ML20237B908

Reg Guide 01.174,draft Issued as DG-1061, Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to Licensing Basis

ML20237B908
Person / Time
Issue date:	07/31/1998
From:	NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES)
To:
References
TASK-*****, TASK-RE REGGD-01.174, REGGD-1.174, NUDOCS 9808200071
Download: ML20237B908 (27)

Text

. ____ ______ _ _

U.S. NUCLEAR REGULATORY COMMISSION July 1998

1. %[ e a g \\)

REGULATORY GU DE OFFICE OF NUCLEAR REGUI.ATORY RESEARCH REGULATORY GUIDE 1.174 (Draft was issued at, DG-1061)

AN APPROACH FOR USING PROBABILISTIC RISK ASSESSMENT IN RISK 4NFORMED DECISIONS ON PLANT-SPECIFIC CHANGES TO THE LICENSING BASIS

1. PURPOSE AND SCOPE Licensing of Production and Utilization Facilities."It does not address licensee-initiated changes to the LB

1.1 INTRODUCTION

that do NOT require NRC review and approval (e.g.,

The NRC's policy statement on probabilistic risk changes to the facility as described in the final safety assessment (PRA) (Ref.1) encourages greater use of analysis report (FSAR), the subject of 10 CFR 50.59).

this analysis technique to improve safety decisionmak-ing and improve regulatory efficiency. The NRC staff's Licensee-initiated LB changes that are consistent PRA Implementation Plan (Ref. 2) describes activities with currently approved staffpositions (e.g., regulatory now under way or planned to expand this use. These ac-guides, standard review plans, branch technical posi-tivities include, for example, providing guidance for tions, or the Standard Technical Specifications) are nor-NRC inspectors on focusing inspection resources on mally evaluated by the staff using traditional engineer-risk-important equipment, as well as reassessing plants ing analyses. A licensee would not be expected to with relatively high core damage frequencies for pos.

submit risk information in support of the proposed change.

sible backfits.

Another activity under way in response to the Licensee-initiated LB change requests that go be-policy statement is using PRA to support decisions t yond current staff positions may be evaluated by the modify an individual plant's licensing basis (LB).1 MspMM@M uMu This regulatory guide provides guidance on the use of PRA findings and risk insights in support oflicensee re-the risk-informed approach set forth in this regulatory quests for changes to a plant's LB, as in requests for 11-guide. A licensee may be requested to submit supple-mental risk information if such information is not sub-cense amendments and techmcal specification changes under Sections 50.90-92of 10 CFR Part 50," Domestic mitted by the licensee. If risk information on the pro-posed LB change is not provided to the staff, the staff 1These are modifications to a plant's design, operation.or other acovi.

will review the information provided by the licensee to ties that require NRC approval. These modifications could include items such as exempuon requests under 10 CFR 50.11 and license determine whether the application can be approved.

Based on the m. formation provided, usia traditional () j amendments under 10 CFR 50.90.

USNRC REGUtATORY GUIDE'S Th. guid.s w. insu.d in th. kilowing 1.n tro.d dnnesons:

{ '

sD@mb m"mYn8s't n tr M"EcEp.'*E$"m"ceA 1 pour n etor.

e producs "U'M "'5."1""d."d tivD"It E=""2.*f7=*w'"iceans'@

$ DON

[ 'Ometn c

=%"'/.=#".A,"" *". #".s'"--.- w m.nd, -.tm.a_L_"; : : "

""":"nti*"' coon J 0"'*

JO"".

"""='

• a p=ma e' ac'"a *v m comm'= at s.noi. cop..s e r.o.mry guida may n. a>isin.d vr a en-o. ey wrmng in. n. pro.

m.N Distnbucon S.nncas S.cnon, Omc. W h Crv.t h.x.t WSM The guid. vv.s mau.c.n.r coned.r.non of comm.nts r.omv.d from th put>hc. Co.nd on Omc.r, U S. Ne m.

der n.p.twy Cownession. V.".srungmn, DC N-M w by t m.nts.no sugg nons for unprow.,m.nts m th.s. guides.r..ncour.g.d or Dy ml 2 W1@NRC. GOV 11 Dm.s guid.go. r.v.j.d.pprunn..w.ccommoa.comm.nm.nd wr n.cin. in,

"*"g nsM uYNuaTui Iy*EJ,m""i "5"vMD"a*aEs"M"'"""

' "'.""n'o.d s" noy

,>na 9008200071 980731

'f f {- l \\ (yJi h&^ )/ 4 n a.14 PDR REOOD 01.174 R PDR

t l

l methods, the NRC staff will either approve or reject the staff practices. Where appropriate, PRA application.

should be used to support the proposal of additional regulatory requirements in ac-This regulatory guide describes an acceptable cordance with 10 CFR 50.109 (Backfit method for assessiug the nature and impact of LB Rule). Appropriate procedures forinclud-changes by a licensee when the licensee chooses to sup-ing PRA in the process for changing regu-port (or is requested by the staff to support) these latory requirements should be developed changes with risk information. The NRC staff would and followed. It is, of course, understood review these changes by considering engineering is-hat the intent of this policy is that existing sues and applying risk insights. Licensees submitting rules and regulations shall be complied risk information (whether on their own imtiative or at with unless these rules and regulations are the request of the staff) should address each of the prin-revised.

ciples of risk-informed regulation discussed in this reg-PRA evaluations in support of regulatory ulatory guide. Licensees should identify how their cho-sen approaches and methods (whether quantitative or decisions should be as realistic as practi-qualitative, deterministic or probabilistic), data. and cable and appropriate supporting data criteria for considering risk are appropriate for the deci-should be publicly available for review.

sion to be made.

The Commission's safety goals for nu-The guidance provided here does not preclude clear power plants and subsidiary numeri-other approaches for requesting changes to the LB.

cai objectives are to be used with Rather, this regulatory guide is intended to improve appropriate consideration of uncertainties consistency in regulatory decisions in areas in which in making regulatory judgments on need the results of risk analyses are used to helpjustify regu-for proposing and backfitting new generic latory action. As such, the principles, process, and ap-requirements on nuclear power plant proach discussed herein also provide useful guidance licensees.

for the application of risk information to a broader set of activities than plant-specific changes to a plant's LB In its approval of the policy statement, the Com-(i.e., generic activities), and licensees are encouraged mission articulated its expectation that implementation to use this guidance in that regard.

of the policy statement willimprove the regulatory pro-cess in three areas: foremost, through safety decision-

1.2 BACKGROUND

making enhanced by the use of PRA insights; through m te eff cient use of agency resources; and through a During the last several years, both the NRC and the reduction in unnecessary burdens on licensees.

nuclearindustry have recognized that PRA has evolved to the point thht it can be used increasingly as a tool in In parallel with the publication of the policy state-regulatory decisionmaking. In August 1995, the NRC ment, the staff developed an implementation plan to de-adopted the following policy statement (Ref.1) regard-fine and organize the PRA-related activities being un-ing the expanded use of PRA.

dertaken (Ref. 2). These activities cover a wide range of 7 k use of PRA technology should be in.

PRA applications and involve the use of a variety of crewed in all regulatory matters to the ex-PRA methods (with variety including both types of tent supported by the state of the art in models used and the detail of modeling needed). For PRA methods and data and in a manner example, one application involves the use of PRA in that complements the NRC's determinis.

the assessment of operational events in reactors. The tic approach and supports the NRC's characteristics of these assessments permit relatively traditional defense-in-depth philosophy simple PRA models to be used. In contrast, other ap-plications require the use of detailed models.

PRA and associated analyses (e.g., sensi-l tivity studies, uncertainty analyses, and The activities described in the PRA Implementa-importance measures) should be used in tion Plan (Ref. 2),which is updated quarterly, relate to a regulatory matters,where practical within number of agency interactions with the regulated in-the bounds of the state of the art, to reduce dustry. With respect to reactor regulation, activities in-unnecessary conservatism associated clude, for example, developing guidance for NRC in-with current regulatory requirements, reg-spectors on focusing inspection resources on tslatory guides, license commitments, and risk-important equipment and reassessing plants with 1.174 - 2

relatively high core-damage frequencies (CDF) for guidelines for evaluating the results of such assess-possible backfit.

ments are provided. This guide also addresses imple-

'Hiis regulatory guide focuses on the use of PRAin mentation strategies and performance monitoring plans a subset of the applications described in the staff's im-associated with LB changes that will help ensure that plementation plan. Its principal focus is the use of PRA assumptions and analyses supporting the change are findings and risk insights in decisions on proposed changes to a plant's LB.

Consideration of the Commission's Safety Goal Policy Statement (Ref. 3) is an important element in Tin.s regulatory guide also makes use of the NRC's regulatory decisionmaking. Consequently, this regula-S afety Goal Policy Statement (Ref. 3). As discussed be-Iow, one key principle in risk-informed regulation is

'I E".ide provides acceptance guidelines consistent with this pohey statement.

that proposed increases in CDF and risk are small and are consistent with the intent of the Commission's In theory, one could construct a tnore generous reg-Safety Goal Policy Statement.The safety goals (and as-ulatory framework for consideration of those risk-sociated quantitative health objectives (OHOs)) define informed changes that may have the effect ofincreasing an acceptable level of risk that is a small fraction (0.1%)

risk to the public. Such a framework would include, of ofother risks to which the public is exposed. The accep-course, assurance of continued adequate protection tance guidelines defined in this regulatory guide (in (that level of protection of the public health and safety Section 2.2.4) are based on subsidiary objectives de-that must be reasonably assured regardless of economic riv:d from the safety goals and their QHOs.

cost). But it could also include provision for possible elimination of all measures not needed for adequate L3 PURPOSE OF THIS REGULATORY GUIDE protection, which either do not effect a substantial re-Changes to many of the activities and design char-duction in overall risk or result in continuing costs that acteristics in a nuclear power plant's LB require NRC are not justified by the safety benefits. Instead, in this review and approval. This regulatory guide provides regulatory guide, the NRC has chosen a more restric-the staff's recommendations for using risk information tive policy that would permit only small increases in in support of licensee-initiated LB changes requiring risk, and then only when it is reasonably assured, such review and approval. The guidance provided here among other things, that sufficient defense in depth and does not preclude other approaches for requesting LB sufficient margins are maintained. This policy is changes. Rather, this regulatory guide is intended to adopted because of uncertainties and to accoum for the improve consistency in regulatory decisions in areas in fact that safety issues contim.e to emerge regarding de-which the results of risk analyses are used to helpjustify sign, construction, and operational matters notwith-regulatory action. As such, this regulatory guide, the standing the maturity of the nuclear power industry.

use of which is voluntary, provides general guidance These factors suggest that nuclear power reactors concerning one approach that the NRC has determined should operate routinely only at a prudent margin above to be acceptable for analyzing issues associated with adequate protection. The safety goal subsidiary objec-proposed changes to a plant's LB and for assessing the tives are used as an example of such a prudent margin.

impact of such proposed changes on the risk associated Fmally, this regulatory guide indicates an accept-with plant design and operation. Tids guidance does not able level of documentation that will enable the staff to address the specific analyses needed for each nuclear reach a finding that the licensee has performed a suffi-power plant activity or design characteristic that may be ciently complete and scrutable analysis and that the re-amenable to risk-informed regulation.

sults of the engineering evaluations support the licens-L4 SCOPE OF THIS REGULATORY GUIDE L5 RELATIONSHIP TO OTHER GUIDANCE This regulatory guide describes an acceptable ap-DOCUMENTS proach for assessing the nature and impact of proposed LB changes by considering engineering issues and ap-Directly relevant to this regulatory guide is the plying riskinsights. Assessments should consider rele-Standard Review Plan (SRP) designed to guide the vant safety margins and defense-in-depth attributes,in-NRC staff evaluations oflicensee requests for changes y

cluding consideration of success criteria as well as to the LB that apply risk insights (Ref. 4), as well l

equipment functionality, reliability, and availability.

as guidance that is being developed in selected

)

The analyses should reflect the actual design, construc-application-specific regulatory guides and the corte-tion,and operational practices of the plant. Acceptance sponding standard review plan chapters. Related 1.174 - 3

regulatory guides are being developed on inservice encouraged to be, used to help ensure and show that testing, inservice inspection, graded quality assurance, these principles are met. These principles are:

and technical specifications (Refs. 5-8). An NRC con-

1. The proposed change meets the current regulations tractor report (Ref. 9) is also available that provides a unless it is explicitly related to a requested exemp-simple screening method fy assessing one measure tion or rule change,i.e., a " specific exemption" un-used in the regulatory guide-large early release fre-der 10 CFR 50.12 or a " petition for rulemaking" quency.The staff recognizes that the risk analyses nec-under 10 CFR 2.802.

essary to support regulatory decisionmaking may vary

2. The proposed change is consistent with the with the relative weight tnat is given to the risk assess-defense-m-depth philosophy, ment element oithe decisionmaking process. The bur-den is on the licensee who requests a change to the g

3. The proposed change maintains sufficient safety to justify that the chosen risk assessment approach, margms.

methods, and data are appropriate for the decision to be 4.

When proposed changes result in an increase in made.

core damage frequency or risk, the increases should be small and consistent with the intent of the Com-The information collections contained in this regu-mission's Safety Goal Policy Statement (Ref. 3).2 latory guide are covered by the requirements of 10 CFR

5. The impact of the proposed change should be mon-Part 50,which were approved by the Office of Manage-itored using performance measurement strategies.

ment and Budget, approval number 3150-0011. The Each of these principles should be considered in NRC may not conduct or sponsor, and a person is not the risk-informed, integrated decisionmaking process, required to respond to, a collection of information un-as illustrated in Figme 1.

less it displays a currently valid OMB control number.

The staff's proposed evaluation approach and ac-

2. AN ACCEPTABLE APPROACH TO ceptance guidelines follow from these principles. In RISK-INFORMED DECISIONMAKING implementing these principles, the staff expects that:

In its approval of the policy statement on the use of All safety impacts of the proposed change are eval-PRA methods in nuclear regulatory activities (Ref.1),

uated in an integrated manner as part of an overall the Commission stated an expectation that "the use of risk management approach in which the licensee is PRA technology should be increased in all regulatory using risk analysis to improve operational and en-matters...in a manner that complements the NRC's de~

gineering decisions broadly by identifying and tak-terministic approach and supports the NRC's tradi-ing advantage of opportunities to reduce risk, and tional defense-in-depth philosophy." The use of risk in.

not just to eliminate requirements the licensee sees as undesirable. For those cases when risk increases sights in licensee submittals requesting B changes will assist the staff in the disposition of such licensee are proposed, the benefits should be described and proposals.

should be commensurate with the proposed riskin-creases. The approach used to identify changes in The staff has defined an acceptable approach to requirements should be used to identify areas analyzing and evaluating proposed B changes. This whererequirementsshouldbeincreased aswellas 3

approach supports the NRC's desire to base its deci-where they can be reduced.

sions on the results of traditional engineering evalua-The scope and quality of the engineering analyses a

tions, supported by insights (derived from the use of (including traditional and probabilistic analyses)

PRA methods) about the risk significance of the pro-conducted to justify the proposed B change posed changes. Decisions concerning proposed should be appropriate for the nature and scope of changes are expected to be reached in an integrated the change, should be based on the as-built and as-fashion, considering traditional engineering and risk Perated and maintained plant, and should reflect information, and may be based on qualitative factors as well as quantitative analyses and information.

Operating experience at the plant.

In implementing risk-informed decisionmaking, 2 or purposes of this guide, a proposed LB change that meets the ac-F B changes are expected to meet a set of key principles.

ceptance guidehnes discussed in Section 2.2.4 is considered to have Some of these principles are written in terms typically met the intent of the policy statement.

used in traditional engineering decisions (e.g., defense

%e NRC staffis aurare of but does not endorse guidelines that have in depth). While written in these terms, it should be un-been developed (e.g., by NEI/NUMARC) to assist in identifying po-derstood that risk analysis techniques can be, and are tentially beneficial changes to requirements.

1.174 - 4

Nf"me Mth u[ns uni FM 3 y,,,,,,,g,,,

l%,"f.52*%',

.,e

\\

m um) v ins a lategrsted Dedssonmaking 4 g *d g g 5 Useperf e-

=;e-E'3===IA OcmJ Pohey Statemet Figure 1. Principles of Risk Informed Integrated Decisionmaking The plant-specific PRA supporting the licensee's Increases in estimated CDF and LERF resulting proposals has been subjected to quality controls from proposed LB changes will be limited to small such as an independent peer review or certifica-increments. The cumulative effect of such changes tion.4 should be tracked and considered in the decision Appropriate consideration of uncertainty is given Process.

in analyses and interpretation of findings, includ-The acceptability of proposed changes should be ing using a program of monitoring, feedbac;, and evaluated by the licensee in an integrated fashion co rective action to addiess significant uncertain-that ensures that all principles are met.6 ties.

Data, methods, and assessment criteria used to sup-The use of core damage frequency (CDF) and large port regulatory decisionmaking must be well docu-early release frequency (LERF)5as bases for PRA mented and available for public review.

acceptance guidelines is an acceptable approach to addressing Principle 4. Use of the Commission's Given the prm.ciples of risk-informed decision-Safety Goal QHOs in lieu of LERFis acceptable in makmg discussed above, the staff has identified a four-principle, and licensees may propose their use.

element approach to evaluating proposed LB changes.

However,in practice, implementing such an ap-This approach, which is presented graplu,cally in hg-proach would require an extension to a level 3 ure 2, acceptably supports the NRC's decisionmakmg PRA,in which case the methods and assumptions Process. This approach is not sequential in nature; used in the I2 vel 3 analysis, and associated uncer-rather it is iterative.

tainties, would require additional attention.

2.1 ELEMENT 1: DEFINE THE PROPOSED CHANGE dAs discussed in Section 2.2.2 below, such a peer review or certdica-Element 1 involves three primary activities. First, tion is not a replacement for NRCreview. Certification is de fmeu as a mechanism for assuring that a PRA, and the process of developing the licensee should identify those aspects of the plant,s and maintaining that PRA, meets a set of technical standards estab.

hshed by a diverse group of personnel experienced in developing

}jCensing bases that may be affeeted by the proposed PRA models, performing PRAs, and performing quality reviews of change, m. eluding but not limited to rules and regula-PRAs. Such a pro =u has been developed and integrated with a peer review pronss by, for example, the BWR Owners Group and imple-tions, final safety analysis report (FSAR), technical mented for the purpose of enhancing the quahty of PRAs at several Specifications, licensing conditions, and licensing BWR facilities.

Commitments. Second, the licensee should identify all SIn this contert,1 ERFis being used as a surrogate forthe carlyfatality QHO. It is defined as the frequency of those accidents leading to sig-nificant, unmitigated releases from containment in a time frame ptior to effective evacuation of the close-in population such that there is a potentialforearly healtheffects. such accidentsgenerallyinclude un.

60nc important element ofintegrated decisionmaking can be the use scrubbed releases associated with early isolation. This definition is of an " expert panel." Such a panel is not a necessary component of consistent with accident analyses used in the safetygoalscrt ening eri-risk-informed decisionmaking; but whe n it is used,the key principles teria discussed in the Commission's regulatory analysis g iidehnes.

and associated decision criteria presented in thisregulatoryguide still

. An NRCcontractor's report (Ref. 9) describes a simple scre rning ap.

apply and must be shows. to have becn met or to be irrelevant to the proach for calculating LERF.

issue at hand.

1.174 - 5

\\

//

1. 8 Q

,.-+

Figure 2. Principal Elements of Risk-Informed, Plant Specific Decisionmaking structures, systems, and components (SSCs), proce-50.12 or a " petition for rulemaking" under 10 CFR dures, and activities that are covered by the LB change 2.802).

being evaluated and should consider the original rea-2.1.1 Combm.ed Change Requests sons for m. eluding each program requirement.

Licensee proposals may include severalindividual When considering LB changes, a licensee may changes to the La that have been evaluated and will be identify regulatory requirements or commitments in its irnplemented in an integrated fashion.The staff expects LB that it believes are overly restrictive or unnecessary that, with respect to the overall net change in risk, com-to ensure safety at the plant. Note that the corollary is bined change requests (CCRs) will fall in one of two also true; that is, licensees are also expected to identify broad categories, each of which may be acceptable:

design and operational aspects of the plant that should

1. CCRs in which any individual change increases be enhanced consistent with an improved understand-risk; ing of their safety significance. Such enhancements

2. CCRs in which each individual change decreases should be embodied in appropriate LB changes that re-risk flect these enhancements.

In the first category, the contribution of each indi-Third, with this staff expectation in mind, the li-vidual change in the CCR must be quantified in the risk censee should identify available engineering studies, assessment and the uncertainty of each individual methods codes,applicableplant-specificandindustry change must be addressed. For CCRs in the second data and operational experience, PRA findings, and re-category, qualitative analysis may be sufficient for search and analysis results relevant to the proposed LB some or all individual changes. Guidelines for use in change. With particular regard to the plant-specific developing CCRs are discussed below.

PRA, the licensee should assess the capability to use, 2.1.2 Guidelines for Developing CCRs refine, augment, and update system models as needed to support a risk assessment of the proposed LB change.

The changes that make up a CCR should be related to one another, for example, by affecting the same The above information should be used collectively single system or activity, by affecting the same safety to describe the LB change and to outline the method of function or accident sequence or group of sewnces, or analysis. The licensee should describe the proposed by being of the same type (e.g., changes in outage time change and how it meets the objectives of the NRC's allowed by technical specifications). However, this PRA Policy Statement (Ref.1), including enhanced de-does not preclude acceptance of unrelated changes.

cisionmaking, more efficient use of resources, and re-When CCRs are submitted to the NRC staff for review, duction of unnecessary burden. In addition to improve-the relationships among the individual changes and ments in reactor safety, this assessment may consider how they have been modeled in the risk assessment benefits from the LB change such as reduced fiscal and should be addressed in detail, since this will control the personnel resources and radiation exposure. The characterization of the net result of the changes. Licen-licensee should affirm that the proposed LB change sees should evaluate not only the individual changes meets the current regulations unless the proposed but also the changes taken together against the safety change is explicitly related to a proposed exemption or principles and qualitative acceptance guidelines in Sec-rule change (i.e., a " specific exemption" under 10 CFR tions 2 and 2.2.1, respectively, of this regulatory guide.

1.174 - 6

l In addition, the acceptability of the cumulative impact safety significance. An example is grading the applica-l of the changes that make up the CCR with respect to the tion of quality assurance controls commensurate with p

quantitative acceptance guidelines discussed in Section the safety significance of equipment. Like other ap-l 2.2.4 of this guide should be assessed.

plications, the staff's review of LB change requests for li APP cations involving safety categorization will be ac-in implementing CCRs in the first category, it is expected that the risk from significant accident se-ng to tbe acceptance guidelines associated with quences will not be increased and that the frequencies each key pn.nciple presented in this regulatory guide, of the lower ranked contributors will not be increased un ess equivalent guidelines are proposed by the h-so that they become significant contributors to risk. It is gensee.S.ince nsk importance measures are often used expected that no significant new sequences or cutsets m sq categorizadons, guidance on their use is pro-will be created. In assessing the acceptability of CCRs, vided m Appendix A to this regulatory guide. Other li APP cation-specific guidance documents address (1) risk increases related to the more likely initiating events (e.g., steam generator tube ruptures) should not guidehnes associated with the adequacy of programs be traded against improvements related to unlikely (in tlus example, quality controls) implemented for dif-events (e.g., earthquakes) even if, for instance, they in-erent safepsigm6 cant categorin (e.g., n ore safety volve the same safety function, and (2) risk should be S18mht and less safety sigm6 cant). Licensees are

• nc uraged to apply n k-informed findings and m-s considered in addition to likelihood. The staff also ex-pects that CCRs will lead to safety benefits such as sim-sights to decisions (and potential LB requests).

plifying plant operations or focusing resources on the As part of the second element, the licensee will most important safety items.

evaluate the proposed LB change with regard to the Proposed changes that modify one or more individ-principles that adequate defense-in-depth is main-tained, that sufficient safety margins are maintained, ual components of a previously approved CCR must also address the impact on the previously approved and that proposed increases in core damage frequency and risk are small and are consistent with the intent of CCR. Specifically, the question to be addressed is the Commission's Safety Goal Policy Statement.

whether the proposed modification would cause the m

previously approved CCR to not be acceptable. If the 2.2.1 Evaluation of Defense-in Depth Attributes answer is yes, the submittal should address the actions and Safety Margins the licensee is taking with respect to the previously ap-One aspect of the engineering evaluations is to proved CCR.

show that the fundamental safety principles on which the plant design was based are not compromised. De-2.2 Element 2: Perform Engineering Analysis sign basis accidents (DBAs) play a central role in nu-The staff expects that the scope and quality of the clear power plant design. DBAs are a combination of engineering analyses conducted tojustify the proposed Postulated challenges and failure events against which LB change will be appropriate for the nature and scope l

P ants are designed to ensure adequate and safe plant re-of the change. The staff also expects that appropriate sponse. During the design process, plant response and consideration will be given to uncertainty in the anal.

associated safety margins are evaluated using assump-3 sis and interpretation of findings. The licensee is ex-tions that are intended to be conservative. National pected to use judgment on the complexity and difficulty standards and other considerations such as defense-in-of implementing the proposed LB change to decide depth attributes and the single failure criterion consti-upon appropriate engineering analyses to support regu-tute additional engineering considerations that influ-latory decisionmaking. Thus, the licensee should con-ence plant design and operation. Margins and defenses sider the appropriateness of qualitative and quantitative associated with these considerations may be affected by analyses, as well as analyses using traditional engineer-the licensee's proposed LB change and, therefore, ing approaches and those techniques associated with should be reevaluated to support a requested LB the use of PRA findings. Regardless of the analysis change. As part of this evaluation, the impact of the pro-methods chosen, the licensee must show that the prin-Posed LB change on affected equipment functionality, ciples set forth in Section 2 have been met through the reliability, and availability should be determined.

use of scrutable acceptance guidelines established for 2.2.1.1 Defense in Depth D

making that determination.

The engineering evaluation should evaluate Some proposed LB changes can be characterized whether the impact of the proposed LB change (indi-as involving the categorization of SSCs according to vidually and cumulatively) is consistent with the 1.174 - 7

Independence of barriers is not degraded.

defense-in-depth philosophy. In this regard, the intent of the principle is to ensure that the philosophy of de-efenses against Imman errors am preserved.

=

fense in depth is maintained, not to prevent changes in The intent of the General Design Criteria in Appen-the way defense in depth is achieved. The defense-in-depth philosophy has traditionally been applied in reac-dix A to 10 CFR Part 50 is maintained.

tor design and operation to provide multiple means t 2.2.1.2 Safety Margins accomplish safety functions and prevent the release of radioactive material. It has been and continues to be an The engineering evaluation should assess whether effective way to account for uncertainties in equipment the impact of the propot.ed LB change is consistent with and human performance. If a comprehensive risk anal-the principle that sufficient safety margins are main-ysis is done, it can be used to help determine the ap-tained. Here also, the licensee is expected to choose the propriate extent of defense in depth (e.g., balance method of engineering analysis appropriate for evaluat-among core damage prevention, containment failure, ing whether sufficient safety margins would be main-and consequence mitigation) to ensure protection of tained if the proposed LB change were implemented.

public health and safety. When a comprehensive nsk An acceptable set of guidelines for making that assess-analysis is not or cannot be done, traditional defense-in-ment is summarized below. Other equivalent accep-depth considerations should be used or maintained to tance guidelines may also be used. With sufficient account for uncertainties. The evaluation should con-safety margins:

sider the intent of :he general design criteria, national Codes and standards or their alternatives approved standards, and engineering principles such as the single f r use by the NRC are met.

failure criterion. Further, the evaluation should consid-Safety analysis acceptance criteria in the LB (e.g.,

er the impact of the proposed LB change on barriers (both preventive and mitigative) to core damage, FSAR, supporting analyses) are met, or proposed containment failure or bypass, and the balance among revisions provide sufficient margin to account for defense-in-depth attributes. As stated earlier, the li-analysis and data uncertainty.

censee should select the engineering analysis tech-A P cation-specific guidelines reflecting this P li niques, whether quantitative or qualitative, traditional E*"*'"I guidance are being developed and may be or probabilistic, appropriate to the propos d LB f und in the application-specific regulatory guides change.

(Refs. 5-8).

The licensee should assess whether the proposed LB change meets the defense-in-depth principle. De-2.2.2 Evaluation of Risk Impact, Including fense in depth consists of a number of elements, as sum-

'IYeatment of Uncertainties marized below. These elements can be used as guide-The licensee's risk assessment may be used to ad-lines for making that assessment. Other equivalent dress the principle that proposed increases in CDF and acceptance guidelines may also be used.

risk are small and are consistent with the intent of the Consistency with the defense-in-depth philosophy NRC's Safety Goal Policy Statement (Ref. 3). For pur-is maintained if:

Poses ofimplementation, the licensee should assess the expected change in CDF and LERF. The necessary so-A reasonable balance is preserved among preven-phistication of the evaluation, including the scope of tion of core damage, prevention of containment the PRA (e.g., internal events only, full power only),

failure, and consequence mitigation.

depends on the contribution the risk assessment makes Over-reliance on programmatic activities to com-to the integrated decisionmaking, which depends to pensate for weaknesses in plant design is avoided.

some extent on the magnitude of the potential risk im-pact. For LB changes that may have a more substantial System redundancy, independence, and diverrity impact, an in-depth and comprehensive PRA analysis, are preserved commensurate with the expected fre-one appropriate to derive a quantified estimate of the to-quency, consequences of challenges to the system, talimpact of the proposed LB change, will be necessary and uncertainties (e.g., no risk outliers).

to provide adequate justification. In other applications, Defenses against potential common cause failures calculated risk importance measures or bounding esti-are preserved, and the potential for the introduction mates will be adequate. In still others, a qualitative as-of new common cause failure mechanisms is sessment of the impact of the LB change on the plant's assessed.

risk may be sufficient.

1.174 - 8

The remainder of this section discusses the use of quirements, and the PRA used to support risk-informed quantitative PRA results in decisionmaking. This dis-decisionmaking should also reflect the impact of pre-

/3 cussion has three parts:

vious changes made to the LB.

A fundamental element of NRC's risk informed 2.23.1 Scope regulatory process is a PRA of sufficient quality Although the assessment of the risk implications in and scope for the intended application. Section light of the acceptance guidelines discussed in Section 2.23 discusses the staff's expectations with re-2.2.4 requires that all plant operating modes and initiat-spect to the needed PRA's scope, level of detail, ing events be addressed, it is not necessary to have a and quality.

PRA that treats all these modes and initiating events. A PRA results are to be used in this decisionmaking qualitative treatment of the missing modes and initia-process in two ways-to assess the overall baseline tors may be sufficient in many cases. Section 2.2.5 dis-CDF/LERF of the plant and to assess the CDF/

cusses this further.

LERF impact of the proposed change. Section 2.23.2 Level of Detail Requimi To Support an 2.2.4 discusses the acceptance guidelines to be Application used by the staff for each of these measures.

The level of detail required of the PRA is that One of the strengths of the PRA framework is its which is sufficient to model the impact of the proposed

+

ability to ch:racterize the impact of uncertainty in change. The characterization of the problem should in-the analysis, and it is essential that these uncertain-clude establishing a cause-effect relationship to iden-ties be recognized when assessing whether the tify portions of the PRA affected by the issue being principles are being met. Section 2.2.5 provides evaluated. Full-scale applications of the PRA should guidelines on how the uncertainty is to be ad-reflect this cause-effect relationship in a quantification dressed in the decisionmaking process.

of the impact on the PRA elements. For applications The staff's decision on the proposed LB change like component categorization, sensitivity studies on will be based on its independent judgment and review the effects of the change it.ay be sufficient. For other ap-P cations it may be adequate to define the qualitative li of the entire application.

\\

relationship of the impact on the PRA elements or only 2.23 Scope, level of Detail, and Quality of the identify which elements are impacted.

PRA If the impacts of a change to the plant cannot 1;e as-The scope, level of detail, and quality of the PRA is sociated with elements of the PRA, the PRA should be to be commensurate with the application for which it is modified accordingly or the impact of the change intended and the role the PRA results play in the inte-should be evaluated qualitatively as part of the deci-grated decision process. The more emphasis that is put sionmaking process (or expert panel process). In any on the risk insights and on PRA results in the decision-case, the effects of the changes on the reliability and un-making process, the more requirements that have to be availability of systems, structures, and components or placed on the PRA,in terms of both scope and how well on operator actions should be appropriately accounted the risk and the change in risk is assessed.

for.

Conversely, emphasis on the PRA scope and quali-2.233 PRA Quality ty can be reducedif a proposed change to the LB results In the current context, quality will be defined as in a nsk decrease or is very small, or if the decision measuringthe adequacy of the actual modeling. A PRA could be based mostly on traditional engineering argu-used in risk-informed regulation should be performed ments, or if compensating measures are proposed such correctly, in a manner that is consistent with accepted that it can be convincingly argued that the change is practices, commensurate with the scope and level of de-my small.

tail required as discussed above. One approach a li-Since this Regulatory Guide 1.174 is intended for a censee could use to ensure quality is to perform a peer variety of applications, the required quality and level of review of the PRA. In this case, the submittal should detail may vary. One over-riding requirement is that the document the review process, the qualification of the p

PRA should realistically reflect the actual design, reviewers thesummarizedreviewfindings,andresolu-construction, operational practices, and operational ex-tions to these findings where applicable. Industry PRA

]

perience of the plant and its owner. This should include certification programs and PRA cross-comparison l

the licensee's voluntary actions as well as regulatory re-studies could also be used to help ensure appropriate i

1.174 - 9

scope, level of detail, and quality of the PRA. If such programs or studies are to be used, a description of the

[

program, including the approach and standard or guide-8" lines to which the PRA is compared, the depth of the review, and the make-up and qualifications of the per-

_.O sonnel involved should be provided for NRC review.

REGON N

[

Based on the peer review or certification process and on te the findings from this process, the licensee shouldjus-REGoN ui tify why the PRA is adequate for the present application

_]._ lh in terms of scope and quality. A staff review cannot be 104 1e cDF-*

replaced in its entirety by a peer review, a certification, or cross-comparison, although the more confidence the F gure 3. Acceptance Guidelines

• for Core staff has in the review that has been performed for the Damage Frequency (CDF) licensee, the less rigor should be expected in the staff review.

The NRC has not developed its own formal stan-t dard nor endorsed an industry standard for a PRA sub-mitted in support of applications governed by this regu-d latory guide. However, the NRC supports ongoing te

'o initiatives to develop a standard and expects that one REGON C

.,v will be available in the future. In the interim, the NRC staff will evaluate PRAs submitted in support of spe-1, ',%

REGON M W

cific applications using the guidelines given in Chapter

"~~ ~^

19 of its Standard Review Plan (Ref. 4). The staff ex-pects to feed back the experience gained from these re-1P 1P LERF-*

views into the standards development process so that ultimately a standard can be developed that is suitable Figure 4. Acceptance Guidelines

• for Large for regulatory decisionmaking as described in this Early Release Frequency (LERF) guide. In addition, the references and bibliography pro-

• The analysis will be subject to increased technical vide information that licensees may find useful in de-review and management attention as indicated by the ciding on the acceptability of their PFA.

darkness of the shading of the figure. In the context of the integrated decisionmaking, the boundaries between regions should not be interpreted as being definitive; 2.2.4 Acceptance Guidelines the numerical values associated with defining the re-The risk-acceptance guidelines presented in this gions in the figure are to be interpreted as indicative regulatory guide are based on the principles and expec-values only.

tations for risk-informed regulation discussed in Sec-tion 2, and they are structured as follows. Regions are There are two sets of acceptance guidelines, one for established in the two planes generated by a measure of CDF and one for LERF, and both sets should be used.

the baseline risk metric (CDF or LERF) along the x-axis, and the change in those metrics (ACDF or If the application clearly can be shown to result in a ALERF) along the y-axis (Figures 3 and 4), and accep-decrea.re in CDF, the change will be considered to tance guidelines are established for each region as dis.

have satisfied the relevant principle of risk-cussed below. These guidelines are intended for com-informed regulation with respect to CDF. (Because parison with a full-scope (including internal events, Figure 3 is drawn on a log scale, this region is not external events, full power, low power, and shutdown) explicitly indicated on the figure.)

When the calculated increase in CDF is very small, assessment of the change in risk metric, and when nec-4 essary, as discussed below, the baseline value of the risk which is taken as being less than 10 per reactor metric (CDF or LERF). However, it is recognized that year, the change will be considered regardless of many PRAs are not full scope and PRA information of whether there is a calculation of the total CDF(Re-less than full scope may be acceptable as discussed in gion 111). While there is no requirement to calculate Section 2.2.5 of this regulatory guide.

the total CDF,if there is an indication that the CDF 1.174 -10

may be considerably higher th 110d per reactor Applications that result in increases to LERF year, the focus should be on fir. ling ways to de-above 104 per reactor year (Region I) would not crease rather than increase it. Suu an indication normally be considered.

would result, for example, if(1) the contribution t These guidelines are intended to provide assurance CDF calculated from a limited scope analysis, such that proposed increases in CDF and LERF are small as the individual plant examination (IPE) or the in-and are consistent with the intent of the Commission's dividual plant examination of external events Safety Goal Policy Statement.

(IPEEE), significantly exceeds 104, (2) a potential vulnerability has been identified from a margins.

As indicated by the shading on the figures, the type analysis, or (3) historical experience at the change request will be subject to an NRC technical and plant in question has indicated a potential safety management review that will become more intensive concern.

when the calculated results are closer to the region boundaries.

When the calculated increase in CDFis in the range The guidelines discussed above are applicable for of104 per reactor year to10-5perreactor year,ap-full power, low power, and shutdown operations. How-i plications will be considered only ifit can be rea-ever, during certain shutdown operations when the con-sonably shown that the total CDF is less than 104 tainment function is not maintained, the LERF guide-per reactor year (Region II).

line as defined above is not practical. In those cases, Applications that result in increases to CDF above licensees may use more stringent baseline CDF guide-10-5 per reactor year (Region I) would not nor-lines (e.g.,10-5per reactor year) to maintain an equiva-mally be considered.

lent risk profile or may propose an alternative guidehne to LERF that meets the intent of Principle 4 (see Fig-AND "IC 1)-

The technical review that relates to the risk evalua-If the application clearly can be shown to result in a tion will address the scope, quality, and robustness of decrease in LERF, the change will be considered t the analysis, including consideration of uncertainties as have satisfied the relevant principle of risk-discussed in the next section. Aspects covered by the informed regulation with respect to LERF. (Be-management review are discussed in Section 2.2.6,In-cause Figure 4 is drawn with a log scale, this region tegrated Decisionmaking, and include factors that are is not explicitly indicated on the figure.)

not amenable to PRA evaluation.

When the calculated increase in LERF is very 2.2.5 Comparison of PRA Results with the small, which is taken as being less than 10-7 per Acceptance Guidelines reactor year, the change will be considered regard-less of whether there is a calculation of the total This section provides guidance on comparing the LERF(Region III). While there is no requirement results of the PRA with the acceptance guidelines de-to calculate the total LERF,if there is an mdication scribed in Section 2.2.4. In the context ofintegrated de-cisionmaking, the acceptance guidelines should not be that the LERF may be considerably higher than nterpreted as being overly prescriptive. They are in-10-5 per reactor year, the focus should be on find-tended to provide an indication, in numerical terms, of ing ways to decrease rather than increase it. Such what is considered accereable. As such, the numerical an indication would result, for example, if (1) the values associated with d'efining the regions in Figures 3 contribution to LERF calculated from a limited scope analysis, such as the IPE or the IPEEE, sig-and 4 of this regulatory guide are approximate values mficantly exceeds 10-5, (2) a potential vulnerabili-that provide an indication of the changes that are gener-ty has been identified from a margins-type analy-ally acceptable. Furthermore, the state of knowledge, or epistemic, uncertainties associated with PRA cal-sis, or (3) histoncal experience at the plant in question has m, dicated a potential safety concern.

culations preclude a definitive decision with respect to which region the application belongs in based purely on When the calculated increase in LERF is in the the numerical results.

range of 10-7 per reactor year to 104 per reactor The intent of comparing the PRA results with the year, applications will be considered only ifit can acceptance guidelines is to demonstrate with reason-be reasonably shown that the total LERF is less able assurance that Principle 4, discussed in Section 2, than 10-5 per reactor year (Region II).

is being met. This decision must be based on a full un-1.174 - 11

derstanding of the contributors to the PRA results and tiating event frequencies, and huma n error probabilities the impacts of the uncertainties, both those that are ex-that are used in the quantification M the accident se-plicitly accounted for in the results and those that are quence frequencies.They are typically characterized by not.This is a somewhat subjective process, and the rea-establishing probability distributions on the parameter soning behind the decisions must be well documented.

values. These distributions can be interpreted as ex-Guidance on what should be addressed follows in Sec-pressing the analyst's degree of belief in the values tion 2.2.E4; but first, the types of uncertainty that im-these parameters could take, based on his state of pact PRA results and methods typically used for their knowledge and conditional on the underlying model analysis are briefly discussed. More information can be being correct. It is straightforward and within the capa-found in some of the publications in the Bibliography, bility of most PRA codes to propagate the distribution representing uncertainty on the basic parameter values 2.2.5.1 Types of Uncertainty and Methods of to generate a probability distribution on the results I

(e.g., CDF, accident sequence frequencies, LERF) of There are two facets to uncertainty that, because of the PRA. However, the analysis must be done to corre-their natures, must be treated differently when creating late the sample values for different PRA elements from models of complex systems. They have recently been a group to which the same parameter value applies (the termed aleatory and epistemicuncertainty.The aleatory so-called state-of-knowledge dependency; see uncertainty is that addressed when the events or phe-Ref.10).

nomena being modeled are characterized as occurring 2.2.5.3 Model Uncertainty in a " random" or " stochastic" manner, and probabilistic models are adopted to descrise their occurrences. It is The development of the PRA model is supported this aspect of uncertainty that gives PRA the probabilis.

by the use of models for specific events or phenomena.

tic part ofits name. The epistemic uncertainty is that as.

In many cases, the industry's state of knowledge is in-sociated with the analyst's confidence in the predic.

complete, and there may be different opinions on how tions of the PRA model itself, and it reflects the the models should be formulated. Examplos include ap-analyst's assessment of how well the PRA model re-Proaches to modeling human performance, common presents the actual system being modeled. This has cause failures, and reactor coolant pump seal behavior been referred to as state-of-knowledge uncertainty. In upon loss of seal cooling. This gives rise to model un-this sec 'an, it is the epistemic uncertainty that is dis.

certainty. In many cases, the appropriateness of the cussed; the aleatory uncertainty is built into the struc-models adopted is not questioned and these models ture of the PRA modelitself.

have become, de facto, the standard models to use.

Because they are generally characterized and Examples include the use of Poisson and binomial treated differently,it is useful to identify three classes of m dels to characterize the probability of occurrence of uncertainty that are addressed in and impact the results component failures. For some issues with well-f rmulated alternative models, PRAs have addressed of PRAs: parameter uncertainty, model uncertainty, and completeness uncertainty. Completeness uncer-moil uncertainty by using discrete distributions over tainty can be regarded as one aspect of model uncer-the alternative models, with the probability associated tainty, but because ofits importance,it is discussed sep-with a specific model representing the analyst's degree f belief that that model is the most appropriate. A good arately. The Bibliography may be consulted for additionalinformation on definitions of terms and ap-example is the characterization of seismic hazard as dif-

.proaches to the treatment of uncertainty in PRAs.

ferent hypotheses lead to different hazard curves,which can be used to develop a discrete probability distribu-2.2.5.2 Parameter Uncertainty tion of the initiating event frequency for earthquakes.

Other examples can be f v ad in the Level 2 analysis.

Each of the models that is used, either to develop the PRAlogic structure or to represent the basic events Another approach to addressing model uncertainty of that structure, has one or more parameters. Typically, has been to adjust the results of a single model through each of these models (e.g., the Poisson model for initi-the use of an adjustment factor. However it is formu-ating events) is assumed to be appropriate. However, lated, an explicit representation of model uncertainty the parameter values for these models are often not can be propagated through the analysis in the same way known perfectly. Parameter uncertainties are those as-as parameter uncertainty. More typically, however, par-sociated with the values of the fundamental parameters ticularly in the Level 1 analysis, the use of different of the PRA model, such as equipment failure rates,ini-models would result in the need for a different structure 1.174 - 12

(e.g., with different thermal hydraulic models used to The issue of completeness of scope of a PRA can be determine success criteria). In such cases, uncertainties addressed for those scope items for which methods are in the choice of an appropriate model are typically ad-in principle available, and therefore some understand-dressed by making assumptions and, as in the case of ing of the contribution to risk exists, by supplementing the component failure models discussed above, adop-the analysis with additional analysis to enlarge the ting a specific model.

scope, using more restrictive acceptance guidelines, or by providing arguments that, for the application of con-PRAs model the continuum of possible plant states cern, the out-of-scope contributors are not significant.

in a discrete way, and are, by their very nature, approxi-Approaches acceptable to the NRC staff for dealing h

mate models of the world. This results in some random with incompleteness are discussed in the next section.

(aleatory) aspects of the 'world' not being addressed 2.2.5.4 Comparisons with Acceptance except in a bounding way, e.g., different realizations of Guidelines an accident sequence corresponding to different LOCA sizes (within a category) are treated by assuming a The different regions of the acceptance guidelines bounding LOCA, time of failure of an operating com.

require different depths of aralysis. Changes resulting j

ponent assumed to occur at the moment of demand.

m net decrease in the CDF and LERF estimates do not These approximations introduce biases (uncertainties) require an assessment of the calculated baseline CDF into the results.

and LERE Generally, it should be possible to argue on the basis of an understanding of the contributors and the In interpreting the results of a PRA, it is important changes that are being made that the overall impact is to develop an understanding of the impact of a specific indeed a decrease, without the need for a detailed quan-assumption or choice of model on the predictions of the titative analysis.

PRA. This is true even when the model uncertainty is If the calculated values of CDF and LERF are very treated probabilistically, since the probabilities, or small, as defined by Region III in Figures 3 and 4, a de-weights, given to differest models would be subjective-tailed quantitative assessment of the baseline value of The impact of using alternative assumptions or medels CDF and LERF will not be necessary. However,if there may be addressed by performing appropriate sensitiv-is an indication that the CDF or LERF could consider-n ity studies, or they may be addressed using qualitative ably exceed 10-4and 10-5respectively,in order for the arguments, based on an understanding of the contribu-change to be considered, the liccasee may be required tors to the results and how they are impacted by the to present arguments as to why steps should not be tak-change in assumptions or models. The impact of mak-en to reduce CDF or LERE Such an indication would ing specific modeling approximations may be explored result, for example, if (1) the contribution to CDF or in a similar manner.

LERF calculated from a limited scope analysis, such as the IPE or the IPEEE, significantly exceeds 10-4 and 2.2.5.3 Completeness Uncertainty 10-5respectively,(2) there has been an identification of a potential vulnerability from a margins-type analysis, Completeness is not in itself an uncertainty, but a or (3) historical experience at the plant in question has reflection of scope limitations. The result is, however, indicated a potential safety concern.

an uncertainty about where the true risk lies. The prob-lem with completeness uncertainty is that, because it re-For larger values of ACDF and ALERF, which lie flects an unanalyzed contribution, it is difficult (if not in the range used to define Region II, an assessment of impossible) to estimate its magnitude. Some contribu-the baseline CDF and LERF is required.

tions are unanalyzed not because methods are not avail-To demonstrate compliance with the numerical able, but because they have not been refined to the level guidelines, the level of detail required in the assessment of the analysis of internal events. Examples are the of the values and the analysis of uncertainty related to analysis of some external events and the low power and model and incompleteness issues will depend on both shutdown modes of operation. There are issues, how-(1) the LB change being considered and (2) the impor-ever, for which methods of analysis have not been de-tance of the demonstration that Principle 4 has been veloped, and they have to be accepted as potential limi-met. In Region III of Figures 3 and 4, the closer the esti-tations of the technology. Thus, for example, the impact mates of ACDF or ALERF are to their corresponding on actual plant risk from unanalyzed issues such as the acceptance guidelines, the more detail will be required.

influences of organizational performance cannot now Similarly,in Region II of Figures 3 and 4, the closer the be explicitly assessed.

estimates of ACDF or ALERF and CDF and LERF are 1.174 -13

to their corresponding acceptance guidelines, the more would not significantly change the assessment. This detail will be required. In a contrasting example,if the demonstration can take the form of well formulated estimated value of a particular metric is very small msitivity studies or qualitative arguments.In this con-compared to the acceptance goal, a simple bounding text," reasonable"is interpreted as implying some pre-analysis may suffice with no need for a detailed uncer-cedent for the alternative, such as use by other analysts, tainty analysis.

and also that there is a pbWally reasonable basis for the alternative. It is not the intent that the search for al-Because of the way the acceptance guidelines were ternatives should be exhaustive and arbitrary. For the developed, the appropriate numerical measures to use decisions that involve only assessing the change in met-in the initial comparison of the PRA results to the ac-rics, the number of model uncertainty issues to be ad-ceptance guidelines are mean values. The mean values dressed will be smaller than for the case of the baseline referred to are the means of the probability distributions values, when only a portion of the model is affected.

that result from the propagation of the uncertainties on The alternatives that would drive the result toward un-the input parameters and those model uncertainties ex-acceptableness should be identified and sensitivity plicitly represented in the model. While a formal propa-studies performed or reasons given as to why they are gation of the uncertainty is the best way to correctly ac-not appropriate for the current application or for the par-count for state-of-knowledge uncertainties that arise ticular plant. In general, the results of the sens;tivity from the use of the same parameter values for several studies should confirm that the guidelines are still met basic event probability models, under cer+ain circum-even under the alternative assumptions (i.e., change stances, a formal propagation of uncertainty may not be generally remains in the appropriate region). Alterna-required if it can be demonstrated that the state-of-tively, this analysis can be used to identify candidates knowledge correlation is unimportant. This will in-for compensatory actions or increased monitoring.The volve, for example, a demonstration that the bulk of the licensee should pay particular attention to those as-contributing scenarios (cutsets or accident sequences) sumptions that impact the parts of the modcl being ex-do not mvolve multiple events that rely on the same pa-ercised by the change.

rameter for their quantification.

When the PRA is not full scope,it is necessary for Consistent with the viewpoint that the guidelines the licensee to address the significance of the out-of-are not to be used prescriptively, even if the calculated scope items. The importance of assessing the contribu-ACDF and ALERF values are such that they place the tion of the out-of-scope portions of the PRA to the base change in Region I or II, it may be possible to make a case estimates of CDF and LERF is related to the mar-case that the application should be treated as ifit were in gin between the as-calculated values and the accep-Region II or III if, for example,it is shown that there are tance guidelines. When the contributions from the unquanti5ed benefits that are not reflected in the quan-modeled contributors are close to the guicelines, the ar-titative risk results. However, care should be taken that gument that the cemtribution from the missing items is there are no unquantified detrimental impacts of the not significant must be convincing, and in some cases change,such as an increase in operator burden. In addi-may require additional PRA analyses. When the mar-tion,if compensatory measures are proposed to counter E n is significant, a qualitative argument may be suffi-i the impact of the major risk contributors, even though cient. The contribution of the out-of-scope portions of the impact of these measures may not be estimated nu-the model to the change in metric may be addressed by merically, such arguments will be considered in the de-bounding analyses, detailed analyses, or by a demon-cision process.

stration that the change has no impact on the unmo-deled contributors to risk. In addition,it should also be While the analysis of parametric uncertainty is demonstrated that changes based on a partial PRA do fairly mature, and is addressed adequately through the n t disproportionally change the risk associated with use of mean values, the analysis of the model and com-those accident sequences that arise from the modes of pleteness uncertainties cannot be handled in such a for-Peration not included in the PRA.

mal manner. Whether the PRA is full scope or only par-tial scope, and whether it is only the change in metrics One alternative to an analysis of uncertainty is to or both the change and baseline values that need to be design the proposed LB change such that the major l

estimated,it will be incumbent on the licensee to dem-sources of uncertainty will not have an impact on the onstrate that the choice of reasonable alternative hy-decisionmaking process. For example, in the region of potheses, adjustment factors, or modeling approxima-the acceptance guidelines where smallincreases are al-tions or methods to those adopted in the PRA model lowed regardless of the value of the baseline CDF or 1.174 -14

LERF, the proposed change to the LB could be de-The cumulative impact of previous changes and signed such that the modes of operation or the initiating the trend in LERF(the licensee's risk management O

events that are missing from the analysis would not be approach);

affected by the change. In these cases, incompleteness The impact of the proposed change on operational i

would not be an issue. Similarly, in such cases, it would complexity, burden on the operating staff, and not be necessary to address all the model uncertainties, overall safety practices; but only those that impact the evaluation of the change.

Plant-specific performance and other factors (for If only a Level 1 PRA is available, in general, only example, siting factors, inspection findings, per-the CDFis calculated and not the LERF. An approach is formance indicators, and operational events), and presented in Reference 9 that allows a subset of the core level 3 PRA information, if available; damage accidents identified in the Level 1 analysis to The benefit of the change in relation to its CDF/

be allocated to a release category that is equivalent to a LERF increase; LERF. The approach uses simplified event trees that can be quantified by the licensee on the basis of the The practicality of accomplishing the change with plant configuration applicable to each accident se-a smaller CDF/LERFimpact; and quence in the Level 1 analysis. The frequency derived The practicality of reducing CDF/LERF when a

from these event trees can be compared to the LERF ac-there is reason to be 've that the baseline CDF/

ceptance guidelines. The approach described in Refer-LERF are above the guideline values (i.e.,104and ence 9 may be used to estimate LERF only in those 10-5 per reactor year).

cases when the plant is not close to the CDF and LERF benchmark values.

2.3 ELEMENT 3: DEFINE IMPLEMENTATION AND MONITORING PROGRAM 2.2.6 Integrated Decisionmaking Careful consideration should be given to imple-The results of the different elements of the engi-mentation and performance-monitoring strategies. The q

neering analyses di.scussed in Sections 2.2.1 and 2.2.2 primary goal for this element is to ensure that no ad-g rnust be considered in an integrated manner. None of verse safety degradation occurs because of the changes the individual analyses is sufficient in and of itself. In to the LB. The staff's principal concern is the possibil-this way, it can be seen that the decision will not be ity that the aggregate impact of changes that affect a driven solely by the numerical results of the PRA. They large class of SSCs could lead to an unacceptable in-are one input into the decisionmaking and help in build-crease in the number of failures from unanticipated ing an overall picture of the implications of the propo-degradation, including possible increases in common sed change on risk. The PRA has an important role in cause mechanisms. Therefore, an implementation and putting the change into its proper context as it impacts monitoring plan should be developed to ensure that the the plant as a whole. The PRA analysis is used to dem-engineering evaluation conducted to examine the im-onstrate that Principle 4 has been satisfied. As the dis-pact of the proposed changes continues to reflect the ac-cussion in the previous section indicates, both quantita-tual reliability and availability of SSCs that have been tive and qualitative arguments may be brought to bear, evaluated. This will ensure that the conclusions that Even though the different pieces of evidence used to ar-have been drawn from the evaluation remain valid. Fur-gue that the principle is satisfied may not be combined ther details of acceptable processes for implementation in a formal way, they need to be clearly documented.

in specific applications are discussed in application-specific regulatory guides (Refs. 5-8).

In Section 2.2.4, it was indicated that the applica-tion would be given increased NRC management atten-Decisions concerning the implementation of tion when the calculated values of the changes in the changes should be made in light of the uncertainty asso-risk metrics, and their baseline values when appropri-ciated with the results of the traditional and probabilis-ate, approached the guidelines. Therefore, the issues in tic engineering evaluations. Broad implementation the submittal that are expected to be addressed by NRC within a limited time period may be justified when un-management include:

certainty is shown to be low (data and models are ade-quate, engineering evaluations are verified and vali-The cumulative impact of previous changes and dated, etc.), whereas a slower, phased approach to the trend in CDF (the licensee's risk management implementation (or other modes of partial implem enta-approach);

tion) would be expected when uncertainty in evaluation 1.174 - 15

findings is higher and where programmatic changes are readily measurable. When actual conditions cannot be being made that could impact SSCs across a wide spec-monitored or measured, whatever information most trum of the plant, such as in inservice testing, inservice closely approximates actual performance data should inspection, and graded quality assurance (IST, ISI, and be used. For example, establishing a monitoring pro-graded QA). In such situations, the potential introduc-gram with a performance-based feedback approach tion of common cause effects must be fuhy considered may combine some of the following activities.

and included in the submittal.

Monitoring performance characteristics under ac-tual design basis conditions (e.g., reviewing actual The staff expects licensees to propose monitonng demands on emergency diesel generators, review-programs that melude a means to adequately track th i

dW performance of equipment that, when degraded, can af-Monitoring performance characteristics under test feet the conclusions of the licensee's engineering evalu-ation and integrated decisionmaking that support the conditions that are similar to those expected during change to the LB. The program should be capable of a design basis event trending equipment performance after a change has Monitoring and trending performance characteris-been implemented to demonstrate tha~ performance is tics to verify aspects of the underlying analyses, re-consistent with that assumed in the traditional engi-search, or bases for a requirement (e.g., measuring neering rmd probabilistic analyses that were conducted battery voltage and specific gravity, inservice in-to justify the change. This may include monitoring as-spection of piping) sociated with non-safety-related SSCs,if the analysis determines those SSCs to be risk significant. The pro-Evaluating licensee performance during traimng gram should be structured such that (1) SSCs are moni-scenarios (e.g., emergency planning exercises, op-tored commensurate with their safety importance,i.e.,

erator licensing examinations) monitoring for SSCs categorized as having low safety Component quality controls, including developing i

significance may be less rigorous than that for SSCs of pre-and post-componeni installation evaluations high safety significance, (2) feedback of information (e.g., environmental qualification inspections, i

and corrective actions are accomplished in a timely reactor protection system channel checks, continu-manner, and (3) degradation in SSC performance is de-ity testing of boiling water reactor squib valves).

l tected and corrected before plant safety can be compro-As part of the monitoring program,it is important mised. The potential impact of observed SSC degrada-that provisions for specific cause determination, trend-tion on similar components in different systems ing of degradation and failures, and corrective actions throughout the plant should be considered.

be included. Such provisions should be applied to SSCs The staff expects that licensees willintegrate, or at commensurate with their importance to safety as deter-least coordinate, their monitoring for risk-informed mined by the engineering evaluation that supports the changes with existing programs for monitoring equip-1.B change. A determination of cause is needed when ment performance and other operating experience on Perfonnance expectations are not bem, g met or when their site and throughout the industry. In particular, there is a functional failure of an application-specific monitoring that is performed in conformance with the SSC that poses a significant condition adverse to quali-Maintenance Rule can be used when the monitoring ty. The cause determination should identify the cause of performed under the Maintenance Rule is sufficient for the failure or degraded performance to the extent that j

the SSCs affected by the risk-informed application. If corrective action can be identified that would preclude j

an application requires monitoring of SSCs that are not the problem or ensure that it is anticipated prior to be-

)

included in the Maintenance Rule, or have a greater res-coming a safety concern. It should address failure sig-olution of monitoring than the Maintenance Rule (com-nificance, the circumstances surrounding the failure or ponent vs. train or plant-level monitoring), it may be degraded performance, the characteristics of the fail-advantageous for a licensee to adjust the Maintenance ure,.md whether the failure is isolated or has generic or Rule monitoring program rather than to deve!op addi-common cause implications (as defined in Ref.11).

tional monitoring programs for risk-informed pur-Finally,in accordance with Criterion XVI of Ap-poses. In these cases, the performance criteria chosen pendix B to 10 CFR Part 50, the monitoring program i

should be shown to be appropriate for the application in should identify any corrective actions to preclude the question. It should be noted that plant or licensee per-recurrence of unacceptable failures or degraded perfor-formance under actual design conditions may not be mance.The circumstances surrounding the failure may l

1.174 -16 1

indicate that the SSC failed because of adverse or harsh in developing the risk information set forth in this operating conditions (e.g., operating a valve dry, over-regulatory guide, licensees will likely identify SSCs pressurization of a system) or failure of another compo-with high risk significance that are not currently subject nent that caused the SSC failuie. Therefore, corrective to regulatory requirements, or are subject to a level of actions should also consider SSCs with similar charac-regulation that is not commensurate with their risk sig-teristics with regard to operating, design, or mainte-nificance. It is expected that licensees will propose LB nance conditions. The results of the monitoring need changes that will subject these SSCs to an appropriate not be reported to the NRC, but should be retained on-level of regulatory oversight, consistent with the risk site for inspection.

significance of each SSC. Specific information on the staff's expectations in this regard are set forth in the application-specific regulatory guides (Refs. 5-8).

2.4 ELEMENT 4: SUBMITPROPOSED CHANGE 2.5 QUALITY ASSURANCE As stated in Section 2.2, the staff expects that the Requests for proposed changes to the plant's LB quality of the engineering analyses conducted tojustify typically take the form of requests for license amend-proposed LB changes will be appropriate for the nature ments (including changes to or removal oflicense con-of the change. In this regard,it is expected that for tradi-ditions), technical specification changes, changes to or tional engineering analyses (e.g., deterministic engi-withdrawals of orders, and changes to programs pur-neering calculations) existing provisions for quality as-suant to 10 CFR 50.54 (e.g., QA program changes un-surance (e.g., Appendix B to 10 CFR Part 50, for der 10 CFR 50.54(a)). Licensees should (1) carefully safety-related SSCs) will apply and provide the ap-review the proposed LB change m order to determine propriate quality needed. Likewise,when a risk assess-the appropriate form of the change request,(2) ensure that information required by the relevant regulations in ment of the plant is used to provide insightsinto the de-cisionmaking process, the staff expects that the PRA support of the request is developed, and (3) prepare and will have been subject to quality control.

submit the request m, accordance with relevant proce-dural requirements. For example, license amendments To the extent that a licensee elects to use PRA in-should meet the requirements of 10 CFR 50.90,50.91, formation to enhance or modify activities affecting the and 50.92, as well as the procedural requirements in 10 safety-related functions of SSCs, the following,in con-CFR 50.4. Risk information that the licensee submits in junction with the other guidance contained in this support of the LB change request should meet the guid-guide, describes methods acceptable to the NRC staff to ance in Section 3 of this regulatory guide.

ensure that the pertinent quality assurance require-ments of Appendix B to 10 CFR Part 50 are met and that Licensees are free to decide whether to submit risk the PRA is of sufficient quality to be used for regulatory information in support of their LB change request. If de'cisions.

the licensee's proposed change to the LB is consistent Use personnel qualified for the analysis.

with currently approved staff positions, the staff's de-termination will be based solely on traditional engi-Use procedures that ensure control of documenta-neering analyses without recourse to risk information tion, including revisions, and provide for indepen-(although the staff may consider any risk inforTnation dent review, verification, or checking of calcula-submitted by the licensee). However, if the licensee's tions and information used in the analyses (an proposed change goes beyond currently approved staff independent peer review or certification program positions, the staff normally will consider both infor-can be used as an important element in this pro-mation based on traditional engineering analyses and cess) information based on risk insights. If the licensee does Provide documentation and maintain records in ac-not submit risk information in support of an LB change cordance with the guidelines in Section 3 of this that goes beyond currently approved staff positions, the guide.

staff may request the licensee to submit such informa-tion. If the licensee chooses not to provide the risk in-Provide for an independent audit function to ven.fy formation, the staff will revicw the proposed applica-quality (an mdependent peer review or certification tion using traditional engineering analyses and pr gram can be used for this purpose).

determine whether sufficient information has been pro-Use procedures that ensure appropriate attention vided to support the requested change.

and corrective actions are taken if assumptions, 1.174 - 17

A description of the components and systems af-analyses, or information used in previous decision-making is changed (e.g., licensee voluntary action) fected by the change, the types of changes pro-or determined to be in error.

posed, the reason for the changes, and results and insights from an analysis of available data on When performance monitoring programs are used equipment performance (relevant staff expecta-in the implementation ofproposed changes to the LB,it tion: all safety impacts of the proposed LB change is expected that those programs will be implemented by must be evaluated).

I using quality assurance provisions commensurate with the safety significance of affected SSCs. An existing A reevaluation of the LB accident analysis and the PRA or analysis can be utilized to support a proposed Provisions of 10 CFR Parts 20 and 100,if appropri-LB change, provided it can be shown that the appropri.

ate (Relevant principles: LB changes meet the reg-ate quality provisions have been met.

ulations, sufficient safety mq;in: are maintained, defense-in-depth philosophy).

An evaluation of the impact of the LB change on

3. DOCUMENTATION AND SUBMITTAL the breadth or depth of defense-in-depth attributes f the plant (relevant principle: defense-in-depth

3.1 INTRODUCTION

philosophy).

To facilitate the NRC staff's renew to ensure that Identification of how and where the proposed the analyses conducted were suffinent to conclude that change will be documented as part of the plant's the key pnnciples of risk-informed regulation have LB (e.g., FSAR, technical specifications, licensing been met, documentation of the evaluation process and conditions). This should include proposed changes findings are expected to be maintained. Additionally, or enhancements to the regulatory controls for the information submitted should include a description high-risk-significant SSCs that are not subject to of the process used by the licensee to ensure quality and any requirements or the requirements are not com-some specific information to support the staff's conclu-mensurate with the SSC's risk significance.

sion regarding the acceptability of the requested LB change.

The licensee should also identify:

Key assumptions in the PRA that impact the ap-3.2 ARCIIIVAL DOCUMENTATION plication (e.g., voluntary licensee actions), ele-Archival documentation should include a detailed ments of the monitoring program, and commit-description of engineering analyses conducted and the ments made to support the application.

results obtained, irrespective of wheth:r they were SSCs for which requirements should be increased.

quantitative or qualitative, or whether the analyses The information to be provided as part of the made use of traditional engineering methods or proba-

's LB (e.g., FSAR, technical specifications, bilistic approaches. This documentation should be licensing condition).

maintained by the licensee, as part of the normal quality assurance program. so that it is available for examina.

As discussed in Section 2.5 of this guide,if a li-tion. Documentation of the analyses conducted to sup.

censee elects to use PRA as an element to enhance or port changes to a plant's LB should be maintained as modify its implementation of activities affecting the lifetime quality records in accordance with Regulatory safety-related functions of SSCs subject to the provi-Guide 1.33 (Ref.12).

sions of Appendix B to 10 CFR Part 50, the pertinent requirements of Appendix B will also apply to the 3.3 LICENSEE SUBMITTAL PRA. In this context, therefore, a licensee would be ex-DOCUMENTATION pected to control PRA activity in a manner commensu-rate with its impact on the facility's design and licens-To support the NRC staff's conclusion that the pro-ing basis and in accordance with all applicable posed LB change is consistent with the key principles regul tions and its QA program desenption. An inde-of risk-informed regulation and NRC staff expecta-Pendent peer review can be an important element of en-tions, the staff expects the following information will suring this quality. The licensee's submittal should dis-be submitted to the NRC:

cuss measures used to ensure adequate quality, such as a A description of how the proposed change will im-report of a peer review (when performed) that addresses pact the LB (relevant principle: LB changes meet the appropriateness of the PRA model for supporting a regulations).

risk assessment of the LB change under consideration.

1.174 - 18

The report should address any analysis limitations that information could include quantitative (e.g., IPE are expected to impact the conclusion regarding accept-or PRA results for internal initiating events, exter-ability of the proposed change.

nal event PRA results if available) and qualitative The licensee's resolution of the findings of the peer r semi-quantitative information (results of mar-review, certification, or cross comparison, when per-gins analyses, outage configuration studies).

formed, should also be submitted. For example, this re-Information related to assessment of total plant

=

sponse could indicate whether the PRA was modified LERF-the extent of the information required will or could justify why no change was necessary to sup-depend on whether the analysis of the change in h

port decisionmaking for the LB change under consider-LERFis in Region II or Region Ill of Figure 4.The

}

ation. As discussed in Section 2.2.2,the staff's decision information could include quantitative (e.g., IPE on the proposed license amendment will be based on its or PRA results for internal initiating events, exter-independent judgment and review, as appropriate, of nal event PRA results if available) and qualitative the entire application.

or semi-quantitative information (results of mar-3.3.1 Risk Assessment Methods

\\

Results of analyses that show that the conclusions 1

In order to have confidence that the risk assessment regarding the impact of the LB change on plant risk conducted is adequate to support the proposed change' will not vary sig) ificantly under a different set of g

a summary of the risk assessment methods used should plausible assumptions.

be submitted. Consistent with current practice, mfor-A description of the licensee process to ensure mation submitted to the NRC for its consideration in making risk-informed regulatory decisions will be PRA quality and a discussion as to why the PRA is made publicly available, unless such information is of sufficient quality to support the current applica-deemed proprietary and justified as such. The follow-tion.

ing information should be submitted and is intended to illustrate that the scope and quality of the engineering 3.3.2 Cumulative Risks analyses conducted to justify the proposed LB change As part of evaluation of risk, licensees should un-are appropriate to the nature and scope of the change.

derstand the effects of the present application in light of A description of risk assessment methods used, Past applications. Optimally, the PRA used for the cur-rent application should already model the effet ts of past The key modeling assumptions that are necessary applications. However, qualitative effects and syner-to support the analysis or that impact the applica-gistic effects are sometimes difficult to model. Track-

tion, ing changes in risk (both quantifiable and nonquantifi-The event trees and fault trees necessary to support able) that are due to plant changes would provide a the analysis of the LB change, and mechanism to account for the cumulative and synergis-tic effects of these plant changes and would help to A list of operator actions modeled in the PRA that demonstrate that the proposing licensee has a risk man-impact the application and their error probabilities.

agement philosophy in which PRA is not just used to The submitted information that summarizes the re.

systematically increase risk, but is also used to help re-sults of the risk assessment should include:

duce risk where appropriate and where it is shown to be The effects of the change on the dominant se-e st effective. The tracking of cumulative risk will also help the NRC staffin monitoring trends.

quences (sequences that contribute more thn five percent to the risk)in order to show that the LB Therefore, as part of the submittal, the licensee change does not create risk outliers and does not should track and submit the impact of all plant changes exacerbate existing risk outliers.

that have been submitted for NRC review and approval.

Documentation should include:

An assessment of the change to CDF and LERF,in-cluding a description of the significant contribu-The calculated change in risk for each application tors to the change.

(CDF and LERF) and the plant elements (e.g.,

information related to assessment of the total plant Cs, procedures) affected by each change, CDF-the extent of the information required will Qualitative arguments that were used tojustify the depend on whether the analysis of the change in change (if any) and the plant elements affected by CDF is in Region II or Region III of Figure 3. The these arguments, 1.174 - 19

\\

Compensatory measures or other commitments whether these changes are already included in the base used to helpjustify the change (if any) and the plant PRA model should also be included.

elements affected, and PERFORMANCE MONITORING Summarized results from the monitoring programs DOCUMENTATION (where applicable) and a discussion of how these results have been factored into the PRA or into the As described in Section 2.3, a key principle of risk-j current application, informed regulation is that proposed performance im-

{

plementation and monitoring stra:egies reflect uncer-l As an option, the submittal could also list (but not tainties in analysis models and data. Consequently, the submit to the NRC) past changes to the plant that re-submittal should include a description and rationale for duced the plant risk, especially those changes that are the implementation and performance monitoring strat-related to the current application. A discuss:va of egy for the proposed LB change.

l l

1 i

Ol 1.174 -20

REFERENCES 1.

USNRC,"Use of Probabilistic Risk Assessment of Piping," Draft Regulatory Guide DG-1063, Methods in Nuclear Activities: Final Policy State-October 1997.2 (To be issued as Regulatory Guide ment,"FederalRegister, Vol. 60, p. 42622 (60 FR 1.178) 42622), August 16,1995.

7.

USNRC,"An Approach for Plant-Specific, Risk-2.

" Quarterly Status Update for the Probabilistic Informed Decisionmaking: Graded Quality As-Risk Assessment Implementation Plan,"

surance," Draft Regulatory Guide DG-1064, June SECY-97-234, October 14,1997.1 1997.2 (To be issued as Regulatory Guide 1.176) 3.

USNRC," Safety Goals for the Operations of Nu-8.

USNRC,"An Approach for Plant-Specific, Risk-l clear Power Plants; Policy Statement," Federal Informed Decisionmaking: Technical Specifica-Register, Vol. 51, p. 30028 (51 FR 30028), Au-tions," Draft Regulatory Guide DG-1065, June gust 4,1986.

1997.2 (To be issued as Regulatory Guide 1.177) 4.

USNRC,"Use of Probabilistic Risk Assessment 9.

W.T. Pratt et al.,"An Approach for Estimating the in Plant-Specific, Risk Informed Decisionmak-Frequencies of Various Containment Failure ing: General Guidance," Chapter 19 of the Stan-Modes and Bypass Events," Draft NUREG/

dard Review Plan, July 1998.2 CR-6595, December 1997.2 5.

USNRC,"An Approach for Plant-Specific, Risk-

10. G. Apostolakis and S. Kaplan, " Pitfalls in Risk Informed Decisionmaking: Inservice Testing,"

Calculations," Reliability Engineering, Vol. 2, Draft Regulatory Guide DG-1062, June 1997.2 pages 135-145,1981.

(To be issued as Regulatory Guide 1.175)

11. A. Mosleh et al.," Procedures for Treating Com-6.

USNRC,"An Approach for Plant-Specific, Risk-mon Cause Failures in Safety and Reliability Informed Decisionmaking: Inservice Inspection Studies," NUREG/CR4780, Vol. 2, January 1Copics are available forinspection or copying for a fee from the NRC Public Document Room at 2120 L Street NW., Washington, DC; the PDR's mailmg address is Mail Stop LL-6, Washington, DC 20555;

12. USNRC," Quality Assurance Program Require-telephone (202)634-3343.

ments," Regulatory Guide 1.33, Revision 2, Feb-2Single copies of regulatory guides, both active and draft, and draft ruary 1978.2 NUREG documents may be obtamed free of charge by writing the Reproduction and Distribution Services Section, OCIO, USNRC, Washington, DC 20555-0001, or by fax to (301)415-2289, or by 3

email to GRW1@NRC. GOV Active guides may be also purchased Copies are available at current rates from the U.S. Goverment Print-from the NationalTechnical Informat on Service on a standmg order ing Office, PO. Box 37082, Washington, DC 20402 9328 (telephone basis. Details of this service may be obtained by wriung NTIS,5285 (202)512-2249);or from the NationalTechnicallnformation Service Port Royal Road, Springfield, VA 22161. Copics of acuve and draft by wnting NTIS at 5285 Pcrt Royal Road, Springfield, VA 22161.

guides are available for mspection or mpying for a fee from the NRC Copies are available for inspection or copying ior a f ee from the NRC Public Document Room at 2120 L street, NW. Washington, DC; the Public Document Room at 2120 L areet NW., Washington, DC; the PDR's mailing address is Mail Stop LL-6, Washington, DC 20555; PDR's mailing address is Mail Stop LL-6, Washington, DC 20555; telephone (202)634-3273; fax (202)634-3343.

telephone (202)634-3273; fax (202)634-3343.

1.174 - 21

BIBLIOGRAPIIY The citations in this bibliography provide an over-Mosleh, A., et al.," Proceedings of Workshop I in Ad-view of uncertainty analysis in PRA; many also contain vanced Topics in Risk and Reliability Analysis, Model extensive references for further reading.

Uncertainty: Its Characterization and Quantification" Apostolakis, G.A.," Probability and Risk Assessment:

(held in Annapolis, Maryland, October 20-22,1993),

USNRC, NUREG/CP-0138, October 1994.1 The Subjectivist Viewpoint and Some Suggestions,"

Nuclear Safety,19(3), pages 305-315,1978.

Parry, G.W., and P.W. Winter, " Characterization and Evaluation of Uncertainty in Probabilistic Risk Analy-Bohn, M.P., T.A. Wheeler, G.W. Parry," Approaches to sis," Nuclear Safety, 22(1), pages 28-42,1981.

Uncertainty Analysis in Probabilistic Risk Assess-ment," NUREG/CR-4836, USNRC, January 1988.1 Reliability Engineering and System Safety (Special Is-Hickman, J.W., "PRA Procedures Guide," NUREG/

sue on the Meaning of Probability in Probabilistic CR-2300, USNRC, January 1983.t Safety Assessment), Vol. 23,1988.

Reliability Engineering and System Safety (Special Is-Kaplan, S., and B.J. Garrick,"On the Quantitative Def-inition of Risk," Risk Analysis, Vol.1, pages 11-28, sue on Treatment of Aleatory and Epistemic Uncer-tainty), Vol. 54, nos. 2 and 3, November / December March 1981.

1996.

USNRC," Severe Accident Risks: An Assessment for ICopies are available at current rates from the U.S. Goverment Print.

Five U.S. Nuclear Power Plants," NUREG-1150, ing Office, PO. Box 37082, Washington, DC 20402-9328 (telephone Vol.3,Januar7 1991*1

(?u2)512-2249); or from the National Technical information Service

),

e{

' g fo, e}d USNRC,"A Review of NRC Staff Uses of Probabilis-n Rc' '

Pri c S at 528ln p ct onor o b

ting m he

,,,e Public Document Room at 2120 L street NW, Washington, DC; the tic Risk Assessment," NUREG-1489, Appendix C.6, PDR's mailing address is Mail Stop LL-6, Washington, DC 20555; March 1994.3 telephone (202)634-3273; fax (202)634-3343.

O 1.174 - 22

APPENDIX A USE OF RISK-lMPORTANCE MEASURES TO CATEGORIZE STRUCTURES, SYSTEMS, AND COMPONENTS WITH RESPECT TO SAFETY SIGNIFICANCE Introduction the technicalissues associated with the use of PRAim-For several of the proposed applications of the risk.

Portance measmes.

informed regulation process, one of the principal activ-TechnicalIssues Associated with the Use of ities is the categorization of structures, systems, and Importance Measures components (SSCs) and human actions according t safety sigsficance. The purpose of this appendix is t In the implementation of the Maintenance Rule discuss one way that this categorization riay be per-and in industry guides for risk-informed applications formed to be consistent with Principle 4 and the expec-(for example, the PSA Applications Guide), the tations discussed in Section 2.1 of Regulatory Guide Fussell-Vesely Importance, Risk Redu ction Worth, and 1.174" Risk Achievement Worth are the most commonly iden-tified measures in the relative risk ranking of SSCs.

Safety significance of an SSC can be thought of as However,in the use of these importance measures for being related to the role the SSC plays in preventing the risk-informed applications, there are several issues that occurrence of the undesired end state. Thus the posi-should be addressed. Most of the issues are related to tion adopted in this regulatory guide is that all the SSCs technical problems that can be resolved by the use of and human actions considered when constructing th sensitivity studies or by appropriate quantification PRA model (including those that do not necessarily ap-techniques. These issues are discussed in detail below.

pear in the final quantified model, because they have In addition, there are two issues, namely (1) that risk been screened initially, assumed to be inherently reli-rankings apply only to individual contributions and not able, or have been truncated from the solution of the to combinations or sets of contributors, and (2) that risk model) have the potential to be safety significant since rankings are not necessarily related to the risk changes they play a role in preventing core damage.

that result from those contributor changes; the licensee should be aware of these issues and ensure that they In establishing the categorization, it is important t have been addressed adequately. When performed and recognize the purpose behind the categorization,which interpreted correctly, component-level importance is, generally, to sort the SSCs and human actions int measures can provide valuable input to the licensee.

groups such as those for which some relaxation of re-quirements is proposed, and those for which no such Risk-ranking results from a PRA can be affected by change is proposed. It is the proposed application that many factors, the most important being model assump-is the motivation for the categorization, and it is the po.

tions and techniques (e.g., for modeling of human reli-tential impact of the application on the particular SSCs ability or common cause failures), the data used, or the and human actions and on the measures of risk that ulti.

success criteria chosen. The licensee should therefore mately determines which of the SSCs and human ac.

make sure that the PRA is of sufficient quality.

tions must be regarded as safety significant within the In addition to the use of a " quality" PRA, the ro-context of the application. Thisimpact on overall risk bustness of categorization results should also be dem-should be evaluated in light of the principles and deci-onstrated for conditions and parameters that might not sien criteria identified in this guide. Thus, the most ap-be addressed in the base PRA. Therefore, when impor-propriate way to address the categorization is through a tance measures are used to group components or human requantification of the risk measures.

actions as low-safety-significant contributors, the in-However, the feasibility of performing such risk f rmation to be provided to the analysts performing quantification has been questioned when a methnd for qualitative categorization should include sensitivity evaluating the impact of the change on SSC unavail-studies or other evaluations to demonstrate the sensitiv-ability is not available for those applications. An ac-ity of the importance results to the important PRA mod-ceptable alternative to requantification of risk is for the eling techniques, assumptions, and data. Issues that licensee to perform the categorization of the SSCs and should be considered and addressed are listed here.

human actions in an integrated manner, making use of Truncation Limit: The licensee should determine an analytical technique, based on the use of PRA im-that the truncation limit has been set low enough so that portance measures, as input. This appendix discusses the truncated set of minimal cutsets contains all the 1.174 - 23

significant contributors and their logical combinations as low risk contributors. Furthermore,it is not desirable for the application in question and is low enough to cap-for the categorization of SSCs to be affected by re-ture at least 95 percent of the CDF. Depending on the covery actions that sometimes are only modeled for the PRA level of detail (module level, component level, or dominant scenarios. Sensitivity analyses can be used to piece-part level), this may translate into a truncation show how the SSC categorization would change if all limit from 10-12 to 10-8 per reactor year. In addition, recovery actions were removed. The licensee should the truncated set of minimal cutsets should be deter-ensure that the categorization has not been unduly af-mined to contain the important application-specific fected by the modeling of recovery actions.

contributors and their logical combinations.

Multiple Component Considerations: As dis-RiskMetrics: The licensee should ensure that risk cussed previously,importance measures are typically in terms of both CDF and LERF is considered in the evaluated on an individual SSC or human action basis.

ranking process.

One potential concern raised by this is that single-event Completeness of Risk Model: The licensee importance measures have the potential to dismiss all should ensure that the PRA model is sufficiently com-the elements of a system or group despite the fact that plete to address all important modes of operation for the the system or group has a high itoportance when taken SSCs being analyzed. Safety-significant contributions as a whole. (Conversely, there may be grounds for from internal events, external events, and shutdown screening out groups of SSCs, owing to the unimpor-and low power initiators should be considered by using tance of the systems of which they are elements.)There PRA or other engineering analyses.

are two potential approaches to addressing the multiple Sensitivity Analysis for Component Data Un-mmponent issue. The first is to define suitable mea-sures of system or group importance. The second is ta certainties: The sensitivity of component categoriza-tions to uncertainties in the parameter values should be choose appropriate criteria for categorization based on addressed by the licensee. Licensees should be satisfied component-level importance measures. In both cases, that SSC categorization is not affected by data uncer-it will be necessary for the licensee to demonstrate that the cumulative impact of the change has been ade-tainties.

Sensitivity Analysis for Common Cause Fail-utes: CCFs are modeled in PRAs to account for depen-While there are no widely accepted definitions of dent failures of redundant components within a system.

system or group importance measures,if any are pro-The licensee should determine that the safety-posed the licensee should make sure that the measures significant categorization has taken into account the are capturing the impact of changes to the group in a combined effect of associated basic PRA events, such logical way. As an example of the issues that arise, con-as failure to start and failure to run, including indirect sider the following. For front-line systems, one possi-contributions through associated CCF event probabili-bility would be to define a Fussell-Vesely type measure ties. CCF probabilities can affect PRA results by en-of system importance as the sum ithe frequencies of hancing or obscuring the importance of components. A sequences involving failure of that system, divided by component may be ranked as a high nsk contributor the sum of all sequence frequencies. Such a measure mainly because of its contribution to CCFs, or a com-would need to be interpreted carefully if the numerator ponent may be ranked as a low nsk contributor mainly included contributions from failures of that system because it has negligible or no contribution to CCFs.

caused by support systems. Similarly, a Birnbaum-like Sensitivity Analysis for Recovery Actions:

measure could be defined by quantifying sequences in-PRAs typically model recovery actions, especially for volving the system, conditional on its failure, and sum-dominant accident sequences. Quantification of recov-ming up those quantities. This would provide a mea-ery actions typically depends on the time available for sure of how often the system is critical. However, again diagnosis and for performing the action, as well as the the support systems make the situation more complex.

training, procedures, and knowledge of operators.

To take a two-division plant as an example, front-line There is a certain degree of subjectivity involved in es.

failures can occur as a result of failure of support divi-timating the success probability for the recovery ac-sion Ain conjunction with failure of front-line division tions. The concerns in this case stem from situations it B. Working with a figure of merit based on " total failure which very high success probabilities are assigned to a of support system" would miss contributions of this sequence, resulting in telated components being ranked type.

1.174 - 24

In the absence of appropriately defined group-level implies that the criteria should be a function of the base irnportance measures, reliance must be on a qualitative case CDF and LERF rather than being fixed for all categorization by the licensee, as part of the integrated plants. Thus the licensee should demonstrate how the decisionmaking process, to make the appropriate deter-chosen criteria are related to, and conform with, the ac-mination.

ceptance guidelines described in this document. If Relationship of Importance Measures to Risk c mponent-levelcriteriaareused,theyshouldbeestab-Changes: Importance measures do not directly relate lished taking into account that the allowable risk in-to changes in risk. Instead, the risk impact is indirectly crease associated with the change should be based on reflected in the choice of the value of the measure used simultaneous changes to all members of the category.

to determine whether an SSC should be classified as be-SSCs Not Included in the Final Quantified Cut-ing of high and low safety significance. This is a con-set Solution: Importance measures based on the quan-cern whether importances are evaluated at the compo-tified cutsets will not factor in those SSCs that have ei-nent or at the group level. The PSA Applications Guide ther been truncated or were not included in the fault tree suggested values of Fussell-Vesely importance of 0.05 models because they were screened on the basis of high at the system level and 0.005 at the component level, reliability. SSCs that have been screened because their for example. However, the criteria for categorization credible failure modes would not fail the system func-into low and high significance should be related to the tion can be argued to be unimportant. The licensee must acceptance criteria for changes in CDF and LERI This make sure that these SSCs are considered.

1.174 - 25

REGULATORY ANALYSIS A draft regulatory analysis was published with the draft of this guide when it was published for public comment (Task DG-1061, June 1997).

No changes were necessary, so a separate regulatory analysis for Regula -

tory Guide 1.174 has not been prepared. A copy of the draft regulatory analysis is available for inspection or copying for a fee in the NRC's Pub-lic Document Room at 2120 L Street NW., Washington, DC, under Task DG-1%1.

O 1.174 - 26

m im i

O

&_S o

~ % ~-

E

$b

?s!R

=

Z E

S_

sa o

a mh

.Z O

'O o o -4 m t

O N

4 g -< g Fo 8 g8m b

h!

8 eg 5Z O

$$5 mM g

i

>n m

8 5s a"

D

- _ _ _ _ _ _ _ _ _ _ _ _ _ _