yes - thought has been given to it.
Like some other things, we've got to be prepared to know what to do with it when we get it back.
If I thought we had the capability to review it, I think we'd move that way,+==i
- t I think we've got to desdt get ourselves up to speed so we know how to handle this infor-mation when it comes back in. We sure can't keep it all in house. The important thing is to get the industry thinking along these lines and reacting to it,and I've taken the tactic lately that whenever we hit a troublesome spot, to throw y
it into the mini-IREP program and send it over to Bob (Bernero) and Frank (Rowsome),
itad I guess we've got a half a dozen mini-IREPs going around the country now being performed by the various utilities in particular areas. 3 I am attempting to go that route whenever I see it has a high payoff.
But we can't just ask them to do it without giving them some instructions and some methodology so they under-stand what we want.atut%n~we'have to have some capability to look at it when LJ it comes back.
I'm eagerly awaiting the results of the Crystal River study which is one of the first big efforts we've made down this line.
Question:
Do you have any requests from Congress or the Executive Branch to set safety goals? Are there any plans for setting specific safety goals?
Answer: Well, I don't really think there are.
In fact, I think maybe we focused too long in the past on the bottom line of risk assessment, and that got us into all kinds of arguments N the bottom line.
IthinkevenwjgoutCongressset-ting a bottom line there's still a lot that can be done aMut' risk assessment to identify the major contributors. And even if we don't set a bottom line, my goal is to continue to work on those principal contributors.
I once talked to CEQ about doing a comparison of energy sources.
I talked to DOE about it.The Acad-emy of Science just completed its monumental report on comparing the health ef-fects of various energy sources.
I don't see much enthusiasm in town for actu-ally setting a safety goal.
I think we ought to have this industry safer than its competitors. 3!ce ith:r it c@t +0 M 1" of cea1,004-ef--coa', cr 6 de--
7 vou-sea su re-i t, The other thing that you find if you've been around Three Mile a 1h A Island or other sites where there's a high psychic cost,;gpeople don't react just to the numerical values.
You've somehow got to factor in these eMier kinds of costs in your risk assessment.4 When you're at Three Mile Island and you talk about releasing one Curie of kryptorrrfor examdel or a small amount of krypton
._a' where the dose would be well within normal limits, and yet you're faced with people on the street and on the telephone who are really hysterical about releas-ing of that, it says that you can't be just a cold-blooded scientist doing cal-culations and diagrams.
You've got to somehow factor in the feelings of people about the nature of the source that we regulate. So I think even if you were to l
i pick a value relative to coal, that nuclear should be some percentage better It's than coal. thw do you measure thatJngwJyu get anyone to accept it?
g very tough. So I guess I see, while qkeepp a m'inimum effort going in that direction, the important thing is to think what we can do today. we can compare systems today.
I'm very pleased with the outcome of thee two or three studies made of every plant in some narrow slice. Arrd in those areD we can pick out
~
the high contributors +and work on them.
I think my time is up.
I just want to wish you a lot of success today.
I'm glad we finally got the momentum to get such a prestigious group together.
It looks like a very good program, and I look forward to having constructive ideas from all of you on how we can further the use of this technique.
Thanks a lot t-
>