ML20235V614
| ML20235V614 | |
| Person / Time | |
|---|---|
| Issue date: | 01/19/1989 |
| From: | Remick F Advisory Committee on Reactor Safeguards |
| To: | Zech L NRC COMMISSION (OCM) |
| Shared Package | |
| ML20235A877 | List: |
| References | |
| ACRS-R-1341, NUDOCS 8903100254 | |
| Download: ML20235V614 (2) | |
Text
. _ _ _ _
w e.
[pnogjeg UNITED STATES y , v. ( , g NUCLEAR REGULATORY COMMISSION
- ]/j/ AL
- sORY COMMITTEE ON REACTOR SAFEGUARDS W ASMN GTON, D. C. 20555 January 19, 1989 The Honorable Lando W. Zech, Jr.
Chairran U.S. f'uclear Regulatery Ccmmission Washington, D.C. 20555 Cear Chairmer. Zech:
SUEJECT: CODE SCALING, APPLICABILITY, Af;D UNCERTAltlTY (CSAU)
METHODOLOGY FOR DETERMINATION OF UNCERTAINTY ASSOCIATED UlTP THE USE OF REALISTIC ECCS EVALUATION MODELS During the 345th recting of the Advisory Ccmmittee on Reactor Sefe-guards, January 12-14, 1989, we completed our review of the methodology develcred by the f:RC Office of Nuclear Regulatory Research (RES) for determining the overall uncertainty in calculation of the maximum fuel claddir.g temperature ceused by less of coolant accidents (LOCAs). This matter was aise censidered during our 344th meeting, December 15-16, 1988, and during a reeting of the Thermal Hydraulic Phenomena Subcom-mittee held on December 7, 19PS. In our review, we had the benefit of discussions with representatives of RES and the Office of Nuclear Peactor Regulatien (NRR). We also had the benefit of the docunents referenced.
The Cornittee previously conmented on the acceptability of the CSAU epproach in a report to you dated September 17, 1987. At that time, the staff's development efforts were approximately at their mid-point. RES has now completed its development effort and has conducted a demonstra-tion of the CSAU method as applied to the realistic calculation of the peak cladding tcnperature (PCT) for a large-break LOCA.
The objective of developing the CSAU methodology has been to provide a technical basis for quantifying uncertainty in estimates of the PCT expected in a large-break LOCA. Estimates are generated using the realistic analytical models and computer codes permitted under the revised emeroency core cooling systems (ECCS) rule. The CSAU method-ology is intended to provide not only a practical method for estimating uncertainty, but also one that is well documented and can be audited.
This is especially important because calculation of PCT is complex and estimates of its uncertainty require the combination of quantitative analysis and expert opinion.
The CSAU methodology should serve as an appropriate guide fnr the NRR staff to use in reviewing future submittels from licenser under the 8903100254 890217 Attachment 12 PDR ACR5 R-1341 PDC _______ _ _ _ _ _ _ _
The Honorable Lande V. Zech, Jr. January 19, 1989 revised ECCS rule. It should also serve as a medel for methodologies that night be developed and used by licensees and their contractors.
RES has suggested that the general approach used on the CSAU program could be epplied te the resolutien of issues associated with the NRC's severe accident research effort. He agree.
Adaitional cerrents by ACRS nember Herold W. Lewis are presented beinw.
Sincerely, Forrest J. Remick Chairman Additirnel Corrents by ACRS Menber Harold R. Lewis I hate oc prcblen with this letter, except that 1 believe the Committee has been too cFeritable toward the clain that this methodology sheds much ligtt on the uncertainty question. Althcugh extensive sensitivity erelyses were pcrforned as part of this program, sens.itivity is not un cert o ir.ty . Unless there exists prior knowledge of the uncertainty in the input parameters, sensitivity analyses say nothing about uncertain-ty. To be sure, comparison of results with experiments would tell snrething about uncertainty, except that the codes are " matured" by this process. The residual uncertainty for other circumstances is then unknown.
1:hile I applaud this effort, the ultimate question of interest is: "If the calculation predicts a temperature of X*F, what is the chance that it wculd really be (X+100)"F, if there were en accident." That is uncertainty, and CSAU contributes little to it.
Therefore, the Committee letter may be overenthusiastic in its endorse-ncnt of the CSAU nethodolcgy for the quantification of uncertainty.
References
- 1. U.S. Nuclear Regulatory Cnnnission, NUREG/CR-5249 (draf t), " Quanti-fying Reactor Safety Margins: Application of Code Scaling, Appli-cability, and Uncertainty Methodology to a Large Break Loss of ,
Coolant Accident," October 24, 1988
- 2. U.S. Nuclear Reculatory Commission, NUREG-1230, " Compendium of ECCS Research for Realistic LOCA Analysis," April 1987 1
f.1
- c.
1 ,
/ o UNITED $TATES
. g
!" n NUCLEAR REGULATORY COMMISSION h
j v ,E ADVISORY COMMITTEE ON REACTOR SAFEGUARDS
' o,,
WASHINGTON, D. C. 20555
....+
February 16, 1989 lhe Honorable Lando W. Zech, Jr.
Chairman U.S. Nuclear Regulatory Commission Washington, D.C. 20555
Dear Chairman Zech:
SUBJECT:
FURTHER ACRS C0 tit 1ENTS ON IMPLEMENTATION OF THE SAFETY G0AL POLICY During the 346th meeting of the Advisory Committee on Reactor Safe- '
i guards, February 9-11, 1989, and in meetings on October 6-7, December 15-16, 1988, and January 12-14, 1989, we continued our review of the NRC staff's plans for implementing the Safety Goal Policy. We had the benefit of a draft paper for Commission approval, " Implementation of Safety Goal Policy," dated January 17, 1989, and of presentations by a member of the staff. We had previously commented to you on this subject in our letters of May 13, 1987, and April 12, 1988, following a number of exchanges with the NRC staff, including several meetings with our Subcommittee on Safety Philorophy, Technology, and Criteria as well as with the full Committee.
Although we agree with the general direction of the staff's recom-mendations, we have substantive differences about a number of issues.
We urge the Commission to implement the policy after considering our recommendations.
Background
The draf t paper proposes guidelines for the NRC staff to use in i implementing the Safety Goal Policy. These guidelines include the _l' structure of an implementation plan, definitions, and quantitative objectives. The paper calls for these guidelines to be incorporated into the policy statement itself through an amendment. In addition, the paper proposes that potential averted on-site costs be used as an offset to licensee costs in cost-benefit analyses. And finally, the paper asks the Commission itself to consider whether the policy should be amended to clarify the relationship of the safety goal and the statutory standard of adequate protection.
ro D n - nn im 4{ Attachment 13
- g i v m ^ vuL o
Honorable Lando W. Zech, Jr. February 16, 1989 Before comenting specifically on the staff paper, an observation about the use of probabilistic risk assessment (PRA) and its relation to the safety goal is appropriate. Although it is frequently said that "the bottom line is the weakest part of PRA," the fact remains that the safety goal cannot be implemented without the bottom line.
Without this bottom line and a safety goal to which it can be com-pared, either explicitly or implicitly, PRA becomes a never-ending search for outliers. Although it is satisfying to some engineers and analysts to identify " dominant" contributors to risk, especially those that can be eliminated readily, there is nothing necessarily less safe about a plant that has most of its risk embodied in one or two outlier sequences than a plant that has its risk distributed more or less uniformly over 20 sequences.
Structure of the Implementation Plan The draft paper describes a structure similar to that suggested in our letter of May 13, 1987, but with some differences. We continue to prefer the structure we recomended, a hierarchical arrangement of five levels using the multiple goals in the policy statement of August 6, 1986.
The staff's current proposal is consistent with our recommendations for Levels One and Two. Level One is the pair.of qualitative goals and Level Two is the two quantitative health objectives.
Our recommendation for Level Three would be the general performance guideline that large accidental releases should occur no more fre-quently than 1E-6 per reactor-year. The staff's Level Three proposal is similar, but differs in the definition of "large release."
The staff proposal defines a large release as "a release that has a potential for causing an offsite early f atality." We are still not satisfied with this definition for two reasons. First, it can or could be considered as little more than the quantitative health objective in Level Two, but at a level ten times more conservative.
Second, this considerable additional conservatism is not accompanied by a significant simplification. The use of the word " potential" in ,
order to encompass the release at Chernobyl will require the use of l Level 3 PRA results with a suitable prescription or selection of potential meteorology and population distribution or location. ,
Although this would be possible for specific plants, it would require i arbitrary assumptions if the safety goals are to be used to test the sufficiency of the Comission's regulations or to provide a basis for establishing design criteria for containments for future plants.
We continue to believe that a definition in terms of the release itself is preferable. It might be defined in terms of curies, leak
.- 1
- l I
Honorable Lando W. Zech, Jr. february 16, 1989 1
or release rate, or fraction of the core or containment inventory. {
In any case, it should be independent of the site characteristics and j should provide some criter.ia against which the design or performance ;
of containments can be tested. We urge you to request the staff to continue seeking a means to define a large release that is not ,
significantly more conservative than the Level Two health objectives I and that focuses the mitigative function on containment design characteristics independent of site or population characteristics.
Our recommendations for Level Four consisted of three specific performance cbjectives: (1) core melt probability, an ex the effectiveness of a plant's prevention systems, (2)conditional pression of probability of containment failure, an expression of the effective-ness of a plant's mitigation systems, and (3) an expression of how well a plant is operated. (We use here the term " prevention" to describe those activities and systems intended to keep the reactor core from melting, and " mitigation" to describe those activities and systems intended to keep away from the would be released from a melted core.) Level publ.ic Four fission products proposed that by the staff is significantly different from what we recommended. It would consist of only one of the three objectives we recommenhd, a limit on core damage frequency. This loses the balance between prevention and mitigation, one form of defense-in-depth, that is inherent in our inclusion of a containment performance objective. We believe this balance should be retained.
The staff proposal for Level Four also omits the ACRS recommendation for a quantification or objective statement of how well a plant is operated. We called this a " plant performance objective." We have not been able to develop a workable definition for this, nor has the staff. In light of this, we rely upon the alternative recommendation made in our letter of April 12, 1988: "If this cannot be done, a prominent caveat, e.g., a warning that PRA results do not tell the full story, should be made a part of the policy or of the implementa-tion plan." We recommend that such a statement be made an explicit part of the plan.
In our letter of May 13, 1987, we recommended a quantitative objec-tive of IE A per reactor-year for " core melt" as a part of the Level Four performance objectives. In our letter of April 12, 1988, we more carefully defined the event that should be associated with this quantitative objective as the " loss of adequate core cooling (core overheating beyond design-basis limits)." The staff proposal seems to agree with our recommendation. We caution, however, that compari-sons of this objective with some of those proposed by others under the description of core melt probability can be misleading.
w ~ .
Honorable Lando W. Zech, Jr. February 16, 1989 We disagree with the staff's proposal to use IE-5 per reactor-year as the . target for mean core damage frequency for future plants. This difference from the objective for existing plants introduces an arbitrary level of conservatism which conflicts with the criterion we suggested for linking the hierarchical levels of safety goal objec-tives; that is, that each subordinate level of the hierarchy should be consistent with the level above and should not be so conservative as to create a de facto new policy. Not only would the staff pro-posal introduce a major inconsistency with the Level Two and Three objectives, but it would result in loss of balance between prevention and mitigation because arguments could then be made that the higher levels of the safety goal hierarchy could be met readily without the need for accident mitigation systems such as containment buildings.
The Commission's safety goal should be the same whether considering the adequacy of regulations for existing plants or for future de-signs, and whether for LWRs or other types of reactor plants.
Definition of " Adequate protection" The term " adequate protection" has importance in the legal areas of safety regulation. Although it is needed and used with apparent precision in legal instruments, its technical definition is not precise. In general, it is accepted as equivalent to the term "with no undue risk to public health and safety" often used in other contexts. Another term, "in full compliance with the regulations" is used as a surrogate, on occasion, for either of these.
We believe that the safety goal should play an important, but in-direct, role in defining adequate protection. Ideally, compliance with the Commission's regulations is a suitable surrogate for defin-ing adequate protection of the public. However, we believe that the adequacy of the regulations should be judged from the viewpoint of whether nuclear power plants, as a class, licensed under those regu-lations, meet the safety goals. It is our understanding, following discussions with the staff, that the staff proposes the safety goal to be a sort of aspirational objective which would be sought but not necessarily eached.
With the safety goal approach now proposed by the staff, a class of plants that meets existing regulations (therefore meeting a standard of adequate protection) would be obliged to make improvements up to the safety goal, if cost-benefit arguments so dictated. The imple-mentation plan proposed earlier by the staff would have used the safety goal as the minimum standard (i.e., adequate protection) and cost-benefit arguments could have been used to justify further
..t b
Ponorable Lando W. Zech, Jr. February 16, 1989 improvements, without other limits. We believe that neither of these approaches is a proper use of the Safety Goal Policy.
We believe that the proper use of the safety goals is embodied in two principles which we have previously recommended:
(1) The safety goal is a definition of how safe is safe enough.
(2) At the present time, the safety goal should be applied to judging the adequacy of regulations and regulatory prac-tices, and not to make specific decisions about individual plants.
The Commission has taken a bold and progressive step in proclaiming the Safety Goal Policy. It is an attempt to place the regulation of safety in nuclear power plants in an appropriate context relative to other risks in society. It is imperfect, but it is as useful a step as has been ta ken by any industry or regulatory agenc Using concepts of cost-benefit analysis or, eve worse, ALARA (y. as low as reasonably achievable), dilutes the achievement and effectiveness of the Safety Goal Policy. We believe that the safety goal is a good present standard fnr "how safe is safe enough." Further, as we have stated earlier, we believe that the safety goals should be used to judge the adequacy of the regulations from the standpoint of whether those regulations result in classes of nuclear power plants which can be and are operated in such a way as to meet the safety goals, and 4 thus provide adequate protection to the public.
A wide community of safety experts and policy makers has concurred, after extended deliberation, in accepting the Safety Goal Policy as reasonable, based on present knowledge. It may be that future information about reactor risk or societal risk will cause a need to adjust the safety goal one way or another, or to make different implicit allowance for uncertainty. Until that happens, we believe that the safety goal should be accepted as an unambiguous working standard for the regulation of nuclear power, along the lines we have suggested.
Cost-Benefit Analysis The staff paper proposes that cost-benefit analyses made to evaluate proposed plant safety improvements should use averted on-site costs as an offset to the plant costs entailed in making such improvements.
We believe that this is appropriate in making cost-benefit assess-ments, although it inevitably adds uncertainty to the results.
However, as discussed above and as we stated in our letter of April l
n *> a a
Honorable Lando W. Zech, Jr. February 16,i989 1 i
124 1988, we believe cost-benefit analysis is not properly a part of j safety goal implementation (in contrast to "backfit" implementation).
{
l Incorporation of Guidelines Into the Policy
, We concur with the staff proposal to incorporate certain of the implementation guidelines as amendments to the policy statement. We have no preferences or comments about the details of this, beyond the reminder that the safety goal is a policy statement, not a regula-tion.
Coherence Among Regulatory Policies The Safety Goal Policy hes been in existence for some time and has, in fact, been an influence in recent regulatory activities. We believe a clear implementation plan is necessary to ensure that it is applied comprehensively, consistently and unambiguously. Several major Commission decisions are presently on the horizon regarding, for example, the Severe Accident Policy, the issue of Mark I con-tainment adequacy, certification of advanced reactor designs, and evaluation of plant operations. In each of the these, the question "how safe is safe enough" must be answered, either implicitly or explicitly. The safety goal can and should bring greater objec-tivity, consistency and clarity to deliberations and decisions about these issues.
Sincerely, orrest J. Remick Chairman Reference Draft Proposed Paper from V. Stello, Jr. , Executive Director for Operations, to the Commissioners,
Subject:
Implementation of Safety Goal Policy (Predecisional) (received January 17,1989).
I
_ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ . _ _ __