ML20217F193
| ML20217F193 | |
| Person / Time | |
|---|---|
| Issue date: | 10/12/1999 |
| From: | Powers D Advisory Committee on Reactor Safeguards |
| To: | Dicus G, The Chairman NRC COMMISSION (OCM) |
| References | |
| ACRS-R-1859, NUDOCS 9910200245 | |
| Download: ML20217F193 (7) | |
Text
, ACRSR-1859
. # # - UNITED STATES y
- f k 3 NUCLEAR REGULATORY COMMISSION ADVISORY COMMr! TEE ON REACTOR SAFEGUARDS PDR I
f g WASHINGTON. D.C. 20655-0001 I October 12,1999 I
l
{
i The Honorable Greta Joy Dicus !
Chairman U.S. Nuclear Ragulatory Commission Washington,' D.C. 20555-0001 j
Dear Chairman Dicus:
SUBJECT:
PROPOSED PLANS FOR DEVELOPING RISK INFORMED REVISIONS TO 10 CFR PART 50," DOMESTIC LICENSING OF PRODUCTION AND UTILIZATION FACILITIES" i
I Dur!ng the 466* meeting of the Advisory Committee on Reactor Safeguards, September 30- 1 October 2,1999, we met with representativer., of the NRC staff and Nuclear Energy Institute to !
discuss proposed plans for developing risk-informed revisions to 10 CFR Part 50. We also met l with a repres6ntative of Public Citizen, Critical Mass Energy Project, to discuss these matters and a recent report issued by Public Citizen. Our Subcommittees on Reliability and Probabilistic Risk Assessment and on Regulatory Policies and Practices met on July 13 and September 24,1999, to discuss these matters. We had the benefit of the documents referenced.
Conclusions and Recommendations
- 1. We agree with the staff's proposal to develop a new regulatc,ry section 10 CFR 50.69 and associated Appendix T to implement Option 2 (changing the special treatment rules in 10 CFR Part 50) of SECY-98-300.
- 2. We agree that the current terminology of safety-related structures, systems, and components (SSCs) should be preserved and that additional terminology referring to the safety significance of SSCs should be considered. We recommend that the staff explore the potential benefits of defining more than two categories of safety significance.
- 3. The determination of the safety significance of SSCs relies heavily on the use of l importance measures. These measures are strongly affected by the scope and quality of the probabilistic risk assessment (PRA). For example, incomplete assessments of risk contributions from low-power and shutdown operations, fires, and human performance will distort the importance measures.
9910200245 991012 ,
n IR '
i PDR R-1859 ACRS PDR 04tW 7 AC C)
I I
2 l
- 4. Even with a full-scope, high-quality PRA, the importance measures have limitations. The guidance to be provided in the proposed Appendix T for the categorization of SSCs should clarify the proper roles of (a) importance measures, (b) sensitivity and uncertainty analysis, (c) baseline core damage frequency (CDF) and large, early release frequency (LERF), and (d) the changes in CDF and LERF (i.e., ACDF and ALERF).
- 5. It is essential that the implementation of Option 2 be scrutable and auditable.
The staff should have access to the risk assessments and technical bases documents (e.g., inputs to and deliberations of the expert panel) that licensees use to justify requests.
- 6. The guidance to be provided in the proposed Appendix T for the expert panel should include insights gained from the implementation of recommendation 4 above. The staff sho'uld include guidance for conducting expert panel sessions and training of the panel members on the use of importance measures.
. 7. We agree with the staff's plan for implementing Option 3 (changing rpecific requirements in the body of 10 CFR Part 50 and associated regulations) of SECY-98-300. Policy issues regarding the role of defense in depth in a risk-informed regulatory system should be resolved before the plan is fully -
implemented.
Discussion
'In a Staff Requirements Memorandum dated June 8,1999, the Commission directed the staff to make risk-informed changes to the scope of SSCs covered by regulations that provide special treatment requirements (e.g., quality assurance, environmental qualification, technical specifications,10 CFR 50.59, ASME Code,10 CFR 50.72, and 10 CFR 50.73).10 CFR 50.2 defines safety-related SSCs as those SSCs that "are relied upon to remain functional during and following design basis events to assure: (1) The integrity of the reactor coolant boundary;
. (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; or (3)
The capability to prevent or mitigate the consequences of accidents which could result in
. potential offsite ' exposures...."
To date, the determination of whether an SSC is safety related has been based largely on
' deterministic' analyses that include engineering judgment. Advances in PRAs have made it possible to quantify the degree to which SSCs are relied upon to ensure that the requirements .
In 10 CFR 50.2 are met. For example, using a combination of deterministic and PRA insights, 1 the South Texas Project Nuclear Operating -Company has concluded that many SSCs currently !
categorized as safety-related contribute very little to CDF and LERF, while a few SSCs currently categorized as nonsafety-related are significant from a risk perspective.
The staff proposes to develop a new rule,10 CFR 50.69, and an associated Appendix T. The 3 new rule will_ explicitly allow the use of a new risk-informed scope. Appendix T will provide the !
criteria for the new categorization process. We agree with this approach. l l
l j
+ ..
3 The current " safety-related" and "nonsafety-related' categories will be retained. Two new categories that consider risk information, i.e., high safety significance and low safety significance, will be developed. Appendix T will provide criteria for the new categorization process. The staff proposes to use a 2x2 matrix where SSCs are to be placed in one of the
.four categories according to safety significance and safety-related status, introducing these new categories while preserving the safety-related and nonsafety-related terminology should help to avoid the confusion that could result from a redefinition of the safety-related concept.
We agree that such an approach is preferable to redefining " safety related" and "important to safety."
At this e'arly stage, the staff has not decided what special treatment the SSCs in each of the four categories of the 2x2 matrix will receive. The staff has indicated that this decision may require a finer treatment of safety significance than the two groups to be proposed in
' Appendix T. The South Texas Project Nuclear Operating Company has chosen to consider four groups for safety significance instead of the two that will be proposed for Appendix T.
They are: 1) high safety /r5k significant (HSS),2) medium safety / risk significant (MSS),3) low safety / risk significant (LSS), and 4) non-risk significant (NRS). LSS and NRS SSCs support ancillary functions (e.g., vents and drains) for safety related systems, but do not affect the primary functions of these systems. LSS SSCs may be included in the PRA while NRS SSCs are not.
We believe that the staff should further evaluate the various options for partitioning the range of safety significance before it settles on a grouping that it considers optimum.
. Appendix T will include requirements for categorizing SSCs using PRA. We offer the following comments and suggestions for inclusion in the development of Appendix T:
- 1. -The s'creening criteria are based primarily on two importance measures: Fussell-Vesely (FV) and Risk Achievement Worth (RAW). The criterir are: FV > 0.005 and RAW > 2 based on either CDF or LERF. It is important to fully understand what information these measures convey as well as their limitations. Detailed discussions on these matters are available in References 9,12, and 13.
As an example, consider a very simple case in which the risk metric, e.g., the CDF due to internal events, is a function of a single accident sequence. We have
. CDF* = fq. = 10dper reactor-year (1)
- where f: . frequency of the' initiating event (say,10-8 per reactor-year) q: . unavailability of the protection system (say,10~8 per demand)
The importance measures for the system are (2) py _ f9 _ i f9
. 4 (3) f 1 RAW = CDNE+ = - = - = 100 CDpE [q q where CDF* is the new value of CDF with the protection system assumed unavailable.
Suppose that several protection systems are added, each of unavailability q,. The new importance measures for the system are fg H q '. (4)
FV = =1 f9b9j (5) fIl9j = 1 = 100 RAW = 9f 09j 9 Even though several protection systems have been added thereby reducing reliance on the original system and reducing the overall risk, the importance measures have not changed. We believe that this insensitivity should be better understood and communicated to the expert panel and that insights from this discussion need to be incorporated into the rule or the associated guidance documents.
- 2. Suppose that the CDF estimate of Equation (1) is expanded to include the contribution from external events. We assume that this contribution is 108 per reactor-year, i.e., it dominates the risk due to interaal events, as is often the case with the seismic contribution. The new CDF is CDF = CDF + CDFEE = 10" + 10 = 1.1x10'8 per reactor-year (6)
A calculation of the new importance measures provides:
(7) py " = 10 -4
= 0.09 1.1x 10 -3 (8)
- 10 -2 + 10 -3
. RAW = = 10 1.1 x 10 -3 As expected, the importance measures of the protection system have been reduced i drastically. The question is whether including the dominant seismic contribution results l
In meaningfulimportance measures, especially within the context of the proposed new '
I
}
l
, 5
- i
' reactor oversight process where the frequency of initiating events and the unavailability ;
of the protection systems are cornerstones of the assessment process.
In a PRA, the additional terms in the equation may be the products of analyses that are )
not as rigorous as those for the terms in which a particular system appears. For {
example, some terms may contain probabilities of recovery actions or damage caused by " external" events, such as fires and tornadoes. The current assessment of risk )
e dributions from low-power and shutdown operations, fires, and human performance
~ ,
b ncomplete. Because the PRA technology for such assessments is not as well (
developed as that for " internal" events, the analyses may contain many overly j conservative assumptions, thus artificially increasing these contributions. I Inconsistencies in the analysis of the various contributions to risk distort the importance measures.
l It is evident that the absolute value of the baseline risk metric is a critical element in i these evaluations and that the importance measures contain only relative information )
with respect to a given risk metnc. j
{
The change in risk depends on this absolute value also, i.e., ACDF at two plants with l
different baseline CDFs, will be different for the same change in the unavailability of a !
component whose importance measures have the same value at these plants. !
Reference 9 states that "if we are interested in controlling the change in risk in an absolute sense, it does not make sense to have a universally fixed value of FV as a criterion for risk significance," and "it is clear that it does not make much sense to define a universal criterion based on RAW."
- 3. The calculation of RAW in Equation (3) requires the estimation of CDF*,i.e., the CDF l assuming that the protection system is unavailable. This assessment may be much more involved than simply setting the unavailability of the system equal to unity. The I assumption of a system being unavailable may affect several terms in the PRA. For example, in a two-train redundant system, the PRA contains terms representing the
" random" Independent failure of the two trains, the probability of a common-cause failure, and the probability that coupled human errors after test and maintenance may disable both trains. All of these terms are affected by the assumption of one train being unavailable. Recovery actions may also be affected (see Reference 11).
We question whether these considerations are adequately taken into account when RAW it calculated for hundreds of components.
- 4. The current practice of calculating FV and RAW is to use the mean epistemic values of the parameters in the ratios appearing in Equations (2) and (3). Tne more rigorous way is to first find the ratios and then to average them over 'he epistemic distributions of the parameters (Reference 10). The current practice is an approximation that is usually reasonable, unless the epistemic uncertainties of the parameters are very large
- (Reference 9). The section on sensitivity analysis in the proposed Appendix T should reflect this observation.
6 The preceding paragraphs are not intended to discourage the use of importance measures.
Although our example is a simple one, it does illustrate that FV and RAW values must be carefully calculated and interpreted. We do believe that a good understanding of the limitations of importance measures is essential to their proper use.
The issues discussed above, as well as the detailed investigations in the cited references, suggest that the members of the expert panel that determines the categorization of SSCs need to be aware of these limitations and constraints. We believe that there is a neod to ensure that members of expert panels have formal training in the properties of importance measures.
Similar training sessions are provided in other contexts, e.g., before quantitative judgments are clicited from engineers and scientists who are not familiar with the cognitive issues associated with the elicitation of expert opinion.
Option 3 of SECY-98-300 deals with changes in specific requirements in 10 CFR Part 50, including general design criteria. The staff's high-level plan for implementing this option and I associated study is acceptable. We note, howevar, that defense in depth plays a critical role in l this plan.
' The PRA Policy Statement of 1995 and subsequent agency documents such as Regulatory Guide 1.174 for risk-informed changes to the licensing basis place defense in depth at the level of a principle whereby PRA should be used in "a manner that supports the NRC's traditional defense-in-depth philosophy." As noted in our May 19,1999 report, this may create conflicts between risk-informed insights and defense in depth. Since the staff's plan includes defense-in-depth consioerations in several key areas, e.g., the identification of candidate requirements to be revised and the determination of the revisions, it is very important for the Commission to clarify the proper role of defense in depth. I We look forward to working with the staff to resolve the significant technical issues associated with the implementation e' @tionc 2 and 3 of SECY-98-300.
Sincerely,
\ 0* ^A tart 4dp Dana A. Powers Chairman i
References:
l
)
- 1. Memorandum dated September 16,1999, from David B. Mattews, Office of Nuclear ;
- Reactor Regulation, to John T. Larkins, Executive Director, Advisory Committee on Reactor Safeguards,
Subject:
ACRS Preliminary Review of the Draft SECY Paper for '
Risk-informing Special Treatment Regulations.
- 2. Memorandum dated September 23,1999, from Thomas L. King, Office of Nuclear Regulatory Research, to John T. Larkins, Advisory Committee on Reactor Safeguards,
Subject:
ACRS Review of Proposed Staff Plan for Risk informing Technical Requirements in 10 CFR Part 50
c 7
~
[3. Memorandum dated June 8,1999, from Annette Vietti-Cook, Secretary, NRC, to William D. Travers, Executive Director for Operations,
Subject:
Staff Requirements - SECY 300 - Options for Risk-Informed Revisions to 10 CFR Part 50 " Domestic Licensing of ;
Production and Utilization Facilities." j
- 4. Letter dated December 14,1998, from R. L. Seale, Chairman, ACRS, to William D. !
. Travers, Executive Director for Operations, NRC,
Subject:
Proposed Commission Paper l Concerning Options for Risk-informed Revisions to 10 CFR Part 50 " Domestic (
Licensing of Production and Utilization Facilities."
- 5. Report dated May 19,1999, from Dana A. Powers, Chairman, Advisory Committee on i Reactor Safeguards, to Shirley Ann Jackson, Chairman, U.S. Nuclear Regulatory i Commission,
Subject:
The Role of Defense in Depth in a Risk-Informed Regulatory S;.:*em. l
\
- 6. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.174, "An Approach for Using I Probabilistic Risk Assessment in Risk-informed Decisions on Plant-Specific Changes to the Licensing Basis," July 1998.
4
- 7. Letter dated July 1 ? 1999, from J.J. Sheppard, South Texas Nuclear Operating j Company, to U.S. Nuclear Regulatory Commission,
Subject:
Request for Exemption to '
Exclude Certain Components from the Scope of Special Treatment Requirements Required by Regulations.
- 8. Title 10: Code of Federal Regulations, Part 50, Domestic Licensing of Production and Utilization Facilities, Section 50.2, Definitions.
- 9. M.C. Cheok, G.W. Parry, and R.R. Sherry, "Use of importance measures in risk-informed regulatory applications," Reliability Engineering and System Safety 60,213-226,1998.
- 10. G. Apostolakis,"The distinction between aleatory and epistemic uncertainties is
- important: An exa'mple from the inclusion of aging effects into PSA," American Nuclear Society Conference, PSA '99, Washington, DC, August 22-25,1999.
- 11. . C.L. Smith, " Calculating conditional core damage probabilities for nuclear plant operations," Reliability Engineering and System Safety 59, 299-307,1998.
12.- W.E. Vesely, " Reservations on 'ASME Risk-Based inservice inspection and Testing: An Outlook to the Future,'" Risk Analysis 18,423-425,1998.
- 13. W.E. Vesely, " Supplemental viewpoints on the use of importance measures in risk-informed regulatory applications," Reliability Engineering and System Safety 60, 257-259,1998.
- 14. ' Report entitled," Amnesty irrational-- How the Nuclear Regulatory Commission Fails to Hold Nuclear Reactors Accountable for Violations of its Own Safety Regulations," by James P, Riccio, Public Citizen, August 1999.
- 15. ' U.S. Nuclear Regulatory Commission,"Use of Probabilistic Risk Assessment Methods in Nuclear Activities: Final Policy Statement," dated August 16,1995.
.