ML20055C238
| ML20055C238 | |
| Person / Time | |
|---|---|
| Issue date: | 03/30/1989 |
| From: | Stello V NRC OFFICE OF THE EXECUTIVE DIRECTOR FOR OPERATIONS (EDO) |
| To: | |
| References | |
| TASK-PINV, TASK-SE SECY-89-102, NUDOCS 8904100108 | |
| Download: ML20055C238 (39) | |
Text
m 4
e i
oooooooooooooooooooooooo l
,,/* " *%A RELEASED TO THE PDR e
! M,. 1 Up4/9o cP W4F/s/
em r inme
%Q, eeeeeeeeeeeeeeeeeeeeeese POLICY I!iSUE March 30, 1989 SECY-89-102 TheCommispenerrotation Vote)
For:
From:
Victor Stello, Jr.
Executive Director for Operations
Subject:
IMPLEMENTATION OF SAFETY GOAL POLICY
Purpose:
To propose a general framework and revised plans for Safety Goal Policy Implementation by the staff.
The proposed plans are intimately associated with implementa-tion of the recently revised Backfit Rule, 10CFR 50.109, particularly with respect to determinations of substantial increases in the overall protection of public health and safety.
Also discussed is the related tratter of adequate protection of public health and safety.
This paper completes the first item under Safety Goal Implementation Activities in the Five Year Plan.
Backoround:
In February 1982 a proposed Policy Statement on Safety Goals was issued for public comment and, in March 1983, a revised Statement was issued in response to connents received.
A 2-year trial evaluation of the safety coals l
resulted in an April 18, 1985, report to the EDO supporting the use of safety goals in the regulatory decisionmaking process.
This trial evaluation revealed that the insights from use of probabilistic risk assess-ments (FRA), together with safety goals as a measuring yardstick, could serve to strengthen the traditional methods of arriving at regulatory decisirts for a wide range of regulatory issues.
On August /
1986, the Coanission issued its Safety Goal Polic,-
tatement authorizing the use of safety goals in t M regulatory process.
On January 2, 1987 the staff submitted to the Commission a Safety Goal Implementation Status Report that recom-mended a framework for safety goal implementation.
The
Contact:
R. W. Houston, RES 492-3900 4
f
'W3 Oy/oo/O f f 4 9
sm.
._. m..
-m m.m -_ m ~~ ~. _
~
~
'{
c The Commissioners 2
Advisory Comittee for Reactor Safeguards (ACRS) dis-cussed this report with the staff and on May 13, 1987, issued a letter to Chairman Zech recomending (1) that safety goals be used to judge the adequacy of existing regulations and regulatory practices rather than to make judgments about specific plants (2) safety goals, objec-tives, and guidelines be related more logically in a hierarchical structure, and (3) continuation of a
" sampling" program of probabilistic risk assessments of selected operating plants to gain a more representative basis on which judgments on the adequacy of existing regulations and regulatory practices can be made.
Following an August 6,1987 ACRS briefing of the Comis-sion on those recomendations, the Comission requested that the staff continue its interactions with the ACRS and coment on those recomendaCons.
(Staff Require-ments Memorandum dated August 1"v. 1987.)
Subsequently, by memorandum dated November 6,1987, the Comissicn indicated its support for the ACRS recomendations and directed the staff to develep a revised implementation
- plan, in late 1987 and early 1988 the staff met with the ACRS and its Subcomittee on Safety Philosophy, Technology and Criteria to discuss how the ACRS recomendations might be carried out.
In a letter dated April 12, 1988, the ACRS provided further coments on its prior recomendations and, in response to the Chairman's request, the staff provided preliminary views on the 10tter ACRS letter in a memorandum dated May 27, 1988.
Additional discussions with the ACRS Subcomittee were held on September 1, 1988.
In the Integration Plan for Closure of Severe Accident Issues SECY-88-147, dated May 25, 1988, the staff indicated its intent to use safety goals and objectives in the closure process.
Disc.ssion:
In the following the staff outlines its recomended general approach to the implementation of safety goals and quantitative objectives, and compares this approach to that suggested by the ACRS.
This is followed by a more detailed discussion of the recommended structure, meaning, and use of safety goal objectives.
Enclosures 1, 2, and 3 constitute the staff responses to the i
)
e
n
-o g
The Connissioners 3
i l
specific questions referred to the staff by the l
Connission in its memorandum dated August 18, 1987.
The scope of the approach in this paper to the implementation of safety goals is directed primarily to light water reactors of current and advanced design.
Proposed quantitative objectives for advanced reactors of the type being sponsored by DOE have been addressed in the centext of " Key Licensing Issues" in SECY 88-203.
A.
General Implementation Concept i
The staff's plans for implementing safety goals and objectives are directed toward bringing more coherence into existing programs and activities already identified in the Five Year Plan, but not explicitly associated with c
safety goals. A need for greater coherence aniong new regulatory policies and the role of the Safety Goal Policy were suggested by the ACRS in its letter dateo March 15, 1988. These plans are therefore intended primarily as guidance to the staff rather than an addi-tional set of action plans.
For this reason it is expected to have only minor resource impacts.
The staff also believes that, if the Connission approves the recommendations made inithis paper, both the industry and the public will be better informed as to the role that safety goals should be expected to play in future regula-tory decisions.
The general approach for implementing a hierarchy of quantitative safety goal objectives as described here is based upon a strategy for the use of probabilistic risk analyses (PRA) in the regulatory process that is consis-tent with the guidelines for regulatory implementation given in the Safety Goal Policy.
This strategy employs the fundamental principle that safety coal ob ectives should be targets for generic regulatory requirements, n_ot requirements, standards, or criteria for individual plant licensing decisions.
The strength of PRA lies in the process of performance of the analysis and what it can reveal about the important factors of design, configuration, and procedures that contribute to the residual risk of operation.
In a rela-tive sense, PRAs can be particularly strong in the " front end" or systems analysis portion of a PRA, i.e., a Level 1 PRA.
On the other hand, PRAs often suffer from i
i
~
1 The Commissioners 4-completeness limitations, unquantifi6ble uncertainties in f
the data base, particularly in the areas of human factors i
and severe accident phenomena, and definitional problems, i
such as core melt. These lead to the conclusion that sumary " bottom line" results should be regarded with skepticism as precise or definitive statements in an l
absolute sense.
It is for these reasons that the recom-mended strategy does not incorporate the use of safety goal objectives as criteria for individual plant licensing actions.
1 The risk perspectives provided by PRAs are regarded as complementary to, not substitutes for deterministic analysis and engineering judgment in the process of l
regulatory decision making on generic matters.
This strategy has been used by the staff in the process of t
ol' resolving generic safety issues such as ATWS and Station Blackout that employed quantitative targets for core damage frequency.
The structure and content of new, modified, or deleted regulatory requirements evolving from the extension and continued use of this strategy l
should provide reasonable 6ssurance that, when imple-mented, the ~overall risk objectives of the Safety. Goal Policy will have been achieved.
This aspect of using safety goal objectives is also consistent with recom-mendations of the ACRS in its letter dated May 13, 1987.
However ACRS comments raise the issue whether safety I
goals should be used to define " adequate protection " the l
statutory licensing standard which must be applied l
without considering economic costs.
In the May 27, 1988 memorandum to the Chairman, the staff, referring to the ACRS letter dated April 12, 1988, comented on this matter to the effect that "....the ACRS l
view appears directed toward a different purpose from that expressed in the Commission's policy statement on
-i safety goals." The staff understands that the ACRS view, expressed as a top down approach to regulation, would associate quantitative objectives in a hierarchy as targets for defining adequate protection of public health and safety.
The process of implementation would thus be directed toward the ultimate establishment of a body of regulations and practices that are derived from the safety goals and objectives, and would then constitute a complete statement, or definition, of adequate protection (no undue risk)..
a
e
~
e 3
The Comissioners S
In its April 12, 1988 letter, the ACRS expressed the view that regulations should be revised without recourse to cost benefit arguments, when the purpose of the revision is directed toward achievement of safety performance based upon safety goal guidance.- In its July 20, 1988 letter on Key Licensing Issues Associated with DOE Sponsored Reactor Designs, the ACRS associates the safety goal policy with a resolution of the Question "How safe is safe enough?" The Commission's backfit policy as set forth in 10CFR50.109 recognizes that there are circum-stances in which substantial increases in the overall i
protection of the public health and safety, over and above the minimum needed for adequate protection, can be achieved by justifiable regulatory action in which economic costs are a consideration. The staff believes 1
that the Commission intended that safety goals and objec-
'1 tives should be directed toward these latter circumstances. Therefore, it is the recommendation of the staff that_none of the safety goal objectives be i
construed as targets for a " generic" and quantitative adequate protection standard.
Rather the staff believes they should be regarded as aspirational targets which, if proximately achie 7d and rnaintained, should provide reasonable assurance that a level of risk consonant with the purpose of the safety goals will have been reached, that this should be " safe enough," and that further backfits would not be justified.
Each of the safety goal objectives discussed below are therefore perceived es a benchmark against which proposed changes in regulatory requirements can be judged, pursuant to requirements of the Commission's backfit rule 10CFR 50.109, or, as identified, for future plants.
Notwithstanding the foregoing, the staff believes that, in order to assure proper implementation of the backfit rule, it would be useful to develop a better understanding of the meaning to be ascribed to the term adequate protection (no undue risk).
To specify what is
" safe enough" suggests clearly that the Commission also must have a good working concept of what is " adequately safe".
Indeed the need for a more precise or quantitative definition of " adequate protection" is the central issue presented to the court in the pending case i
on the backfit rule.
Furthermore, it is essential that such an understanding, or definition, of adequate protection have a clear relationship to Safety Goal l
l l
l
rp
-t The Commissioners 6
Policy.
The staff believes that such a relationship can be established by reference to the two Quantitative Health Objectives (QH0s) defined in the Safety Goal Policy.
Accompanying the publication of the revised backfit rule on June 6, 1988 was an extensive discussion of the issue of defining adequate protection._ Among other things it noted that the Commission's " rules do not, strictly speaking, define adequate protection -- they only pre-sumptively assure it " and that "most of the Consnission's rules and regulations are ultimately based on unquantified and -- presently unquantifiable ideas of what constitutes adequate protection." But it also notes that "some quantitative and generally applicable definition of adequate protection may eventually emerge as.a byproduct of the Commission's efforts, still in their early stages, to implement its general safety goals, which take a partly quantitative form."
The commission has noted in the Safety Goal Policy Statement, relative to the levels specified for the QH0s, that "this does not necessarily mean that an additional risk that exceeds 0.1 percent wculd by itself constitute a significant additional risk." The staff believes however, that at some point higher than the 0.1% level of the QH0s the additional risk would begin to be regarded 3
as unacceptable and would become a candidate for one factor in specifying an undue risk (or adequate protection) level.
This point could be a numbu of times the QHO level and perhaps ten times that level.
The specification of a benchmark standard along these lines could be viewed as an initial step in defining adequate protection and could be used to make judgments on some kinds of potential changes to the regulations pursuant to 10CFR 50.109 where such a point of reference is useful.
As emphasized earlier in this paper, however, quantitative risk assessments (PRAs) are not up to the task of providing definitive findings on which narruwly differentiated individual plant licensing decisiont can be made. Therefore, the actual use of such a stancard would be indi m t, in the same fashion as existing and proposed safety goal quantitative objectives.
l i
The Commissioners 7
The staff has no current plan to a rry out a program for defining adequate protection.
Should the Commission so direct, the staff would prepare such a plan that would include a benchmark relationship to Safety Goal Policy such as discussed above.
If the plan's objective would be to develop a full specification of the meaning of adequate protection, it is estimated that several years may be required to bring it to completion.
Turning now to another question regarding the meaning to be ascribed to safety goal objectives, should they be regarded as benchmarks for individual plants cr for the overall or collective average of all plants?
If all of the goals and objectives were regarded as targets for a generic adequate protection standard cs suggested by the ACRS, there would be no difference and the question would be moot.
In the safety goal policy statement itself, a fair reading of the qualita*,1ve safety goals suggests that either interpretation would be admissable. On the other
'i hand, the quantitative health objectives must be read as ii benchmarks for each individual plant.
The general performance objective, or large release guideline, proposed by the Commission for further staff examination, is expressed as an "....overall mean fre-quency of a large release --- from a reactor accident....,"
The staff proposes to interpret this as an overall or collective average for all plants and to use the same interpretation for an additional objective for core damage frequency as proposed below.
This interpretation recognizes an expectation of and a tolerance for the fact that risk analyses on individual plants are likely to reflect variations about a collec-tive average.
It also raises the question as to whether this mecns that the overall mean frequency might be dominated by a small number of " outlier" plants.
The staff believes that this issue is being adequately addressed in the individual plant examination (IPE) and containment performance improvement (CPI) programs identified in SECY-88-147.
l i
The Commissioners 8
t B.
Principal, Elements of Implementatior The first element involves the establishment of a structure or hierarchy of quantitative objectives, similar but not identical to that proposed by the ACRS.
This proposed structure is described in Section C.
The second principal element of the implementation process is the review of existing and future PRAs in the light of existing regulatory requirements to determine their effectiveness by assessing their proximity to the safety goal objectives. This is the sampling program suggested by the ACRS.
The bulk of the PRAs are those performed on currently licensed light water reactors (LWR) and NUREG-1150 is planned to be a major focal point for this effort.
Other PRAs, including those from industry sources, will also be reviewed as applicable.
PRAs on U.S. plants currently available to the staff are listed in Table 1.
The staff plans to fold this work into the Systematic Review of Light Water Reactor P.equirements, an ongoing program which has been identi-fied as a Significant Agenda Item.
It is expected that this pro ~ cess will also provide useful information relating to the anticipated effectiveness of regulatury requirements for future plants, particularly those re-flecting advancements in LWR safety technology.
Since the span of regulatory requirements is much too extensive to tackle as a whole, the staff has identified candidate areas on each of which this strategy can be applied.
A list of these areas, shown in Table 2, has been selected from program elements and activities in-cluded in the current Five Year Plan and in which PRA is expected to play a significant role.
The staff has already indicated in SECY-88-147 its intent to use safety goc 1 objectives in its analysis of proposed generic containment mformance improverrents.
If the Commission approves the recommendations herein, the staff expects to apply this process to relevant activities within each of the programs Ifsted in Tabie 2.
The third principal element of safety goal implementation is directed toward the overall integration of risk l
reduction efforts.
This was an important element of the I
earlier plan described for the Commission in January l
1997.
It is a program to continue the development and l
i The Comissioners 9
application of a technique that can be conveniently used to sum up or integrate risk reduction modifications on a plant specific basis starting from a baseline state of the plant as reflected in a PRA.
Successive risk signi-ficant modifications actually made to the plants, as well as potential modifications that may be required by the NRC, can be reflected in or tested by this technique.
The principal effort. Liready planned, involves expanding and traintaining up-to-date a readily accessible dcta base containing an increasing number of plant specific risk profiles from PRAs that can be used to estimate and track individual and aggregate or average risk profiles for cperating plants or for groups of similar plants.
The specific tools that the staff.has developed and can be used for this effort are the PC-based codes SARA'and IRRAS. An example of their use has been demonstrated to NRC senior management to assess the risk significance of uncompleted multi-plant action items at selected plants.
In the future these tools are expected to be a significart aid in estimating the overall proximity of individual and collective plant performance tu safety goal objectives.
The fourth principal element involves the use of subsi-diary quantitative targets, i.e. targets that are com-i patible with but subsidiary to the quantitative safety goal objectives themselves. Subsidiary targets represent a partitioning of safety goal objectives.
They are useful in conjunction with limited scope risk analyses that focus on the risk significance of specific generic safety issues. This technk;ue has been used by the staff for some time, such as in the resolution of the station blackout issue, USI A-44.
C.
Structure of Safety Goal Objectives The ACRS proposed a five level safety goal hierarchy along the following lines to facilitate a top-down approach to the implementation of the Safety Gcal Policy.
Level One
- Qualitative Safety Goals Level Two
- Quantitative Health Objectives (QHO) i Level Three - Large Release Guideline (A General Plant Performance Objective)
Level Four - Performance Objectives l
Level Five '- Regulations and Regulatory Practices l\\
l l.
l-L l
l lt:'
1
t
]
l The Commissioners 10 i
l Levels Two. Three, and Four in this hierarchy collect-ively constitute Safety Goal Objectives, i.e., the i
quantitative targets.
The Level Two objectives are the two quantitative Health Objectives specified in the Safety Goal Policy Statement relating to lctent cancer and early mort 611ty risks.
I It is the staff's understanding that the ACRS intended that each successive level in the hierarchy be regarded as a surrogate for the preceding level, ano should be l
sufficiently more conservative than the preceding level to accommodate uncertainties, but not so conservative as i
to create a de facto new policy. The staff's proposal can be viewed as a preliminary but not complete step in this direction, particularly with respect to the per-formance objective for Level Four of the hierarchy, as noted below.
The ACRS recommended that the "large release" guideline proposed in the Safety Goal Policy Statement be adopted as a Level Three performance objective and provided some views on what a large release should mean.
It also recommended that Level Four consist of thre'e different components that would relate respectively to (1) core melt frequency (2) a containment performance objective, and(3)anobjectiveexpressinghowwellaplantshould be operated.
To link the hierarchical levels together the ACRS suggested four criteria.
The staff has used these criteria in formulating optional definitions and speci-fications for the Level Three and Level Four objectives, and has also added additional criteria.
enumerates these criteria and describes the options that have been considered by the staff for defining and specifying the Level Three and Four objectives, and the reasons for the reconnendations that fc110w.
P oposed Safety Goal Objectives 1.
l The Level Two objectives are specified and defined in the Safety Goal Pnlicy statement itself.
These go directly to the matter of radiological risk ard, for comparison on an individual plant basis, require an analysis provided in a Level III PP,A.
At this time the staff proposes to simplify the hierarchy of objectives by recommending t
~
~
~
'~
a t
The Commissioners 11 successive limitations in the scope of each objective to correspond, in inverse order, to prod.ucts of Level I, II, and III PRAs. This has the characteristic of associating each level of the hierarchy with rules and regulatory practices that address in sequence, (1) accident pre-vention,(2)accidentmitigation,and(3)off-site consequence mitigation.
This association is shown in Figure 1.
(a) Level Three i
A Level Three objective derives from the large release guideline proposed by thi. Commission for further staff examination.
This guidelice was stated as follows:
"....the overall mean frequency of a large release of radioactive materials to the environment from a reactor accident should be less than 1 in 1,000,000 per year of reactor operation."
As discussed in Enclosure 1, there are a number of different ways to give more explicit meaning to the term "large release," both quelitative and quantitative.
From that discussion, for the Level Three objective, the staff recommends the following qualitative definition of a large release.
A large release is a release that has e potential for causing an offsite early fatality.
The staff believes that this definition meets all of the criteria for a safety goal objective and is a reasonable analogue of the definition of core damage recommended for Level Four of the hierarchy.
In addition it should be apparent that it cicarly implies releases much larger than occurred at THI-2, but would encompass a release of the magnitude that occurred at Chernobyl even though after the fact, that release did not result in offsite early fatalities.
To develop additional guidance to the staff for use with this definition, two prosfr tive surrogates for it are proposed for additional tw,ing.
One of these is similar to the definition of a large release proposed by the staff in January 1987.
This one is directed toward the analytical capability to project one or more early i
i l..
.=..
The Comissioners 12 fatalities from releases.
The second prospective surrogate is directed toward the ability to project early containment failure that creates or leads to a direct pathway for transport of radioactive material from a severely damaged reactor core, to the environment.
The attributes of these prospective surrogates are discussed in Enclosure 1.
(b) Level Four For Level Four of the hierarchy, the staff at this time recommends a single objective, for core damage frequency.
The ACRS has called attention to the fact that the term
" core melt" is widely used in the nuclear safety community and recomends a definition of core melt as loss of adequate core cooling.
It is not uncommon to find the terms core melt, core dama damage to be used interchange 6bly. ge, and severe core In NUREG-1150 DRAFT, the terms core damage or severe core damage are dominantly used.
In this paper the staff uses the term core damage and associates that term with loss of adequate core cooling as recomended by the ACRS. contains a~more complete discussion of the implications of this definition. The Level Four quanti-tative safety goal objective recomended by the staff is as follows:
Theoverallmeanfrequenegofcoredamageevents should not exceed 1 x 10' per reactor year.
This frequency is consistent M th the ACRS proposed objective.
In its Safety Goal Policy Statement the Commission indicated that it ".... intends to pursue a regulatory program that has as its objective providing reasonable assurance, while giving appropriate consideration to the uncertainties involved, that a severe core damage accident will not occur at a U.S. nuclear power plant."
In its Severe Accident Policy Statement (August 8, 1985) the Comission indicated that it.... fully expects that venders engaged in designing new standard (or custom) plants will achieve a higher standard of severe accident safety performance than their prior designs."
It is of interest to note that the recent report developed by the International Nuclear Safety Advisory Group (INSAG),
i s t 3
The Commissioners 13
" Basic Safety Principles for Nuclear Power Plants" (No.
75-INSAG-3, 1908) endorses a more stringent target for future plants for the likelihood of occurrence of severe core damage, although not necessarily implying that this should be a regulatory objective.
The question is, of course, related to the aggregate risk of nuclear power plants in the United States if there should develop further growth in nuclear generating capacity in the future, as well as to the fact that the experience with licensing and operation of current plants has provided a sound basis for technological improvements or innovations in new designs to make them even safer. As a separate objective, and to aid in the establishment of proposestouse10'gurestandardizedplants,thestaff requirements for fu per reactor year as a mean core damage frequency target for each design, noting that each design can become a general class of plants in the future.
As indicated earlier, the ACRS suggested two additional objectives for Level Four of the hierarchy.
The.first would be a containment performance objective expressed as a limit on the likelihood of a large release for the entire family of core melt scenarios.
Such an objective, taken in conjunction with a core damage frequency objective, can be viewed as a generic quantification of the traditional principle of defense-in-depth.
The staff believes that this could act as an unnecessary and even undesirable constraint on the balance between accident prevention and accident mitigation.
For this reason, discussed more fully in Enclosure 1, the staff makes no recommendation at this time for such an explicit containment performance objective, preferring the use of the large release guideline to express an objective for the combined effectiveness of accident prevention and mitigt. tion.
The second additional Level Four objective suggested by the ACRS would be an expression intended to measure how well a plant is operated.
While fully recognizing how important to safety this matter is, the staff cannot at this time make any reconciendations as to how such an objective might be quantitatively defined.
l, T.,
s i
lhe Commissioners It, Table 3 provides a summary of the Level Two, Three, and Four safety goal objectives proposed to be used by the staff.
2.
Comparing PRA Results to Safety Goal Objectives i
The quantification of safety goal objectives requires clarification to assure consistency of application.
In particular, it is the staff's intention that each quanti-fled safety goal objective in Levels Three, and Four of the hierarchy is to be understood to encompass all contributing initiating events (internal and external) except sabotage.
The Commission has aircady expressed the same intent with respect to the QH0s (Level Twu) in its Safety Goal Policy.
This would mean that the testing or sampling program on specific plants, as envisioned by the ACRS, should be carried out using full scope PRAs to the best of their capability to account for all initia-ting events, in order to make a fair comparision with the l
safety goal objectives.
Less than full scope PRAs can be useful for dealing with many generic safety issues, however and can be produced at lower cost.
The staff proposes to continue the use of additional subsidiary objectives in the analysis of these issues as identifice below.
It is also important to recognize that PRA practice has not yet arrived at standardized methodology for the treatment of uncertainties.
Thus, " bottom line" results have frequently"been single valued " point estimates" or "best estimates, propagated through the analysis without regard to uncertainties, or expressed as means, medians, or some other characteristic of a distribution of possible " bottom lines" when the uncertainties are pro-J pagated through the analysis.
The Safety Goal Policy Statement itself specifies mean values for the Ouanti-tative Health Objectives and for the large Release Guideline.
The staff proposes also to define the plant performance objective in terms of mean values of a distribution.
in principle, therefore, a fair comparison of the results of a particular PRA with any of the Safety Goal Objectives requires that the PRA results be expressed also as mean values.
PRA analysts and reviewers therefore should exercise caution in drawing conclusions based upon a comparison of PRA results with
0 The Commissioners 15 l
Safety Goal Objectives if the former are not expressed as mean values.
3.
Subsidiary Objectives To make use of PRA information of less than full scope 4
the staff proposes to use the following guidelines:
(a)
For PRAs that include internal events only, 2
subsidiary objectives that are equal to the
]
quantitative objectives in Levels Two Three, j
and Four of the hierarchy may be used for comparison purposes.
The apparent anomaly in i
this guidance should not be construed as a partitioning of risk between internal and external events, but as a reflection of the staff judgment that PRA bottom lire summary numbers that may differ from one another by a factor of two or three among different analysts on the same plant or design cannot typically be regcrded as definitive differences.
1 (b)
For PRAs that focus on a limited range of initiating events, subsidiary objectives less than the quantitative objectives in Levels Two.
Three, and Four of the hierarchy may be used for comparision purposes. Judgment must be exercised in the light of the scope of the events under consideration in partitioning the safety goal objectives.
It is expected that this guidance will continue to be applied when l
the PRAs are useo to assist in the resolution of generic safety issues.
D.
Guidelines for Conduct of Cost-Benefit Analyses The staff has reviewed the opinion expressed by the Office of General Counsel in the matter of considering averted onsite costs in backfit analyses.
This opinion indicated that such costs should be considered as an offset against other licensee costs, in order to calcu-late a licensee's net backfit cost, but not as a factor contributing to a finding that a given proposed backfit would bring about a substantial increase in protection to public health and safety.
The staff recommends Commission concurrence in this opinion and proposes to
,m.
~
~
~
[ g ;.
y y
,/
The Commissioners 16 update the relevant geldance documents as necessary to reflect this opinion.
This as well as other cost-benefit issues are discussed in Enclosure 2.
As to the surrogate of $1000 per person-rem within 50 miles, the staff has concluded that this continues to be a satisfactory criterion for use in cost-benefit analysis and does not propose any change at this time.
Recomendation:
I recomend Comission approval of these plans to extend the Safety Goal Policy guidelines to the staff for regulatory implementation, incorporating specifically the proposed structure, definitions, and use of qcantitative objectives as described in Sections A.-B, and C, and that the staff be directed to prepare a conforming amendment to the Safety Goal Policy Statement to incorporate these additional guidelines, primarily in Section V of the-policy statement, to be completed by the end of FY89.
I also recommend Comission approval of the proposed incorporation of averted onsite costs as an offset of other licensee costs in staff cost-benefit analyses.
Finally, I request direction from the Comission as to whether it wishes to incorporate in an amended Safety Goal Policy Statement a clear relationship between the policy and the statutory standard of adequate protection along the lines discussed herein.
1 Coordination:
The Office of Nuclear Reactor Regulation concurs in these staff recommendations.
The Office of General Counsel has reviewed this paper end has no legal objec-tion to it, but notcs that the potential effects of the recent 1.imerick decision on matters covered by this paper are not clear at this time.
'?
/
Vic65t110,'Jr.j Executive Director for Operations Encle',ures :
j 1.
Jptions for Specifying Safety Goal Objectives 2.
Cost-Benefit Considerations i
3.
Responses to Questions Raised by (former)
Comissioner Bernthal
p
.: a i'
17 I
i Commissioners' comments'or consent should be provided directly
[
Lto the Office of the Secretary by.c.o.b. Friday, April,28, 1989.
Commission Staff Office comments, if any, should be submitted i
to the Commissioners NLT Monday, April 10, 1989, with an-(
information' copy to the Office of the Secretary.
If the' paper i
is of such a nature.that it requires additional time for analytical review and comment, the Commissioners and the
- Secretariat should be apprised of when comments raay. be expected.
i:
i '
This paper isftentatively scheduled for discussion at an Open Meeting on Thursday,' April 13, 1989.
Please. refer to'the L
appropriate Weekly commission Schedule, when published, to ~
L confirm.the specific date and time.
DISTRIBUTION:
Commissioners OGC h
OIA 4
GPA
' REGIONAL OFFICES 3
- EDO-
3 SECY t
l<
l r
1 I
w
- y... J1)g y
.w
' 3 /g[. 4 : ;
a,
. oc T t ;;' +
,%lf y-
@g y
- ((ih in-i[i '..
.,.4-w:
[
j..;.
Safety Goal
- Hierarchical PRA:
- Level!
Level lit 1 ;
Gif ',
i*
One
.N/A t
Two
/-
I
/
II
/-
III
- /.
.j.
Consequence l!"
Mitigation.
4 I'
r i
[
- Three
/
I
'/ ~
-II
/'
i-Accident Hitigation
' Four.
/
I
/
Accident-i Prevention Five' N/A h
4
' FIGURE 1 RELATIONSHIP OF SAFETY GOAL OBJECTIVES T0 PRA LEVELS rag
} }l_
t T
41 b't :. h;,
e e-
TABLE I PLANTS WITil PRA'S AVAILABLE TO NRC STAFF ANALYST /
PLANT PRA PRA i
NO.
PLANT PROGRAM TYPE LEVEL STATUS NO.
COMPLETE I
1 ANO-1 TAP A-45 B&W 3
COMPLETE 2
2 BIG ROCK POINT INDUSTRY BWR1 3
COMPLETE 3
3 BROWNS FERRY-1 1 REP BWR4 MK1 1
COMPLETE 4
3 BROWNS FERRY-1 INDUSTRY BWR4 MK1 3
COMPLETE 5
4 BRUNSWICK 1 INDUSTRY BWR4 MK1 1
COMPLETE 6
5 BRUNSWICK 2 INDUSTRY BWR4 MK1 1
COMPLETE 7
6 CALVERT CLIFFS IREP CE 1
COMPLETE 8
i 6
CALVERT CLIFFS RSSMAP CE 1
COMPLETE 9
1 COMPLETE 10 1
8 COOPER TAP A-45 BWR4 MK1 3
COMPLETE 11 9
CRYSTAL RIVER-3 IREP B&W 2
COMPLETE 12 10 CRYSTAL RIVER-3 INDUSTRY B&W 1
COMPLETE 13 10 GESSAR 11 INDUSTRY BWR 3
COMPLETE 14 11 GRAND GULF-1 IDCOR BWR6 MK3 3
COMPLETE 15 11 GRAND GULF-1 RSSMAP BWR6 MK3 1
COMPLETE 16 11 GRAND GULF-1 NUREG-1150 BWR6 MK3 3
COMPLETE 17 12 INDIAN POINT-2 INDUSTRY W4 3
COMPLETE 18 13 INDIAN POINT-3 INDUSTRY W4 3
COMPLETE 19 14 LASALLE-2 RMIEP BWR5 MK2 3
IN PROGRESS 20 15 LIMERICK-1 INDUSTRY BWR4 MK2 3
COMPLETE 21 16 MILLSTONE-1 1 REP BWR3 MK1 1
COMPLETE 22 17 MILLSTONE-3 INDUSTRY V4 7
COMPLETE 23 18 OCONEE-3 RSSMAP B&W 2
COMPLETE 24 18 OCONEE-3 EPRI/NSAC B&W 3
COMPLETE 25 19 PEACil BOTTOM RSS BWR4 MK1 3
COMPLETE 26 19 PEACil BOTTOM IDCOR BWR4 MK1 3
COMPLETE 27 19 PEACII BOTTOM NUREG-1150 BWR4 MK1 3
COMPLETE 28 20 POINT BEACII-1 TAP A-45 W2 3
COMPLETE 29 21 OUAD CITIES-1 TAP A-45 BWR3 MK1 3
COMPLETE 30 22 SEABROOK INDUSTRY V4 3
COMPLETE 31 23 SEQUOYAll IDCOR W4 IC 3
COMPLETE 32 23 SEQUOYAll RSSMAP W4 IC 1
COMPLETE 33 2 3 SEQUOYAll NUREG-1150 W4 IC 3
COMPLETE 34 24 Si!OREllAM INDUSTRY BWR4 MK2 3
COMPLETE 35 25 SP-90 INDUSTRY APWR 1
COMPLETE 36 26 ST, LUCIE-1 TAP A-45 CE 3
COMPLETE 37 27 SURRY NUREG-1150 W3 SA 3
COMPLETE 38 27'SURRY RSS W3SA 3
COMPLETE 39 28 THI-1 INDUSTRY B&W
?
COMPLETE 40 29 TURKEY POINT-1 TAP A-45 W3 3
COMPLET6 41
'30 YANKEE ROWE INDUSTRY W4 3
COMPLETE 42 31 ZION IDCOR W4 3
COMPLETE 43 31 ZION INDUSTRY W4 3
COMPLETE 44 31 ZION NUREG-1150 W4 3
COMPLETE 45
g.
.o.
4
~..-
f i
4 R
i
'i TABLE 2 i
U CANDIDATE AREAS
- FOR ANALYSIS Fi 0F REGULATORY REQUIREMENTS l
r Human Performance Reliability of r,cootor Systems Accident Management Seismic-and Fire Protection i
Reactor Accident Risk Analysis Severe Accident Policy Implementation.
Generic and Unresolved Safety Issues
-Standardized and Advanced Reactors l
Regulatory Improvements r;
i'
+
Program Elements or Activities in Five Year Plan a
)
h 5
,-s
.a
-n w-,
'y if.
j
^
'e' j
t
[
i l
c TABLE 3 l
SAFETY GOAL OBJECTIVES i! -
i.
il' Individual Individual t
Level Two:
Early Mortality Risk Cancer Mortality Risk 5-x 10'7/R-Y 2 x 10-6/R-Y Level Three:
Large Release - Potential i
for Offsite Early Fatality 10-6/R-Y(1)
' I Surrogates:
1.
1 or more early fatalities 2.
Early containment failure and pathway to environment Level Four:
Core Damage Frequency II) 1 x 10'4/R-Y f
(For Future ALWR Designs:
1 x 10-5/R-Y) i I
-(1)LOverallmeanfrequency R-Y Reactor-Year
.-pv$',~-
y v
--.e ye._,
3 w.
g
- +- -
r-,
9 ENCLOSURE 1 SAFETY GOAL OBJECTIVES OPTIONS FOR DEFINING A LARGE RELEASE AND PLANT PERFORFANCE OBJECTIVES 1.
INTRODUCTION In a memorandum dated November 6, 1987 (COML2-87-30/87-34), Commission guidance on Implementation of the NRC's Safety Goal Policy, the staff was requested to prepare option papers as follows:
"The staff should submit for Commission's approval an options paper addressing a range of definitions for a large release of radioactive materials, including defining a large release in terms of quantity of fission products.
Industry goals being applied to advanced reactor design programs should also be discussed.
The definition of a "large release" should encompass the Chernobyl accidental release."
"The staff should submit for Commission consideration an options paper for specifying appropriate Level Four (See ACRS 5/13/87 letter
---) performance objectives, which can be used in making decisions as to whether specific regulations or regulatory practices are consistent with criteria of Levels One, Two, and Three.
As noted by ACRS, these objectives should be an expression of the effectiveness of plant accident prevention and mitigation systems (e.g. containment performance), as well as plant operations."
This enclosure constitutes the staff response to these two requests.
These options have been evaluated by the staff in terms of the following criteria for linking the hierarchical levels of safety goal objectives.
The first four were suggested by the ACRS.
Each subordinate level:
(1) Should be consistent nith the level above.
(2)
Should not be so conservative as to create a de facto new policy.
(3) Should represent a simplification of the previous level, (4)
Should provide a basis for assuring that the Safety Goal Policy objectives are being met, (5) Should be defined to have broad generic applicability.
.(6) Should be stated in terms that are understandable to the public, and (7) Should generally ccmport with current PRA usage and practice.
l l
4 2
ENCLOSURE 1 In the following, the reader should be aware that the meaning to be ascribed to the term "overall mean frequency" is given in the main part of the Commission paper to which this is enclosed.
II.
Defining A large Release The concept of a large release can suggest that a threshold defini-tion is desired, i.e. given the potential for a broad spectrum of possible releases, not all should be considered as large.
Before proceeding with a discussion of definitions however, it should be recognized that the large release guideline itself is inherently more conservative than either of the Level Two Quantitative Health Objectives (QHO).g At an overall mean frequency of less than 1 in 1,000,000 per year, g y release definition would result in average i
individual risks of exposure to that release that are less than those implicit in the QH0s. This is due to the fact that (1) the latent cancer mortality risk objective is already greater by a factor of 2 than the large release guideline frequency, and (2) wind rose; considerations alone reduce the risk of individual exposure to any release by substantially more than a factor of 2.
This latter consideration follows from the definition of an average individual given in the Safety Goal Policy Statement.
Thus, alternative definitions of a large release threshold can reflect varying degrees of conservatism with respect to the QHO but can never be equivalent to either QH0.
It has already been noted in the Safety Goal Pol hy Statement itself that the early mortality risk objective is the controlling one. This conclusion is clearly demonstrated for the five LWRs treated in NUREG-1150 (Draft).
In the following dis-cussion, therefore, the focus of the consistency criterion is en early mortality risk and the staff sees no need for making any recommendations for subordinate objectives relating to the QH0 for latent cancer mortality risk.
Defining a large release in the context of a large release frequency objective is analogous to the task of defining core damage or core melt.
Difficulties in defining the latter were highlighted in the April 12, 1988 ACRS letter.
The principal options for definitions of a large release that the staff has considered are in terms of offsite health effects, offsite doses, magnitude of release as a quantity of 1
The early mortality risk QH0 represents a 5 x 10'7 per year objective for an average individual wi QH0 represents a 2 x 10'ghin one mile. The latent cancer mortality risk per year objective for an average individual within ten miles.
(NUREG-0880, Rev. 1) t
c p
3 ENCLOSURE 1 U
fission products, and containment failure modes.
A technical problem common to any option, but, particularly manifest in the second and third, is the fact that the distribution of many proposed measures of a large release are continuous in nature without any discrete break point.
For example, if a large release were to be defined as some number of curies of activity, the uncertainties inherent in the L
calculation of release magnitudes in a PRA are such that a sharp distinction between a calculated value of X curies and X-1 curies cannot be considered significant.
But in principle if X curies defined a large release, then, a slightly smaller number would not be a large release.
This problem is, of course, exacerbated if X is a relatively large quantity.
For this reason, the staff recommends a qualitative definition of a large release for Level III of the p
hierarchy, as follows:
A large release is a release that has a potential for causing an offsite early fatality.
The staff believes that this definition meets all of the criteria for a safety goal objective at this level of the hierarchy.
In addition, it should be appsient that it clearly implies releases much larger than occurred at TMI-2, but would encompass a release of the magni-
'tude that occurred at Chernobyl even though, after the fact, that release did not result in offsite early fatalities.
The following discussion foceses on the attributes of possible definitions of a large release that have been considered for quantitative specification of a discrete threshold value for a large release.
A.
Offsite Health Effects The staff previously proposed to define a large release as the collection of all releases that would result in one or more early fatalities.
Such a definition can be viewed as actually displacing the early mortality Quantitative Health Objective.
It is not so much i
a definition of a large release as it is a redefinition of the entire i
large release guideline, to the effect that the overall mean fre-quency of occurrence of one or more early fatalities offsite should not exceed 1 in 1,000,000 per year.
A demonstration of its use in draft NUREG-1150 shows that for the five plants studied it is more stringent than the Level Two objective.
It also incorporates site related factors that require the performance of a Level III PRA to test. The site related factors include meteorology, population distribution, and estimates of the effectiveness of emergency plans.
When Level III PRAs are available, however, it is conventional l
)
4 ENCLOSURE 1 practice to display early fatality consequences in the form of a complementary cumulative distribution function (CCDF) and the com-parison with this definition can be made directly from such a representation.
This definition has considerable merit and satifies most of the criteria identified earlier.
It does not satisfy the third criterion here, i.e. simplification of scope, and it is not clear whether or not it would be deemed to satisfy the second criterion.
A particular merit of this definition, however, is its broad generic applicability to any kind of plant, including) advanced reactors of the type being sponsored by DOE.
(Criterion 5 A variation on this option can be defined to accommodate the simpli-fication criterion.
This would eliminate the need for a plant specific Level III PRA (but not the need for consequence calcula-tions) by specifying a set of standard or reference values for all of the site related factors.
This would have the advantage of focusing
- more directly on the combination of plant accident prevention and mitigation features and afford a fairer safety comparison among different plants without the variations of site specific factors that affect overall risk.
Given the availability of a Level !! PRA, the performance of the necessary consequence calculations to test the objective is a relatively simple and inexpensive matter.
I The staff proposes to continue to test this option, as a potential surrogate for the recommended qualitative definition of a large release, particularly with respect to the degree of conservatism that it may introduce when compared to the QH0 for early mortality risk.
For this purpose, the staff proposes to select reference values of site related factors that approximate average values for U.S. sites.
B.
Offsite Dose The use of an individual dose definition of a large release is attractive because the use of dose criteria has been conventional practice in rules and regulatory practices, e.g. the 25 REM whole body guideline value in 10 CFR Part 100. Although not always dis-played, the analytical methods used in Level III PRAs produce intermediate results of individual doses since the health effects models require such information.
Any definition of large release in direct terms of offsite doses would require for comparison purposes consideration of site related factors, i.e. either a Level III PRA or a reference site.
As in the case of offsite health effects, the use 4
of a dose is not so much a definition of a large release as it is a restatement of the guideline, e.g. the overall mean frequency of l
l
4 5
ENCLOSURE I a
exposure to any offsite individual resulting in 6 dose of X REM or more should not exceed 1 in 1,000,000 per year.
If the value of X is greater than the threshold value for early fatality then it would retain some consistency with the early mortality Q)HO.
Smaller values ofXwouldmakeitamorestringent(conservative guideline and a de facto new policy.
It would also introduce a 1;rger increment of risk aversion when compared to risks from normal operational releases, in addition, such a guideline as written would require also a,speci-fication as to whether "any individual" means a maximally exposed individual or an average individual. This distinction was, of course, addressed in the Safety Goal Policy Statement in the context of the QH0s where the reference is to an average individual.
The use of dose criteria in regulatory requirements, however, typically refer to maximally exposed individuals.
It has also been suggested that it would be useful to understand the relationship between a quantified large release objective and criteria for defining an Extraordinary Nuclear Occurrence (ENO). A definition of a large release in terms of dose or dose rate could be seen as making that relationship more apparent.
On the other hand, should the need arise, it might be equally or even more instructive to ask, given the proposed definition of a large release, what the mean frequency of occurrence of a releas'e that would trigger the ENO criteria might be.
A similar question can be asked with respect to other dose criteria in other parts of the regulations or guidance documents, such as the dose guidelines in 10CFR 100, or the Protective Action Guides (PAG) that are recomended for offsite i
i On balance, the staff recommends that the large release objective not be defined in dose terms in the form considered above since such definitions would not significantly comport with criterion (3) and many possible definitions would not compvrt with criteria (1) and (2).
C.
Magnitude of Release to the Environment In this and in part D following this section, optional definitions i
are considered that require results only from level 11 PRAs.
Although somewhat complicated by the fact that a large number of radionuclides are involved, a large release can be defined directly as a source term magnitude.
It is common practice in PRAs to express source terms as percentages of core inventories of the chemical elements, or groups of elements, that represent the radionuclides present at the time reactor trip occurs (typically at full power operation).
For each element or group, the reduction from 100% of i'
l
'""';....----..'-.-------....-.m f
j,_.-
7 6
ENCLOSURE 1 I
the initial core inver, tory reflects the extent to which: mitigation L
systems and physic 61 and chemical phenomena act to prevent their escape-to-the environment. Table 1, reproduced from the Reactor Safety Study (WASH-1400), displays the source term (release category) groupfngs developed in that work.
This traditional method of characterizing source terms does not incorporate changes in radionuclide composition due to radioactive 1
decay prior to release to the environment. The decay of radionu-clides is independent of other physical and chemical changes and is taken into account in the consequence calculations in a Level Ill PRA starting from the initial core inventory. A nm accurate perception of the relative magnitudes of source terms would be-obtained if the entries under each element group reflected the extent of decay prior to the time of initial release.
For the BWR 2 and 3 release c
[
categories for example, the 30 hour3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> decay prior to release would actoM'y represent a substantially smaller fraction of the noble gue, celeased, m
Inspection of the r & mse fractions for each of the element groups in
-3 Table 1 suggests a :wsible basis for recognizing by inspection a potential threshold definition for a large release in terms of the release fractions of the noble gases and one or more of the other groups. Thus, Niease categories PWR 1 through PWR 6 and BWR 1 through BWR 4 show substantial release fractions above 1% and might be considered-large. !All of these releases are associated with core melt and significant containment function failure.
NUREG-1150 (Draft) displayed information showing-the relative contributions of E
source term groups to both early and latent ' cancer mortality (e.g.
Fig. 6.11 of Vol. 1).
For early mortality virtually all groups niake a contribution, inciuling noble gases. On inspection.of similar source term characterizations from other PRAs, the staff would expect that any source term involving the release of virtually all of the F
noble gases, and about 1% or more of any of the other source term element groups would qualify as a large release and be compatible P-with the recommended qualitative definition. The staff would regard
[
this as a rule-of-thumb or common sense approach to the identificatiun of large releases, but it does not qualify as a precise threshold definition.
D.
Containment Failure w
An important product of a Level 11 PRA is a set of containment failure modes. These are interconnected with plant damage states in matrix form to reflect the probability (or range of probabilities) that each plant damage state leads to each particular containment s-L
m I'
7 ENCLOSURE 1
. failure mode.
The staff has observed that Level 11 PRA analyses can make reasonable distinctions between relatively early containment failures, i.e. releases starting within a few hours of the initiating event, and late containment failure.
In general, it is the early containment failures that give rise to the source terms that dominate the' residual risk to public health and safety, particularly with 4
respect to early mortality risk.
A definition of a large release focusing on early containment failure is a simplification that would comport strongly with the early mortal,ity risk quantitative health objective of Level II of the hierarchy.
This presents still another option for defining a large release, as t
follows:
A large release is any release from an event involving severe core damage, primary system pressure boundary failure, and early containment failure.
This definition focuses on the circumstances that give rise to a direct pathway for the transport of radioactive material from a damaged core to the environment.
It can also be regarded as a restatement of the large release guideline, to the effect that the overall mean frequehcy of early containment failure for core damage and primary system failure events should not exceed 1 in 1,000,000 per reactor year.
Adentages of this definition incluae the likelihood of reasonable public understanding of its meaning, and the fact that it does not incorporate source term uncertainties in its computation.
The staff considers that this definition has merit, but is limited to application to reactors of conventional design, i.e. with containments.
As an example of an application of this definition, calculations performed for NUREG-1150 Draf t for Surry have been used to develop summary mean frequency numbers that can be compared with modes (ge release guideline (Table 2). bins) were identified, of which thirtee the lar Eighteen centainment failure 2
, failures.
Each of the latter has the potential for releases that could cause an early fatality.
The overal containment failure is found to be 5 x 10"g mean frequency of early per reactor year by this i
metgodwhendirectcont6inmentheating(DCH)isincluded,and2x 10~ per reactor year without DCH.
The. staff proposes to continue to test this optional definition also, as a potential surrogate for the recommended qualitative defiaition of a large release for light water reactors that employ the l
l
t-8' ENCLOSURE 1
=.
conventional three barrier defense-in-depth design features to mitigate releases, i.e. fuel cladding, primary system boundary, and containment'.
III. Plant Performance Objectives The ACRS recommended that Level Four of the hierarchy should include three performance objectives.
These would be expressions of (1) the effectiveness of plant accident prevention systems (2) the effect-iveness of the design of plant accident mitigation systems, and (3) how well the plant is operated.
Following is a discussion of con-siderations for specifying objectives for these.
A.
Accident Prevention Objective The ACRS recomended a goal of "less that 10~4 per reactor year for 1the mean core melt frequency....," noting that the term core melc was to mean loss of adequate core cooling which can result in severe core damage.
As noted in the main body of this Commission papor the staff prefers the term core damage but with the same meaning suggested by the ACRS.
!'ConsistencywithtgeLevelThreeobjectivewould,ofcourse,placea lower limit of 10~ on this specification, Available PRA evidence to date suggests that current plants, on the whole, probably are configured such that the overall mean c bably near but still somewhat above 10~gre damage frequency is pro-per year.
It is expected that future plants can and should do better than this.
It is also expected that progress will be made in future PRAs to reflect the staff's technical judgment, also shared by the ACRS, that the like-lihood of reaching the core-on-the-floor stage is less than the likelihood of loss of adequate core cooling.
The realization of this i
judgment is reflected in the current efforts to develop and put in place accident management programs.
Given the foregoing the staff recommendhtion for an aspirational objective for accident prevention is the following:
Theoverallmegnfrequencyofcoredamageeventsshouldnot exceed 1 x 10~ per reactor year.
The staff believes that this objective places a primary emphasis on accident prevention and will provide reasonable assurance that a severe core damage accident should not occur at a U.S. nuclear power plant.
If each of the current population of approximately 100 plants had a calculated core damage frequency approximating this overall
9 ENCLOSURE 1 4-mean value, it would imply the overall occurrence of such events, on average, at a frequency of about once in a hundred years, a time interval longer than the expected lifetime of any single plant.
As a subsidiary objective, and to aid in the establishment of staffproposestouse10gandardizedlightwaterreactorplants,the requirements for future s 4
per reactor year es a mean core damage frequency target for each such design, noting that each design can become a general class of plants in the future.
B.
Accident Mitigation Objective The term accident mitigation can be taken to refer to all measures taken to lessen or mitigate immediate, near term, or long term consequences of core damage, depending upon how far the accident progresses.
An accident mitigation objective can be. viewed as a means of quantifying more explicitly a defense-in-depth philosophy in the basic design and operation.of nuclear power plants.
A defense-in-depth approach to regulation reflects an awareness of the need to make safety judgments in the face of some residual-uncertainty; in effect, not putting all the eggs in one basket.
A major application of this approach has been manifest in the engineering design of light water reactor plants through the principle of requiring three successive barriers to the release of radioactive materials to the environment.
These three barriers are the fuel cladding, the primary coolant system boundary, and the containment.
Variations and advances in reactor safety technology associated with the relative reliance on passive or active features of the barriers and on the likelihood of passive or active failures are key considerations in risk assessment.
The general plant performance objective expressed in the form of the large release guideline, in and of itself, would permit broad flexibility in design to achieve the objecthe, including the actual elimination of, for example, a containment barrier or structure as conventionally understood.
For those designs, however, that adhere to the three barrier approach to defense-in-depth, the development of more specific plant performance objectives (Level Four of the hierarchy) can in principle, give expression to desired levels of performance effectiveness for any one of the thrriers, or any two taken either separately or in combination.
The ACRS has noted that there is "an unquantified, but probably substantial, difference between the probability of loss of adequate core cooling" "and the probability of the core-on-the-floor stage."
The latter represents a significant challenge to the containment, as
. v.
s 10
' ENCLOSURE'1 4
normally understood, but the ACRS notes that there are several stages at which the accident progression (in-vessel) may be errested, and that there are difficult technical issues associated with predicting the progress of a severe accident.
Although the TMI-2 accident demonstrated conclusively that severe core melt accidents can occur without failure of the reactor pressure vessel, the state-of-the-art of PRA to estimate the likelihood of vessel failure given loss of adequate cooling and core damage is, at best, not well developed.
In fact, most PRAs have assumed that the core-on-the-floor stage is reached with a probability of 1.0 given loss of adequate core cooling and onset of core damage.
i Given this_ situation, the ACRS has suggested an objective that focuses on the third, or containment barrier, viz. that "as a minimum the containment performance objective should be such that there is i
less.than one chance in ten for a large release for the entire family of core melt scenarios."
In this context the staff understands the term core melt scenarios to mean all those that do, or are assumed to, result in pressure vessel failure and core-on-the-floor.
This ACRS proposal has the general character of a conditional containment failure probability.
From the foregoing it may be seen that optional expressions for an accident mitigation objective can be formulated as a conditional probability in any of the following ways, (1) the probability of pressure vessel failure (i.e. core-on-the-floor) given core damage, (2) the probability of a large release given pressure vessel failure and core-on-the-floor, or (3) the probability of a large release given core damage. In this context we take the term core damage to be, as a' practical matter, essentially synonymous with loss of adequate core cooling.
Conceptually this.can be thought of as core damage in excess of emergency core cooling system criteria of 10CFR50.46.
Option (1) would be an objective relating to mitigation within the primary coolant system boundary.
This subject area is a primary focus of the evolving accident management program as noted earlier.
Option 2 is the type recommended by the ACRS, focusing on the mitigation capability of the containment under severe accident loads.
Draft NUREG-1150, for example, displays results of calculations for conditional early containment failure for internal events.
(Fig.
Examination of these results shows that there is an extremely broad band of possible outcomes in such calculations.
The staff recognizes that calculations of this type that are possible within the scope 'of a Level 11 PRA convey l
l l
l
11 ENCLOSURE 1
- c information about the effectiveness of containments over a broad spectrum of challenges from severe core damage / core melt sequences.
This includes the fact that there are many such sequences in which failure is not expected to occur as well as many in which failure would, not surprisingly, be expected.
Current staff efforts in the IPE, containment performance improvements, and accident management programs will continue to explore reasonable ways in which containment mitigation capabilities for current plants can be improved for severe accident sequences beyond the design basis.
The staff believes however, that for safety goal purposes, the best perspective is one of integrated performance as expressed in frequency terms rather than conditional probability terms.
This is consistent with the " balanced approach" the staff has taken in the BWR Mark I containment performance work described in SECY-88-206.
The staff believes that the single objectives already identified and recomme'nded for Levels Three and Four of the hierarchy are sufficient for Safety Goal Policy implementation at this time.
Option (3) would integrate in-vessel and ex-vessel performance.
That is, it would represent the combined mitigative capability of the reactor coolant system pressure boundary and the containment.
Given the proposed specifications and definitions of both Levels Three and four objectives, an accident mitigation objective expressed in Option (3) form would be redundant.
C.
Operational Performance Objective The staff fully concurs with the ACRS that "how well a plant is operated" is vital to overall_ plant safety.
It is for this reason that a major emphasis of HRC current efforts is directed toward the upgrading of staff and industry programs to improve plant operations as described in SECY-88-147. Among other things, these include the SALP process, a Performance Indicator Program (SECY-88-103), a proposed rulemaking on maintenance of nuclear power plants (SECY-88-142), and periodic Senior Management' assessments of overall l
performance at individual plants.
Also in place are programs to l
assure that regulatory practices do not inadvertently detract from l
safety, e.g. the Technical Specification Improvement Program.
Risk perspectives on many issues arising in these programs play an l
important role.
l The staff observes, however, that some attributes of good safety practice are not, and some probably cannot be, factored into PRAs.
Progress is being made in the direction of incorporating some human t
,4 4'
s L12 ENCLOSURE 1 4
factors considerations into risk analyses, relating, for example, to-emergency operating procedures. The effectiveness of maintenance practices should eventually be reflected in improved reliability data bases for specific plants.
However, management attitude and effectiveness, and quality of training are examples of factors that may never find their way into PRAs.
In view of the above, the staff cannot recommend at this time, a quantitative operational performance objective in the hierarchy of safety goal objectives.
IV.
Industry Objectives for Advanced Light Water Reactors The utility industry, through the EPRI Advanced Light Water Reactor Requirements (ALWR) Document has proposed to adopt some objectives.
that address severe accidents.
Specifically, EPRI has proposed the following:
1.
An objective for core damage frequency of 10'0 per reactor year, and j
2.
Anadditionalobjectivestatedasfollows: "The dose from I
events whose-frequency exceeds 10' per reactor year must I
be less than 25 REM whole body at the assumed site boundary distance of 0.5 miles."-
The first of these is specified by EPRI as a " quantitative investment protection goal" and the second as a public safety goal that the industry should strive for in future ALWR designs.
The staff be-lieves that these are laudable goals for the industry to adopt, and-l are consistent with the Commission's expectations that designers of I
future plants will strive to make them safer.
They are not however, represented by EPRI as substitutes for the Commission's safety goals and need not be seen as in conflict with the staff recommendations i
herein.
The second goal above bears a strong resemblance to the large release guideline. Attributes of such a goal have been addressed above.
It is not clear to.the staff at this time just how EPRI would propose to apply their goal but on its face it appears to be a very stringent one that if achieved, would be well within the mortality risk objectives (QH0) set forth in the Commission's Safety Goal Policy Statement.
I
j,
a J
h
" t r
g
,l}l':<,
s i-)
I g
'1
.4' jp y
TABLE 1 4
O
- TdBLE 5-1' *
SUMMARY
OF ACCIDENTS INVOLVING CORE
^
I DURATION WMU4ING EIEVATION
- A TIME OF Of T1HE FOR Or RE11ASE FRA 10N OF COPE IWDrf0RY pr1 EASED I
RE12ASE RE1 EASE EVACUATION RE12ASE CA15tatY Reactor-Yr (Hr)
(Hr)
(Kr)
(Meters) (10 Stu/Hr) 3e*Kr Org. I 1
Ca*Rb Te-Sb R4*Sr Ru la '"I i MMAASE '
r 0
!M1 9x10' 2,. 5 0.5 1.0 25
' 520(d)
, hs 6x10 0.7 0.4 0.4 0.05 0.4 3x10'3
- 3
- 3 M2 8x10' 2.5 0.5 1.0 0
170 0.9 7x10'3 t.1 0.5 0.3 0.06 0.02 4x10
- 3 M3 4x10' 5.0 1.5 2.0 0
6 0.8 6x10 0.2 0.2 0.3 0.02 0.03 3:10 M4 5x10 2.0 3.0 2.0 0
1 0.6 2x10 0.09 0.04 0.03 5x10'# 3x10 4x10
- 7 PwR 5' 7x10' 2.0 4.0 1.0 0
0.3 0.3 2x10' O.03 9x10' 5s10' 1:10 6x10
- 1x10'$
- 3 Pwn 6 6x10 '
12.0 10.0 1.0 0
N/A C.3 2x10' ex10'4 ex10
- 1x10' 9x10 ' 1x10'$ 1x10' PWR 7 4x10 10.0 10.0 1.0 0 '
H/A 6x10' 2x10 2x10*$ 1x10 ' 2x10' 1x10 1x10 2x10
- 8 PWR S 4x10 0.5 0.5 N/A 0
N/A 2x10' 5x10' 1x10 5x10 1x10 1x10 0
0 5
- II ftra 9 4x10 "
0.5 0.5 N/A 0
N/A 3x10 7x10 1x10' 6x10' 1x10
1x10 O
0 7x10'3 0.40 0.40 0.70 0.05 0.5 5x10'3 BWR 1 1x10
2.0 2.0 1.5 25 130 1.0
' WWR 2
-6x10 30.0 3.0 2.0 0
30 1.0 7x10' O.90 0.50 0.30.
0.10 0.03 4x10' 7x10'I 0.10 0.10 0.30 0.01 0.02 3x10 aut 3 2x10f 30.0 3.0 2.0 25 20 1.0
- 3 4x10'3 6x10 6x10 1x10 WWR 4 =
2 0 '
5.0 2.0 2.0 25 N/A 0.6 7x10 exio
- 5x10 5x10 2x10 ' 6x10~1I 4x10 ex10-12,,3n-14 0
0
- d
~ BWR 5 1x10 3.5 5.0 N/A 150 N/A b) A discussion of the isotopes used in the study is found 1.n Appendix VI.
Background on the isotope groups and release mechanisms is found in AppendLx VII.
(b) Includes Mo, Rh,' Tc, Co.
(1) lacaudes Hd, Y, Ce, Pr,14, Nb.Aa, Ca. Pu, pp, Er.
C) A lower energy release rate than this value applies to part of the period over which the radioactivity is'being released.
1%e effect of lower energy release sates on consequences is found in Appendix VI.
From Reactor Safety Study WASH-1400 I
l 1
l l
TABLE 2 MEAM CONTA1!O1ENT FAltt!RE MODE FREQtfENCY (StlRRY)
Mean Conditional ~obabilityofContainmentRjlease
-Cont.Fa11urgMode",
Modes Given Pla-osmage State / Frequency (Yr-)
Freq. Per 10 Reactor Years SYYB SNNN.
'AYNI AYYB THNN TYYBU TYYB0 V
Containment Failure Mode 7.1E-06 5.7E-06
'8.2E-08 1.0E-06 1.9E-06 1.0E-06 1.1E-06' 9.0E-07 0.16 0.0363 0.0047 0.0040
- 0.0139 1.
Early overpressure; high RCS pressure; 0.006 spray failure 0.0034 0.0026
=
=-
0.09 2.
Ssme as 1; sprays operate 0.0006 0.0008 0.0301 3.
Estly overpressure; Icw or moderate RCS 0.0049 0.09 pressure; spray failure 0.0387 0.0001 0.0001 4.
Same as 3; sprays operate 0.0031 0.08 1.0000 5.
Containment failure precedes core meltdown
=--
0.00 6.
Containment isolation failure; sprays fall 0.03 0.0019 0.0015 0.0014 0.0014 7.
Conteinment isolation failure; sprays 0.0017 0.0017 0.8128 0.74 operate S.
Containment bypass with submerged release 0.0700 t
0.0700 0.1872 0.38 9.
Containment bypass without water scrubbing /
or induced steam generator tube rupture 0.2307 0.0628 0.0503 2.35
- 10. Same as 1. but with direct beating 0.0001 0.3145 0.34 0.1803 0.1447'
- 11. See as 2. but with direct heating 0.22 0.0004 0.0000
- 12. Same as 3. but with direct heating 0.0314 0.66 0.0011
- 13. Sme as 4. but with direct heating 0.0920 All Esrly Containment Failure (Modes,1-13) 0.1332 0.3301 1.0000 0.0722 0.3385 0.2533 0.2739 1.0000 5.2 5.8 0.3799 9.2336 0.1057 0.1282 Late Containment Failure 0.3894 0.3031.
8.5 0.5479 0.4279 0.6410 0.5979 0.4774 0.3668-Sum of all Conditional Probabilities T.'UUM TUDU6 TUUDO T.TuGU TiUBJJ T.TdM TGOM TOMO No Containment failure t
containment heat LOCA leading to low pressure in the RCS prior to vessel breacn. with RWST inventory discharged to containment:
AYY8 removal, spray injection, and spray recirculation are all available.
Small LOCA with intermediate pressure in the RCS prior to vessel breach and RWST inventory discharged to containment; containm SYYB heat removal, spray injection. and spray recirculation are all available.
Small LOCA with intercediate pressure in the RCS prior to vessel breach; no RMST inventory is discharged to containment and the Note that this implies that there will be very limited water avaliable in the ShNN containment spray systems are not available.
Intact RCS prior to vessel breach, with no RWST Inventory discharged to containment and the containment spray systems not reactor cavity.
Note that this implies that there will be very limited water available in the reactor cavity. Intact RCS pri TNNN TYYB recti.ulation are available.
Interfacing-system LOCA.
LOCA leading to low pressure RCS prior to vessel breach, with RMST in,entory discharged to containment; V
containment spray injection successful but no containment heat removal and no spray recirculation.
ANYI ENCLOSURE 1
m_,..m.
r
~
(.c' i
e
,d'-
,h ENCLOSURE 2 COMMISSION QUESTIONS ON COST / BENEFIT ANALYSIS In COMLZ-87-30/87-34 (dated Nov. 6, 1987) the Commission directed the staff to work with the Office of General Counsel to develop an information paper on:
.(1) how the staff would propose to implement 0GC's guidance (June 4, 1987 memo from W. Parler to Commissioner F. Bernthal) on the use of averted on-site costs in backfit analyses, including examples of how recent backfit analyses would be changed, if any, by implementation of the OGC position; (2) whether the issue of averted off-site property damage costs should be included in a more explicit manner in backfit analyses; and (3) whether $1,000/ person-rem remains an appropriate cost / benefit criterion.
1.
Averted On-Site Costs In accordance with June 4, 1987 OGC guidance on consideration of averted on-site costs in backfit analysis, the staff proposes to modify existing regulatory guidance to specify that in conducting backfit analyses, averted on-site costs will be considered as an offset against other licensee costs in order to calculate a licensees net backfit cost.
It will be made clear that averted on-site costs will not:be counted as a benefit and will only be considered after a determination has been already made, in accordance with 10 CFR 50.109, that the proposed backfit will result in substantial increase in overall protection of _the public health and safety or the common defense and security.
Whenestimating(avertedon-sitecosts,considerationwillbegivenwhere1) the cost of de appropriate to of replacement power and (3) repair and refurbishment costs.
l Averted on-site costs have been estimated by the st u f in several recent analyses including the VSI-A44 Backfit Analysis, and the TAP A-45 " Decay Heat Removal" Analyses.
It does not appear that consideration of averted on-site costs would substantially change the results of these analyses.
Averted l
on-site costs were not used in the backfit analysis for the ATWS rule.
l However, if they had been ysed, the conclusion would likely have been the same.
The cost / benefit analyses for the five reference plants in draft NUREG-1150 were done both with and without consideration of averted onsite costs.
A total of 57 proposed improvements were evaluated for the five reference plants (Surry, Zion, Sequoyah, Peach Bottom, and Grand Gulf).
If averted onsite costs are not considered, 3 have a positive benefit / cost ratio (using
- $1,0 M/ person-rem as a surrogate for offsite effects) and 2 are marginal.
If i
l averted onsite costs are considered as a negative costs to the utility, 10 proposed improvements would have a clearly positive benefit / cost ratio.
It should be noted, however, that the use of averted onsite cost will make a difference only for preventative measures (i.e. measures that would reduce the 1
probability of severe core damage).
l l
g-pi i f' 6,
2 ENCLOSURE 2 a+
g
- 2.: Averted Offsite Property Damage Costs OGC in its June 4, 1987 memorandum to Commissioner Bernthal states that the NRC is_ obligated by the language of the Atomic Energy Act to protect off-site property as well as public health.
At the present time the staff uses
$1,000/ person-rem as a surrogate for all averted off-site impacts including property damage costs.
Estimates of off-site impacts have been compared with' the $1,000/ person-rem criterion for a number of potential accidents.
The results of many of these comparisons were summarized for the Commission in'an October 23, 1985 memorandum from W. J. Dircks.
These comparisons indicate the use of $1,000/ person-rem for the population within a 50. nile radius is a -
. reasonable surrogate for all off-site impacts including offsite property damage.
In draft NUREG-1150 total averted offsite costs for proposed backfits to the five reference plants were calculated two ways:
(1) by using the above
$1,000/pergon-remsurrogateand(2)bymong/earlyillnessorcancerfatality tizing.off-site health effects (using $10 /early fatality avoided and $10
- avoided) and adding this to estimated off-,ite property damage costs (including relocation expenses, lost wages, decontamination costs, lost public and private property, and the value of interdicted land and crops)'.
In each case the
$1,000/ person-rent surrogate resulted in estimated averted off-site costs which
. were 3-10 times higher than those estimated by calculating health effects and property damage. costs separately and then summing them.
Based on comparative analyses performed to'date it appears that the $1,000/
person-rem serves as a reasonable surrogate for all off-site cost, including property damage costs, from a severe accident.
Therefore, the staff proposes to continue to use $1,000/ person-rem as a. surrogate for all off-site costs.
However, the staff plans to analyze information available.from the Chernobyl accident,.as.a check on whether cost estimates presently used by the NRC suitably reflect all off-site costs f rom severe reactor accidents.
3.
$1,000/ Person-Rem As noted in the above discussion of averted off-site property damage costs,
$1,000/ person-rem has been found to be a reasonable surrogate for al'l health and property damage costs.
The staff expects to continue use of the
$1,000/ person-rem criterion unless and until information based upon the Chernobyl experience or other new information suggests a need for change.
1 m
9
,n..
4,?
- L.
EllCLOSURE 3 CONCERNS OF FORMER COMMISSIONER BERNTHAL InCOMLZ-87-30/87-34(datedNov.6,1987), staff'scurrentthinkingonthe-following two questions was requested.
i 1.
Population Density Considerations Concern:
1 How population density should be considered in evaluating the overall societal risk criteria.
Response
-The Comission's second safety goal states that societal risks to life and I
I health from nuclear power plant operation...should not be a significant
. addition to other societal risks.
This goal was translated into the quantitative health objective (QHO) that the risk to the population with 10 miles of a nuclear power plant of cancer fatalities that might result from plant operation should not exceed 0.1% of the sum of cancer fatality i
risks resulting from all other causes.
Although the safety goal refers to societal risk, the QHO requires a calculation which is independent of population density.
However, the effect of population density is taken into account to'a large extent in the cost / benefit analysis.
In conducting the cost / benefit analysis, benefits are expressed in terms of reduction in offsite person-rem expected to result from' proposed changes in plant design or operation.
The reduction in offsite person-rem is
-sensitive to the populatign density and distribution around the plant.
For example, a 1982 study. of the then existing 91 U.S. reactor sites, found that the person-rem within 50 miles of a hypothetical SST-1 release varies by a factor of about 30 from the most sparsely to the most densely populated site.
l 2.
Acceptability of a Plant With No Containment Concern:
Whethercoremelgprobabilityalonecouldbeconsideredtomeetthe Comission's 10 per year criterion for a large off-site release, i.e.,
would it be acceptable to have no containment in such a case.
He (former Commissioner Bernthal) notes this is the central policy issue likely to
, come before the Commission in connection with staff's review of the DOE advanced reactor designs.
1 NUREG/CR-2239 " Technical Guidance for Siting Criteria Development" pg.
2-33.
G
- . n<
4
N O 2
ENCLOSURE 3 6.
i.3
-p
Response
If an applicant were able to demonstrate with high confidene that the expected
.coredamagefrequencyforaproposedplantwaslessthan10~g/yr.,theplant j
would meet the large release guideline even if it had no containment.
Although this is not a consideration for plants of present design, it has been proposed
'for the DOE advanced designs.
The prospective use of probabilistic techniques
-and design objectives by the staff lave been described in SECY 88-203, " Key Licensing lssues Associated With DOE Sponsored Reactor Designs "
k Ti i