ML20049H501
| ML20049H501 | |
| Person / Time | |
|---|---|
| Issue date: | 02/28/1982 |
| From: | NRC OFFICE OF POLICY EVALUATIONS (OPE) |
| To: | |
| References | |
| NUREG-0880, NUREG-0880-FC, NUREG-880, NUREG-880-FC, NUDOCS 8203030199 | |
| Download: ML20049H501 (45) | |
Text
-
NUREG-0880 For Comment Safety Goals for Nuclear Power Plants:
A Discussion Paper i
U.S. Nuclear Regulatory Commission Office of Policy Evaluation f, ~ %,,,
hkkh.).
s.....
l Psa S8Ri? "" " 8 l
0800 R PDR
NOTICE Availability of Reference Materials Cited in NRC Publications Most documents cited in NRC publications will be available from one of the following sources:
- 1. The NRC Public Document Room,1717 H Street, N.W.
Washington, DC 20555
- 2. The NRC/GPO Sales Program, U.S. Nuclear Regulatory Commission, Washington, DC 20555
- 3. The National Technical information Service, Springfield, VA 22161 Although the listing that follows represents the majority of documents cited in NRC publications, it is not intended to be exhaustive.
Referenced documents available for inspection and copying for a fee from the NRC Public Docu-ment Room include NRC correspondence and internal NRC memoranda; NRC Of fice of Inspection and Enforcement bulletins, circulars, information notices, inspection and investigation notices; Licensee Event Reports; vendor reports and correspondence; Commission papers; and applicant and licensee documents and correspondence.
The following documents in the NUREG series are available for purchase from the NRC/GPO Sales Program: formal NRC staff and contractor reports, NRC-sponsored conference proceedings, and N RC booklets and brochures. Also available are Regulatory Guides, NRC regulations in the Code of Federal Regulations, and Nuclear Regulatory Commission Issuances.
Documents available from the National Technical Information Service include NUREG series reports and technical reports prepared by other federal agencies and reports prepared by the Atomic Energy Commission, forerunner agency to the Nuclear Regulatory Commission.
Documents available from public and special technical libraries include all open literature items, such as books, journal and periodical articles, and transactions. Federal Register notices, federal and state legislation, and congressional reports can usually be obtained from these libraries.
Documents such as theses, dissertations, foreign reports and translations,and non-NRC conference proceedings are available for purchase from the organization sponsoring the publication cited.
Single copies of NRC draft reports are available free upon written request to the Division of Tech-nical information and Document Control, U.S. Nuclear Regulatory Commission, Washington, DC 20555.
Copies of industry codes and standards used in a substantive manner in the NRC regulatory process are maintained at the NRC Library, 7920 Norfolk Avenue, Bethesda, Maryland, and are available there for reference use by the public. Codes and standards are usually copyrighted and may be purchased from the originating organization or, if they are American National Standards, from the American National Standards institute,1430 Broadway, New York, NY 10018.
l l
NUREG-0880 For Comment Safety Goals for Nuclear Power Plants:
A Discussion Paper Manuscript Completed: February 1982 Date Published: February 1982 Office of Policy Evaluation U.S. Nuclear Regulatory Commission Washington, D.C. 20555
.en
i s
ABSTRACT This report includes a proposed policy statement on safety goals for nuclear power plants published by the Commission for public comment and a supporting discussion paper.
Proposed qualitative goals and associated numerical guide-lines for nuclear power plant accident risks are presented.
The significance of the goals and guidelines, their bases and rationale, and their proposed mode of implementation are discussed.
iii i
TABLE OF CONTENTS Page COMMISSION STATEMENT:
PROPOSED POLICY STATEMENT ON SAFETY GOALS FOR NUCLEAR POWER PLANTS......................................................... vii SUPPORTING REPORT:
SAFETY G0ALS FOR NUCLEAR POWER PLANTS: A DISCUSSION PAPER EXECUTIVE
SUMMARY
5-1 I.
INTRODUCTION................................................
1 A.
Purpose, Scope, and Application of a Statement of Safety Policy................................................
1 B.
Past and Present Regulatory Assumptions and Practices...
2 C.
Options and Approaches..................................
3 1.
Policy 0ptions......................................
3 2.
Alternative Regulatory Approaches...................
5 D.
Development of This Statement of Safety Policy..........
8 E.
Outline of Paper........................................
9 II.
STATING A SAFETY P0LICY.....................................
9 A.
Basic Characteristics of a Safety Goal..................
9 B.
Issues in Formulating a Safety Policy for Nuclear Power Reactor Accidents..............................
11 1.
Scope of Concern...................................
11 2.
Risk Aversion......................................
12 3.
Industry Size......................................
13 4.
Prompt and Delayed Fatalities......................
14 5.
Equity / Compensation.................................
14 III.
S A F E T Y G0AL S...............................................
15 A.
Gene r a l Co n s i de r a t i o n s.................................
15 B.
St a temen t and Ra t i on a l e................................
16 IV.
NUMERICAL GUIDELINES.......................................
18 A.
Ge n e r a l Co n s i de r a t i o n s.................................
18 B.
Statement and Rationale................................
21 1.
Individual and Societal Mortality Risks............
21 2.
Benefit-Cost Guideline.............................
25 3.
Plant Performance Guideline........................
26 v
TABLE OF CONTENTS (Continued)
Page V.
IMPLEMENTATION OF G0ALS AND GUIDELINES:
RECOMMENDATIONS........
28 A.
Acceptability of Nuclear Reactor Accident Risks............
28 B.
Relationship of Safety Goals and Numerical Guidelines to Current Regulations...................................
29 C.
Trial Period of Use of the Numerical Guidelines............
30 D.
Use of Benefit-Cost Numerical Guideline....................
30 E.
Relationship of Safety Goals to Probabilistic Risk Assessment...............................................
31 F.
Treatment of Uncertaintids in Analysis and Application of the Proposed Safety Goals and Numerical Guidelines....
32 G.
Action Plan for Implementation............................
33
. REFERENCES R-1 GLOSSARY G-1 APPENDIX: Other Quantitative Safety Goal Proposals A-1 1
1 1
I i
6 4
1 f
l vi
i l
Comission Statement, as published in the Federal Register:
PROPOSED POLICY STATEMENT ON SAFETY G0ALS FOR NUCLEAR POWER PLANTS In accordance with its previously announced Plan for Developing a Safety Goal (45 FR 71023, October 27,1980), the Nuclear Regulatory Commission hereby publishes for public comment a proposed policy statement on safety goals for nuclear power plants. A report discussing the develop-i ment of the proposed policy statement is being published separately as NUREG-0880, Safety Goals for Nuclear Power Plants: A Discussion Paper.
A copy of NURET 0880 is available for inspection at the Comission's Public Document Room, 1717 H Street, N.W., Washington, D.C.
Single copies of NUREG-0880 are available upon written request and at no cost to persons who wish to comment. Requests should be made to the NRC-GPO Sales Program, Attention: Sales Manager, Division of Technical Information and Document Control, U.S. Nuclear Regulatory Commission, Washington, D.C. 20555 (Phone 301-492-9530). Copies may also be purchased from the NRC-GP0 Program and the National Technical Information Service, Springfield, Virginia 22161.
Comments on the statement and on NUREG-0880 will be considered by the Commission in connection with possible modification of the proposed policy statement before its enunciation in effective form.
Comments are solicited concerning the entire subject matter of this pro-posed policy statement and NUREG-0880 or any of their aspects.
In addition, the Commission requests responses to certain additional, specific questions appearing in this notice.
Written comments should be addressed to the Secretary of the Commission, U.S. Nuclear Regulatory Comission, Washington, D.C. 20555, Attention:
Docketing and Service Branch, and should be received by May 18, 1982.
Comission plans for public meetings on the proposed policy statement will be announced later.
For further information:
Contact Mr. Dennis 'lathbun or Mr. George Sege, Uffice of Policy Evaluation, U.S. Nuclear Regulatory Commission, Washington, D.C. 20555, (202) 634-3276.
Dated at Washington, District of Columbia, this lith day of February, 1982.
For the Nuclear Regulatory Commission.
l l
Samuel J. Chilk Secretary of the Commission vli i
e-
-n.-
e..
--m.-
SAFETY GOALS FOR NUCLEAR POWER PLANTS:
A PROPOSED POLICY STATEMENT 2
1.
INTRODUCTION A.
Purpose and Scope In its response to the recommendations of the President's Com-mission on the Accident at Three Mile Island, the Nuclear Regulatory Commission (NRC) stated that it was " prepared to move forward with an explicit policy statement on safety philosophy and the role of safety-cost tradeoffs in the NRC safety decisions". This draft policy statement is a step in that direction. Current regulatory practices are believed to ensure that the basic statutory requirement, adequate protection of the public, is met.
Nevertheless, current practices could be improved to provide a better means for testing the ade;uacy of and need for current and proposed regulatory requirements.
The Commission believes that such improvement could lead to more coherent and consistent regulation of nuclear power plants, a more predictable regulatory process, a public understanding of the regulatory criteria that the NRC applies, and public confidence in the safety of operating plants.
Ultimately, an explit.it statement of NRC safety policy is needed. Such a statement would state the Commission's views on the acceptable level of risks to public health and safety and on the safety-cost tradeoffs in regulatory decisionmaking.
This proposed policy statement focuses on one matter of special public concern at the present time: nuclear power plant accidents which may release radioactive materials from the reactor to the environment.
Except as noted in the following sentence, it is our intent that nuclear power plant accident risks from various initiating mechanisms be taken into account to the best of the capability of current evaluation techniques, even where uncertainties (as with earthquakes) may be substantial.
The safety goal does not include risks from routine emissions, from the nuclear fuel cycle, from sabotage, or from diversion of nuclear material.
The risks to the public resulting from routine emissions from operating nuclear power plants are addressed in current NRC practice as follows.
Before a nuclear power plant is licensed to operate, NRC prepares an environmental impact assessment which includes an evaluation of the radiological impacts of routine operation of the plant on the population in the region around the plant site.
The assessment is subjected viii
to public comment and may be extensively probed in adjudicatory hearings.
For all plants licensed to operate, NRC has found that there will be no measurable radiological impact on any member of the public from routine operation of the plant.
(
Reference:
NRC staff calculations of radiological impact on humans contained in Final Environmental Statements for specific nuclear power plants, e.g., NUREG-0779 and NUREG-0812.) The objective of the present proposed policy statement is to develop goals for limiting to an acceptable level the 4
additional potential radiological risk which might be imposed on the public as a result of accidents at nuclear power plants.
_ Development of This Statement of Safety Policy B.
In developing this draft policy statement, the Commission has solicited and benefited from the information and suggestions provided by workshop discussions. Two NRC-sponsored workshops have been held, the first in Palo Alto, California, on April 1-3, 1981 and the second in Harpers Ferry, West Virginia, on July 23-24. The first workshop addressed general issues involved in developing safety goals. The second workshop focused on a discussion paper which presented proposed safety goals.
Both workshops featured discussions among knowledgeable i
persons drawn from industry, public interest groups, universities, and elsewhere, and representing a broad range of perspectives and disciplines.
Finally, the Commission received and considered a Discussion Paper on Safety Goals for Nuclear Power Plants, submitted in a
November IMl, by its Office of Policy Evaluation.
In arriving at a final decision on a statement of its nuclear power plant safety policy and goals, the Commission will take i
into consideration the comments and suggestions received from the public in response to this draft statement.
II. QUALITATIVE SAFETY G0ALS The Commission proposes to adopt qualitative safety goals sup-ported by provisional numerical guidelines. The Commission proposes as its first qualitative safety goal that the risk of a nuclear power plant accident not be a significant contributor to a person's risk of accidental death or injury. The intent is to require a level of safety such that individuals living or working 4
near nuclear power plants should be able to go about their daily lives without special. concern by virtue of their proximity to such plants. Thus, the Conriission's first proposed safety goal is:
.IX I
T-
Individual members of the public should be provided a level of 4
protection from the consequences of nuclear power plant accidents I
such that no individual bears a significant additional risk to life and health.
4 The Commission also proposes that a limit be placad on the societal risks posed by reactor accidents.
This proposed goal has two elements. First, the risks of accidents should be such that, when added to the risk of normal operation, the total risk to the public from an operating nuclear power plant would be comparable to or less than the risk from other viable means of generating the same quantity of electrical energy. Second, the risks of accidents should be reduced to the extent that is reasonably achievable through the application of available technology.
(This principle is already applied to the normal operation of nuclear power plants.)
The use of a benefit-cost test on safety improvements to reduce societal risks is implicit in this goal.
Thus, the Commission's second proposed safety goal is:
Societal risks to life and health from nuclear power plant accidents should be as low as reasonably achievable and should be comparable to or less than the risks of generating electricity by viable competing technologies.
i The comparative part of this goal is to be interpreted as requiring that the risks from accidents should be low enough that the total risks of nuclear power plants resulting from normal operation and accidents are comparable to or less than the total risks of the operation of competing electricity generating plants.
III. PROVISIONAL NUMERICAL GUIDELINES A.
General Considerations A key element in formulating a safety policy which establishes numerical guidelines is to understand both the strengths and 4
limitations of the techniques by which one judges whether these guidelines have been met.
A major step forward in the development and refinement of accident risk quantification was taken in thc Reactor Safety Study completed in 1974.
The objective of the Study was "to try to reach some meaningful conclusions about the risk of nuclear accidents." The Study did not directly address the question of what level of risk from nuclear accidents was acceptable.
X
Since the completion of the Reactor Safety Study, further progress in developing probabilistic risk assessment and in accumulating relev=ot data has led to recognition that it is feasible to begin to use quantitative reactor safety guide-lines for limited purposes, liowever, because of the sizable uncertainties still present in the methods and the gaps in the data base--essential elements needed to gauge whether the guidelines have been achieved--the quantitative guidelines should be viewed as aiming points or numerical benchmarks which are subject to revision as further improvements are made in probabilistic risk assessment.
In particular, because of the present limitations in the state of the art of quantitatively estimating risks, the numerical guidelines are not substitutes for existing regulations.
B.
Numerical Guidelines We want to make clear at the beginning of this section that no death attributable to a nuclear power plant accident will ever be " acceptable" in the sense that the Commission would regard it as a routine or permissible event. We are discussing acceptable risks, not acceptable deaths.
In any fatal accident, a course of conduct posing an acceptable risk at one moment results in an unacceptable death moments later. This is true whether one speaks of driving, swimming, flying or generating electricity from coal. Each of these activities poses a calculable risk to society and to individuals.
Some of those who accept the risk (or are part of a society that accepts the risk) do not survive it. We intend that no such accident (s) will occur, but the possibility cannot be entirely eliminated.
Furthermore, this risk is less than the risk that society will accept from from each of the other activities mentioned above during the same 30-year period, including generating the same amount of electricity from Coal.
l.
Individual and Societal Mortality Risks The Commission proposes the following two provisional numerical guidelines:
l The risk to an individual or to the population l
in the vicinity of a nuclear power plant site of prompt fatalities that might result from reactor accidents should not exceed one-tenth of one percent (0.1%) of the sum of prompt fatality risks resulting from other r
accidents to which members of the U.S. population are generally exposed.
xi l
}
The risk to an individual or to the population in the area near a nuclear power plant site of cancer fatalities that might result from reactor accidents should not exceed one-tenth of one percent (0.1%) of the sum of cancer fatality risks resulting from all other causes.
The Commission proposes this 0 1% ratio of the risks of nuclear power-plant accidents to the risks of accidents of non-nuclear-plant origin to reflect the first qualitative goal, which would provide that no individual bear a significant additional risk.
In addition, the 0.1% figure is consistent with the provision of the second qualitative safety goal, which seeks to keep risks as low as reasonably achievable.
It is also consistent with the comparative provision of the second qualitative safety goal, since calculations suggest that the risk of accidents at a nuclear power plant that is consistent with the proposed numerical guide-lines would compare favorably with risks of viable competing technologies.
The 0.1 percent ratio to other accident risks is low enough to support an expectation that people living or working near nuclear power plants would have no special concern due to the plant's proximity.
The individual risk is taken as the estimated probability of fatality from a nuclear power-plant accident for an individual in the vicinity of the plant, including prompt deaths and delayed deaths.
The individual risk limit is applied to the biologically average individual (in terms of age and other risk factors) who resides at a location within 1 mile from the plant site boundary.
In applying the numerical guideline for prompt fatalities as a population guideline, the Commission proposes to define the vicinity as the area within 1 mile of the nuclear power-plant site boundary since calculations of the consequences of major reactor accidents suggest that individuals in the population within a mile of the plant site boundary would be subject to the greatest risk of prompt death attributable to radiological causes. Beyond this distance, atmospheric dispersion and radioactive decay of the airborne radioactive materials sharply reduce the radiation exposure levels and the corresponding risk of prompt fatality.
xii
.~
i i
i In applying the numerical guideline for cancer fatalities, i
f as a population guideline, the Commission proposes that the population considered subject to significant risk be taken as the population within 50 miles of the plant site.
A substantial fraction of exposures of the population to radiation would be concentrated within this distance.
l This guideline would ensure that the potential increase in delayed cancer fatalities from all reactor accidents at a typical site would be no more than a small fraction of the 4
year-to-year normal variation in the expected cancer i
deaths from non-nuclear causes. Moreover, the limit protecting individuals provides even greater protection to the population as a whole.
That is, if the guideline is met for individuals in the immediate vicinity of the plant site, the risk to persons much farther away would generally be much lower than the limit set by the guideline.
- Thus, compliance with the guideline applied to individuals close to the plant would generally mean that the aggregated 1'
societal risk for a 50-mile-radius area would be a number of times lower than it would be if compliance with just the guideline applied to the population as a whole were involved.
1 2.
Benefit-Cost Guideline The Commission proposes a benefit-cost guideline for use in decisions on safety improvements which would reduce individual and societal risks below the levels specified in the first and second numerical guidelines in accordance with the "as low as reasonably achievable" (ALARA) principle.
1 It proposes that a guideline of $1,000 per man-rem-averted be adopted for provisional use and subject to revision in 1
the light of public comments.
The benefit of an incremental reduction of risk below the numerical guidelines'for societal mortality risks should be compared with the associated costs on the basis of $1,000 per man-rem averted.
This guideline is intended to encourage the efficient i
allocation of resources in safety-related activities by providing that the expected reduction in public risk that i
would be achieved should be commensurate with the costs of 1
the proposed safety improvements. The benefit of an incremental l
reduction of risk below the numerical guidelines for societal mortality risks should be compared with the associated 4
costs, including all reasonably quantifiable costs (e.g.,
design and construction of plant modifications, incremental cost of replacement power during mandated or extended
-outages, changes in operating procedures and manpower requirements).
a xiii'
i Justification of proposed plant design changes or corrective actions would be related to the reduction in risk to society measured as a decrease in expected population exposure (expressed in man-rem) under accident conditions. To take into account the fact that a safety improvement would reduce the public risk during the entire remaining lifetime of a nuclear power plant, both the estimated cost of the improvement and the benefit (risk reduction) should be adjusted to reflect only the remaining years during which the plant is expected to operate (i.e.,
annualized).
The NRC staff has some experience in the use of benefit-cost analysis and criteria in evaluating improvements in the treatment of routine radioactive effluents trom nuclear power plants.
In 1975 the Commission discussed a benefit-cost value of $1,000/ man-rem reduction in the evaluation of improvements proposed to reduce routine radiation exposures. However, the use of a benefit-cost guideline in evaluating means for reducing population risks from power reactor accidents would be new.
3.
Plant Performance Guideline An important objective of efforts to reduce the public r.isk associated with nuclear power plant operation is to minimize the chance of serious reactor core damage since a j
major release of radioactivity may result from accidents involving core damage. Because of the substantial uncertainties inherent in probabilistic risk assessments of potential reactor accidents, especially in evaluation of accident consequences, the Commission proposes a limitation on the probability of a core melt as a provisional guideline for NRC staff use in the course of reviewing and evaluating probabilistic risk assessments of nuclear power plants.
It is likely that this guideline will need to be revised as new knowledge and understanding of core performance under degraded cooling conditions are acquired. Thus, the Commission proposes the following guideline:
large-Scale Core-Melt: The likelihood of a nuclear reactor accident that results in a large-scale core melt should normally be less than one in 10,000 per year of reactor operation.
The Commission also recognizes the importance of mitigating the consequences of a core-melt accident, and continues to emphasize containment, remote siting, and emergency planning as integral parts of the defense-in-depth concept.
xiv
IV.
IMPLEMENTATION The application and prospective regulatory use of safety goals and associated numerical guidelines are important considerations in a Commission decision whether to adopt a particular proposed set of goals and guidelines.
The Commission's intention is that the goals and guidelines would be used by the NRC staff in conjunction with probabilistic risk assessments and would not substitute for NRC's reactor regulations in 10 CFR Chapter 1.
Rather, individual licensin decisions would continue at present to be based principally on co< a ince with the Commission's regulations.
The proposed numerical benefit-cost guideline may be used during the trial period as one consideration in deciding whether corrective measures or safety improvements should be made in plants previously approved for construction or operation. Benefits should be measured in terms of estimated annual reduction in radiological risk due to reactor accidents. Costs of safety improvements should be annualized over remaining plant life.
In all applications of the goals and guidelines, the probabilistic risk assessments, if performed, should be documented, along with the associated assumptions and uncertainties, and considered as one factor among others in the regulatory decisionmaking process.
The nature and extent of the consideration given to the numerical guidelines in individual regulatory decisions would depend on the issue itself, the quality of the data base, and the reach and limits of analyses involved in the pertinent probabilistic calculations.
The proposed numerical guidelines should aid professional judgment, not replace judgment with mathematical formulas.
The Commission is requesting the staff to develop a specific action plan for implementation of the proposed qualitative safety goals and numerical guidelines. The plan should indicate for Commission review and approval how the NRC staff plans to use the goals and l
guidelines in conjunction with probabilistic risk assessments.
The plan, along with the public comments on this' policy statement and the discussion paper (NUREG-0880), will be considered by the j
Commission in reaching a final decision on the adoption of'a reactor safety policy statement and its associated goals'and guidelines.
ADDITIONAL QUESTIONS.
I A number of basic issues have been raised in connection with the development of the policy statement.
The Commission requests coninents on the issues posed by the following questions as well as on all other aspects on which commenters wish to offer views.
xv
1.
Background:
The proposed benefit-cost guideline provided in furtherance of the "as low as reasonably achievable" (ALARA) principle would set a numerical formula of
$1000 per man-rem averted for consideration in tradeoffs of societal mortality risk reductions against the cost of achieving them.
The discussion paper describes the basis of the trade-off calculctions as follows:
"The benefit of an incremental reduction of risk below the numerical guidelines for societal mortality risks should be calculated for the population l
reasonably expected to be within 50 miles of the
(
nuclear power plant site.
The associated costs should include all reasonably quantifiable costs (e.g., design and construction of plant modifications, incremental cost of replacement power during mandated er extended outages, changes in operating procedures and manpower requirements)."
l Question:
Should the benefit side of the tradeoffs include, in addition to the mortality risk reduction benefits, the economic benefit of reducing the risk of economic loss due to plant damage and contamination outside i
the plant?
l 2.
Background:
The primary numerical guidelines address the per-missible net residual health risks after application l
of all elements of a defense-in-depth safety philosophy.
l Safety against core melt and integrity of containment are two of the chief elements of that defense in l
depth. A further guideline sets a proposed numerical limit on core-melt probability.
However, for reasons stated in the paper (NUREG-0880), no numerical guide-line for containment failure risk is included.
- Instead, i
qualitative guidance and the operation of the other numerical guidelines are relied on to guide regulation of containment effectiveness.
Question:
Should there be added a numerical guideline on availability of containment function, given a large-scale core melt?
3.
Background:
The last paragraph of the proposed policy statement calls on the NRC staff to develop, for Commission review, an action plan for implementation of the goals and numerical guidelines. The policy statement as well as the discussion paper (NUREG-0860) provide guidance on the implementation approach'to be employed, but only in rather general terms.
Comments and suggestions are solicited for consideration.in develop-ment of a detailed approach to implementing the safety policy. Responses to the following specific questions would be welcome:
xvi
l' What further guidance, if any, should be given Questions:
a.
for decisions under uncertainty?
b.
What further guidance, if any, should be given on resolution of possible conflicts among quantitative aspects of some issue?
c.
What approach should be used with respect to accident initiators which are difficult to i
quantify, such as seismic events, sabotage, multiple human errors, and design errors?
d.
Should there be definition of the numerical guidelines in terms of median, mean, 90 percent confidence, etc.?
If so, what should be the terms?
e.
Should the staff action plan include further specification of a process which will lend credibility to the use of quantitative guidelines and methodology?
If so, what should be the principal bases and elements of such guidance?
f.
On what basis should the numerical guidelines be applied to protection of individuals? Should they be applied to the individual at greatest risk, or should they be used in terms of an average risk limit over a region near the plant?
Any comments or suggestions pertaining to the present discussion of this topic (or other specifics) would be welcome.
4.
Background:
The Advisory Committee on Reactor Safeguards has proposed, as part of a safety-goal approach " intended to serve as one focus for discussion," that greater weight should be given to a single very severe accident
-than to a number of smaller accidents with the same total consequences.
(NUREG-0739). The ACRS proposal includes a specific quantitative formula for reflecting such " risk aversion." The risk aversion concept and the ACRS formula were discussed in'the NRC-sponsored safety-goal workshops, with controversial results.
As pointed out.in the discussion paper (NUREG-0880),
some' elements of the defense-in-depth approach'(containment, remote siting, emergency plans) aim'at mitigation of severe accidents. However, the proposed guidelines include no specific risk-aversion formula.
xvii i
Question:
Should there be specific provision for " risk tversion"?
If so, what quantitative or other specific provision should be made?
SEPARATE VIEWS OF COMMISSIONER BRADFORD The draft safety goal contains an implicit maximum theoretical acceptable consequence from nuclear power plant accidents of some 13,000 deaths over the life of the 150 plants now in operation or under licensing review.* Although the Commission staff does not dispute the validity of this calculation, the Commission declines to include it in the material put forth for comment.
While one must approach this calculation warily for several reasons, including the inadequacy of the data base, the difficulty of verification, and the omission of nonaccident related deaths and other health effects, the Commission's refusal to state it at all is a sad mistake. The fact is that society seems likely to accept a maximum theoretical risk of more deaths during the period in question fro'n a number of other sources, including generating electricity from coal. However, the Commission'c, refusal to put forth any clear " bottom line" for comment, attaching whatever cautionary language it finds necessary,** undermines forthright discussion of the goal and recalls the past regulatory overprotective-ness of nuclear power that has helped to bring the technology into disrepute today.
ADDITIONAL VIEWS OF CHAIRMAN PALLADINO, COMMISSIONER AHEARNE, AND COMMISSIONER ROBERTS Commissioner Bradford states that our safety goal would set as the maximum theoretical acceptable consequence from nuclear power accidents some 13,000 deaths over the life of the 150 plants now in operation or under
. licensing review.
While numerical guideline limits may be summed over the lifetime of the present LWR industry, the result, without proper qualifications, is misleading.
- Thecalculationis4000reactoryearsx1.7millignpeopleastheaverage population within 50 miles of a plant x (1.9 x 10, which is 0.1% of the cancer risk from all sources.) Five hundred of the expected 4500 reactor years have, of course, already occurred.
- I should note in this context that nost of the " qualifications" stated by other Commissioners to these views are not really qualifications.
They stated in assence that the safety goal is not really the one set forth here for comment but is something lower, determined by one piece of the proposed goal or, in Commissioner Ahearne's case, by future xperience unless the first accident should approach 13,000 fatalities.
If this is the case --
~
and I do not know that.it is not -- then the Cottraission has issued the wrong goal for comment.
xviii-
l l
l The fIrst qualification is that the proposed guidelines on risk should be viewed from the perspective that they are expressed as ratios to the risks of accidental and cancer death commonly experienced by the U.S.
population. Tt.is ratio is 1:1000. Thus, the estimate of 13,000 fatalities from nuclear power plant accidents over the LWR industry lifetime should be viewed in relation to the 13 million fatalities in the same relevant population during the same approximate time period as a result of accidents and cancer (not stemming from nuclear power plant accidents).
The second qualification is that the proposed numerical guidelines are based on an accident radiological source term that may be overstated by an order of magnitude.
- A third qualification relates to the stringency of the proposed core-melt guideline. The proposed core-melt guideline value together with a reasonably assumed containment reliability would have the effect of limiting to a small number the probability of a major release of radioactive material from a large-scale core-melt' accident during the present LWR industry's remaining lifetime in the United States. The core-melt probability guideline may be more stringent than the guidelines for individual and population risks.
ADDITIONAL VIEWS OF COMMISSIONER AHEARNE I disagree with Commissioner Bradford's " implicit maximum theoretical dCCeptable Consequence" statement, for an additionai reason.
if accidents were to occur which did lead to loss of hundreds of lives, additional safety measures would undoubtedly be required.
Thus I believe the number calculated by Commissioner Bradford would never be approached.
SEPARATE VIEWS OF C0FNISSIONER GILINSKY I will be interested in comments en the proposed NRC " safety goal".
I do not, however, support this proposal.
The proposed guidelines are too remote from the nitty-gritty hardware decisions that have to be made every day by designers, builders, operators, and regulators to be of much use.
It is difficult to see how the proposed safety goal would have helped the Commission to decide questions such as: How much environmental qualification of reactor safety equipment will be required? Or reactor fire protection? Or reactor security?
It is, in fact, so hard to tell what the implications of the proposed safety goals are that one doesn't know whether to agree or disagree with them, quite apart from knowing whether they are workable or not.
xix i
c
. - ~
i Guidance of the sort we are talking about is, of course, necessarily general.
The object is to state a " safety doctrine" which expresses the Comission's purposes and the general means by which they will be achieved. Such a statement could help bridge the gap between the law's broad but vague instructions - " adequate protection to the health and safety of the public" (Section 182a of the Atomic Energy Act (42 U.S.C.
Sec. 2232) -- and the specific day-to-day decisions faced by the Comission 'and its staff, so that every new decision does not require a return to the Act, the fundamentals of mathematics, and the laws of nature for a redetermination of how much protection is " adequate".
Bridging the gap could help the Comission reach more consistent and coherent decisions, and to make them more quickly.
However, the statement will not serve this purpose if it is too general or too abstract; and that is exactly the trouble with the safety goal proposed
^
by the Commission. This probably results from the way in which the proposal was put together, starting with abstract propositions about safety goals and refining these notions in a series of seminars.
Starting with a grand overall safety goal has the appeal of logical neatness, but it is not the way to go about dealing with our needs:
devising specific guidance for dealing with some very difficult practical questions. The effort to develop such guidance has to start 4
i with these practical questions.
The most pressing one is how to handle "backfitting"; that is, to what extent shall new requirements be applied to plants that have already received authorization for construction or i
operation? As a practical matter, essentially all the decisions the Comission will face over the next decade will be of this type.
I would j
especially welcome public comment on the relation of the Commission's proposal to this question.
In principle, the backfitting problem is addressed by that part of the i
safety goal which sets a value_of "$1000 per man-rem of public exposure avoided."
In practice, there are so many calculational steps and questionable assumptions between the $1000 and the man-rem of radiation exposure to the public in the vicinity of the reactor that the connection between the two is in most cases too loose to serve as a guide to decision.
It is an illusion to think, as the Comission apparently does, that "probabilistic risk assessment" will alter that l
picture in the foreseeable future.
The only reliable guides to reactor safety remain time-tested engineering principles: redundant and diverse means of protection against core damage, sound containment, sufficient distance from populated' areas, effective emergency preparedness, and, of course, careful attention to
)
quality assurance in construction and operation.
To provide guidance to the NRC technical staff and the nuclear industry, and to inform the
-public, the Commission should distill its experience ind state clearly and succinctly that each of these principles must be satisfied separately, xx
~
is and how this is to be done.
Unfortunately, the Commission seems to be on an opposite course.
It seems to be headed in the direction of allowing these guiding principles to be traded off one against the other without limit.
(For example, the Commission has, in effect, dropped the siting rulemak.ing which would have required uniform minimum distances between nuclear power plants and surrounding populations.)
The Commission appear $ to assume that probabilistic risk assessment will prove to be sufficiently workable and accurate to check whether these trade-offs will result in plants which neet the safety goals the Commission expects to adopt. This would amount to delegating the Commission's safety decisionmaking to complex computer programs that no one fully understands and which may or may not turn out to contain errors.
4 The use of systematic analytical techniques to review nuclear plants does deepen understanding of complex reactor systems and their inter-actions. Such analysis is also helpful in assessing the effect of backfits. The staff's work on assessing the reliability of auxiliary feedwater systems provides a good example of the usefulness of these techniques. But their limitations, especially where reliability data is lacking, should be kept in mind.
Finally, we should understand that the safety goals we~are speaking of here are intended to help us decide on the minimum safety requirements which will be imposed. The goals naturally have to recognize that more safety, generally speaking, costs more money and that, at some point in the process of increasing safety, additional money is better spent elsewhere.
Yet, despite these monetary limitations and the fact that only minimum hardware requirements are imposed, the electric utilities should, with sufficient care, be able to avoid large accidents altogether, and that should be the safety goal for each facility.
Nuclear power plant staffs i
should be instructed to prevent severe reactor core damage and to prevent significant uncontrolled releases of radioactivity from containment i
under all circumstances.
l I want to add that I agree with Commissioner Bradford that the Commission's i
statement should have included his 'Lservations on the number of deaths implied by the Commission's goal.
The Commissian's unwillingness to l
display these numbers, with which it does not disagree, is a small but revealing sign that it does not trust the public's good sense.
l i
1 xxi 1
1 SAFETY GOALS FOR NUCLEAR POWER PLANTS:
A DISCUSSION PAPER This discussion paper has been prepared at Commission request by the Office of Policy Evaluation for the Commission's consideration in its development of a Safety Goal Policy Statement.
Other NRC staff, nobably the Inter-Office Steering Group on Development of a Safety Goal, have contributed to this paper.
i EXECUTIVE
SUMMARY
In its response to the recommendations of the President's Commission on the Accident at Three Mile Island, the Nuclear Regulatory Commission (NRC) stated that it was " prepared to move forward with an explicit policy statement on safety philosophy and the role of safety-cost tradeoffs in the NRC safety decisions".
An explicit statement of NRC safety policy is also needed as a response to public concern about the safety of nuclear power plants.
We propose that the Commission's policy statement focus on nuclear power plant accidents which may release radioactive materials from the reactor to the environment.
If adopted by the Commission, the primary purpose of the policy statement will be to articulate the Nuclear Regulatory Commission's interpreta-tion of what constitutes adequate protection against the risks of nuclear power plant accidents and thereby to provide a clearer basis for NRC safety rules and for guidance to the NRC staff in making safety evaluations and deternining research priorities.
Such a statement would clarify for the general public as well as for the nuclear industry the Commission's views on the acceptable level of risks to public health and safety and on the safety-cost trade-offs in regulatory decisonmaking in regard to the risks of nuclear power plant accidents.
Current regulatory practices are believed to ensure that the basic statutory requirement, adequate protection of the public, is met.
Nevertheless, current practices could be improved to provide a better means for systematically guiding regulatory decisions and for testing the adequacy of and need for regulatory requirements.
A statement of safety policy could contribute to such improvements and could lead to more coherent and consistent regulation of nuclear power plants, a more predictable regulatory process, a public under-standing of the regulatory criteria that the NRC applies, and public confidence in the safety af operating plants.
The purpose of this discussion paper is to submit for the Commission's con-sideration a proposed statement of safety policy including its underlying rationale.
We have concluded that the most useful form of expressing the Commission's policy with respect to protection of the public from the risks of nuclear power plant accidents is adoption of qualitative goals along with several numerical guidelines for use in conjunction with the proposed qualitative goals.
Two qualitative safety goals are proposed:
Individual members of the public should be provided a level of protec-tion from the consequences of nuclear power plant accidents such that no individual bears a significant additional risk to life and health.
S-1
Societal risks to life and health from nuclear power plant accidents should be as low as reasonably achievable and should be comparable to or less than the risks of generating electricity by viable competing technologies.
We recommend several numerical guidelines for Commission adoption.
The term
" guidelines" is uNd instead of " quantitative goals" to emphasize their pro-visional status.
The provisional status is based on two considerations:
the need for public views and comments as well as additional experience before establishing quantitative goals that, in essence, define "how safe is safe enough;" and the fact that the ability to verify achievement of quantitative goals in any specific instance is severely limited by the present state of the art of probabilistic risk assessment.
The primary numerical guidelines are stated as limits on the incremental individual and societal mortality risks resulting from nuclear reactor accidents.
The limits are expressed as a percentage of the mortality risks faced by the public attributable to accidents and cancer resulting from all other causes.
Our proposal is that the numerical guidelines would be tested in a regulatory framework for a period long enough to permit evaluation of their effectiveness as an aid in regulating the safety of nuclear power plants.
The guidelines would be subject to revision at the end of that period to take into account experience and the degree of success in their application as well as to take into account new refinements in probabilistic risk assessment methodology.
The primary numerical guidelines which are recommended are:
Individual and Societal Prompt Mortality Risk The risk to an individual or to the population in the vicinity of a nuclear power plant site of prompt fatalities that might result from reactor accidents should not exceed one-tenth of one percent (0.1%) of the sum of early fatality risks resulting from other accidents to which members of the U.S. population are generally exposed.
Individual and Societal Delayed Mortality Risk The risk to an individual or to the population in the area near a nuclear power plant site of cancer fatalities that might result from reactor accidents should not exceed one-tenth of one percent (0.1%) of the sum of cancer fatality risks resulting from all other causes.
The first guideline is intended to define provisionally the individual and societal risk of prompt mortality due to accidents which would not be con-sidered a significant incremental risk beyond that to which members of the general U.S. population are already exposed.
The second guideline is intended to define the individual and societal delayed mortality risk which would not constitute a significant additional risk beyond that risk to which members of the general U.S. population are already exposed.
S-2
1 l
Two additional, secondary numerical guidelines are also proposed.
The first of these is a benefit-cost guideline, intended to encourage efficient allocation of resources by providing that the risk reduction expected to be achieved by j
the proposed safety improvements should be commensurate with their cost.
The other proposed guideline would limit the probability of a large-scale core melt.
The numerical benefit-cost guideline recommended for adoption is:
The benefit of an incremental reduction of risk below the numerical guidelines for societal mortality risks should be compared with the associated costs on the basis of $1,000 per man-rem averted.
Our intention is that this guideline would be applied after the primary individual and societal risk numerical guidelines have been achieved.
It would be used in decisions on safety improvements designed to reduce individual and societal risks below the levels suggested in the first and second numerical guidelines.
It would also be considered as a factor in deciding whether to make design and operational modifications (i.
e., backfitting) of existing plants in response to new safety requirements. We intend that the comparison be made on an annualized data basis which reflects the remaining number of l
operational years in the life of the plant in order to account for applications to backfitting as well as evaluation of safety improvements for new plants.
The standard of $1,000 per man-rem averted should be considered provisional l
and subject to revision in the light of public comments.
Because of substantial uncertainties inherent in probabilistic risk assessment of potential reactor accidents -- especially in evaluation of accident conse-quences -- we believe it is also necessary to have a secondary provisional numerical guideline limiting the probability of a large-scale core melt.
The likelihood of a nuclear reactor accident that results in a large-scale core melt should normally be less than one in 10,000 per year of reactor operation.
Application and prospective regulatory use of the proposed safety goals and associated numerical guidelines are important considerations in deciding whether to adopt specific proposals. We offer the following recommendations concerning the manner in which safety goals would be used.
j Recommendation:
Because the proposed safety goals and associated numerical guidelines would state the Commission's position on the l
acceptability of nuclear reactor accident risks, the Commission should issue the safety policy statement in draft form for public review and comment.
i S-3 i
l l
Recommendation:
Safety goals and guidelines used in conjunction with probabilistic risk assessments should not substitute at present for reactor regulations in 10 CFR Chapter 1; rather, individual licensing decisions should continue to be based principally on compliance with the Commission's regulations.
Recommendation:
The proposed numerical guidelines should be adopted on a provisional basis so that they would be tested in a regula-tory framework during a trial period of sufficient duration to evaluate their effectiveness.
The provisional numerical guidelines would be in lieu of adoption of quantitative safety goals.
Recommendation:
The proposed numerical benefit-cost guideline should be used during the trial period as one consideration in deciding whether corrective measures or safety improvements should be made in plants previously approved for construction or operation.
Benefits should be measured in terms of esti-mated net annual reduction in radiological risk due to reactor accidents.
Costs of safety improvements should be annualized over remaining plant life.
Recommendation:
Regulatory decisions to use probabilistic risk assessment should be made on the basis of an appraisal of its value in the specific application.
Implementation of the state-ment of safety policy should not, by itself, mandate the use of probabilistic risk assessment.
Recommendation:
In probabilistic risk assessments made in conjunction with safety goals, the underlying assumptions and associated uncertainties should be disclosed and documented for con-sideration in the regulatory process.
In most situations these probabilistic risk assessments should be performed during the trial period on the basis of realistic assump-tions and best-estimate or mean-value analyses, and they should include an understandable presentation of the magnitude and nature of the uncertainties.
Recommendation:
The Commission should request that the staff propose, within a short period following publication of the proposed qualitative safety goals and associated numerical guide-lines for public comment, a detailed action plan for their implementation.
1 S-4
1.
INTRODUCTION A.
Purpose, Scope, and Application of a Statement of Safety Policy The primary purpose of a statement of safety policy is to articulate the Nuclear Regulatory Commission's (NRC's) interpretation of what constitutes i
adequate protection against the risks of nuclear power plant accidents and thereby to provide a clearer basis for NRC safety rules and for guidance to the NRC staff in making safety evaluations and determining research priori-ties.
This statement could lead to more coherent and consistent regulation of nuclear power plants, a more predictable regulatory process, a public under-standing of the regulatory criteria that the NRC applies, and public confidence in the safety of operating plants.
This discussion paper and associated Commission policy statement focus on a matter of special public concern at the present time:
the risk
- of nuclear power plant accidents which may release radioactive materials from the reactor to the environment.
Except as noted in the following sentence, it is our intent that nuclear power plant accident risks from various initiating mechanisms be taken into account to the best of the capability of current evaluation techniques, even where uncertainties (as with earthquakes) may be substantial.
The safety goal does not include risks from routine emissions, from the nuclear fuel cycle, from sabotage, or from diversion of nuclear material.
The risks to the public resulting from routine emissions from operating nuclear power plants are addressed in current NRC practice as follows.
Before a nuclear power plant is licensed to operate, NRC prepares an environmental impact assessment which includes an evaluation of the radiological impacts of routine operation of the plant on the population in the region around the plant site.
The assessment is subjected to public comment and may be extensively probed in adjudicatory hearings.
For all plants licensed to operate, NRC has found that there will be no measurable radiological impact on any member of the public i
from routine operation of the plant.
(Refs. 21 and 22; also Final Environmental Statements for other specific nuclear power plants.) The objective of the present proposed policy statement is to develop goals for limiting to an acceptable level the additional potential radiological risk which might be imposed on the public as a result of accidents at nuclear power plants.
If the Commission adopts a statement of safety policy for nuclear power plant accidents, we would expect it to consider developing and publishing similar statements concerning other nuclear facilities and activities.
Current regulatory methods are believed to meet the basic statutory requirement that there be adequate protection of the public.
Nevertheless, current practice l
could be improved to provide a better means for enunciating NRC decisions and for testing the need for and adequacy of regulatory requirements.
Because the specific licensing and other regulatory decisions pertinent to nuclear power plants are often expressed in terms of operational directives (that is, they are usually related to prescriptive requirements on design, hardware, procedures,
- The term " risk" as used in this paper means the product of the probability of occurrence of an accident and the magnitude of the consequences, given that occurrence. l
etc.), the bases for the decisions are generally described in issue-specific terms rather than in terms of NRC's underlying safety philosophy.
The nature of these directives contributes to the difficulty in understanding the Commission's interpretation of " adequate protection."
A great deal more is known today about nuclear reactor technology than was known in the early 1960's.
Safety reviews have become very complicated and usually entail sophisticated technical analyses.
Yet, inevitably, un-certainties remain.
There are " unresolved safety issues," and major research and development programs continue within both NRC and the nuclear industry to enhance and confirm the safety of some plant systems and to improve safety evaluation methods.
If the Commission adopts a statement on safety policy for nuclear power plant accidents, we would expect it to be used to set priorities for allocation of resources and to evaluate the need for new regulatory requirements or for retaining existing ones.
It would also be available for case-by-case and generic use in staff evaluations where NRC regulations did not provide a definitive basis for regulatory decisions.
Ultimately, a statement of NRC safety policy is needed as a response to public concern about the safety of nuclear power plants.
Its formulation should take into account Congressional and public views.
A statement can serve to strengthen communication with the Congress and the public on policy with respect to regulation of nuclear power.
Such a statement of safety policy should explain to the general public as well as the nuclear industry the Commission's views
]
both on the acceptable level of risk to public health and safety and on the j
safety-cost tradeoffs in regulatory decisionmaking with regard to the risks of l
accidents at nuclear power plants.
A statement of safety policy could give both the general public and the industry greater confidence in the regulatory system responsible for protecting the public from the risks associated with the benefits of nuclear power.
B.
Past and Present Regulatory Assumptions and Practices The basic principles of regulatory practice consistent with the statutory mandates of the Atomic Energy Act and inherent in the safety approach which has been followed since the early 1950's are summarized below:
Absolute safety or "zero risk" is not legally required (Ref.1).
The Atomic Energy Act refers to " adequate" rather than " absolute" protection of the public health and safety.
There is risk in nuclear power, just as there is risk in all technologies, including competing energy technologies, as well as in every personal activity in which people engage.
The intent l
of Congress expressed in that legislation is that nuclear power be deve-loped under a licensing system for safe commercial use to generate elec-l tricity.
The Commission's continuing practice of conservatism and use of the defense-in-depth concept is intended to provide an extra margin of pro-tection.
Nuclear power plants have been designed, constructed, and i
operated so as to provide an extra margin of safety for unforeseen events.
l.
.+-e
,w
,-e
,.em+
- - - - - - - - ~ - - - - -
e-r e--
Because of the complexity of nuclear power plants and the limited opera-ting experience with them, it has been reasonable to assume that not all potential failure and accident scenarios, including ones that could present significant radiological hazards, have been identified.
Potential failures and accident scenarios continue to be studied in order to improve knowledge of reactor safety.
Regulatory decisions are made on the basis of best available evidence despite the presence of residual uncertainties.
This approach has involved striking a balance between the degree of uncertainty and the potential radiological consequences of a decision made under uncertainty.
In cases where the uncertainty regarding radiological hazard has been sufficiently great, the potential source of the hazard has not been permitted.
In particular, the Commission's regulation of radiological hazards from nuclear power plants has evolved since the early 1960's into a complex system of binding rules (10 CFR Chapter 1, primarily 10 CFR Parts 20, 50, and 100) and supplementary regulatory guidance (usually in the form of regulatory guides).
At its most fundamental level, the approach which has been and is being used requires plants to be constructed and operated in a manner consistent with sound engineering practice.
Sound engineering practice as applied to nuclear power plants is embodied in a defense-in-depth concept.
This practice involves quality assurance and control in plant design, construction, and operation to reduce the likelihood of accidents, installation of backup systems to nullify the consequences of malfunctions in important plant systems and to prevent individual malfunctions from escalating into major accidents; and installation of engineered safety features to confine the consequences of certain postulated major design-basis accidents to minimize effects on the public health and safety.
The Commission has also discouraged the siting of nuclear plants in areas of high population density or in locations near natural or man-made hazards.
More recently, siting policy has also emphasized the requirement of reasonable assurance that adequate protective measures can and will be taken by the licensee and the state and local authorities in the event of accidents more serious than design-basis accidents.
C.
Options and Approaches 1.
Policy Options:
The Commission can choose from three primary options in stating its safety philosophy:
continue the present policy, adopt quali-tative goals, or adopt qualitative goals with numerical guidelines.
Continue the Present Policy.
The choice of this option would mean that the NRC would conclude that, despite diligent effort, it has been unable to develop a statement expressing further its philosophy of nuclear safety, in either qualitative or quantitative terms, which would add useful content to present practices.
The NRC staff would continue to 'm probabilistic risk analyses as one tool in both safety standard setting anc :eactor casework.
If the Commission chooses this option, there would remain the option of continuing or renewing efforts to develop an explicit goal for adoption in the future.
Adopt Qualitative Goals.
The choice of this option might be accomplished by the issuance of a Commission statement of safety philosophy which further interprets the Atomic Energy Act's standard of adequate protection of public health and safety.
This statement could also include guidance to the NRC staff on applying the qualitative goals to the regulatory process.
For instance, the Commission might adopt a more explicit interpretation of "no unreasonable risk" or "as low as reasonably achievable" goals in reactor safety regulation.
The concepts of "no unreasonable risk" and "as low as reasonably achievable" have been the mainstay of Federal health and safety legislation and have the obvious advantage of flexibility in keeping pace with changes in social values or technology.
Moreover, qualitative goals have the particular advantage of being more readily understandable to the general public than either the continu-ation of present practice or adoption of numerical guidelines.
Thus, qualitative goals would guide the NRC's reactor safety decisionmaking in a way that would be more readily apparent than present practice.
Over time, the qualitative goals might influence NRC's safety decisions and lend them a greater coherence and predictability than they presently appear to have.
It should be noted again that, as in the first option, the NRC staff would continue to use probabilistic risk analysis in its work, subject to whatever modification would be needed to conform staff practice to Commission-approved qualitative goals.
It has also been pointed out that qualitative goals would avoid some of the pitfalls of quantitative goals.
For instance, adopting quantitative goals may impede or preclude the development of a broadly accepted set of safety princi-ples from which quantitative goals could possibly be derived.
In addition, quantitative goals may dominate the decisionmaking process and thereby direct attention away from the development and application of sound engineering practice.
Adopt Qualitative Goals with Numerical Guidelines.
The choice of this option would capture the benefits of qualitative goals and quantitative guidelines in measuring performance while avoiding the shortcomings of qualitative goals without numerical guidance.
A number of public commenters specifically endorsed quantitative safety standards as being essential to improving the rationality of the NRC's regulatory process and permitting the full benefits of applying probabilistic risk assessment techniques to NRC safety decisions.
They viewed the current NRC regulatory practices as an example of a qualitative approach to achieve an acceptable level of risk but acknowledged the difficulties of demonstrating that a qualitative goal has, in fact, been achieved.
- However, some NRC Safety Goal Workshop participants and other commenters referred to the wide uncertainty inherent in quantitative risk assessment and concluded that this would render the use of a quantitative guideline in the regulatory process incapable of yielding technically supportable results.
A number of participants in the second NRC Safety Goal Workshop advocated drawing a clear distinction between broad and aspirational goals that set the aim and thrust of safety regulation and narrower, operational standards that codify specific decision rules.
The general goals should, in their view, be qualitative and need not be--in the view of some, should not be--constrained by what can currently be demonstrated or even by what is believed to be cur-rently attainable.
They should be aiming points.
Specific safety policies and standards, including quantitative standards, should be related to these goals and modified, if warranted, on the basis of periodic review. l
h In its June 23,1981, " Policy, Planning and Program Guidance, FY 1983-87," the Commission expressed particular interest in an attempt to establish quantita-j l
tive safety guidance for NRC use in conjunction with probabilistic risk analysis.
Public commenters and participants in the NRC Safety Goal Workshops, while generally agreed on the need for quantitative standards in an explicit statement of safety policy (Refs. 6 and 11), nevertheless concluded that only quantitative guidelines, not goals, were feasible at this time.
The realization grew that the connection between qualitative goals and quantitative guidelines is more tenuous than had been believed, with the result that proposals combining both either describe the relationship metaphorically (e.g., guidelines are " based" on goals) or, more rarely, recognize the disjunction.
Accordingly, the Atomic Industrial Forum (AIF) proposes three qualitative principles as the basis of its proposed quantitative guidelines (Ref. 10).
In response to these considerations, we have developed qualititative goals and numerical guidelines discussed in Sections III and IV, respectively.
2.
Alternative Regulatory Approaches:
There exist several regulatory approaches measuring the adequacy of protection of public safety.
Each offers advantages and disadvantages in assessing the risks of reactor accidents.
The NRC, in attempting to arrive at a workaMe notion of
" acceptable risk," must choose among alternative regulatory approaches, ea l of which has important implications for the decisionmaking process and ensuring adequate protection to public safety.*
No-Risk Approach.
This approach is exemplified by the Delaney Clause of the Food Drug and Cosmetic Act, which prevents the addition of any carcinogen in food, and by the Clean Air Act Amendments (1970), which require the Environ-mental Protection Agency to set primary air quality standards protecting the health of even the most sensitive group.
These statutes embody the notion that no unnecessary risk, even a very small one, is acceptable. While a no-risk regulatory approach may have some appeal, it may be an unwise guide to regulatory decisons by requiring enormous expenditures of resources to avert comparatively few fatalities or injuries.
As noted earlier, NRC's statutory mandate under the Atomic Erargy Act does not require a zero-risk standard.
Technology-based Standards Approach.
This approach underlies EPA's regulation of water quality and plays an important part in its regulation of air quality.
In theory, mandating best-available technology does not require an agency to examine formally the costs of achieving the benefits of proposed regulations.
However, in practice, implementing best-available technology standards at least implicitly involves an economic feasibility test.
Neither the Atomic Energy Act nor the National Environmental Policy Act requires the NRC to i,e the best-available technology as a basis for reactor safety regulation.
However, the Commission's application of the ALARA principle to the regulation of the health effects of normal reactor operations clearly requires consideration of alternative technologies for reducing exposures as a factor in decisionmaking.
^For a detailed discussion of these alternatives, see Reference 12.
Cost-Effectiveness Approach.
A cost-effectiveness approach uses a standard measure, usually, dollars, for the value of averting fatalities or injuries.
When implemented, the approach stipulates a maximum expenditure for resources to avert those consequences.
Safety regulations would require the regulated industry to make safety improvements (of its choice in different activities --
operations, equipment, design) up to an aggregate expense equal to the stipu-lated standard for the expenditure of resources (e.g., $1 million per life saved).
The NRC has discussed using a formula of $1000 per man-rem averted in imple-menting the ALARA principle for routine radioactive effluents from nuclear power plants.
Risk-Risk Comparison.
A risk-risk comparison in a regulatory framework estab-lishes the level of risks of relevant alternatives; excludes other factors such as benefits or economic, environmental, or other costs; and selects that alternative with the smallest estimated risk.
This framework has two severe limitations.
First, the NRC is allowed to deny a nuclear plant license if the NRC concludes that a non-nuclear alternative would be preferred, but statutory limitations preclude the NRC licensing the non-nuclear alternative.
- However, in a more limited way, the Commission could employ a risk-risk comparison in evaluating alternative proposed safety improvements.
A second limitation is its exclusion of other important factors, benefits as well as costs, which give a necessary context for assessing the magnitude of the risks of a reactor accident.
Nevertheless, risk-risk comparisons are widely employed in assessments of nuclear power.
Both the Advisory Committee on Reactor Safeguards (ACRS) and the AIF make comparisons between the risks of reactor accidents and other kinds of risks in explaining their quantitative safety goals (Refs. 5 and 10).
For example, the ACRS compares its proposed safety goal standards to overall mortality rates by age groups and to coal-fired means of generating electricity in an industrial complex.
The AIF compares its proposed goal for individual and population mortality risks to present levels of mortality risks in the U.S. population.
Although the NRC can make only limited specific uses of risk-risk comparisons, their widespread use and diverse articulation sugoast a more general use for them. While the comparisons must be made with cais in order to recognize substantial qualitative differences, they can put the risks of reactor acci-dents and from hazardous or energy generating technologies into perspective.
They can thereby serve as a secondary means of evaluating the proposed safety goal by suggesting in another way the larger contexts in which regulatory decisions are made.
Benefit-Cost Analysis:
A benefit-cost analysis uses a common measure, usually dollars, to quantify the effects of proposed actions so that the net effect may serve as the basis for decisionmaking.
Rigorously applied, benefit-cost analysis quantifies all effects, even though some are more easily quantified 1 !
l i
than others.
In the case of a regulatory agency which must ensure public safety and health, benefit-cost analysis would require setting an explicit dollar value on a human life, a controversial issue in itself.*
The NRC performs a partial benefit-cost analysis to support its environmental impact statements under the National Environmental Policy Act.
These are partial analyses because many environmental and social effects are not expressed i
in dollars.
The NRC staff also use values (i.e., benefits.) and impacts (i.e.,
costs) as factors in the Commission's consideration of proposed standards and regulations.
Nevertheless, we believe that both the lack of information about the probabilities and consequences of major reactor accidents, and the difficul-ties of assigning quantitative values to some of the effects of those accidents do not permit a full benefit-cost analysis in term of dollars.
Risk / Net-Benefit Balance Framework:
A risk / net-benefit framework balances the benefits less the costs against risks.
This framework resembles benefit-cost analysis except that all factors would not necessarily be translated into a common unit (i.e., monetary terms) as in cost-benefit analysis.
Rather, the risks would be considered one factor in reaching a regulatory decision.
Though quantification is sought to the extent practical, not all factors may be subject to precise quantification; some may necessarily be placed in the so-called " display and discuss" category.
This framework, because it can include a wide range of specific factors, permits debate on what should or should not be taken into account.
On the one i
hand, some stress that the notion of acceptable--and, therefore of unacceptable--
risk implies the option of not building a specific facility to serve a social requirement. On the other hand, some believe that the economic benefit of nuclear power should not count for much, and others believe that costs should not be counted in decisions on the allocation of safety resources because the avoidance of large accidents is an absolute requirement.
Still others want costs to include, among othm s, economic losses from reactor and environmental contamir.ation, socio-eccnomic costs of emergency actions, loss-of power costs, and even costs in public anxiety.
A major issue, then, is what to include as a risk, benefit, or cost in this framework and how to weight it.
Another major issue is how much to spend for risk reduction beyond the standards suggested by safety goals and numerical guidelines as required by the ALARA principle.
Some commenters call for an economic standard in making such decisions.
The intent of such standards would be to correlate incremental improvements in risk reduction with their costs.
Such standards would also provide a quantitative measure for applying the ALARA principle.
However, some commenters, especially some industry representa-tives, falt that no such measure was necessary, for the industry would achieve l
a level of safety compatible with the ALARA principle simply because of its desire to avoid the direct economic costs of a reactor accident.
" Executive Order 12291, which is applicable to Executive Branch agencies, requires formal benefit-cost analyses and the selection of that alternative with greatest net benefit. 1
We do not believe that a full, quantitatively expressed risk / net-benefit framework is technically feasible today.
But we do believe that this is the appropriate conceptual framework for defining acceptable risk.
In particular, we believe that the risks of radiation should be offset by social benefits which exceed their other social costs.
For this reason, we do not exclude the benefits of nuclear generated electricity or the costs of safety improvements in decisions about reactor safety.
In short, we believe that, in principle, the risk / net-benefit framework is potentially a useful framework for setting NRC safety goals, although we recognize the practical difficulties that stand in the way of comprehensive application.
Therefore, in the development of this proposed safety policy we have used mainly risk-risk comparisons.
D.
Development of This Statement of Safety Policy In its response to the recommendations of the President's Commission on the Accident at Three Mile Island, the NRC stated that it was " prepared to move forward with an explicit policy statement on safety philosophy and the role of safety-cost-tradeoffs in the NRC safety decisions" (Ref. 2, p. A-3).
This discussion paper is a step in tha't direction and is meant to help develop the Commission's safety policy statement.
If the approach recommended is adopted by the Commission, such an approach would be used as an important tool in guiding future NRC regulation of nuclear power plants.
However, it should be amphasized that a Commission policy statement based upon this paper would not replace NRC's rules in 10 CFR Chapter 1.
Existing statutes require nuclear plant operations to provide adequate protec-tion to the public health and safety, and authorize the NRC to take actions to minimize danger to life or property.
With regard to the health impacts of normal operations, the NRC has stated a goal that radiation exposures and routine radioactive releases be kept "as low as reasonably achievable."
(See 10 CFR 620.1 and 10 CFR Part 50, Appendix I.) This paper is intended to lay the groundwork for NRC safety goals and associated numerical guidelines appli-cable to reactor accidents.
In developing this paper, NRC has solicited and benefited from the information and suggestions provided by public comment and workshop discussions.
In the fall of 1980, the Commission instituted a project to state explicitly the level of protection which it believed adequate to ensure public safety with regard to nuclear reactor accidents and, to that end, published a Plan for Developing a Safety Goal (Ref. 3).
In accordance with that plan, the Commission subsequently issued a preliminary statement of policy considerations which may enter into an articulation of the NRC's statement of its safety goal.
The Commission's statement, along with a more detailed discussion, was published as the report Toward a Safety Goal:
Discussion of Preliminary Policy Considera-tions (Ref. 4).
This report included a brief summary statement published in the Federal Register which invited comment on all aspects of the subject.
This report, issued in March 1981, was discussed at an NRC-sponsored workshop in Palo Alto, California, on April 1-3, 1981 (Ref. 11).
This first workshop illuminated many important issues of safety goal formulation, including both quantitative and qualitative elements and economic, ethical, social, and political issues as well as technical. considerations.
An Approach to Quantitative Safety Goals for Nuclear Power Plants (Ref. 5), the quantitative l
l l l
i safety goal proposal submitted to the Commission in October 1980 by the ACRS "to serve as one focus for discussion," was used at that workshop as one example of a concrete application of the concepts discussed.
A second NRC-sponsored safety goal workshop was held in Harpers Ferry, West Virginia, on July 23-24 (Ref. 6).
That second workshop had a more specific focus, a draft paper entitled Discussion Paper:
Safety Goals for Nuclear Power Plants (issued by NRC's Office of Policy Evaluation on July 10) (Ref. 7).
The workshop addressed a reference safety goal statement in this paper and explored significant alternatives.
Like the first workshop, it featured discussions among knowledgeable persons drawn from industry, public interest groups, universities, and elsewhere, and representing a broad range of perspec-tives and disciplines.
E.
Outline of Paper The remainder of this paper addresses the problems of setting goals and guide-lines for incorporation in a safety policy statement.
Section II discusses the necessary characteristics of a safety goal, the issues in formulating safety goals, and some approaches to goal setting in a regulatory framework.
Sections III and IV set forth the general considerations entering into the formulation of safety goals and numerical guidelines.
In these two sections particularly, this paper draws a sharp distinction between the terms " goal (s)"
and " guideline (s)."
Goals should be understood to be qualitative statements interpreting the statutory standard for adequate protection from the risks of nuclear power reactors.
Guidelines should be understood to be numerical criteria for use by the NRC staff in conjunction with probabilistic risk assessments (PRAs).
The final section of this paper discusses the manner of implementation of the safety goals and guidelines and concludes with a series of recommendations.
An Appendix presents brief abstracts of other quantitative safety goal proposals.
II.
STATING A SAFETY POLICY A.
Basic Characteristics of a Safety Goal Any safety goal to be adopted by the Commission must be consistent with the Atomic Energy Act of 1954 and the Energy Reorganization Act of 1974, which created the NRC.
A goal of "zero risk", for example, would ensure safety at the cost of sacrificing other social objectives which motivated Congress's approach to nuclear power regulation.
Courts have made it clear that "zero risk" is not an appropriate standard for the NRC to apply.
At the same time, a safety goal which gave decisive weight to the interest of promoting nuclear power development, even at the cost of high risk to the public, would clearly be inconsistent with the nonpromotional posture established for the NRC by the Energy Reorganization Act.
Between these obvious extremes, however, the NRC has considerable discretion in adopting either qualitative or quantitative reactor safety objectives for use in regulation.
1 l
l i l
The formulation of a safety goal can be an important factor in affecting current regulatory practice.
Although the basic characteristics of a safety goal have been stated somewhat differently, they are similar in their essen-tials.* At the very least, a safety goal should be comprehensive, logical, practical, verifiable, and publicly acceptable (Refs. 8 and 9).
These basic characteristics represent five ideals for formulating a safety i
goal, and, given the complexity of this task, some are difficult, if not impossible, to achieve.
Nevertheless, we have striven to take account of these considerations in formulating the qualitative goals and numerical guidelines disussed in Sections III and IV.
In discussing these characteristics below, we indicate any disparity between the achievement of an ideal and the results of this effort.
Comprehensive - Safety goals should be responsive to a problem definition which addresses the significant risks of social concern, including prompt and delayed fatalities, injury, and cost and benefit factors and relates to other special issues, notably, safety-cost tradeoffs; applicability to plants operating, being built, or being planned; goals for future improve-ments; and potential regulatory use in the development of rules and in case decisions.
i The safety goals discussed here are, we believe, comprehensive within the l
proposed scope of this statement. We have limited it to considerations pertinent to accidents in operations in power generation at nuclear power plants which might lead to serious radiological consequences.
We have i
deliberately excluded from present consideration accidents in other stages in the nuclear power fuel cycle.
At another time, the NRC may choose to develop a statement of a safety goal for the other aspects of the nuclear fuel cycle.
Logical - There should be a sound chain of reasoning which supports the safety goals and numerical guidance which are proposed.
The proposals should be supported by adequate rationale.
Setting safety goals does not happen according to a clear-cut formula or procedures.
Nor do all efforts to formulate a safety goal share the same i
assumptions of principles or values, the same definitions of the problem or the best approach to it, or the same information or importance attached to it.
We have attempted to develop a positten responsive to the NRC's legislative and judicial mandate to provide " adequate protection" in regulating the development of nuclear power. To that end, each proposed i
l qualitative goal and numerical guideline is explained by the discussion which accompanies it.
i
- Quantitative safety goals proposed by other individuals and groups are described in the Appendix.
i 1 !
~_,
l i
Practical - Goals should be practical in a regulatory framework.
The basic qualitative goals should be formulated in terms intended to be durable, though associated numerical guidelines should probably not be regarded as permanent, but rather provisional, and applied on an experi-mental basis in order to gain experience in their application.
Goals should be implementable, and it would be desirable if they increased regulatory efficiency and effectiveness in the use of NRC's resources.
We propose to regard the numerical guidelines as prov'isional and to apply them on an experimental basis long enough to test their effectiveness.
Verifiable - Goals should be formulated so that it is possible to verify the relationship between the goals and the estimated level of performance of reactors.
The limitations of the methods for verification should be formulated, and the manner of their use in reactor regulation should be defined.
Uncertainties in verification techniquas are a factor in defining goals.
Verifying the relationship between a safety goal and the estimated level of performance of a reactor poses a dilemma:
confirm a relationship based on probability estimates of major accidents when those estimates cannot be confirmed by observation and when every effort aims to prevent a major accident.
For NRC's purposes, this dilemma provides the impetus for refining the methodology of probabilistic risk assessment.
In any case, verification is a difficult task.
Publicly Acceptable - The formulation and application of the goal should be sensitive to Congressional and public views.
Although the accept-ability of the safety goals is complicated by the heterogeneity of the public and the diverse values and perspectives of affected groups, the goals should reflect the views of many different sources.
One objective should be better communication with the Congress and the public on the risks as well as the benefits of nuclear power.
We propose that the Commission solicit public comment and take that comment into account in developing its final statement of a safety goal.
B.
Issues in Formulating a Safety Policy for Nuclear Power Reactor Accidents The value judgments underlying the safety goal should be explicit, as many participants in the second NRC Safety Goal Workshop urged. Accordingly, we have attempted to set down the key issues concerning social values and, in addressing these issues, to state the assumptions on which the remainder of this discussion paper is based.
In so doing, we recognize that the assumptions and even the definition of the issues themselves are likely to be controversial.
Nevertheless, we view this statement of social-value assumptions which underlie the remainder of this paper as a necessary step in formulating proposed goals.
1.
Scope of Concern:
Is there a special public sensitivity about nuclear reactor accidents which should be taken into account in setting safety standards?
Several of the panelists at the first NRC Safety Goal Workshop felt that standards for nuclear power plants should be much stricter than standards for other electricity generating technologies because of the greater uncertainty i
surrounding the level of nuclear accident risks.
Many commenters believed that the risks associated with nuclear power differ in important respects from those associated with other modes of generating electricity and other risk-related activities.
Efforts to treat all risks as comparable tend to overlook the specific character of nuclear risks and thereby neglect important differences.
Others at the NRC workshops argued that nuclear power is already safer than alternatives, but that standards should be the same for all hazardous techno-logies.
Public comments submitted by the industry take a similar position:
risks.from nuclear power and goals for nuclear power should be comparable to the risks and goals for other comparable activities, especially electric power generation.
While we recognize public concerns about reactor accidents, we do not believe that specific consideration of public perceptions would constitute a reliable basis for reactor regulation.
Thus, we believe that the primary basis in setting nuclear reactor accident safety goals and numerical guidelines should be the technical assessment of risks.
2.
Risk Avercion:
Is a single major nuclear reactor accident causing a number 01 casualties to be viewed as worse than a number of small accidents when the total number of casualties is the same?
At issue is whether society would be more averse to the occurrence of one large accident than to a number of smaller accidents having the same conse-quentes.
The term " risk aversion" is sometimes used to indicate the undesir-ability of accidents that take multiple lives.
However, in the sense used here, it means that an accident which takes ten lives, for example, is viewed as more than ten times worse than an accident which takes one life.
The ACRS discussion paper, in supporting this view, suggests a specific proposal for initial discussion, namely, that the estimate of early fatalities from a nuclear accident be incre.ased by raising that estimate to the 1.2 power (i.e.,
the so-called "a model") to account for societal risk aversion.
Both the theoretical concept of risk aversion and the formula in the ACRS paper for handling risk aversion were discussed at both NRC Safety Goal Workshops.
The participants at the NRC Safety Goal Workshops spent considerable time discussing the merits of risk aversion. Many were sympathetic to the concept of some allowance for risk aversion because of the social disruption which could result from a major nuclear accident.
Others opposed the use of this concept on the ethical and social grounds that the concept introduces an unjustified inequality in valuing lives.
They believed that implementing a concept of risk aversion in safety goals and standards would divert resources and attention to very small probabi.;ty potential accidents and away from contributors to total risk.
The AIF and other industry commenters were opposed to risk aversion as distorting allocation of risk management resources.
Critics favoring the risk aversion concept in principle viewed the a-model as simplistic and invalid, but they suggested no alternative formula.
Some commenters felt that a proper safety goal would consider risk aversion to such an extent that any risk of a large accident from nuclear plants would be prohibitive, with the result that the plant would not be built or operated.
One workshop panel chairman argued that much more research and analysis is needed to determine whether risk aversion could justifiably be incorporated into a safety policy.
f We believe that, even in cases which might justify the specific consideration i
of risk aversion (those in which the uncertainties about accidents with large consequences are great), there is insufficient information about it to support development of a specific quantitative formula.
For this reason, we do not at this time advocate distinguishing among such accidents by incorporating risk aversion in a quantitative way into our goals statement or by allocating proportionately greater attention or resources to those accidents which pose the risk of greater consequences from accidents of very low probability.
However, we re-emphasize the need to treat high-consequence accident potentials with special care. We note that containment, remote siting, and emergency planning requirements, which retain their importance in NRC's reguictory fabric, reflect NRC's continuing concern about potential accidents of low probability but high consequences.
3.
Industry Size:
Should the size of the light water reactor industry affect the development of reactor safety goals?
Some participants in the Safety Goal Workshops stressed the need to take into consideration industry scale in the course of development of safety objectives.
These workshop canelists argued that it might make a difference whether goals were being designed for an industry operating 70 reactors or one operating 500 reactors.
They identified three general categories of problems which would need to be addressed if there were a large increase in the number of reactors:
institutional constraints possibly stemming from a shortage of skilled personnel in nuclear technology and demands on the industrial and regulatory system; societal vulnerability arising from social reaction to accidents; and a possible relationship between the frequency of major reactor accidents and the size of the LWR industry (e.g., can desired standards of safety be maintained irrespective of whether the industry consists of one reactor or one thousand reactors?).
Neither the ACRS nor the Atomic Industrial Forum (AIF) addressed the problem i
of industry scale.
Clearly, with increasing national and regional dependence on electrical genera-tion by nuclear power, there is a legitimate concern that a single reactor accident (or even a "near miss" accident) or major new generic safety issue could lead to shutting down a substantial segment of a region's (or the nation's) electrical capacity.
Such a result could lead to major social and economic disruptions in the affected area which were not direct consequences of the accident.
We intend the proposed goals in this paper to apply to the immediately fore-seeable set of reactors, that is, thosa now operating, being built, or being planned. We think that if a risk-benefit approach is followed, then questions of industry scale become l u s important since most risks, resource costs, and l
benefits increase proportionately.
However, we also view the goals as dynamic, l
4, i
j with future review by the Commission permitting adjustments as the industry and its scale and technology change, and operational and regulatory experience accumulates.
l 4.
Prompt and Delayed Fatalities:
Should safety goals distinguish between prompt and delayed fatalities?
The issue here is whether prompt fatalities should be considerei differently from delayed fatalities which may not manifest themselves for many years.
On the one hand, some believe that public perceptions of risk suggest a substantially greater emphasis 09 prompt than on delayed deaths and that goal-setting should 1
reflect greater concern for averting prompt fatalities because of the greater loss of life expectancy.
Such a belief would lead to a significantly greater allocation of society's resources to averting prompt fatalities than to averting delayed deaths.
For instance, the ACRS discussion paper proposes that lives ending as prompt fatalities be valued at five times those ending as delayed fatalities.
On the other hand, others raise ethical and social objections analogous to objections raised to the concept of risk aversion to a value judgment that treats prompt and delayed deaths differently (i.e., " discounting" future loss of life).
From a practical perspective, the AIF, while granting that a factor of two or three could be applied to reflect the different life-shortening I
impacts of prompt and delayed fatalities, views the difference as being of small significance in view of the much larger uncertainties in the probabilistic risk estimates.
The AIF proposes to ignore the difference in the interest of simplicity.
We believe there is merit in placing special emphasis on averting prompt rather than delayed fatalities.
Distinguishing between risks of nrompt fata-lities and delayed fatalities is a distinction worth making.
However, it is difficult to justify any particular quantitative formula for weightirig the difference.
The problem of relative weights does not arise if numerical j
guidelines for prompt fatalities and delayeo fatalities are stated separately, as proposed in this paper, so prompt fatalities are compared with prompt, and delayed with delayed.
5.
Equity / Compensation: What should be the role of equity of distribution of risks and benefits in safety goal formulation?
Some Workshop participants, noting that those who bear the risks from a techno-logy may not share proportionately in its benefits, felt it was desirable to com7ensate those on whom risks are unevenly imposed.
They distinguished two kinds of potential inequities:
those resulting from geographical differences and potential intergenerational effects.
The first kind of inequity is illustrated by the example of siting a reactor in a sparsely populated region in order to reduce the risk to a more populous region.
Both regions receive the benefits of the electricity generated.
Several panel members felt that under these circumstances those living near the site deserved compensation for i
the incremental risk.
Also, there are potential inequities caused by transfer of risks to future generations through genetic effects or long-term land contamination. 4
f While we do not disagree with these claims, we believe that it is not possible to devise a system of regulation whereby the distribution of risks and benefits would always be equitable to each individual.
However, we note that France and Japan employ a rate differential system to compensate nearby residents for the proximity of a nuclear power plant.* In any case, we think that, if the risks are small enough, there should be a correspondingly reduced need to use a compensation principle in order to balance risks and benefits to individuals.
We recognize that there is the potential for intergenerational transfer of risks through genetic effects or as a result of long-term contamination.
The ethical issue involved was the subject of some discussion at the first NRC Safety Goal Workshop, but the participants did not come to any clear consensus on how intergenerational transfer of risks should be considered in development of a safety goal. We recognize the public concern regarding this issue.
Though we cannot suggest a good way to handle the issue in a safety goal context, we believe that here too keeping the risks of accidental radioactive release low should reduce the basis for concern.
III.
SAFETY G0ALS A.
General Considerations In one sense, the principles of adequate protection of public health and safety and of no undue risk embodied in the Atomic Energy Act can be seen as de facto qualitative goals fnr power plant safety.
Accordingly, the NRC's statement of its safety policy might consist of little more than a statement suitable for articulating these principles, as, for example, the following:
The NRC's safety objective is to ensure adequate protection of public health and safety through prevention of a nuclear reactor accident which would result in the release of a sufficient amount of radioactive material to pose a significant risk to people and their i
societal and physical environment.
Such a statement would not, however, represent an operationally very useful fulfillment of the NRC's announced intention to make an explicit statement of safety policy.
Other, perhaps more specific, qualitative goals are likely to be of greater benefit in communicating to the public, the industry, and the NRC staff what the Commission's safety policy in regulating power plants is.
l-These goals would not reduce to zero the risks posed by nuclear power plants l
to public health and safety.
Instead, they could help ensure that incremental
^In France, enterprises and' residents near a nuclear plant receive the benefit of reduced electric rates.
Japan has a compensation system involving direct subsidies (to local governments and to fishermen) as well as reduced electric l
rates.
However, we understand that these compensation schemes are based on considerations of economic equity, without direct reference to health-and-safety risks.
A similar compensation result is incidentally accomplished in those U.S. jurisdictions (e.g., in New Jersey and Connecticut) in which utilities are subject to local taxation with the tax-income benefit accruing to the localities.
i I
)
i j
individual risks were small in comparison to other normal accident risks.
j Of course, not all other forms of risk commonly encountered are necessarily acceptable,.but some risk comparisons are relevant to setting goals for reactor 4
safety. We propose that societal risks be as low as reasonably achievable and comparable to those of other electricity generating technologies.
This is not i
to say that risk should be the only factor.
Rather, increased risks should be j
weighed against the benefits of nuclear power generation.
As the ACRS proposal I
states, " Acceptable risk is most properly addressed in the context of alterna-tives, including the option of not building a facility to supply a particular societal need or want" (Ref. 5).
In considering any qualitative goal, we should pose two tests in addition to the five desirable characteristics of a safety goal discussed earlier:
I Does the proposed qualitative safety goal have the potential for improving the effectiveness of the regulatory process?
Does it communicate more clearly to the public and the Congress the Commission's safety objective in reactor regulation?
It is not clear to us whether any of the proposed qualitative goal statements by themselves can provide affirmative answers to these two questions.
More generally, standing alone without numerical guidance, qualitative goals may not answer satisfactorily the question posed by some:
Specifically, what is the level of reactor safety which the Commission is actually trying to achieve?
Nevertheless, quantitative guidelines stipulate only measures of plant and reactor performance regarded as safe, but do not establish on what principle j
the level of safety is considered adequate.
Thus, qualitative goals and quantitative guidance have complementary functions:
qualitative goals are indispensable to a statement of safety policy and should be stated explicitly.
B.
Statement and Rationale First Qualitative Safety Goal i
Individual members of the public should be provided a level of pro-tection from the consequences of nuclear power plant accidents such that no individual bears a significant additional risk to life imd health.
l Because persons are inevitably exposed to various risks of accidents in the i
course of everyday life, each individual has an annual probability of dying as the result of an accident.
An individual's risk of accident fatality varies with the person's age, occupation, habits, leisure activities, and many other factors.
This safety goal proposes that the risk of a nuclear accident not be a significant contributor to a person's risk of accidental death or injury.
The incremental risk should be sufficiently low that individuals should be able to go about their daily lives without special concern because of their proximity in residence or work to a nuclear power plant.
l
Second Qualitative Goal Societal risks to life and health from nuclear power plant accidents should be as low as reasonably achievable and should be comparable to or less than the risks of generating electricity by viable competing technologies.
We propose that a limit be placed on the societal risks posed by reactor accidents.
The proposed goal has two elements.
First, we believe that the residual risks should be compared to those from other means of generating the same quantity of electricity.
The comparative part of this goal implies that the risks from nuclear power plant accidents should be low enough that the total risks associated with a nuclear power plant are comparable to or less than the total risks of plants using competing means of generating electricity.
We see coal as ordinarily the only important viable competing technology at this time.
In most situations, hydro generation is not a viable alternative means of central-station generation because there are not enough hydro sites in most sections of the country.
We believe that natural gas or oil-fired generation is not a viable alternative because of the uncertain long-term supply and high cost.
There may be other means of generating the same quantity of electricity with advanced technologies (e.g., solar), but we do not believe that these technologies can be considered viable alternatives today.
Second, the risks should be reduced to the extent practicable on the basis of reactor safety technology.
(This principle is already applied to the normal operation of nuclear power plants.) The application of a benefit-cost test on safety improvements which would reduce societal risks is implicit in this goal.
Other qualitative goal statements have also been considered.
Some Workshop participants suggested the following alternative qualitative safety goals:
A significant likelihood of a catastrophic nuclear accident during the foreseeable future (i.e., lifetime of reactors existing, under construction and proposed) is intolerable.
A significant likelihood of a core melt during the same period with radioactive releases resulting in either offsite land contamination requiring decontamination, or several somatic or genetic health effects is intolerable.
These goals suggest that a significant likelihood of a core melt accident any time during the lifetime of the light-water-reactor industry is unacceptable.
These goals would be justified by a view that a core-melt accident could have such vast consequences (" ripple effects") that the industry and the country would be severely damaged, with massive indirect costs as a result.
)
One reason for the ditference between these two sets of safety goals is a difference of perspective (and of underlying values).
The proposed qualitative goals focus on annual individual and societal health risks and do so on an annualized, plant-by plant basis.
The alternative qualitative goals focus on the probabilities of the occurrer.ce of events with major consequences on an industry-wide basis.
Clearly, the choice of plant year versus industry-lifetime perspective is important to the statement of safety goals, with substantial implications for the quantitative guidance based on tl.em.
The Workshop dis-cussion indicated that qualitative goal statements are usually interpreted with regard to their associated numerical guidelines.
To many, different quantitative expressions, though mathematically equivalent, may create different impressions and lead to different interpretations of the same qualitative safety goals or quantitative guidelines.
Thus, for instance, a likelihood of a core-melt of 10 4 per reactor year of operation (i.e.,1 in 10,000 chances per plant per year), which may be arguably small, appears significant when it is computed for a 200-reactor industry over the 30 year operating life cycle.
In that case, if one assumed that all reactors just met the guideline, there would be a roughly 45 percent statistical chance of at least one major accident involving a large-scale core melt at some time during the next 30 years.
How-ever, it is more likely that typical reactors taken together would have a far lower statistical chance of having a large-scale core melt in the next 30 years because many reactors would perform better than a probability guideline of 10 4 per reactor year of operation.
Also, only a small fraction of such core-melt accidents would have major offsite consequences.
Another alternative safety goal which would go even further to protect indivi-duals and society from the consequences of a core-melt accident is the following:
Not one accident involving substantial uncontrolled radioisotope release to the environment should occur within the operating life of currently foreseeable power reactors.
Such a qualitative safety goal would reflect the special concern that focuses on a nuclear plant's potential for accidents of very low probability but very severe consequences.
The usefulness of such a safety goal is doubtful.
In practice, this goal may bc viewed as implying a zero-risk standard (at least during the foreseeable life of the nuclear power industry), which the present statute does not require.
Moreover, it would not appear useful in an operational way to the NRC staff.
If adopted and not used by the regulatory staff, it may be perceived by the public as " window dressing" and thus undermine public confidence in NRC's regulatory actions.
We have not yet seen statements of alternative qualitative safety goals which we should recommend for Commission adoption.
However, it is quite possible that public comment and review of the Commission's draft proposed safety policy statement--which we recommend--may lead to alternative statements of qualitative safety goals which would be more useful in ensuring adequate protection of the public health and safety than those proposed here.
IV.
NUMERICAL GUIDELINES A.
General Considerations A key element in formulating goals or guidance which contain numerical safety objectives is to understand both the strengths and limitation of the techniques by which one judges whether these objectives have been met.
The extent to which present methods are capable of verifying that safety objectives are met thus becomes an issue in the process of deciding whether available data and methods permit establishing quantified safety goals.* At the heart of the issue is a question about the reliability of probabilistic risk assessment as a basis for confidence that safety goals have been met.
The numer: cal guide-lines proposed in this paper rely on probabilistic risk assessment to indicate whether they are met.
Hence, it is appropriate to review briefly the development of probabilistic analysis as a means of quantifying risks from reactor accidents.
A major step forward in the development and refinement of accident risk quanti-fication was taken by the Reactor Safety Study during the period 1972-1974.
The objective of the Study was "to try to reach some meaningful conclusions aboue the risk of nuclear accidents." The study did not address the question of what level of risk from nuclear accidents was acceptable.
Despite its substantial methodological advances in the state of the art of quantifying the probabilities and consequences of reactor accidents, the final report of the study (WASH-1400) and particularly its Executive Summary were subject to strong criticism.
The summary findings and conclusions did not properly emphasize the data gaps and uncertainties in underlying assumptions as well as the subjective manner of accounting for human errors.
In July 1977, the NRC chartered a Risk Assessment Review Group to provide advice and information to the Commission on the final report of the Reactor Safety Study, WASH-1400.
In January, 1979, after consideration of the Review Group's report (NUREG/CR-0400), the Commission issued a policy statement on risk assessment disavowing the Executive Summary.
With respect to reactor accident probabilities, the Commission accepted the Review Group's conclusion that absolute values of the risks presented by WASH-1400 should not be used uncritically either in the regulatory process or for public policy purposes.
Nonetheless, taking due account of the reservations expressed in the Review Group Report, the Commission supported the extended use of probabilistic risk assessment in regulatory decisionmaking where warranted by the quality of the data base.
With encouragement from the Commission to extend the use of probabilistic risk l
assessment methods, the NRC staff has continued to develop and refine the technique and its application.
Progress has been made in recent years.
As an example, electrical and other reactor safety system component failure rates are tabulated by component and operating environment properties.
Efforts are l
now under way to improve the capability of quantifying the effects of operator I
errors on plant safety performance.
Estimates of the radioactivity released in the event of a major reactor accident are being reviewed for possible revision and refinement on the basis of new experimental and analytical work.
- In the Appendix, we describe a number of safety goal proposals which urge a l
quantitative formulation of safety goals and suggest specific numerical values for key safety parameters.
All of these proposals depend on the use of probabilistic risk assessment.
i Despite the progress in applying probabilistic risk assessment to many reactor safety problems as well as in improving the methodology and acquiring greater understanding of its value and limitations, overall risk estimates remain and will undoubtedly continue to remain subject to significant uncertainty.
Over-all risk as the " bottom line" in evaluating the adequacy of protection of the public health and safety depends on many safety analysis decisions that will continue to involve substantial elements of engineering judgment which are now necessarily based on a less well-developed foundation than one might wish.
Accordingly, NRC has a substantial research program to refine the probabilistic risk methods and a major analytical program to evaluate the rapidly accumulating operating experience and to feed back the lessons learned from this experience into the reactor operating and design groups.
Primary research areas include the phenomenology of core melt and containment behavior, fission product transport, modeling of emergency protective actions, analysis of the effects of operatcr error on plant safety performance, and evaluation of the reliability of reactor components and systems.
In summary, we believe that progress in the development of probabilistic risk assessment and the accumulation of the relevant data base are sufficient to make it feasible to use quantitative reactor safety guidelines for limited purposes.
However, because of the sizable uncertainities still present in the methodology and the gaps in the data base--essential elements needed to gauge whether the objectives have been achieved--the quantitative objectives should be viewed as aiming points or numerical benchmarks which are subject to uncertainties in interpretation, which may perhaps be reduced as further improvements are made in the state of the art of probabilistic risk assessment.
In particular, because of the present limitations, we urge that numerical safety objectives serve as guidelines to provide a safety perspective only, and not as a substitute for existing regulations.
Application of the present deterministic regulatory requirements should be continued, at least until the residual uncertainties in estimates of overall risks of reactor accidents can be greatly reduced.
Of the three policy options discussed in the preceding section, we believe that the most useful one for guiding regulatory actions relevant to nuclear power plant safety is adoption of qualitative goals along with some numerical guidelines for use in conjunction with the proposed qualitative goals. We use the term " guidelines" instead of " goals" to indicate provisional status.
There are three reasons for this provisional status:
The present capability of verifying by probabilistic risk assessment whether the proposed numerical risk values have been met in any particular instance is seriously limited.
The specification of quantitative goals would define the level of risk considered acceptable--which is really a socio political decision that should not be made without broad public input.
These limits can be expected to change with experience with them, with changes in perception of risks and competing values, and with experience with other technologies.
=
The provisional numerical guidelines presented in this section are stated as limits on increased individual and societal mortality risks as a consequence of nuclear reactor accidents in relation to other risks of prompt and delayed fatalities faced by the public.
Our proposal is that these guidelines would be tested in a regulatory framework for enough time to permit evaluation of their effectiveness in reactor safety j
regulation.
These guidelines would be subject to revision at the end of that period on the basis of the experience and degree of success in application.
During this period, we expect that additional refinements would be made in probabilistic risk assessment methods.
Our views on implementation of safety goals are discussed more extensively in a following section.
B.
Statement and Rationale l
1.
Individual and Societal Mortality Risks Prompt Mortality Risk The risk to an individual or to the population in the vicinity of a nuclear power plant site of prompt fatalities that might result from i
reactor accidents should not exceed one-tenth of one percent (0.1%) of l
the sum of prompt fatality risks resulting from other accidents to which members of the U.S. population are generally exposed.
l Delayed Mortality Risk The risk to an individual or to the population in the area near a nuclear power plant site of cancer fatalities that might result from reactor accidents should not exceed one-tenth of one percent (0.1%) of the sum of cancer fatality risks resulting from all other causes.
j We propose the 0.1% ratio of the risks of nuclear plant accidents to risks of accidents of non-nuclear plant origin in the belief that it reflects a reasor l
able interpretation of the first qualitative goal, which would provide that no individual bear a significant additional risk.
The 0.1% figure, taken together l
with the other guidelines, is also consistent with the second qualitative i
safety goal, which seeks to keep risks as low as reasonably achievable.
It is j
also consistent with the comparative provision of the second qualitative safety goal since calculations suggest that the nuclear plant risks meeting i
the proposed guidelines would compare favorably with risks of viable competing technologies.
(It should be noted that the choice of nuclear versus non-nuclear electric power generation at a central generating plant today almost invariably means nuclear versus coal.)
The prompt mortality risk guideline is intended to define provisionally the individual and societal mortality risk which should not constitute a significant I
additional risk beyond that to which individuals or the population near a nuclear power plant are generally already exposed.
This guideline would limit the prompt mortality risk of accidental death as a result of a nuclear accident.
t I.
1 The 0.1 percent ratio to other accident risks is low enough to support an i
expectation that people living or working near nuclear power plants would have no special concern due to the plant's proximity.
The individual risk is taken as the estimated probability of fatality from a nuclear power plant accident for an individual in the vicinity of the plant, including prompt deaths and delayed deaths.
The individual risk limit is applied to the biologically average individual (in terms of age and other i
risk f..: tors) who resides at a location within 1 mile from the plant site 1
boundary.
The individual mortality risk of prompt fatality in the United States is about l
5x10 4 per year for all accidental causes of death (Ref.13).
Thus, on the average, approximately 5 persons out of 10,000 die annually as a result of accidents in the United States. The pro,mt mortality risk guideline would limit the increase in an individual's annual risk of accidental death (5 in 10,000) by an increment of no more than 5 in 10,000,000 per year.*
i Estimates of prompt fatalities due to a major reactor accident indicate that l
]
individuals most at risk live or work within a few miles of a reactor. We j
propose to define the vicinity as the area within one mile of the nuclear power l
plant site boundary since calculations of the consequences of major reactor accidents suggest that individuals in the population within a mile of the 2
plant site would be subject to the greatest estimated risk of prompt death attributable to radiological causes.
Beyond this distance, atmospheric dis-persion of the airborne radioactive materials sharply reduces the radiation exposure levels and the corresponding risk of prompt fatality.**
Population data for 111 reactor sites in 1979 are reported in Reference 14.
i The population within 1 mile of a site *** ranges from 0 to approximately
- The additional prompt mortality risk from a nuclear power reactor acciden_t is far below the risk of death from nonnuclear accidents.
For example, each year about 3 out of every 100,000 persons in the United States die as a result of fires or burns, widely dreaded causes of death.
The proposed numerical guide-lines would limit the risk of a prompt fatality from a nuclear power reactor accident to less than one-sixtieth of this risk for those within 1 mile of a reactor site.
- 0ne set of calculations (Ref. 20, at p.1-38) indicates that, in the absence of protective measures, the conditional probability of exceeding a 200-rem whole-body dose given a core-melt accident would be reduced from the pro-babilities at 1 mile from the reactor by a factor of 1.5 at 5 miles, 3 at 10 miles, and 100 at 14 miles; and that 3000-rem lung-dose probabilities would be reduced by a factor of 4 at 5 miles and 15 at 7 miles.
- The population data cited are for circular areas of 1-mile radius from the reactor.
Demographic statistics are not available for the somewhat larger, irregularly shaped areas extending to 1 mile from the boundaries of the sites' exclusion areas.
For the still larger circular areas extending to 2 miles from the reactor the population ranges from 0 to slightly over 9,000; the mean population is 1089, the median 280.
Ninety percent of the sites have fewer than 3,900 inhabitants within 2 miles from the reactor.
i 1,400 persons.
The average (mean) for all sites is 168.
Ninety percent of all sites have populations less than 560 persons; half the sites (median) have less than 41 persons within a mile of the plant; some have no persons within that distance.
Thus, for an average site (i.e., one with a population of 168 within a mile),
there would be, on the average, one-tenth of a fatality per year due to all accidental causes (i.e., motor vehicles, falls, drownings,. etc.) for the general population within 1 mile.* According to the proposed numerical guideline, the increased risk due to major reactor accidents should not exceed 0.0001 of an estimated fatality per year for this average site.
For a more densely populated location, one with a population of about 500 persons within 1 ndle of the site (a population exceeded by less than a dozen nuclear power plant sites), the estimated prompt fatalities in the event of a major reactor accident would increase by 0.0003 per year.
(The increase would be 0.002 per year for a 2-mile circle.)
The delayed mortality risk guideline for individual or societal risk would limit the increased risk of a delayed fatality as a result of a reactor accident to one-tenth of one percent (1 in 1,000) of the cancer risk not related to nuclear power to which these individuals in society are already exposed.
On the average, roughly 19 persons per 10,000 population die annually in the United States as a result of cancer (Ref. 15).
The risk of developing a fatal cancer is subject to large variation depending on geographic and demographic factors.
The variations among states range from an annual rate of about 7 deaths per 10,000 population in Alaska, to roughly 16 in Virginia, to about 25 deaths in Rhode Island.
The variation in annual rate of cancer death is even greater when age is taken into account, from 3 deaths per 10,000 in the 25-to-44 year age group to 133 in the over-75 year age group.
(The long latency period for many cancers, up to 30 yedes in some cases, is a factor in increased mortality at older ages. ) The delayed mortality risk guideline would limit the increase in an individual's annual risk of a cancer death (19 in 10,000) by an increment of no more than 19 in 10,000,000 per year.
- Normally, in the event of a release of radioactivity, the degree of an individual's exposure to the risk of cancer (or more prompt serious radiation illness) varies according to his or her location (distance and direction from a plant) with respect to the meteorological pattern prevailing at the time of the accident.
The individual risk of developing a latent cancer decreases sub-stantially as distance from the plant increases.
At 10 or more miles, an individual's risks are very small, especially if there is sufficient warning time to take emergency protective action, such as sheltering or evacuation, in l
order to minimize exposure.
I i
As stated earlier in this section, the individual limit for delayed cancers is to be applied to a person residing within 1 mile from the plant boundary.
l
- Accident statistics show that the average annual accident rate for farm l
residents is about 66 per 100,000; the national averaje accident rate is i
48 per 100,000.
Thus, using the national average accident rate as a reference should be conservative since the population in the vicinity of power reactors is probably more characteristic of farming populations.
f 4 b
. _ _ _ _ _ _. _ _ =.
. ~
In applying the numerical guideline for delayed cancers as a population guide-line, we propose that the population considered subject to significant risk be i
taken as the population within 50 miles of the plant site.
We choose a 50-mile distance because a substantial fraction of the exposures of the population to 4
radiation would be concentrated within this distance.
The NRC already uses a 50-mile cutoff distance in implementing the ALARA principle for routine reactor releases.
By limiting to 0.1 percent the risk to the population living within 50 miles of a nuclear power plant site, this guideline would provide that the potential increase in delayed fatalities from all reactors at a site would be no more than a small fraction of the normal variation in the expected cancer deaths from other (non-nuclear) causes.
Moreover, the limit protecting individuals provides even greater protection to the population as a whole.
That is, if the guideline is met for individuals in the immediate vicinity of the plant site, persons much further away would generally have a risk much lower than the limit set by the guideline.
Thus, compliance with the guideline applied to individuals close to the plant would generally mean that the aggregated societal risk for a 50-mile-radius area would be a nut.ber of times lower than the societal guideline alone would permit.
is The 1979 population withi'n 50 miles of a plant ranges from 7,700 to 17.5 million (Ref. 14).
The average (mean) is 1.7 million.
Ninety percent of the
{
plant sites have populations less than 4.1 million within 50 miles; half the j
sites (median) have populations less than 950,000 within 50 miles.
From the mean population figure of 1.7 million, the average number of cancer fatalities per year from non-nuclear causes is predicted to be approximately 3.200.
For the average plant, the numerical guidelines permitting a 0.1 percent increase in delayed fatalities would allow no more than an additional 3.2 estimated fatalities.
Thus, this guideline value is small with respect to the average number of predicted cancer fatalities per year for a population of 1.7 million.
It is also small with respect to the geographic variation in cancer death rates. When applied to the mean population within a 50-mile radius of a power plant site, the annual cancer rate for Rhode Island (2.5 per 1000) would correspond to 4,300 cancer deaths per year, and the annual cancer rate for Virginia (1.6 per 1000) would correspond to 2,700 cancer deaths.
Thus, the average number of 3.2 additional estimated deaths is small in comparison to a regional variation of 1,600 (i.e., 4,300 - 2,700) cancer deaths.
(We draw attention again to our previous observation that operation of the guideline for individual risk would normally be controlling, which would necessarily limit the aggregated societal risk to a fraction of the delayed deaths estimated by using the societal guideline alone.)
Our intention is that the individual and societal mortality risk guidelines be applied on a per-site basis.
Therefore, the maximum permitted risk to an individual or to the population in the vicinity of a site having more than one nuclear power reactor would be no more than the maximum permitted risk from a single reactor site.
Therefore it can be expected that tighter requirements will be imposed on plants at multi-unit sites than at single-unit sites.
Where the guidelines are used for assessing existing or proposed generic l
regulatory requirements, we believe that the national health and accident i
statistics should be used as the comparison basis.
In plant-specific appli-I cations, state or regional health and accident statistics may be appropriate.
l -..
2.
Benefit-Cost Guideline i
We propose a benefit-cost guideline for use in arriving at decisions on safety improvements that, in accordance with the ALARA principle, are intended to reduce societal risks below the levels specified in the first and second numerical guidelines:
The benefit of an incremental reduction of risk below the numerical guidelines for societal mortality risks should be compared with the associated costs on the basis of $1,000 per man-rem averted.*
This guideline.is intended to encourage efficient allocation of resources by providing that the reduction in public risk should be commensurate with the costs of proposed safety improvements.
To take into account the fact that a safety improvement would reduce the public risk during the entire remaining lifetime of a nuclear power plant, both the benefit (risk reduction) and the estimated cost of the improvement should be compared on an annualized data basis over the years during which the plant is expected to operate.
The ALARA principle in conjunction with this guideline may be used as a factor in making backfit decisions on plants under construction and in operation.
Safety improvements may reduce risks either by reducing the probability of an accident or by mitigating its consequences should it occur.
The risk reduction, stated as man-rems averted per year, would be calculated by finding the dif-i ference between the product of the annual probability of occurrence of the accident and the resulting consequences of population exposure, and the same product for the case in which the proposed safety improvement has been made.
For a given proposed safety improvement, the man rems averted per year would l
be a constant.
In contrast, the cost of a specific proposed safety improvement annualized over the lifetime of a plant would be less for a new plant than for an older plant.
rcr 'his reason, the net effect of applying the benefit-cost guideline on an annua 3ized basis is to justify a greater expenditure of resources to improve the safety of newer plants.
l l
The benefit of an incremental reduction of risk below the numerical guidelines for societal mortality risks should be calculated for the population reasonably expected to be within 50 miles of the nuclear power plant site.
The associated costs should include all reasonably quantifiable costs (e.g., design and l
construction of plant modifications, incremental cost of replacement power during mandated or extended outages, changes in operating procedures and manpower requirements).
The NRC staff has some experience in applying benefit-cost analysis and criteria to the evaluation of reactor effluent treatment systems which would reduce radiation exposure of the off-site populations to routine radioactive releases.
- The NRC has not used this criterion extensively, although it was first published in 1975.
However, some value should be used.
Comment is pacticularly requested on the value and the basis for selecting a specific value.
- - -. - ~
i j.
Since adoption of Appendix I to 10 CFR Part 50 in 1975, a value of $1,000/ man-rem reduction has been in the interature for use in the evaluation of improvements I
in effluent control to reduce population exposures within 50 miles of a plant.
However, the use of a benefit-cost guideline in reactor accident safety would 1
j be new. Moreover, the guidelines of Appendix 1 to 10 CFR Part 50 are applied to the reduction of the more or less continuous off-site low-level radiation i
exposure, whereas the guideline proposed here is intended to reduce off-site j
exposure to the occurrence of a highly unlikely but large consequence radio-l logical hazard.
The proposed guideline of $1,000 per man-rem would be equivalent to $10,000,000 j
per life saved, on the assumption that a 10,000 man-rem exposure results in one (statistical) fatality.
This figure overstates the cost because, as calculations of accident consequences indicate, perhaps over half the delayed fatalities could occur outside the 50-mile radius (boundary of affected population) which we have assumed.
If the exposed population outside the i
50-mile zone is included, the proposed guideline would typically be equivalent 1
to a little less than $5,000,000 per life saved.
This value is higher than j
values calculated for actual and proposed life-saving activities in other (nonnuclear) regulatory contexts (e.g., highway and automobile safety, air pollution, carcinogens in drinking water), where the estimated costs per life saved were found to range from zero to as much as a few hundred million dollars, with most of the values below $200,000 per life saved (Ref. 16.) Studies of the costs of safety protective measures in nuclear power plants show a similar 4
i wide range in the net cost per life saved (Ref.17.)
P i
3.
Plant Performance Guideline Reactor Accident Prevention:
Large-Scale Core-Melt Guideline i
The likelihood of a nuclear reactor accident that results in a large-scale core melt should normally be less than one in 10,000 per year of reactor operation.
I An important aspect of the public risk associated with nuclear reactor operation is the chance of serious core damage since a major release of radio-activity may result from accidents involving core damage.
Because of the substantial uncertainties inherent in probabilistic risk assessments for potential reactor accidents, especially in evaluation of accident consequences, we propose a provisional guideline as an interim limitation on core-melt probabilities for NRC staff use in the course of its review of probabilistic l
risk assessment studies.
But this guideline is not intended to serve as a regulatory requirement which must be met for plant operation.
i I
Tho limitation on core-melt probability may need to be revised in the light of new knowledge and understanding of core performance under degraded cooling conditions.
Although there are a number of intermediate degraded core state conditions short of large-scale fuel melt, probabilistic risk assessment methods today cannot make a meaningful distinction among intermediate core l
failure states.
A great deal of relevant research work funded by NRC is now under way, and the Commission has in process a major policy development effort in which degraded core performance is addressed.*
The ACRS has proposed as a quantitative safety goal the mean probability of significant core damage shou'1d be less than 1 in 100 over a light-water reactor's lifetime.
The ACRS defines significant core damage as damage resulting in the release of over 10 percent of the noble gas inventory into the primary coolant system.
The ACRS proposal states that the safety goal level corresponding to this limit on occurrence rate should be less than 3 in 10,000 per reactor year.
j The ACRS further proposes that the mean probability of large-scale fuel melt should be less than 1 in 10,000 per reactor year as a goal and less than 5 in J
10,000 as an upper limit.
The ACRS defines large-scale fuel melt to occur when over 30 percent of the oxide fuel becomes molten.
The subject of reactor accidents involving core damage was discussed generally at the first NRC workshop on safety goals.
However, the focus of the discus-sion was more on using accident probability goals in industry and NRC regulatory staff work rather than on establishing the specific limits on accident probabi-lities.
The goals for substantial release, fuel melt, and significant core damage are related.
Not all core-damage accidents will proceed to large scale fuel melt, and, of those that do, only a fraction would be accompanied by failure of the containment to prevent substantial radioactive release offsite.
This secondary numerical guideline is intended to be interpreted with some flexibility, to cover those cases where a somewhat higher probability of core melt might be considered acceptable because of other compensating factors, such as low power level, remote siting, or improved features to mitigate the consequences of a core-melt accident (e.g., an improved containment).
Any safety goal which depends on estimates of the probabilities of major reactor accidents is subject to substantial inherent uncertainties in its application.** There has only been one instance of a reactor accident resulting t
l
^This effort, previously referred to as the Severe Core Damage Rulemaking, but now included in a broader research and policy-development effort encompas-sing severe accident rulemaking and related matters, may lead to revision of NRC's rules or conceivably new rules or policies which govern NRC's approach to hydrogen evolution and control, or equipment design to prevent or mitigate con-sequences in the event of a serious accident resulting in core degradation.
- 0ne recent NRC study (reported in NUREG-0715) which has reviewed the results of a number of risk assessments performed by industry (Ref. 19) cites analyses of severe core damage probabilities, estimates of which range from 2 in 10,000 to 1 in 100,000 per reactor year.
These are plant specific estimates for light-water reactors which include seven pressurized-water reactors and one boiling water reactor.
As the report stresses, these estimates are subject to considerable uncertainty.
Considerable further work in core melt probability assessment is in progress as part of the Interim Reliability Evalua-tion Program (IREP), under sponsorship of the NRC Office of Nuclear Regulatory Research.
in serious core damage in a commercial light-water power reactor in United States to date (i.e., TMI-2).
Consequently, reactor core-damage probabilities cannot be based upon empirical, statistical evidence; ror, indeed, would major reactor accident frequencies high enough to permit statistical verification be tolerable.
I As a result, the proposed numerical guideline on a large-scale core melt must be viewed as subordinate to the primary guidelines limiting individual and societal risks.
The history of reactor accidents and of low probability accidents in other advanced technologies has shown that accidents may result from failure sequences not analyzed in advance.
Indeed, a major purpose of NRC's ongoing light-water reactor research program is to increase our under-i i
standing of reactor systems and their behavior in accidents which may lead to core damage.
Research program results may add confidence in parts of the analyses involved in making estimates of core-damage probabilities, which would nevertheless retain a large measure of residual uncertainty.
We also recognize the importance of mitigating the consequences of a core-melt accident, and we advocate continuing emphasis on containment, remote siting, and emergency planning as integral parts of the defense-in-depth concept.
[
V.
IMPLEMENTATION OF G0ALS AND GUIDELINES:
RECOMMENDATIONS In deciding whether to adopt the proposed safety goals and numercial guidelines, it is important to consider how they would be used in nuclear power plant regulation.
The following discussion conccrns the manner of application of the proposed goals and guidelines, and presents recommendations on implementation.
1 A.
Acceptability of Nuclear Reactor Accident Risks Potential reactor accidents constitute an additional risk to the public health and safety, to be weighed against the net social benefits derived from nuclear power.
The Commission's statement of its safety philosophy, especially of the safety goals and numerical guidelines, would make explicit its determination of what is meant by adequate protection as required under the Atomic Energy Act.
It would establish the increment in individual and societal mortality risk attributable to nuclear power reactor accidents which the Commission i
believes would be reasonable when compared to risks to society posed by day-to-day living and by comparable technologies.
It would also place on the record the Commission's opinion about how safe is safe enough.
The Cnmmission's Special Inquiry Group on the accident at Three Mile Island commented that "the ultimate judgment of how safe is safe enough is a judgment for the Executive and Congress.
The Commission should probably undertake in the first instance to articulate a proposed standard for their consideration and for public discussion, so that the value judgment about how much risk is acceptable from commercial nuclear pawer plants can be thoroughly and publicly aired." Discussion in the Congress earlier this year also revealed that some members were convinced of the necessity for broad public comment and debate on a draft proposed safety goal statement before adoption by the Commission.
The Commission shares these views.
Its June 23, 1981, "FY 1983-87 Policy, Planning, and Program Guidance" (p. 3) makes the folicwing commitment:
"The NRC will j.
seek to define as clearly as possible the level of protection of the public health and safety that it believes is adequate based on' statutes, public and Congressional comment, and NRC's subjective and quantitative evaluations."
Recommendation:
Because the proposed safety goals and associated numerical guidelines would state the Commission's position on the acceptability of nuclear reactor accident risks, the Commission should issue the safety policy statement in draft form for public review and comment.
B.
Relationship of Safety Goals and Numerical Guidelines to Current Regulations The proposed policy statement which sets forth the safety goals and numerical guidelines is not intended to displace or deemphasize the defense-in-depth approach and other key elements embodied in current regulation of reactor safety.
Rather, it is intended to help make the regulatory process more cohesive and to provide a more systematic policy basis as an aid for making engineering and regulatory judgments on specific reactor safety issues.
The nature and extent of the consideration given to the numerical guidelines in individual regulatory decisions would depend on the nature of the issue, the quality of the data base, and the reach and limits of analyses involved in the pertinent probabilistic calculations.
The proposed numerical guidelines are intended to aid professional judgment, not to substitute a mathematical formula for it.
They could offer guidance within a stated framework of application; they would not have the force of a rule.
They would be considered as one factor among others in safety-related rulemaking and generic standard setting.
The licensing of individual plants would continue to be based principally on NRC regulations rather than conducted with direct reference to the safety goals and associated numerical guidelines.
Nevertheless, quantitative safety guidelines are useful in the application of probabilistic risk assessements (PRA's), the only available tool for gauging quantitatively how well reactors meet those safety ob' 'tives.
However, because of the present limitations of probabilistic analyses would be premature to adopt quantitative safety goals in conjunction witt.
,babilistic analysis as mandatory requirements in individual licensing cases as a substitute for meeting the Commission's regulatory requirements.
This view has been expressed by many l
of those who have made quantitative risk assessments of individual nuclear power plants and is based on their experience.
At present, PRA is being used to better understand the relative importance of l
the various generic safety issues and proposed new requirements, that is, l
their relative contributions to the reduction of residual risk.
Such use i
provides clearer guidance for setting priorities for the allocation of staff and industry resources since there are insufficient resources to work on all I
of the potential safety issues that have been identified.
Recommendation:
Safety goals and guidelines used in conjunction with pro-babilistic risk assessments should not substitute for the reactor regulatinns in 10 CFR Chapter 1; rather, individual
(
licensing decisions should continue to be based principally l
on compliance with the Commission's regulations.
l l
l C.
Trial Period of Use'of the Numerical Guidelines In order to encourage continued development and use of probabilistic risk assessment, the provisional numerical guidelines shouk be adopted for use by 1
the regulatory staff during a trial period long enough to evaluate their effectiveness as an aid in reactor safety regulation.
One could argue that, because of the uncertainties in probabilistic risk assess-ment, the value of the numerical guidelines in licensing is minimal.
On the contrary, these uncertainties merely suggest the need to use probabilistic risk assessment in a cautious manner and in carefully selected areas.
Never-theless, the use of PRA in such a sense can contribute valuable insights, point out weaknesses in safety related design and procedures, and assist in making cost-effective choices among alternative solutions to a safety problem.
During the trial period, the safety goals and associated numerical guidelines should be used to gain perspective in evaluating the desirability of new reactor safety improvements and regulations and the retention of existing regulatory requirements.
They may also be taken into account in individual licensing-case situations where regulations do not dictate the regulatory decisions, for example, about whether existing plants need to meet new require-4 i
ments.
(However, as recommended below, in all applications of the goals and guidelines, the probabilistic ris:, assessments, if performed, should be documented--along with the associated assumptions and uncertainties--and considered as only one factor among others in the regulatory decision making process.) It is recognized that application of numerical guidelines would offer limited benefit in the regulatory process at this time for accidents initiated by certain kinds of events, for which the uncertainties associated I
with the analyses currently are substantial.
Earthquakes more severe than the safe shutdown earthquake are an important example of such events.
They should nevertheless be taken into account to the best of the capability of current evaluation techniques.
Our present regulatory practices, ccmbined witn the low level of rick called for by the proposed numerical guidelines, are intended to provide sufficient protection to public health ar.d safety, and l'RA would be used only to find existing weak points in the regulatory fabric.
Recommendation:
The proposed numerical guidelines should be adopted on a provisional basis so that they would be tested in a regulatory framework during a trial period of suf ficient duration to evaluate their effectiveness.
The provisional numerical gridelines would be in lieu of adoption of quan-titative safety goals.
D.
Use of Benefit-Cost Numerical Guideline The use of the proposed numerical benefit-cost guideline deserves special consideration. While it is intended to be a broadly applicable guideline, its primary application would be in backfitting decisions.
Making changes to an i
l existing plant is more expensive and subject to greater practical difficulties l
than designing and constructing features for plants not yet built.
The cost l
of improvements in an old plant would usually be greater and the benefits would be less because of the shorter remaining life of the plant.
The numerical guide-lines, notably the benefit-cost guideline associated with the "as low as -.
1 l
t reasonably achievable" (ALARA) principle, could provide a useful contribution to-the basis for deciding whether backfitting is needed or exemption is appro-priate.
In order to account for differences in remaining useful plant life, comparisons between man-rem reduction and costs should be made cn an annualized basis.
That is, the cost of safety improvements should be spread over the remaining useful life of the plant.
t For corrective actions for operating plants which do not appear to meet the numerical guidelines, -the necessary action should be taken within a time commensurate with the increased risks involved.
When the risks are not judged to be serious enough to demand immediate action, the timing of corrective action may. include reasonable consideration of minimizing unscheduled down 1
time and any continued need for power.
The basic criterion for the timing of j
necessary retrofits should be consistency between the increased risk permitted uhile awaiting correction and the risks acceptable from plant operation through-out the plant's remaining useful life.
Thus, the ALARA principle should be followed with regard to the scheduling of retrofits as well as for the initial determination as to whether the new requirement should be imposed at all.
i j
For older plants that are judged as being generally consistent with the primary numerical guidelines for individual and societal risk, the criterion of $1,000 per man-rem averted should also be applied in safety improvement decisionmaking.
Because the risk reduction estimate depends on probabilistic risk assessment and its associated uncertainties, the decision whether or not to incorporate a specific safety' improvement may have to lean heavily on judgmental factors.
Recommendation:
The proposed numerical benefit-cost guideline should be used during the trial period as one consideration in deciding whether corrective measures or safety improvements should be made in plants previcusly approved for constructicn l
or operation.
Benefits uuld be measured in terms of l
estimated annual reduction in radiological risk due to reactor accidents.
Costs of safety improvements should be annualized over remaining plant life.
F.
Relationship of Safety Goals to Probabilistic Risk Assessment The application of the proposed safety goals and numerical guidelines depends i
in large measure on having available means for quantitatively estimating the potential risk to the public of nuclear power plant accidents.
With rame important limitations, the means now available, probabilistic risk assessment (PRA), is capable of addressing a wide spectrum of hypothetical accidents and providing numerical estimates of the likelihood and consequences of their occurrence.
1 llowever, the value of probabilistic risk assessment does not rest solely or even preponderantly on this capability.
It is also a valuable tool for exploring the contributions to public risk of component and system reliability and failure modes as well as errors in design, installation, and operation.-
It provides quantitative insights concerning the safety significance of NRC design and licensing requirements.
Nonetheless, a Commission policy statement on reactor safety goals should not, by itself, expand the use of probabilistic I
risk assessment methods.
Rather, judgments on the desirability of use of quantitative risk assessment should be made on the merits of the application and apart from Commission established safety goals and guidelines.
Recommendation:
Regulatory decisions to use probabilistic risk assessment should be made on the basis of an appraisal of its value in the specific application.
Implementation of the state-ment of safety policy should not, by itself, mandate the use of probabilistic risk assessment.
F.
Treatment of Uncertainties in Analysis and Application of the Proposed Safety Goals and Numerical Guidelines The value of quantitative risk assessment used in connection with safety goals is limited by uncertainties inherent in the underlying data, risk assessment methods, and the underlying physical phenomena.
Some of these uncertainties may be reduced in the future, but important uncertainties will inevitably remain.
Particularly significant sources of uncertainty are present in the following areas:
(1) Completeness of postulated accident initiators and system failures con-sidered, time-sequencing of events in accident scenarios, extent of detail in modeling event and fault trees, proper treatment of partial failures of components or systems, consideration of common-mode failures, for example, through external accident initiators such as earthquakes.
(2) Various errors which may affect plant safety, e.g., operator errors of omission or commission (perhaps under stress) in taking action to terminate an accident or to mitigate its consequences, maintenance and testing errors, and errors in design and in fabrication, construction, and instal-lation.
(3) Correct modeling, including formulation of proper success / failure criteria, accounting for systems interactions and interdependencies, grouping of source terms, coding fault trees and event trees, treating test and maintenance activities, and behavior of people during emergencies.
(4) Lack of good data, including plant-specific versus generic data, choice of statistical techniques, failure rates, and meteorological data.
(5) Assumptions and modeling to treat phenomena such as external events (for example, earthquakes), various equipment and component failures, fission product transport and pathways, and resulting exposures of people.
Although some uncertainties can be reduced by the development of better analyti-cal methods and the expansion of the data base, the probabilistic nature of risk assessment,as applied to nuclear reactors dictates that uncertainties are likely to remain large.
A fundamental limitation in the application of any quantitative overall acci-dent-risk goal or guideline, in view of the importance of low probability high-consequence events, is that verification of compliance in any scientific.
or conventional sense is not possible.
Implementation of the proposed numerical guidelines for reactor safety must take into account this fundamental limitation of probabilistic risk assessment and its associated uncertainty.
Recommendation:
In probabilistic risk assessments made in conjunction with safety goals, the underlying assumptions and associated uncertainties should be disclosed and documented for con-sideration in the regulatory process.
In most situations, these probabilistic risk assessments should be performed during the trial period on the basis of realistic assump-tions and best-estimate or mean-value analyses, and they should include an understandable presentation of the magnitude and nature of the uncertainties.
G.
Action Plan for Implementation The desirable uses of safety goals and numerical guidelines during the trial period should be proposed by the NRC regulatory staff.
A step-by-step action plan for Commission review and approval should indicate how the NRC staff plans to use the safety goals and guidelines in conjunction with probabilistic risk assessments.
j Recommendation:
The Commission should request that the staff propose, within a short period following publication of the proposed qualitative safety goals and associated numerical guide-lines for public comment, a detailed action plan for their implementation.
REFERENCES 1.
The District Court decision in Nader v. Ry recognizes some kind of balancing process:
Absolute certair.ty or " complete," " entire," or " perfect" safety is not required by the Atomic Energy Act, nor does nuclear safety technology admit of such a standard.
Power Reactor Development Co. v International Union, Electrical Workers, supra; cf., Crowther v. Seaborg, 312 F.
Supp. 1205, 1235 (D. Colo. 1970).
363 F. Supp. 946, 954-955 (O.C.D.C. 1973) 2.
NRC Views and Analysis of the Recommendations of the President's Commission on the Accident at Three Mile Island, NUREG-0632, November 1979.
3.
Plan for Developing a Safety Goal, NUREG-0735, October 1980.
i 4.
Toward a Safety Goal:
Discussion of Preliminary Policy Considerations, NUREG-0764, March 1981.
5 AjL pproach to Quantitative Safety Goals for Nuclear Poscr Plants, A
NOREG-0739, October 1980.
6.
Workshop on a Proposed Safety Goal, NUREG/CP-0020, September 1981.
7.
" Discussion Paper:
Safety Goals for Nuclear Power Plants," Office of Policy Evaluation, NRC, July 10, 1981.
8.
Ayprcaches to Acceptable Risk:
A Critical Guide, NUREG/CR-1614, Septc.T.ber 1980.
9.
" Concepts, Problems, and Issues in Developing Safety Goals and Objectives for Commercial Nuclear Power;" Roger Mattson, Malcolm Ernst, Warren l
Minners and Miller Spangler; Nuclear Safety, Vol. 21, pp. 703-716 i
(1980).
10.
A Proposed Approach to the Establishment and Use of Quantitative Safety Goals in the Nuclear Regulatory Process, The Atomic Industrial Forum Committee on Reactor Licensing and Safety, May 1981.
- 11. - Workshop on Frameworks for Developing a Safety Goal, NUREG/CP-0018, June 1981.
12.
A Survey of Safety Levels in Federal Regulation, NUREG/CR-2226, June 1981.
i 13.
A Risk Comparison, NUREG/CR-1916, February 1981.
t R-1
14.
Demographic Statistics Pertaining to Nuclear Power Reactor Sites, NUREG-0348; October 1979.
15.
Cancer Facts and Figures, 1981, American Cancer Society.
16.
"Value of a Life: What. Difference Does it Make?", J. D. Graham and J. W. Vaupel, Risk Analysis, Vol. 1, pp. 89-95 (1981).
17.
"A Cost-Benefit Comparison of Nuclear and Non-Nuclear Health and Safety Protective Measures and Regulation," E.P. O'Donnell and J.J. Mauro, Nuclear Safety, Vol. 20-5, pp. 525-540, September-October 1979.
18.
Three Mile Island:
A Report to the Commissioners and to the Public, Nuclear Reaulatory Commission Special Inquiry Group, January 1980, NUREG/CR-1250.
19.
Task Force Report on Interim Operation of Indian Point, NUREG-0715, August 1980.
20.
Planning Basis for the Development of State and Local Government Radio-logical Emergency Response Plans in Support of Light Water Nuclear Power Plants, NRC-EPA Task Force on Emergency Planning, NUREG-0396, November 1978.
21.
Final Environmental Statement Related to the Operation of Waterford Steam Generating Station, Unit No. 3, NUREG-0779, September 1981.
22.
Final Environmental Statement Related to the Operation of WPPSS Nuclear Project No. 2, NUREG-0812, December 1981.
I f
I R-2
GLOSSARY Annualized - applied to a data basis in which both benefits (risk-reduction) costs are taken into account for each of the remaining years of plant operational lifetime As low as reasonably achievable, or ALARA - a basic concept of radiation protection that specifies that radioactive discharges from nuclear plants and radiation exposure to personnel be kept as far below regulatory limits as "is reasonably achievable taking into account the state of the technology, and the economics of improvement in relation to benefits to the public health and safety, and other societal and socioeconomical considerations, and in relation to the utilization of atomic energy in the public interest" (10 CFR S 20.1).
Benefit-cost analysis - comparative analysis of benefits and costs that may serve as a basis of decisionmaking.
A common measure, usually dollars, is employed.
The method calls for employment of quantitative equivalence standards between benefits and costs.
Rigorously applied, benefit-cost analysis quantifies all effects, even though some are more easily quantified than others.
Backfit - to apply new requirements to previously approved reactors to bring them up to the same degree of compliance with the new regulations and new interpreta-tions and guidance as new reactors.
Containment - an enclosure around a reactor to confine radioactive materials that otherwise might be released to the atmosphere in the event of an accident.
Core - the central portion of a nuclear reactor containing the fuel elements, moderator, neutron poisons and support structures.
Core melt (also fuel melt) - the term applied to the overheating of a reactor core as a result of the failure of reactor shutdown or cooling systems, leading to substantial melting of the radioactive fuel and th'e structures which hold the fuel in place.
The probability of extensive but lesser core damage cannot now be calcalated accurately enough to use the concept of intermediate states of core melt in a safety goal.
Defense in depth - in engineering practice as applied to nuclear power plants, involves careful quality assurance and control in plant design, construction, and operation to reduce the likelihood of accidents; installation of backup systems to nullify the consequences of malfunctions in important plants systems and to prevent individual malfunctions from escalating into major accidents; and installation of engineered safety features to confine the consequences of certain postulated major " design basis accidents" to minimize effects on the public health and safety.
It also involves siting of nuclear plants in areas of low population density and in locations that are not near natural or man-made hazards, and calls for responsible assurance that adequate protective measures can and will be taken by the licensee and the state and local authorities in the event of serious accidents.
l t
G-1 i
i Delayed (or latent) fatalities - fatal cancers that may occur a long time (typically 20 or 30 years) after a person's exposure to radiation.
These exposures increase a person's statistical likelihood of being stricken by cancer.
The higher the dose, the greater that likelihood.
Design-basis accident - a postulated accident that a nuclear facility must be l
designed and built to withstand without exceeding the offsite exposure linits provided in the siting regulation (10 CFR Part 100).
Event-tree analysis - as applied to nuclear reactor safety, an event tree defines an initial failure within the plant and examines the sequence of events which 4
follow, depending upon the subsequent operation or failure of various systems that are designed to mitigate the adverse consequences of the initial failure.
Fault-tree analysis - a fault tree examines an event such as a system or sub-system failure and traces the various possible event paths to that failure.
Using fault trees along with component failure data, it is possible to estimate the likelihood of system failure. While an event tree proceeds from assumed causal event to inferred consequent events, the fault tree proceeds from assumed consequence to inferred potential causes.
Fault trees are used to derive the function or system success / failure probabilities that are then used in the event tree modeling.
Individual risk - the estimated probability of fatality from a nuclear power plant accident for an individual in the vicinity of the plant. including prompt deaths and delayed deaths.
Incapacitating illness or morbidity is not included here explicitly, because protection against death also provides added protection against illness.
[In similar fashion, the risk of death stands as a surrogate for genetic effects; i.e., prevention of one results in prevention of the other.]
The individual risk limit is applied to the biologically average individual (in terms of age and other risk factors) who resides at a location within 1 mile from the plant.
Probabilistic risk assessment or probabilistic risk analysis (PRA) - the art of mathematically quantifying an expected average risk based on observed and calculated component and human failure rates and the anticipated consequences associated with these failures, which may occur either singly or in combination.
i Probabilistic risk assessment typically involve the use of event trees and fault trees, although these are not the only tools available for such assessments.
Prompt (or early) fatalities - those fatalities that could occur shortly after an accident (generally within sixty days) as a result of a lethal dose of radiation j
t j
Regulatory Guide - an NRC publication which is used to describe and make available to the public methods acceptable to the NRC staff of implementing specific parts of the Commission's regulations, delineate techniques used by the staff in evaluating s,,ecific problems or postulated accidents, and other-wise provide guidance to applicants.
Regulatory Guides are not NRC requirements in a strictly legal sense.
Rem - acronym for " roentgen equivalent man" it is a unit of dose of any ionizing l
radiation that produces the same biological effect as a unit of absorced dose of ordinary X-rays.
G-2
Risk - the product of the probability of occurrence of an accident and the magnitude of the consequences given that occurence.
Risk aversion - the view, held by some, that a single large-scale accident with severe consequences is more undesirable than the sum total of many smaller accidents each of which involves lesser consequences, even when the total conse-quences associated with the single large accident are comparable to the aggregated consequences of the many smaller accidents.
Societal risk - the risk to.the aggregate population near nuclear power plant 1
sites.
It is the product of the number of fatalities that could result from an accident and the probability of occurrence of the accident.
In estimating i
societal risk, we propose that the calculations assume a distance out to 50 miles from the plant site since a substantial fraction of the total exposure of the population to radiation would be concentrated within this distance.
Vicinity - as applied to nuclear power plant sites, " vicinity" refers the area immediately adjacent to the site.
It is the area within approximately one mile from the site, where the risk of prompt fatalities in the event of a radioactive release resulting from a rejor nuclear accident would be greatest.
4 1
1 e
i
?
G-3 l.
APPENDIX OTHER QUANTITATIVE SAFETY G0AL PROPOSALS
- This appendix reviews and compares a number of quantitative safety goal proposals.
Individual proposals vary significantly with respect to inclusive-ness of risk elements and numerical criteria for each of these elements.
However, the proposals do contain a number of similar attributes which are worth comparing.
A short description of several of the proposals follows.
Table 1, at the end of this appendix, summarizes these descriptions.
Because many of the proposals are expressed in different units, the table includes a number of explanatory footnotes.
1.
ACRS.
The Advisory Committee on Reactor Safeguards sent the Commission on October 31, 1980 a paper describing an approach to establishing safety goals for nuclear power plants.
(Reference A1) This paper was intended to serve as a focus for discussion on the subject of quantitative safety goals, not a final proposal recommended for Commission adoption.
The ACPS proposed safety criteria (i.e., decision rules) which would place limits on the frequency of occurrence of certain hazardous conditions within t!.e reactor, on the individual risks due to either early or delayed death, and on the overall societal risk of early or delayed death.
The ACRS paper also included an "as low as reasonably achievable" criterion to include both the economic costs and the monetary value of preventing premature death as well as a risk-aversion (see Glossary) criterien.
The ACRS discussion paper proposed two values for each quantitative goal:
an upper, non-acceptance limit of risk which must be satisfied for extended operation of a new plant or for issuance of a construction permit, and a goal level which is lower than the non-acceptance limit.
Between the upper limits and the goal levels, the paper envisions a discretionary range for case-by-case consideration of uncertainities and competing risks.
Once the upper, non-acceptance limits have been satisfied, risk must still be reduced if such reduction is reasonably achievable on a cost-effectiveness basis.
The benefit standard for measuring effectiveness is $5 million/ prompt fatality averted
- and $1 million/ delayed fatality averted.
The cost-effectiveness criterion presupposes a capitalized basis for evaluating the effectiveness of additional safety measures against their cost.
The ACRS approach would incorporate a societal risk-aversion criterion to weight high-consequence events more heavily than low-consequence events.
The proposed ACRS criteria would apply only to new light water reactors and might be considered to be "more stringent than is deemed appropriate for existing plants."
- References cited are listed at end of Appendix.
A-1
i 2.
AIF:
In May, 1981, the Atomic Industrial Forum Committee on Reactor Licensing and Safety issued a proposed safety goal based upon three prin-ciples:
(a) the level of protection should be such that no individual bears an inordinate risk; (b) quantitative safety goals for nuclear power plants should be consistent with those applied to other technologies; and (c) the goals should promote a rational allocation of societal resources.
(Reference A2) The AIF proposed primary maximum incremental risk criteria for individuals and populations, and secondary critaria on cost-benefit considerations and large-scale fuel melt.
In the regulatory application of safety goals, the AIF believes it is premature to require submittal of plant-specific probabilistic risk assess-ments as a licensing condition.
In its view, risk assessment and associated safety goals should be used to examine the existing body of NRC regulations, to establish generically the level of safety provided by these regulations, and to identify where changes are warranted.
The AIF believes that the various comprehensive risk assessments now completed or underway for indivi-dual plants should be used to draw generic conclusions with regard to com-pliance with quantitative safety goals. Thus, they believe that pending NRC rulemaking activities such as those pertaining to severe core damage, minimum engineered safety features, and reactor siting should be resolved in the context of probabilitic risk assessment and proposed safety goals.
AIF also believes that plants found to be in compliance with the existing regulatory requirements, which provide a level of safety that satisfies the safety goals, should nc,t have to perform a plant-specific probabilistic risk assessment as a condition of license issuance or as part of a license application.
3.
Kinchin (U.K. ):
The proposal of G. H. Kinchin of the United Kingdom Atomic Energy Authority has been summarized in the ACRS discussion paper.
(Refer-ence A1, pages 25 to 28)
In brief, the Kinchin proposal calls for conser-vative safety goal criteria because of the difficulty in balancing economic advantages against health risks.
He proposes that the risk of immediate death to an individual member of the public be small compared with other involuntary risks, and suggests a value of 10 8 per reactor year as the goal for this occurrence.
Basing his position on a rationale which includes the considerations that a future death is preferable to an immediate death and that the life expectancy of young individuals is affected more by radiation-induced cancers than is that of older persons, Kinchin proposes a value of 3x10 5 per reactor year as the probability of inducing a delayed death to the individual.
4.
Joksimovic:
V. Joksimovic and others with the General Atomic Company have developed safety criteria based on probabilistic risk assessment.
(Refer-ence A3) All accidents which prooabilistic calculations indicate are likely to occur within the total projected operating lifetime of a commercial nuclear power program must be prevented as part of a " design-basis" program.
- Increased throu.gh the risk aversion concept when multiple casualties are involved (e.g., to $13 million per actual prompt death averted when 100 potential prompt casualties are involved).
A-2
For the United States, assuming 170 reactors, a probability of 10 4 per reactor year represents the lower limit where there is a 50% chance that a design-basis accident whose consequence would result in no identifiable injury to the public will occur. In the " safety-margin" region, protection is provided against events whose probability of not happening is 90%.
The probability for safety margin events is 10 s per reactor year and is held as a standard for design capability.
Rarer events can occur, but those with a probability below 10 8 are 99% sure not to occur and are thus not expected to affect public health and safety.
Those events with probabilities between 10 5 and 10 8 per reactor year are within the
" safety research" region and are candidates for safety study and experi-ments.
Until such research is completed, designers are advised by Joksimovic to incorporate in their designs a capability to mitigate such events.
Since individual risk is established in accordance with EPA guidelines, Joksimovic would chose 5 rem as the consequence limit for an event whose probability is 10 4 per reactor year, and 5 man-rem per reactor year for normal operations.
Societal risk, if based on " balanced risk" -- reducing risks in proportion to their contribution to total risk -- allows for 100 l
latent cancer fatalities at an accident risk of 10 4 For an " emphasized risk" policy, a lower consequence societal risk limit would be necessary, and Joksimovic uses 0.1 fatalities at an accident risk of 10 4 (Joksimovic also constructs a limit on dollar losses attending accidents.
This limit is congruent with insurance underwriting practice that accidents with a prob-ability of 10 5 per year and a damage potential of $300 million represent the upper limit of insurability.)
5.
Starr:
C. Starr of the Electric Power Research Institute discusses three approaches to determining acceptable risk as a criterion for regulatory l
purposes.
(Reference A4) The first to approaches have the implied premise that nuclear utilities and their vendors might not sufficiently minimize public risk without a regulatory overview.
The first approach is simply to set an upper bound of potential nuclear risk at one-tenth of the worldwide minimum risk to anyone from uncontrollable natural accidents.
This would be 10 7 per person per year and is described by Starr as a negligible level.
A second approach would seek to provide a marginal equality of cost effectiveness of resources spent on safety and would set the acceptable aggregated regional risk level at about 10 4 per year.
l This approach presumes that nuclear risks are as acceptable as other risks of accidental death in the U.S. (for instance, 2x10 4 annual risk of motor vehicle death) and that an adequate compensating benefit for the nuclear power plant would be perceived and accepted.
Starr considers as a third approach that an informed utility industry might seek a low risk level because of financial self-interest.
In view of the response of the industry and the financial community to the TMI experience, the frequency of accidents that disable the plant, even without public risks, must be I_
substantially reduced to 1 in 10,000 reactor years.
On the basis of l
WASH-1400, Starr scales this accident level to an annual individual acute and latent risk of 1x10 8 per reactor year within 25 miles of the plant.
Thus, an informed utility industry would be seeking reliability and safety levels better than the negligible level of the first approach.
Starr recommends the third approach since it is based on long-term utility self-A-3
interest.
The regulatory role then (1) focuses on areas where the industry has less financial interest (i.e., safety systemt that protect the public but not the plant) and (2) checks to see that industry acts in accordance with its own financial interest by pursuing plant safety.
REFERENCES Al An Approach to Quantitative Safety Goals for Nuclear Power Plants, NUREG-0739, October, 1980.
A2 A Proposed Approach to the Establishment and Use of Quantitative Safety Goals in the Nuclear Regulatory Process, The Atomic Industrial Forum Committee on Reactor Licensing and Safety, May, 1981.
A3 V. Joksimovic and L.F. O'Donnell, Quantitative Goals for the Regulatory Process, GA-A16119, October 1, 1980.
A4 C. Starr, Risk Criteria for Nuclear Power Plants:
A Pragmatic Proposal, ANS/ ENS International Conference, November 16-21, 1980.
A-4
TABLE 1 COMPARISON OF SAFETY GOAL PROPOSALS (*)*
MOST EXPOSED AVERAGE EXPOSED SOCIETAL RISK CORE INDIVIOUAL RISK INDIVIDUALRISg)
(fatality)/Ryr COST SOURCE MELT /Ryr (fatality)/Ryr (fatality)/Ryr BENEFIT PROMPT DELAYED TOTAL PROMPT DELAYED TOTAL PROMPT DELAYED TOTAL ACRS (c.d) Goal 1x10 4 1x10.s 5x10.s 6x10 '(o) 1x10.s(e) 1xio.t(f) 1xio.t(9) 0.4 2
2.4
$5x108/early (Tpper 5x10 4 5x10
- 2.5x10.s 3x10 5 5x10.s
$xio.7 5x10 7 2
10 12 life saved
'i Limit
$1x108/de-layed life saved (+$100/
perscn-ren)(h) 1x10 s 1x10.s 0.2(f)
,Starr 1x10 7(t) 4, AIF 1x10
- 1x10 5(d) 6x10 8(g) 1
$100/ person-ree Joksimovic 1x10
- 5x10 7 2x10.s 3xio.s Balanced (f)
Balanced 4x10 8 7x10 8 Emphasized Emphasized 4x10.at 7x10 4 Levine 1x10 *(j) 5x10 s(k) 2x10 7(k) 5x10.s(k) 8x10 '(e) 1x10.s(f) 1x10 8(g) 3x10 *(1) 0.2(1) 0.2(1)
Kinchin (U.K.)
1x10 8 3x10 5 3x10 5 7x10 '(e) 6x10 8'(f) 6x10 8'(g) 3x10
- 1x10 2 1x10 8(o)
Corkerton et al.(U.K.)
1x10 8 1x10.s (m)
WASH 1400 5x10 5 6x10 '(n) 4x10.s(n) 6x10 7(n) 1x10 '(e) 2x10 '(f) 2x10 '(g) 5x10 5 3x10 8 3x10 8 "This table was orfynially constructed by NUS Corporation.
I
+-
NOTES:
(c) Values relate to one reactor except as noted in (d) below. ACRs values are based on 1200 MW(e) reactors operating at full capacity for 1 year (i.e.10ao KWH). Other goals in the table are based either on 1000 MW(e) or on an unspecified power level and unspecified load factor. These differences in power level and effects of capacity factor are not important considering the fairly wide variations in values presented herein. Many units are approximate since calculations have been made to interpret various authors' statements and to put various goals on the same basis.
(b) The category of Average Exposed Individual Risk is added to illustrate goals to be met or implied risk levels for the proportions of people exposed to doses which cause the bulk of the early and delayed fatalities, as opposed to the few people livir.g in the immediate vicintity of the plant at the "most exposed" level.
(c) Entries of safety goals related to engineering safeguards have been reduced to the minimum since these are subsidiary to the public risk goals. For ARCS, " core damage" and " containment failure" have been removed, leaving " core melt".
(d) These values are per site per year and are thus, applicable to multiple reactors at some sites.
2 (e) These values are based on an assumed average population to 10 miles radius around a plant of 43,000 (NUREG-0340). See also a
footnote (o).
(f) These values are based on an assumed average population to 200 elles radius around a plant of 17x108 (NUREG-0340). See also footnote (o).
(g) These values are derived by dividing the total societal risk by an assumed average population of 200 miles radius around a plant of 17x108 (NUREG-0340). They are not the sum of Early Rist and Latent Risk for an Average Individual. See also footnote (o).
(h) Based on a value of 104 person-res latent cancer, $108 per delayed cancer averted yields $100 per person-rem.
(1) This is Starr's total individual risk value for people " local" to the plant (about 10,000 people) who would receive compensation for this relatively elevated risk. See also footnote (o).
(j) To derive values of ACRS' type from Levine's proposed goal, a value of 10-4/ reactor year is assumed for the core melt safety goal, since WASH-1400 had an estimated value of 5x10 5/ reactor year.
(k) The values for the most exposed individual risk are derived by taking the ratio most exposed. average exposed risk for individuals identified by the WASH-1400 data. These are applied to the average individual risk values derived from Levine's goal.
l
(1) Levine's goal components of early and delayed societal risks have been separated in the ratio identified in WASH-1400.
(m) Corkerton states that this is presumed "small" for U.K. licensable sites.
(n) WASH-1400 did not propose safety goals. These values are implicit in the WASH-1400 data and results and are based on CRAC analyses.
(o) These values did not appear in the original reference. They were calculated for inclusion in this table on certain assumptions about population distributions, etc. Since a range of assumptions is possible, these values should be viewed merely as one attempt at quantification on a consistent basis.
P
~
I U.S. NUCLEAR REOULATORY COMMISSION NU 0Y8Y BIBLIOGRAPHIC DATA SHEET For Comment il TITLE AND SUSTITLE (Ade vobme Na, #F apprapnam)
- 2. (Leave blank 1 Safety Goals for Nuclear Power Plants: A Discussion Paper
- a. RECIPIENT'S ACCESSION NO.
?
- 7. AUTHOR (S)
- 5. D ATE REPORT COMPLETED M ON TH l YEAR Office Of Policy Evaluation February 1982
- 9. PERFORMING ORGANIZATION NAME AND MAILING ADDRESS (inctedr I,a Codel DATE REPORT ISSUED i
Office of Policy Evaluation Er"uary I*1g82
'^"
U.S. Nuclear Regulatory Commission
,,(,,,,,
Washington, D.C. 20555
- 8. (Leave Nank1
- 12. SPONSORING ORGANIZATION NAME AND MAILING ADORESS //ncluor I,p Code)
- 10. PROJECT (TASK / WORK UNIT NO.
Same as above.
- 11. CONTRACT NO.
l
- 13. TYPE OF REPORT PE RIOD COVE RE D (inclusere dams)
Regulatory Report
- 15. SUPPLEMENTARY NOTES 14 (Leave umkJ
- 16. A8STR ACT QO0 words or kss)
This report includes a proposed policy statement on safety goals for nuclear power plants published by the Comission for public comment and a supporting discussion paper. Proposed qualitative goals and associated numerical guidelines for nuclear power-plant accident risks are presented. The significance of the goals and guidelines, their bases and rationale, and their proposed mode of implementation are discussed.
t t
- 17. KEY WORDS AND DOCUMENT AN ALYSIS 17a. DESCRIPTORS I
l 17b. IDENTIFIERS /OPEN ENDED TERMS I
- 18. AVAILA8tLITY STATEMENT
- 19. SECURITY CLASS #Th<s report)
- 21. NO. OF PAGES Unclassified Unlimited 2* SjnS's*sD^ie'd'"#'#
- ' S NOC FORM 336 (7 77) 1
I UNITED STATES NUCLE AA REGULATOAY COMuiI2 ION f
]
O W ASHING TON. D. C. 20555 Postass Ano FEE: PAGO U S. NUCLE AR REGUL ATORY OF FICI AL SUSINESS comuession FEN ALTY FOR PRIVATE USE, $300 12]S 5 pJ /t c 7 /
?
Ua
- f. 4 L 4 ',c, A s e <,C 9 J M s A)1 JIV CF TIOC i20 L I C (
t) La t I C A r l e t, 3 yLI 3p s
PM NUdEG C C FY LA 212
'a A s til N G I L N CC 20555 0
O O
Q o
e C
l s
O C
k