ML20028C568
| ML20028C568 | |
| Person / Time | |
|---|---|
| Issue date: | 08/27/1982 |
| From: | Fraley R Advisory Committee on Reactor Safeguards |
| To: | Dircks W NRC OFFICE OF THE EXECUTIVE DIRECTOR FOR OPERATIONS (EDO) |
| Shared Package | |
| ML20027A756 | List: |
| References | |
| FOIA-82-557, RTR-NUREG-0880, RTR-NUREG-880 NUDOCS 8301100436 | |
| Download: ML20028C568 (7) | |
Text
_ _ _ - - _ _ _ _ - - _ _ _ _ _ _ - _ _ _ _ -
- [p ne c o
.'e c
UNITc0 STAT ES 8
NUCLEAR REGULATORY COMMISSION 2 4s w',".,
ADVISORY COMMIT TEE ON HEACTOH SAFEGUARDS n
'o, kDd
/
WASWNCTON, O C. MSS g%...../
August 27, 1 982 MEMORANDUM 10:
William J. Dircks Executive Director for Operations FROM:
R. F. Fraley Executive Director, ACRS
SUBJECT:
ACRS REVIEW OF THE DRAFT ACTION PLAN FOR !!-iPLEMENTING THE COMMISSION'S PROPOSED SAFETY G0ALS The ACRS plans to review the NRC Staf f "Draf t Action Plan for Implementing the Commissioner's Proposed Safety Goals" at its September 1982 meeting has asked its Subcommittees on Safety Criteria / Class 9 Accidents to help prepare the Committee in this regard.
Dr. Okrent, Subcommittee Chairman, believes it would be helpful to have a range of matters clarified with regard to the Draft Action Plan and asks that you arrange to have the appropriate Staff members provide comments on the questions that follow below, prior to or at the Subcommittee meeting which is to be held Wendesday, Septaber 8,1982, whichever is more convenient.
(It should be noted that additional points of interest concerning the draft action plan are likely to arise; the Subcmmittee will try to get any further questions to you as soon as possible.)'
The intent of the questions is partly to try to provide a mechanism for informing the full Committee concerning possible matters of interest.
The intent is also to help the Subcommittee gain a better understanding of the Staf f points of view, something that should be useful in any cooperative ef fort between the Staff and the ACRS on these cmplex mtters.
General 1.
Since containments vary in their ability to deal with "similar" core nelt accidents, and since various accident scenarios can lead to very widely differing radioactivity releases from containment, given any particular containment, does the Staf f feel that core melt frequency alone is a suf ficient trigger point or principal bases for input into decision-maki ng?
If not, how will such aspects be factored into the N
efforts undertaken under the implementation plan?
2.Qhile the plan suggest that PRA's can provide insight as to the accident sequences that dminate risk, the main focus of Staf f attention is on core melt.
HW is the relationship to risk to be e mintained adequately?
B301100436 821210 PDR FOIA SHOTWELB2-557 PDR t
\\'
(
William J. Dircks August 27, 1982 3.
Some sites have many more than the average number of people within the first several miles of the plant.
Others have substantially larger than average populations within 50 miles or more.
How will the Staff factor such site considerations into the ef forts undertaken under the implementation plan?
4 There is considerable interest in Europe in having any safety policy consider not only health effects but some limit on the long-term loss of access to a significant area of highly used land (agricultural or urban).
Has the Staff developed any opinions on this matter? How might it affect an implementation plan, if it were part of the safety policy?
5.
Has the Staff considered an accident which leads to a delayed release permitting ef fective evacuation but eventually results in significant amounts of cesium and other undesirable, non-valatiles? Such an accident might pass the trigger points given in Table 2 for pending CP and ML applications yet still represent an unacceptably high or undesirably high risk of large scale, long-term contamination.
6.
Some ACRS members have expressed concern about the significance that can be placed on health ef fects calculations involving very small doses to many people and have asked whether, at least @erationally, limits should be placed on decrete release categories (possibly allowing in some discrete way for dif ferences anong sites). What are the Staf f opinions and preferences in this regard?
7.
If Nuclear Reactor Regulation were asked to provide its recommended l
safety policy and quantitative safety objectives, how would it dif fer from the July 1982 draft safety policy prepared by OPE 7 C_ontainiaent Performance and Uncertainties 4
1.
If the Commission were to ask the Staf f to develop and include a contain-ment performance criterion in its trial action plan (not for licensing use), how wo'ld the Staf f proceed? What fonn might it take?
u 2.
On Page 11, the Staf f discusses containment performance.
Does the Staf f feel able to specify a containment performance guideline now for large dry containments?
If not, Jiat information is needed and when and how is it being obtained, if it is? What specific informa-tion is needed for other containment types?
i 3.
Page 22, why does it take until FY 84-85 to develop PRA and contairrnent performance assumptions for "other types of containment structures"?
Is there merit during this trial implanentation period, in attempting to specify containment performance criteria, and learning from the "gave and take" of discussion and analysis?
l c
William J. Dircks August ?7,1982 4
On Page 8, is there a technical basis for the statement that "the largest range of uncertainties are found in the area.of containment performance modeling, modeling and estimating the recurrence of natural phenomena, and evaluating the consequences of natural events beyond the design basis?"
If so, can the report te made available?
If not, how are design errors, multiple human errors, uncertainties in very low level radiation ef fects, among others, compared to the items mentioned.
5.
On Page 12, does the Staf f expect to be able to develop quantitative system performance criteria independent of the containment, site, other sys t ems, etc. ? How practical is a generic reliability or risk alloca-tion expected to be?
6.
Does the Staf f believe that the nedian provides a proper definition of ri sk ? If the median is used, just how will " strong weight be given to the magnitude and importance of uncertainties"?
(Page 1) 7.
If the Commission were to decide that mean rather than nedian values were to be used in its design objectives, how would the Staf f change its Action Plan? Would the operating level numbers change?
_A_c,cident initiators c
1.
The action plan currently proposes not to include certain initiators in its approach to implementation.
Which specific initiators or modes of failure will be excluded?
If allocation of some of the risk to these initiators is intended, how will it te done and justified?
How and when are these to be dealt with probabilistically and/or determi ni sti cal ly ? Are specific work plans underway to accomplish this?
2.
The ACRS recommended that the NRC develop a conscious approach to dealing with all aspects of sabotage, trying to keep this initiator compatible with the safe'y policy.
Does the Staf f have any proposal on how to achieve this, assuming the Staf f supports the idea?
3.
On Page 10, the Action plan says "The NRC believes that suf ficiently low (though not quantifiable) levels of risk attributable to external events can te achieved by applying NRC's current detenninistic criteria.
"for this reason, the numerical guidance on tie likelihood of core-pelt presently is to be apportioned between external and all other accident initiators under the assumption that tie contribution of external events to core-relt frequency is generally low, provided NRC's deterministic criteria are net, lheref ore, the numerical tvidance for core-melt accidents will te implenented by allocating the major
William J. Dircks August 27, 1982 portion to internally initiated transients and loss-of-coolant accidents.
This allocation is pragmatic because it permits PRA to be utilized in estimating the risk in areas that are somewhat more amenable to present-day analysis in that they depend on the importance of design, equipment performance, and procedures.
In a few years, if the state-of-the-art warrants, PRA could be used either to verify generically that the risk attributable to external hazards is low and need not be routinely calculated on a plant-specific basis, or to assess that risk on a plant-specific basis.
Substantial research is now underway to develop more effective techniques to analyze the probability of core melt and the risk from external events."
Why is this position acceptable in view of the following:
(a) External events Mve been rodeled in some industry sponsored PR As.
(b)
External events have been dominant contributors to risk in some PRAs.
(c)
The consideration of external events may change the cost / benefit balance for some proposed safety improvements.
Although the NRC Staff consultants have suggested ways in which internal events may be equally important or doninant compared to the Zion estimate of the contribution of external events, it is also possible to increase the Zion estimate due to external events by a factor of 10 to 100 by increasing the assumed systematic uncertainties in fragilities or by using other (WASH-1400 like) assumptions on the seismic hazard Curve.
The conclusion on risk / benefit tradeof f can be drastically ef fected if one includes contributions from external events, as well as by the assumptions on the seismic fragility of the mitigating feature.
Will the NRC Staf f conclusions not be subject to reversal if external events are excluded during the first time period of trial implementation when many significant decisions will be made?
Benefit-Cost Guideline 1.
Several ACRS members have doubts about using an ALARA approach philoso-phically or pragmatically.
Does the Staf f believe that, in view of the large uncertainties / differences of technical opinion likely to exist in may important issues, ALARA can provide a major input into decis ion-ma ki ng?
If so, how will dif ferences/ uncertainties / incomplete-ness be dealt with?
If not Wat should the NRC do?
1
8 William J. Dircks August 27, 1982 2.
What does the Staff feel is the justification' for the use of 10-3/RY median core melt frequency, with no specification of uncertainty and an incomplete set of initiators, as the operating limit below which ALARA based $1000/ man rem would take over for Ols? Would the Staff perfer to use mean or higher confidence values for this threshold?
3.
On Page 12, the Staff appears to be proposing 10 x 2 x 104 = 2 x 109 5
dollars as the cost of an average core melt accident? How does this relate to the costs, if one includes of f-site and on-site economic effects, as well as health ef fects (including costs of mplacement power).
4.-
In Table 1 reference is neede to fixing individual sequences greater than 10-5, ear core melt frequency, using ALARA guidelines.
Presumably,
/y an evaluation of any proposed improvement would include its benefits for all relevant scenarios.
Does the Staff agree?
If an improvement was cost-effective in reducing risk, and the risk reduction exceeded some deminimus level, would it not be a cand[date, even if the individual scenarios affected did not meet the 10 /yr test?
5.
How will the Staff keep PRA analysts from subdividing scenarios in order to make individual scenarios come out less than the limits shown in Table 17 a 10 g/yr conservative or 10 9t from the approach in the SRP, namely Is th Staf f planning to depa 6.
/yr best estimate i order not to consider an initiator or scenario, and to use 10 g/yr.instead?
7.
On Page 14, what is the basis for use of 107, discount factor?
Is inflation included?
If so, will all benefits account for inflation, as well?
Risk Assessnents 1.
Whose PRA results will be used in decision-making if considerable dif ferences exist among those performed by the Staff, industry, etc., as occured for ATVS for many years?
2.
How does the Staf f plan to define and obtain adequate quality assurance for PRAs of various types and scopes performed by or for the Staff (not in review of an industry submission)? How will the Staff obtain adequate peer review of such PRAs? What is the Staf f definition of adequate peer review for such PRAs?
3.
What does the Staf f feel would be optimal and what is the minimum mquirement with mgard to review of industry-submitted PRAs on issues, as well as for whole reactors?
t William J. Dircks /cgust 27,1982 4
The Staf f has suggested use of fairly prescriptive methods / data for future PRAs to be requested from licensees.
How will a fairly pre-i scriptive approach to a PRA procedures guide be developed if there are significant technical dif ferences within the community on component failure rate data, how to treat common mode errors, phenomenology of core melt progression, etc? One ACRS consultant (Mueller) suggested tha -
use of Review Boards to define acceptable methods / data for controyer sial aspects of the analysis.
Another ACRS consultant (Davis) suggested that there be an independent group. established to provide reviews in such depth as was needed. There clearly are other possible approaches.
How does the Staff propose to establish acceptable methods / data for controver-sial matters?
Confonnance with numerical guidelines would not be required for licensing 5.
acceptability, according to Page 3 of the action plan. Ho'w would the Staf f use PRAs? What acceptance criteria would be used? How muld they be applied legally?
6.
Does the Staf f anticipate that the legal status of PRA proposed in the action plan could be a viable alternative?
Has the legal ann of the i-NRC commented on these aspects?
Is it the Staf f intention to never have a PRA for nonnal sites, for CP/0L 7.
review plants and for OLs not in SEP program?
If not, what is the plan?
Other Specific Issues Does the implementation Plan tend to put more requirements on the 1.
Staf f than the licensee with regard to implementing the Safety Policy?
For example, the Staff would presumably need to justify new regulatians/
requirements.
But, the licensee would not have to examine his plant with a PRA and then evaluate possible improvements.
Does iten 5 on Page 7 prejudge the outcone of any severe-accident 2.
rul emaking? Might there not be a " defense-in-depth" basis for a philosophical decision that OLs should improve containment, as practical and not-too-cost-inef fective, considering all the uncertainties, even if the design objectives Mye been met, particularly when they are to be met by median values of an un-complete PRA?
What is the largest probability of gross pressure vessel failure, 3.
assumed to lead to category 2 release, which would be accepted by the conditions shown in Table 2.
(a) for Pending CP t. ML applications; (b
for high population density sites; (c
for normal sites with existing OL?
t William J. Dircks August 27,1982 -
.4 Are the operating limits, stated as defined in Table 2 using limited PRAs, median estimates, etc. intended to apply to Indian Point?
5.
What are the NRC Staff answers to the four questions posed by the Cunmission in NUREG-08807 cr.:
H. Denton, NRR M. Enrst, NRR R. % ttson, NRR:
S. Hanauer, NRR E. Goodwin, NRR R. Minogue, RES R. Bernero, RES D. Okrent ACRS J. M. Griesmeyer, ACRS i
f 5
.i i
i t
4 6
v.,_
.v-
.r.
. ~. _ - -,,.
. ~. - _.., - -..,. -
Q CCCy
, [y,.,. ',[o.
O.
UNITED STATES
'g NUCLEAR REGULATORY COMMISSION e
ADVISORY COMMITTEE ON REACTOR SAFEGUARDS gg I
e., $
g W ASH WGT ON, D. C. 20555
'g v
,e
September 15, 1981 MEliORANDUM FOR:
Forrest J. Remick, Chairman Inter-0ffice Steering Group on Development o afet' Goal FROM:
R. F. Frale ecut ve ir or, ACRS
Subject:
COMMENTS REGARDING NUREG-0739, "AN APPROACH TO QUANTITATIVE SAFETY G0ALS FOR NUCLEAR POWER PLANTS" As stated in the letter transmitting NUREG-0739, that report was intended to offer a possible approach to the development of quantitative safety goals for nuclear power plants.
It was expected that it would be only a first step in an interactive process of discussion and revision.
A significant' response to NUREG-0739 has been provided by the Atomic Industrial Forum in a letter to the ACRS dated March 26, 1981.
In addi-tion, the AIF has offered a different proposed approach in the paper "A Proposed Approach to the Establishment and Use of Quantitative Safety Goals in the Nuclear Regulatory Process" dated May 1981.
It is evident that the hoped-for process of discussion and iteration has begun.
In furtherance of that process, Drs. David Okrent and Michael Griesmeyer have prepared the attached paper addressing the comments and proposal from the AIF.
It must be emphasized that NUREG-0739 was not intended to be an ultimate ACRS position.
It was intended to be both-tentative and provocative and to serve as the first step in a process of discussion.
The attached paper is offered in the same spirit.
Mr. Myer Bender has provided the following additional comments regarding this matter:
The' information provided by Drs. Okrent and Griesmeyer is relevant to the questions asked by the AIF.
However, the ACRS has not at this stage en-dorsed the approach presented in NUREG-0739 and has not examined whether the matters questioned by AIF or others influence the assessment of its usefulness.
Hence, it would be premature to focus great attention on re-fining this safety goal approach until others have been examined.
Attachment:
Ltr. to Dr. Clark Gibbs, AIF, cC i
from Drs. Griesmeyer and Okrent dtd. 9/11/81 j
transmitting, "A Discussion of Some Comments
[,e on MUREG-0739" by Drs. Griesmeyer and Okrent t-cc w/att.:
Commission W. J. Dircks EDO G. Sege, OPE D.-Rathbun, OPE s.
y
UNIT ED STATES
- o 8 gs,,;., f NUCLEAR REGULATORY COMMISSION ADVISORY COMMITTEE ON REACTOR SAFEGUARDS i c y",
.c c ?;., 4
/
we.sn mcToy. o. c. 2esss g
- % *..../
September 11, 1981
~
L, z.
Dr. CTark Gibbs, Chairman
- Comittee on Reactor Licensing and Safety Atomic Industrial Forum, Inc.
7101 Wisconsin Avenue Washington, D.C. 20014
Dear Dr. Gibbs:
In a letter dated March 26, 1981 to Dr. J. Carson Mart, Chairman of the ACRS, you provided comments by the AIF Committee on Reactor Licensing and Safety on NUREG-0739, "An Approach to Quantitative Safety Goal,s for Nuclear We have. tried to prepare a document responsive to the Power Plants."
points raised in your letter and are forwarding a copy for your informa-tion.
Sincerely.
Michael Griesmeyer David Okrent
Enclosure:
As stated s
t A
g s
J
(-
{
A DISCUSSION OF SOME COMMENTS ON HUREG-0739 i
BY
^
J. MICHAEL GRIESMEYER STAFF MEMBER, ADVISORY COMt11TTEE ON REACTOR SAFEGUARDS U.S. NUCLEAR REGULATORY COMMISSION AND DAVID OKRENT CHEMICAL, NUCLEAR AND THERMAL ENGINEERING DEPARTMENT UNIVERSITY OF CALIFORNIA, LOS ANGELES, CA SEPTEMBER 1981 D
4 4
A
- J i
/
r
\\
f 0
f
- ~
f C
t A DISCUSSION OF SOME COMMENTS Or! NUREG-0739
, )l i
1.
Introduction 1
In a letter dated October 31, 1980 from ACRS Chairman Milton S. Plesset to NRC Chairman John F. Ahearne, the Advisory Committee on Reactor Safeguards (ACRS) described a preliminary proposal for a possible approach to quantitative safety goals for nuclear power plants and forwarded a detailed report on the subject, HUREG-0739.III (See Appendix A.)
The ACRS stated that the proposed approach was intended to serve as one focus for discussion on the subject of quantita-tive safety goals and as such is expected to be only a first step in an itera-tive process.
Several written comments on NUREG-0739 have already been submitted. This docu-ment will discuss some of the comments provided by the Atomic Industrial j
Forum (AIF) in a letter from D. Clark Gibbs to ACRS Chairman J. Carson Mark dated March 26, 1981.
Also available to serve as an elaboration on the AIF letter is an AIF paper dated. May 198L entitled, "A Proposed Approach to the Establishment and Use. of Quantitative Safety Goals in the Nuclear Regulatory Process..(2)
The comments in the AIF letter are constructive, and their existence, together with the AIF proposal, provides a useful basis for developing further insight into these matters.
In this document we will try to respond to the major points raised in the AIF letter.
On occasion we will go beyond the specific points raised by the AIF in an effort to provide additional rationale for the proposals in NUREG-0739.
<r s
)
~
2.
Roots of the Aproach to Outatitative safety Goals A najor coment rude in the AIF Totter en 1;UREG-0739 is as follows:
v o "Too little rationale is provided.
Ue agree, as the cuthors have stated, that all of the numerical values given are 'primarily a natter of judgeraent' and that 'the structure of the risk taanagement framework is more important than the numerical values assigned to specific parameters. '
The authors should provide, as others have, more insight into the underlying principles or philosophy that were used to guide their approach to defining _ the stiucture and deciding on the propsed nunarical criteria."
It is true that liUREG-0739 provides a iess -than complete rationale for the preposed framework and the trial numerical paramaters suggested for the deci-sion rules. While a thorough rationale will not be given here, an attempt will be made to present some of the guiding philosophy and considerations that were used in developing the approach to quantitative safety goals that is presented in llUREG4739' It is important to note that 1:UREG-0739 is intended to apply to future LWRs, and the discussion presented in. this document continues that approach.
For reactors in cparation or under construction, some modification would be appropriate both in the decision rule framework and the numerical parameters suggested in !;UREG-0729.
2.1 Some Qualitative or Semi-Quantitative Criteria The guiding philosophy for liUREG-0739 included the following series of par-tially ove rl apping and not-all-inclusive qualitative or semi-quantitative criteria:
o Future nuc1 car powei plants should, if practical, present less risk to society than that from its principal cen.petitor, namely r. cal, as it is current-ly being employed or likely to be crpicyed in the near future. (The differing nature of the impacts fr om coal end nuclear power will, however, make the
- k.,
~
required comparisons di f ficul ty and th2 l arge uncertainties in ~ the dsti-nates of these risks will require the use of some fann of mean or expected value of risk for the comparison.)
I o The risk arising from the presence of one or more LWRs at a particular site to those individuals at greatest risk (i.e., those living or working very close 2
to the reactor site) should be small enough that: 1) it does not significantly increase their risk of death from accidents or from cancer and 2) questions of equity are removed from importance, i.e., any imbalance between the increment of individual risk and direct' benefit should be.small enough that a conscious effort to balance the disparity is not required. Automatic balancing is accom-plished to some ertent in many communities, of course, by hroperty taxes orr large technological facilities and by the employee payroll that is spent in the community.
In France a reduction in electricity rates for those living nearby is being impicmented.,
I o
The safety-related design should be required to place emphesis both orr the: - '
prevention of accidents which could lead to severe core damage or large scale fuel melt and on the mitigation of accidents involving large scale fuel melt.
The probability of such an accident should be very low, and there should be a very low probability that an individual living near the plant will be killed, even if a large scale fuel melt accident does occur.
o The reactor should be designed to meet specified safety goals.
Suitable design effort should then be made to reduce further the level of risk to public health and safety and to economic resources t'y use of an as-low-as-reasonably-achievable, cost-effectiveness criterion against which to measure additional
.r.,
C C
improvements.
This would be irr consonance witir a general societal philosophy to keep risk as low as practical.
It would be in consonance with a philosophy which included an aspiration toward achieving improved safety, as practical, in future years.
It would also reflect an expectation that the actual risks from future LWRs will be less than the goal levels as a result of the applica-tion of ALARA.
o All LWR. accident sources should be considered in evaluating the risks, and-the safety goals should be compared against mean values which have allowed for the presence of large uncertainties.
o Incentives should be provided to reduce still further the likelihood of accidents involving large numbers of casualties without unduly penaliz.ing the technology or placing excessive costs on society.
The quantitative safety goal approach presented in NUREG-0739 is an attempt to assemble these qualitative goals in a framework intended to assure that they can be implemented irr a meaningful way.
2.2 Some Considerations for a Workable F' amework r
Several considerations have been used in the development of the framework proposed in NUREG-0739, including the following-o It is assumed that if the NRC were to arrive at a tentative decision on quantative safety goals and criteria, it would publish them for general comment and would also seek implicit or explicit approval from Congress.
If a policy of using quantitative safety goals were adopted by the NRC, at first for a trial period it would most likely be intended for general policy guidance while
( __
(.
detailed methodology could be tried out in nonbinding fashion on spedtf tc nuclear power pl ants.
Implementation of quantitative safety goals may be 1
progressive and is likely to complement rather than replace general criteria, and other deterministic criteria, standards and guides that are found to be of continuing value.
The reliability and probabilistic analysis methods that are used in probabi-o listic risk assessment were originally developed as tools for design reliabi-lity and risk management in the aerospace industry.
Although there has been significant developmerit since then to allow some quantification of risk, the main utility of these methods remains in their roles as design optimization and risk management tools.
The framework for implementing the luantitative goals should carefully ensure their propei use in these capacities as well as in the estimation of the levels of risk represented by the particular power plants.
o It must be anticipated that large differences wil1 exist in results among
)
probabilistic risk analyses performed independently for the same plant, unless a completely prescribed method and data set are used.
There will be large uncertainties in the resul ts, and some accident initiators will always be difficult to quantify.
Some of the uncertainty is due to the randomness of the processes that lead to the irdpacts, and some is due to the lack of a capabfif ty to analyze many phe-nomena and processes accurately.
While there will be some reduction in uncer-tainty as more data are collected and better models constructed, some uncer-tainties will always remain.
The framework for the quantitative safety goals 9
must provide means both for reducing the uncertainties to the extent practical and for accommodating the residual uncertainties in the management of risk.
e l- %
i 1
(
(
Reduction of uncertainties, in.the analysis will require improved mathods and data.
Methods, for some aspects; of risk analysis are just now being developed and nust be allowed to evolve. While a nearly complete standardization of risk assessment models and' data, cuch as is done for some deteministic calcula-tions in current licensing requirements, would greatly facilitate NRC review of such studies, it appears that such standardization would be premature at this time.
Since thorough testing of the methods and models of risk assessment is not and will not be possible, emphasis must be placed upon the process through
~ which the risk estimates are developed.
Quality assurance requirements and an independent and searching peer review must be developed. Such a peer review at this early stage in the development of risk assessment. methods must be particularly thorough since means to assure quality have not been developed.
o Residual uncertainties must be accommodated in the structure of the quanti-tative safety framework so that decisions can be made. Because of anticipated differences and large uncertainties in the risk estimates, it is important, if not vital, to have a formal process for establishing the risk estimates to be used in the detemination of whether the safety goals have been met.
The method of estabitshing closure on this issue should. be fair, effective and practical, and should be established in a manner that provides public confi-dence in the process.
o It is likely that operational experience and further studies of nuclear power plant safety will from lead to significant changes in the risk estimates.
For example, specific plants may be found to have features, such as flaws in components, which fall outside the assumptions used in originally estimating.
. i
the risk; or ned informaticn on nearby carthquako sources may modify th; overall risk estimate.
In order to accor.rodate situations such as these in a rianner that allows for discretion and consideration of overall societal objec-tives such as need for power, it would be desirable to build some ficxibility r
into the quantitative saf sty goals framewort.
o Uncertainties may be much larger for generic analysis than for a plant specific analysis.
If the quantitative goals are not used on a plant specific basis but only to rationalize and justify general deterministic requirements, the problem of determining whether the safety goals have been met, as well as ascertaining the residual risk from each of the wide variety of plants that satisfy the detenr.inistic criteria also satisfies the qu5ntitative safety goals, the deteministic criteria may have to be very conservative and/or very detailed.
In this case a major advantage of going to quantitative safety goals
~
would be lost, i.e.,
the flexibility of allowing the licensee to search for j
cost-effective and optimal designs.to meet the safety goals.
The performance of a risk analysis is Itkely to be required of applicants currently awaiting nuclear power plant construction pennits in the United States.
It is anticipated that applicants will of ten use these risk assess-ments _to argue for or against particular design changes or requirements even if the NRC does not apply the quantitative safety goals on a plant by plant basis.
The qualitative criteria and general considerations given above were used in part to develop the approach to quantitative safety goals that appear in NUREG-0739.
The rest of this paper will provide a more specific response to the issues raised by the AIF comments on NUREG-0739.
(
c 3.
Complexity of the Approach to Quantitative Safety Goals A principal comment by the AIF is made on page 2 of their letter, as follows:
o "One characteristic of a viable safety goals framework is simplicity.
The framework proposed in the ACRS report is unnecessarily complex and requires considerable simplification before it can be implemented effectively and understood by a broad segment of the technical community and the general public.
Specific areas where simplification would be beneficial include the following:
The upper, non-acceptance limits are unnecessary and a single goal value is sufficient for each of the decision rules proposed.
This goal value could be considered a " burden of proof" level, where, if the estimated value is above the goal the licensees must justify deviations, and if the estimated value is below the goal level, the NRC should justify changes.
Realistic cost-benefit criteria should be used to provide such justification.
The use of three different hazard states adds unnecessary complex-ity to the decision rules.
Limits on the occurrenci of large scale fuel melt should be considered as subservient to the primary safety goals that treat directly the risk to public health and safety.
,C The conditional probability included in the hazards state defini-tien and other tables, requiring the assumption of the existence of a large scale fuel melt event, is ur,necessary because the intended objective is achieved by specifying individual and societal risk criteria."
3.1 Safety Goals Level and Upper Nonacceptance Limits There clearly are arguments pro and con concerning the proposed use in NUREG-0739 of both upper, nonacceptance limits and safety goal levels.
The AIF suggests that, for reasons of simplicity among others, the upper, nonaccep-tance limits are unnecessary and a single goal value is sufficient.
Others have questioned whether the proposed factor of five difference between the upper, nonacceptance limit and the safety goal value was smaller than the uncertainty in the actual value of the parameter involved, and hence of doubt-ful meaning.I3I
(
(
A principal reason for proposing a double set of limf ts in HUREG-0739 was ta provide some flexibility to the regulatory process in view of the large uncer-7
.f y
tainties inherent in risk evaluation for power reactors and the anticipa-tion that predicted values would be subject to change with time.
r For new LVRs it was assumed that the designers would submit a reactor design that they had calculated to meet the safety goal limits (as well as having been subjected to ALARA, cost-effectiveness review for further possible improve-ments).
It was also assumed that the NRC Staff would not take a position favorable to a construction pennit (CP) unless they agreed that the safety goal levels were being met.
Hence, it is likely, although not defi' nite, that the Risk Certification Panel (or other responsible group) would make a similar finding.
Controversy at this stage could result fro:n possible disagreement with the conclusions of the designer and the NRC Staff by the third party, independent p,egr review, or by intervenors.
j Given agreement at the CP stage that the safety goals were met, there would remain some likelihood either prior to operation or after operation had begun that new information or the evaluatior, of other reactor cases might lead ta a revised judgement by the NRC or the Risk Certification Panel that the reactor risk now was in excess of one or more of the decision rule safety goals.
If there were not also a set of larger, nonacceptance limits, the NRC would presumably be obligated to initiate corrective action on a time scale commen-surate with the importance of the violation of the safety goal.
With the proposed, two-tier approach, the NRC would have flexibility; it might not require any action which was not c1carly cost effective if a safety goal was judged to have been violated, but not the upper, nonacceptance level.
,r-(
(
~'
An additional reason for the two-tier approactr is thought to lie in pendt-ting relatively larger values for the upper, nonacceptance limits than would be likely to be judged suitable if only a single set of itmits was used.
The larger the value, the more ifkely it is that fairly general agreement might, be reached that the value was not being exceeded despite the uncertainties inherent in probabilistic assessment for LWRs.
In a paper given at the AIF Licensing Workshop April 14, 1981 in New Orleans, ACRS member William Kerr,. ( } responded to the AIF comment that the upper, nonacceptance limits are unnecessary as follows:
"It is my belief, based on experience, that if s'uch a limit is not stated it will be established anyway.
Better to have it in the open so it can be discussed.
You will note that'the frame-work proposed does permit a range of negotiation between the upper limit and the goal level."
3.2 Multiple Hazard States The AIF recomends the use of.one hazard state, in the form of a supple-mentary criterion, rather than the three proposed in Table 2.1. on page 59 of J
(See Appendix A.)
More specifically, the AIF would retain the hazard state on large scale core melt and eliminate that labeled significant core damage and that on the conditional probability of a large scale uncon-trolled release of radioactivity, given a large scale fuel melt.
The hazard state labeled "significant" core damage does not represent a vital aspect of the proposed approach, although some have placed great emphasis on the need to try to prevent recurrence of an " interrupted" core melt accident like TMI because of its ultimate large effects on the parent utility and the nuclear industry, despite the very slight release of radioactivity to the I4I environment.
Kerr also expressed a preference for three, rather than
( -..
{
^
}"
- o'no, hazard states, noting. his-interest'in seeing some emphasis on ~ prevention even after some core damage has occurred, rather.than assuming that once some damage has been inflicted complete melting is inevitable.
~
4 The AIF proposal to eliminate the conditional hazard state which designates a low probability of large scale release of radioactivity to the -atmosphere, given a large scale core melt, represents a large difference in philosophy.
This same large difference appears again when the AIF recommends elimination of the conditional decision rule on risk to the most exposed individual, given a core melt.
The ACRS proposal would require that a perfomance criterion exist for the containment and other systems intended to mitigate the consequences of fuel melt, even if the designer calculated that the limits on risk to the individual and society were being met by having achieved a sufficiently low frequency of fuel melt, possibly coupled with very effective evacuation and other emergency h
The ACRS proposal would divide the accomplishmant of safety partly measures.
into prevention of serious accidents and partly into mitigation and-control of such accidents as a form of defense-in-depth.
It is again noted that the ACRS proposal is intended to be applicable to new reactors; the proposal acknow-ledges that existing reactors might not meet all the proposed criteria.
4 It is believed that with the ACRS proposal, a greater public consensus will be possible that the proposed levels of safety have been achieved.
It is also believed that knowledgeable, neutral, third parties, such as those who might i
comprise a Risk Certification Panel, may be more likely to agree that safety.
goal levels for the individual and for society had been met despite the con-siderable uncertainties inherent in the process and the differences to be i
expected among separate risk studies of the same ISR.
,)
s.
- r
(
(
The limits proposed for thc' condittom1 hazard state in HUREG-0739 cppear tu be achievable, albeit with some todification of containment, assuming the mix of fuel melt events reported in WASH-1400 and other, core recent probabilistic risk studies for specific LWRs.I6*7I However, it is conceivable that this mix will change, for exampla due to design changes which reduce the frequency of the currently dominant contributors to fuel melt, leading to a new mix which offers a greater challenge to containment, possibly because of missiles.
Should that situation become generally accepted, some relaxation in the condi-tional containment requirement for a new mix of less frequent fuel melt initi-ators might become appropriate.
3.3 On Combining Early and Delayed Health Effects The ACRS approach proposes separate goals (and non-acceptance limits) on early deaths and deaths from delayed cancer resulting from the release of radioactive material during an accident.
The safety goal for the risk of early death to individuals near the site of 10-6/ year due to all of the reactors at the site would represent an increment of only 1% in the mortality rate due to all causes for girls between the ages of.10 and 14, the age group having the lowest mortal-ity rate. Similarly, the proposed safety goal for delayed cancer death of Sx10-6/ year would represent an incremental risk of roughly one in 2003 for death due to this cause.
In its proposed approach to quantitative safety goals, the AIF (2) uses only a single mortality goal, combining early and delayed deaths.
Their recommended goal i s 10-5/ reactor year.
Since for individuals living near the site, the risk of early death is usually calculated to be larger than that of delayed,-
C.
(
(
cancer death, tha AIF proposal would pennit a percentage increment'of let in i
the risk of death for girls between 10 and 14 years of age for a single reac-
)
tor. For a multiple reactor site, say three reactors, the risk increment would.
be 307, for girls in this age group for the AIF proposal.
It should be noted, however, that the goal levels address the most exposed I
individuals and thus the average risks for the individuals living, say, within the first five miles of the site would be smaller for both the AIF proposal and the ACRS trial proposal.
4.
Consideration of Economic Losses Another AIF comment was as follows:
"o In view of their intended use as instruments of NRC regulatory policy, safety goals should address exclusively matters of public health and safety, and should not include considerations relating to protection of property or economic interests."
}
The AIF endorsed the concept of an as-low-as-reasonably-achievable ( ALARA),
cost-effectiveness criterion on accident risk reduction, but, as indicated in the connent quoted above, recommended in their own proposal that the costsi of an accident allow only for public health effects at a rate of $100/ man rem (which the AIF equates to a value of $1,000,000 per pre < nature death averted).IU Since risk stu[ics generally indicate a factor of five or so more delayed cancer deaths than early deaths from postulated accidents involving large uncontrolled releases of radioactivity, the AIF proposal is about a factor of two less than the ACRS proposal with regard to the dollar value benefits of averting premature deaths due to accidents (8) if risk aversion is not a significant factor or is not included.
,r-I...
i
C
(..
Thh economic costs cf an accident both to the plant end external to the plant
~ '
are real costs, however. Both are ultimately borne by the public, in the fornr of higher electricity rates, taxes, insurance rates, direct property d: maga, etc. Hence, it is not clear why an as-low-as-reasonably-achievable criteria I
should not include economic losses. On this subject Kerr says:
"All the information we have suggests that public unacceptance of risk is strongly conditioned by perceived benefits. Fine.ncial risk in a number of forms, destruction of rich fann lands, elimination of the usability of urban areas, is a strong negative benefit."
'NUREG-0739 does not address the potential use of discounting costs to present value in the application of the cost-effectiveness criterion. The factor of two multiplier on economic losses proposed in NUREG-0739 would not be used if-the philosophy were changed from one emphasizing prevention to one seeking a
" fair trade-off" between cost of improvements and the benefit of risk reduc-tion. (The problem of losses omitted from the estimates due to the difficulty.
of quantification must still be addressed.) Risk aversion for early (or latent cancer) death would likewise not be included unless there were a policy dect-sion to use the cost-effectiveness criterion to encourage a trend toward the use of the more remote of an otherwise equal pair of suitable sites.
A separate question, not raised by the AIF comments, relates to how an ALARA criterion could be implemented so as to accomplish its intent in a practical fashion in view of the huge number of design variations which might be subject to analysis if an appropriate limit were not defined.
In fact, Consumers Power proposed and employed an ALARA approach to examine and evaluate possible risk reduction features for its Big Rock Point PlantI9I.
A possible approach to the ALARA concept for risk frcm accidents in new plants, an approach which is designed to complement the overall risk' management fra&
)
vork delineated in NUREG-0739, has recently been suggested by Okrent and Griesmeyer.(10) It attmpts to suggest a possible " recipe" which might meet the concurrent requirements of being practical, including a method for closure of the issue, and having the potential for leading to cost-effective improve-ments in safety.
It includes a subjective approach to the question of discounting.
Finally, an important distinction between the ALARA approach proposed by the AIF and that in NUREG-0739 needs to be spelled out. The proposal in NUREG-0739 is stated to apply to new reactors and the ALARA criterion would be applied in the design process. On the other hand, the ALARA approach of the AIF is apparently intended to apply to existing reactors; the AIF would have a re-quirement imposed on the NRC Staff that any proposed backfitting or change in u
existing regulations satisfy the ALARA test. Also, any licensee who proposed deviation from current regulations would have to meet an ALARA test.(l1I
- 5. Public Perceptions and Risk Aversion A final principal comment in the AIF letter was the following:
o " Decision rules should be based on an objective estimate of risk without additional arbitrary factors to address subjective public perceptions of risk. Although our society may ultimately require sone alteration of the risk criteria to account for risk aversion associated with nuclear power, it is premature and inappropriate to judge the extent of this alteration now.
Technologists should first present a best technical judgment on decision rules."
rg i -,
e
(, *
[
Th'e,ACRS' proposal 945 intended to represent something which the Nuclear
'tegulatory Conmission As an independent agency, appointed by the President, confirmed by the Senate, and subject to ' he' laws passed by Congress, night t
'prorwT gate.
As such, technicaT questions on 1the one hand, and public evalua-
_.s tions and public perceptions of risk on the other cannot be completely re,parated in the policy described in such a propasal.
Many aspects of public evaluatfon and perception of risk will have to be considered in the development s
~of an acceptable ~ safety policy, only two.of which will be discussed here.
'One might be more averse to one kind 'of 'hazacd or risk, than another,. and i
s therefdre ask or recommen'd th'at a higher level of safety be required for the former than the latter.
O cours, there can be other reasons for recommend-
,.1 ing a ' higher level of safetyt forj example, the benefits may ba less. or the risk may be less well-known.
)'
b There is considerable evidence that, the public, in general, and many elected; representatives of the phblic believe that nuclear power should pose less risk
- than.thit currently posed by its alternatives. Governor Bruce Babbitt, Chair-man of the Nuclear Safety Oversight Comittee, appointed by President Carter, and a member of the President's' Comission on the Three Mile Island Accident, chaire[d by John G. Keminy, took this -as his pos.ition in a meeting with the ACRS.I The ACRS' f:as. stated.more than once that -it believed that this
. objective' - shculd> nk and wsI teing sohght by it.(13,14)
This position is s
reflected in NUREG-0739 in the recomer.dqd goal for societal risk.
i-i
?
i' i
(2)
, lyits approach to quantitativi safety criteria, the AIF notes that its y
' prop 6]yd pals for societal risk for LKP.s,would compare favorably with the h,
. risk iM;u gtenattve en,irgy ge'neratingi sources, t ut it does not make this a 1
jual(tat)cEciteHof.,-
r 3
a, 3
y s
u
.g -
Ts
)
-.Qi l
~
'N
~
p i9 Q
(
i second form cf risk aversicn arises if society judges n singlo large accident to be more severe in its overall impact than many small accidents which occur rore fregently and have the same expected (or mean) value of impact.
It has been suggested in the literature that society may be averse to single large accidents by a factor proportional to the square of the number of casual-I Il ties or more.(10 Griesmeyer et al
, and Johnson and Kastenberg have illustra?ed that society does not generally require that the frequency of '
large accidents fall off at a rate such that their impact is, like that of more frequent, smaller accidents when the consequences of each is, say, squared.
Many existing and proposed societal ventures would have to be prohibited, were such a criterion to be met, since it would not be practical to achieve it Nevertheless, there are responsible goverrnental groups who have expressed strong inclinations toward aversion to large accidents; for example, Sutcliffe(18) reports that the provincial government of Groningen in Holland has " adopted an
)
interesting sliding scale, in which accidents capable of causing ten deaths, ought to have a probability not exceeding 1 in 1000; over 100 deaths, not exceeding 1 in 100,000, and of 1000 deaths, complete unacceptability."
In the nuclear reactor safety area, the pioneering proposal of F. R. Famer(19I consisted of a line which separated those accidents whose combination of frequency of occurrence and consequence was acceptable from those which were nonacceptable; the so-callad famer line included risk aversion to larger accidents. The NRC will have to decide if and how it will deal with risk aversion of this kind in any set of quantitative safety goals or criteria it adopts.
C C
~
That an element cf risk aversiorr has always existed in the regulation of
' nuclear power reactors can be deduced from the negative regulatory approach taken taward the siting of large reactors within cities wher confronted by a specific application and'the generally cautious regulatory approach to the use of sites more densely populated than Indian Point which, in the mid 1970's,.
culminated in a position to accept as not being special only sites having about half the surrounding population density of Indian Point.(20 In a sense, the question is not "Is the NRC risk-averse in its, actions?" but "Should the NRC policy toward risk aversion be included in quantitative risk goals or criteria and if so, how?"
To decide this, the NRC must decide more clearly what its policy with regard to risk aversion is and how it wishes to express it.
As part of its policy, the NRC might decide it wishes to provide an incentive to e CP applicant to choose a site hdving a lower population density within the first five or ten miles, other things being equal. To do this, one could treat accidents involving larger numbers of early deaths as more costly than a a number of smaller accidents producing the same statistical number of early deaths per reactor year. The proposal made in NUREG-0739 to use an alpha = 1.2.
for the_ calculation of benefits in reducing the number of premature early deaths would provide some such incentive. Clearly, other mathematical forms for such risk aversion are possible and might better reflect some chosen policy. The numerical parameters used would also have to be set to provide the desired incentive.
'k b
(
~
(.
S'imilarly, if it wera th2 NRC policy to provida cn incentive to choose the site
~
having lower overall surrounding population density, otner thingc being equal,.
i or if it. wished to provide an additional incentive to consider design features aimed at reducing the consequences of those low probability events leading to a very large uncontrolled release of radioactive material,. the NRC could weight the number of cancer deaths by a factor greater than unity.
9 w.
4 9
e 4
'^
(- -
REFERENCES 1.
Advi:;ory Ccmmittee on Reactor Safeguards, An Approach to Quantitative Safety Goals for Nuclear Power Plants, NUREG-0739, October 1:!B0 2.
Atomic Industrial Forum, A Proposed Asproach to the Establishment and Use of Quantitative Safety Goals in tie Nuclear Regulatory Process, May T981 Dunster, H.J., Coment on D. Okrent, " Industrial Risk," Proc. R. Soc of 3.
London, Conference on the Perception and Assessment of Risk, London, November 12-13, 1980, A376, p 133-149, 1981 4.
Kerr, W., Remarks of the AIF Licensing Workshop in New Orleans, LA, April 14, 1981 5.
Slovic, R., B. Fischoff, and S. Lichtenstein, " Perceived Risk and Quantitative Safety Goals for Nuclear Power," ANS Trans., 35, p 400, November 1980 Limerick 6.
Philadelphia Electric Company, "Probabilistic Risk Assessment:
Generating Station, Vol 1 & 2, March 1981 U.S. Nuclear Regulatory Commission, " Interim Reliability Evaluatiorr 7.
Program Study for the Crystal River Power Station,"1981 (in press)
(
Aldrich, D.C., Letter to Jan Norris of the NRC, March 24, 1981 8.
9.
Consumers Power Cmpany, Probabilistic Risk Assessment: Big Rock Point Plant, March 1981
- 10. Okrent, D. and J. M. Griesmeyer, "A ' Recipe' for an ALARA Criterion for LWR Accidents," School of E,ngineering and Applied Science, University of California, Los Angeles, UCLA-ENG-8122, September 1981, (in press)
- 11. O'Donnell, E., Presentation before the ACRS Subcommittee Mtg on the Use of Probabilistic Risk Analysis in Reactor Licensing, Los Angeles, CA, July 28-29, 1981
- 12. Babbitt, B., Remarks to Advisory Committee on Reactor Safeguards, December 1980
- 13. Silvernan, L., Letter to J. A. McCone,
Subject:
Rector Site Criteria, October 22, 1960
- 14. Carbon, M.W., Letter to J. F. Ahearne,
Subject:
Coments on the Pause in Licensing, December 11, 1979 i
1
w
?'
REFERENCES (cont'd)
- 15. Ferriera, J. and L. Slesin, Observations on the Social Impact of Large Accidents, Operations Research Center, Tech Report No.122, Massachu-setts Institute of Technology, October 1976
- 16. Griesmeyer, J.M., M. Simpson and D. Okrent, The Use of Risk Aversion in Risk Acceptance Criteria?, School of Engineering and Applied Science, University of California, Los Angeles, UCLA-ENG-7970, October 1979
- 17. Johnson, D.H., and W. E. Kastenberg, " Application and Implications of Trial Risk Acceptance Criteria," in An Approach to Quantitative Safety Goals
~
for Nuclear Power Plants ACRS, NUREG-0739, October 1980.
- 18. Sutcliffe, J.R., " Shipping Risks at Braefoot Bay " Science and Public
- Policy, 9,, pp 356-364, October 1980
- 19. Farmer, F.R., " Siting Criteria - A New Approach," Containment and Siting of Nuclear Powe_r Plants, Vienna: International Atomic Energy Agency, pp.
303-318, 1967
- 20. Okrent, D., Nuclear Reactor Safety: On the History c the Regulatory Process, University of Wisconsin Press,1981.
h e
4 w
0 e
6 e
.-- y
e-(.
APPENDIX A (See ACRS Ltr. to J. F. Ahearne dated 10/31/80,"An Approach to Quantitative Safety Goals for riucicar Power Plants"
.CQ e
9 e
b A