ML20248C557
| ML20248C557 | |
| Person / Time | |
|---|---|
| Issue date: | 01/30/1998 |
| From: | Callan L NRC OFFICE OF THE EXECUTIVE DIRECTOR FOR OPERATIONS (EDO) |
| To: | |
| References | |
| SECY-98-015, SECY-98-015-01, SECY-98-015-R, SECY-98-15, SECY-98-15-1, SECY-98-15-R, NUDOCS 9806020187 | |
| Download: ML20248C557 (190) | |
Text
o RELEASED TOTHE POR
\\
l?,%~
$ Sbdht h4) i
\\
,i om u
..............>..m POLICY ISSUE (Notation Vote)
JanuaN 30.1998 SECY-98-015 EQB:
The Commissioners FROM L. Joseph Callan Executive Director for Operations
SUBJECT:
FINAL GENERAL REGULATORY GUIDE AND STANDARD REVIEW PLAN FOR RISK-INFORMED REGULATION OF POWER REACTORS PURPOSE:
(1)
To request Commission approval for the publication and use of Regulatory Guide 1.174 (formerly DG-1061) and Standard Review Plan Chapter 19, which provide general guidance regarding the submittal and review of risk-informed proposals that would change the licensing basis for a power reactor facility; and (2)
To respond to requests the Commission has made in Staff Requirements Memoranda dated June 5,1997, and November 18,1997.
SUMMARY
The staff has completed final versions of Regulatory Guide (RG) 1.174 (DG 1061 in its draft form) and Standard Review Plan (SRP) Chapter 19, which provide general guidance to reactor licensees and the NRR review staff on the use of probabilistic risk assessment in plant-specific licensing basis changes. This paper summarizes changes made to the documents, provides the final versions of the guide and SRP chapter and a proposed Federa/ Registernotice announcing their availability, and addresses related issues provided in Staff Requirements Memoranda. The regulatory guide and SRP chapter are based on a set of policy issues discussed in SECY-97-287. Commission approvalis requested to publish and use the final versions of RG 1.174 and SRP Chapter 19.
, NY 7
CONTACTS:
, j.%.
9\\ )(y!
Thomas L. King, RES TO BE MADE PUBLICLY AVAILABLE
\\
i 415-5790 WHEN THE FINAL SRM IS MADE X
AVAILABLE
/
l 9006020187 900130 PDR SECY o D 90-015 R PDR f p1 L k
.I -
Q1(($ &i f
i s co s,
t 6
The Commissioners 2
B_ACKGROUND:
The Commission's June 5,1997, Staff Requirements Memorandum (SRM) approved publication of four draft RGs, three draft SRPs, and one draft NUREG document for comment by the public.
These guidance documents support the implementation of risk-informed regulation in the following areas:
Generai Guidance (DG-1061 and SRP)
Inservice Testing (DG-1062 and SRP)
Graded Quality Assurance (DG-1064)
Technical Specifications (DG-1065 and SRP), and The Use of PRA in Risk-Informed Applications (draft NUREG-1602)
The 90-day public comment period closed on September 30,1997. During the comment period, a three-day public workshop was held (on August 11-13,1997). The workshop was well attended; the commenters offered a number of constructive comments, some criticisms, and some suggestions for changing the guidance. By the end of the comment period, the staff received formal written comments from approximately forty sources, most of which were associated with the nuclear industry.
In reviewing the comments on the general guidsnce, the staff found similar comments from many different commenters, and what emerged was a set of specific concerns as follows:'
According to the draft guide, allissues treatable with a risk-informed approach require NRC review and approval. This means that items of little or no safety significance still require considerable resource allocations by industry and staff.2 The NRC's proposed guideline of not allowing changes involving anyincrease in risk in plants with a baseline core damage frequency (CDF) greater than or equal to 104 per reactor year is too conservative and too rigid when applied to proposals involving very small changes in risk. In addition, the approach for consideration of uncertainties was interpreted by some commenters as being unnecessarily complex.
The guidance in the draft documents (including draft NUREG-1602) with respect to scope, level of detail, and quality of a PRA is viewed as being appropriate for treating
' A more complete discussion of comments received and staff responses is provided in the draft Federa/ Register notice (Attachment 1) announcing the publication and availability of RG 1.174 and the final version of the SRP Chapter 19 and in a staff document (Attachment 6) which provides a summary and analysis of the comments.
2 The staff believes thtt this comment is better addressed in its ongoing consideration of revisions to the NRC's current criteria in 10CFR 50.59 for determining when NRC review and approval of a facility change is appropriate. As such, this issue is not discussed in RG 1.174.
The Commissioners 3
only the broadest, most complex issues. A roadmap for performing simplified analysis for the many simpler issues that licensees are considering was not provided.
The NRC's proposed acceptance guidelines apply equally to issues involving either power operation or shutdown operation and issues involving either temporary changes to the facility or permanent facility changes. However, differences between these conditions warrant treatment with separate guidelines.
The guidance in the draft documents implies that an onerous level of effort will be required on the part of licensees to perform and document risk analyses, and establish and maintain a follow-up performance monitoring program in support of proposed changes of little safety significe.nce.
In parallel with the public comment process, the staff has completed related activities which have also' helped to shape the final form of the guidance documents. These activities included:
Pilot review activities associated with the risk-informed technical specification and graded quality assurance pilot applications, Responses to issues raised in Staff Requirements Memoranda dated January 22,1997, March 7,1997, April 15,1997, June 5,1997 and November 18,1997, Discussions with the Advisory Committee on Reactor Safeguards (ACRS) and its Subcommittee on Probabilistic Risk Assessment (PRA), the Committee to Review Generic Requirements (CRGR), and the staff of the Office of General Counsel, and Development of a Commission paper (SECY 97-287, dated December 12,1997) describing the key policy issues associated with the final version of RG 1.174 and associated staff recommendations.
The staff has chosen to finalize the general guidance documents (RG and SRP) at this time, to ensure that the key policy issues are identified, discussed, and resolved prior to finalization of
. the application-specific guidance documents (which are now due to the Commission at the end of March 1998, except for the guide /SRP on inservice inspection (ISI), which are due at the end of April 1998).
DISCUSSION The staff has developed final versions of DG 1061 (called RG 1.174 in its final form) and SRP Chapter 19 (Attachments 2 and 3). The significant changes the staff has made to these documents, in response to all of the activities noted above, are discussed below. Following that discussion. moponses are provided en related issues the Commission has raised in Staff Requirements Memoranda dated June 5,1997, and November 18,1997.
Scone of the General Guidance Documents The description of the scope of the regulatory guide has been slightly modified to make clear that it applies only to changes in those parts of the " current licensing basis," as defined in l
a The Commissioners 4
10 CFR Part 54, which require NRC review and approval. The RG and SRP have been modified to make clear that the term " current licensing basis" is being used for convenience and is not intended to imply any change in the regulatory status of commitments.
Princioles of Risk-informed Reaulation The staff has made significant modifications to two of the five principles of risk-informed regulation that must be satisfied for the staff to approve a change (as well as clarifications to others). In the draft guidance documents, Principle 4 states: " Proposed increases in risk, and their cumulative effect are small and do not cause the NRC Safety goals to be exceeded." This has been changed in the proposed final guidance to read: " Proposed increases in core damage frequency and risks are small and are consistent with the intent of the Commission's Safety GoaIPolicy Statement." This change is necessary because the original wording could be interpreted to mean that the demonstration of this principle mynt involve a comparison of PRA results with the Safety Goal quantitative health objectives (QHOs). In fact, the guide and
' SRP focus on comparisons with acceptance guidelines for core damage frequency (CDF) and large early release frequency (LERF), which are subsidiary objectives to the safety goals.
Thus, for purposes of this regulatory guide, a proposed change which meets the acceptance guidelines is considered to have met the intent of the policy statement.
In addition, the staff has removed the reference to implementation from Principle 5. The principle now focuses clearly on the importance of monitoring the impact of risk-informed
. changes. Implementation is treated as a step in the process of making a risk-informed change, and discussed as part of the staff's expectations.
Acceptance Guidelines for Very Small Channes in Risk and Treatment of Uncertainties A large number of public comments suggested that, under some conditions, the quantitative acceptance guidelines in the draft guidance documents are unnecessarily restrictive. This is considered to be a policy issue by the staff, as discussed in SECY-g7-287. As discussed in that paper, and subject to Commission approval, the staff has revised the guideline that would apply to plants with CDFs above 10dper reactor year and/or LERFs above 104 per reactor 4
year. The original guideline forbids increases of any size, while the new one permits very small calculated increases in these measures. In quantitative terms, "very small" in this context I
means an increase ofless than 104 per reactor year in core damage frequency or 10-7 per reactor year in large early release frequency. Thess values represent one percent of the baseline CDF/LERF guidelines, and are considered by the staff to be reasonable guideline
, values given typical calculated frequencies of core damage and LERF, typical calculated frequencies of important accident sequences, the guidance contained in the Commission's Regulatory Analysis Guidelines, and the margin between the CDF and LERF values and the QHOs This change will increase opportunities for licensees to propose changes which have very little significance to CDF/LERF but could reduce regulatory burdens, making this more consistent with the philosophy of risk-informed regulation, as expressed in the PRA Policy Statement. To ensure that such changes do not lead to large cumulative changes in CDF/LERF, which is contrary to Principle 4, licensees are required to track cumulative changes in these measures and report them each time they propose a new change for review. In addition, licensees must address why compensatory changes that result in a net reduction in CDF and LERF cannot be made. Guidance for staff review of cumulative changes has been incorporated into SRP Chapter 1g.
L The Commissioners 5
The staffs approach to treatment of uncertainties is also considered to be a policy issue, and is discussed in SECY-97-221 and SECY-97-287. These papers discussed several attemative approaches to treating uncertainties in the context of licensing basis changes.
In SECY-97-287, the staff recommended that the basic approach for treating uncertainties contained in the draft version of the guide be retained in the final version, but be clarified to l-provide a better description of what the licensee should consider and address in his submittal to identify and account for the important sources of uncertainty. For "very small" CDF/LERF increases (as defined above), this will limit uncertainty analysis to that associated with the changes in CDF and LERF and the use of sensitivity analysis to test the changes in CDF and LERF against the acceptance guidelines. For larger CDF/LERF increases uncertainty and sensitivity analysis will also apply to the baseline CDF and LERF. The attached guide and SRP chapter reflect these changes to this guidance, subject to Commission approval of the policy recommendation.
i Accentance Guidelines for Shutdown Ooerations and Temoorary Plant Conditions i
SECY-97-287 also discusses two policy issues on acceptance guidelines for shutdown operations and temporary plant conditions. With respect to the former, public comment on DG-1061 noted that conditions relating to the definition of large early release frequency can be quite different for shutdown conditions versus power operations. Thus, the LERF definition developed using perspectives of full power accidents may be inapplicable for shutdown accidents. This comment is consistent with the staff's current understanding of shutdown risk.
As such, the staff plans to give consideration to possible additional acceptance guidelines for shutdown conditions as part of its research program beginning in FY 1999. In the interim, and subject to Commission approval, the current CDF and LERF guidelines in RG 1.174 will remain applicable for shutdown conditions. However, if the proposed CLB change involves equipment used in shutdown operations when containment fundions are not available, licensees will have the flexibility to propose a reasonable definition for LERF considering the reduced radionuclides inventory or to rely solely on an assessment of core damage (i.e., CDFs below the 10'5 per reactor year) as a way to limit the release frequency.
Comments received on the draft guidance suggest that an additional set of guidelines may be appropriate to limit the conditional CDF and LERF during certain temporary plant conditions, e.g., with equipment failed or found to be out of service. The staff has considered these comments and believes that they merit additional assessment, and recommended in SECY 287 that such an assessment be undertaken, but not as part of the finalization of DG-1061.
, Inteorated Decision Makina RG 1.174 has been revised to provide additional information on the factors included when
" increased management attention" is called for in decision making and the conditions under which proposed licensing basis changes can be submitted in combinations. With respect to the former, the set of factors has been modified to clarify that PRA Level 3 (offsite health effect risk) information can be used and that the benefit of proposed changes will be considered commensurate with the proposed increase in CDF or LERF.
With respect to the latter, the guide now provides guidance with respect to what types of combinations of proposed licensing basis changes will normally be considered by the staff (Section 2.3 of RG 1.174).
l The Commissioners 6
Scone. Level of Detail. and Quality of a PRA In response to many comments received on DG-1061, SRP Chapter 19 and draft NUREG-1602, the staff has revised its guidance to licensees for performing a PRA in support of a risk-informed change to the CLB and its guidance to the NRC reviewers of such PRAs. Specifically, the staff has:
Removed the reference to draft NUREG-1602 in RG 1.174 and SRP Chapter 19 and provided a summary discussion on PRA quality in the RG and SRP.
Made clear in RG i.174 and SRP Chapter 19 that licensees should determine the appropriate scope, level of detail and quality of the PRA based on the application being treated; Incorporated additional guidance in RG 1.174 for determining the appropriate scope and depth of uncertainty analysis and sensitivity studies for an application specific PRA:
Clarified guidance to staff reviewers in SRP Chapter 19 for judging the acceptability of PRAs on an application specific basis; and Acknowledged that for purposes of addressing PRA quality, the staff will accept as one element for review the results of licensee sponsored peer reviews, cross-comparison studies, and certificistion programs, provided that the standards that have been applied in those reviews, studies, and programs are described in the submittal.
Performance Monitorina and Documentation The staff has clarified its guidance regarding monitoring the performance of systems, structures, components (SSC) that have been affected by a risk-informed change. RG 1.174 makes clear the stars expectation that performance monitoring programs should be structured such that SSCs are monitored commensurate with their safety importance, i.e., monitoring for SSCs categorized as low safety significance may be less rigorous than that for SSCs of high safety significance. The staff has also added guidance that encourages licensees to integrate, or at least coordinate, their monitoring for risk-informed changes with existing programs for j
monitoring equipment performance and other operating experience on their site and throughout the industry, such as monitoring covered under the Maintenance Rule.
' The staff has reviewed the documentation section of DG-1061 to identify requested information that in all likelihood would not normally be necessary to complete many reviews. This review revealed several information requests that were considered unnecessary and were removed 1
from the guidance. The staff has also supplemented the documentation section to clarify the l
staffs guidance that licensees track and report cumulative enanges in CDF/LERF and describe the specific information that should be included in a licensee's submittal.
Staff Response to SRM dated June 5.1907 in a Staff Requirements Memorandum dated June 5,1997 (Attachment 4), the Commission requested that the staff: (1) continue to evaluate the proposed decision criteria and methnds of
The Commissioners 7
ensuring conformance to the criteria included in the guidance; and (2) develop guidance on how to confirm the assumptions and analyses used to justify risk-informed changes to the licensing basis. These are addressed in the following two paragraphs, respectively.
Since issuing the draft guidance documents for comment, the staff has given additional consideration to the proposed acceptance guidelines and methods for ensuring conformance to these guidelines. These considerations are discussed in depth in the staff's recent paper on acceptance guidelines and consensus standards for use in risk-informed regulation (SECY-97-221) and the staff's more recent paper on the remaining policy issues associated with final regulatory guidance on risk-informed regulation (SECY-97-287). The changes that have resulted from these considerations are cummarized above in the discussion of changes to the draft guidance documents.
In RG 1.174 and SRP Chapter 19, the staff has provided guidance for performance monitoring of SSCs as the principal means to ensure that the engineering evaluation conducted to examine the impact of the proposed changes continues to reflect the actual reliability and availability of SSCs that have been evaluated. In addition, the staff has made it clear in RG 1.174 that a PRA performed in support of risk-informed changes to the CLB should reflect the actual design, construction, operational practices, and operational experience of the plant, and has provided guidance in SRP Chapter 19 to permit the staff to determine if a licensee's PRA is acceptable in this regard. It should be noted that this guidance permits licensees to take credit in their analysis for voluntary actions. However, if these voluntary actions are later modified, licensees are expected to assess the impact on previous staff approvals. On the other hand, the guidance clarifies that systems, structures or components with high risk significance which are not currently subject to regulatory requirements, or are subject to a level of regulation which is not commensurate with their risk significance, or voluntary actions that are key to the decisionmaking may be identified. The guidance states that, in such cases, an appropriate level of regulatory requirement should be determined and reflected in the licensing basis.
Staff Resoonse to SRM dated November 18.1997 in a Staff Requirements Memorandum dated November 18,1997 (Attachment 4), the i
Commission requested that the staff discuss the amount of variability and the degree of uncertainty that can be tolerated for regulatory purposes in PRAs performed by licensees within the risk-informed regulatory framework. These issues are addressed below.
The amount of variability that can be tolerated is addressed in two ways in RG 1.174 and SRP
' Chapter 19. First, there will be variability in PRAs when they are used for different purposes.
That is, for some applications a simplified PRA model will suffice, while for others a more detailed model is necessary. RG 1.174 and SRP Chapter 19 make clear statements with respect to the need to have the PRA performed match its intended use.
Second, there will be variability which results from the use of different scopes, methods, and assumptions. Absent PRA standards at this time, the staff's approach to addressing this form of variability has two parts. The shorter-term part is being addressed directly by the regulatory guides and SRPs and as part of the ongoing risk-informed pilot programs.
The Commissior.ers 8
In risk-intormed processes govemed by RG 1.174 and SRP Chapter 19, variability in PRAs will be managed through the use of the standards that have been incorporated implicitly, in the SRP especially, regarding the scope, level of detail, and quality of the PRA. Specifically, the guidance suggests that licensees subject their PRA to a peer review, an industry PRA certification process, or PRA cross-comparison study. Such processes and studies will help eliminate, or at least identify the sources of variability that are not the result of differences in the design, construction, or operation. As discussed in SRP Chapter 19, the staff will review the application of these programs, including the industry standards that have been applied and the qualifications of the personnelinvolved. In addition to this, the staff's own independent technical review per SRP Chapter 19 will ultimately provide a check on PRA quality.
Specifically, Appendix A.of SRP Chapter 19 discusses the key elements expected in the PRA, such as: initiating events, event trees, fault trees, data, common cause failures, human performance and sequence quantification. The safety evaluation reports resulting from these reviews will document the staff's assessment of quality and thus help to define the needed quality for specific applications.
The longer-term part of the staff's approach for addressing model and assumption variability is the development of PRA standards. As discussed in the October 1997 quarterly update of the PRA implementation Plan (SECY-97-234), the staff is working with ASME to develop such standards. Once developed and found acceptable, it is the staffs intention to endorse the standard in a revision to RG 1.174.
The issue of the degree of uncertainty that can be tolerated for regulatory purposes in PRAs has been the subject of considerable discussion between the staff and the ACRS Subcommittee on PRA, much of which has been documented in response to previous SRMs.8 This work has culminated in the three-pronged approach to treatment of uncertainty that the staff has included in RG 1.174:
Address parametric uncertainty and any explicit model uncertainties in the assessment of mean values; Identify sources of uncertainty related to modeling and perform sensitivity studies to evaluate the impact of using attemate models for the principal implicit model uncertainties; and Identify the sources of uncertainty related to incompleteness and use quantitative analyses or qualitative analyses as necessary to explore the impact of incompleteness as appropriate to the decision and the acceptance guidelines.
This approach has the major advantage that it is consistent with the state of the art of PRA methods. The approach avoids the value judgements of the analysts being implicitly incorporated in the results, which can contribute to unwarranted variability in results of PRAs.
The method also makes the evidence used in making a decision more visible in that it focuses attention on the assumptions and approximations made by the analysts. Decision making in
' Responses are provided in SECY-97-221 and SECY-97-287.
l The Commissioners 9
light of these uncertainties then becomes a matter of weighing the different issues that can I
impact the decision in addition to the comparison of calculated numbers with the acceptance guidelines. This approach recognizes explicitly that it is not just the numerical values of the various measures of CDF/LERF and their changes that are important, but that it is also important to understand what contributes to the PRA results, and how the various sources of uncertainties impact those results.
COORDINATION:
l-l RG 1.174 and SRP Chapter 19 have been reviewed by the ACRS and their views were provided in a letter dated December 11,1997 (Attachment 5). CRGR has reviewed both documents and in a meeting with the staff on December 11,1997 indicated their approval for publication of the docum.ents in final form for use. The Office of the General Counsel has reviewed both documents and has no legal objection to them being issued for use.
RECOMMENDATION.
That the Commission approve for publication and use RG 1.174 and SRP Chapter 19, as provided in Attachments 2 and 3, using the Federa/ Register announcement provided as L. Jose ih Callan Execi e Director for perations Attachments:
- 1. Federal Register notice announcing publication of final RG 1.174
- 2. Regulatory Guide 1,174
- 3. Standard Review Plan Chapter 19 l
- 4. Staff Requirements Memoranda dated June 5,1997, I
and November 18,1997 I
- 5. Letter from ACRS regarding " Proposed Final Regulatory Guide 1.174 -
and Standard Review Plan Chapter 19 for Risk-Informed, Performance-Based Regulation," dated December 11,1997.
l
' 6. Memorandum from M. Cunningham to M. Hodges, dated January 7,1998,
" Summary of the Resolution of the Overall Comments Received on the 1
General Risk-Informed Draft Regulatory Guide and Standard Review Plan" j
l cc:
SECY ACRS j
ClO Commissioners l
OCAA OIG
)
10 l
Commissioners' comp!eted vote sheets / comments should be provided directly to the Office of the Secretary by cob Tuesdav. Februarv 17.1990.
Commission staff office comments, if any, should be submitted to the Commissioners NLT February 9.1998. with an information copy to the Office of the Secretary. If the paper is of such a nature that it requires additional review and comment, the Commissioners and the Secretariat should be apprised of when comments may be expected.
e FederalRegister notice announcing ublication of final RG 1.174 and SRP Cha ter 19 s
l 1.
l
[7590-01-P]
NUCLEAR REGULATORY COMMISSION I
I Use of PRA in Plant Specific Reactor Regulatory Activities:
Final Regulatory Guide and Standard Review Plan section
]
i AGENCY:
Nuclear Regulatory Commission.
ACTION:
Issuance of final documents.
)
SUMMARY
- In June 1997, the Nuclear Regulatory Commission issued for public comment a series of draft regulatory guides and Standard Review Plan Sections, and a draft NUREG document addressing the use of PRA in support of risk-informed regulatory activities. The preparation of these documents follows from the Commission's August 16,1995 Policy Statement on the Use of PRA Methods in Nuclear Regulatory Activities (60 FR 42622). The draft guidance documents provide examples of acceptable approaches for using probabilistic risk assessment (PRA) information in support of plant-specific changes to plant licensing bases.
The use t,y power reactor licensees of such PRA information and guidance is voluntary, and altemative approaches may be proposed. The Commission conducted a workshop on August 11-13,1997, during the comment period, to provide an overview of the draft documents, to answer questions regarding their intended application, and to solicit comments and suggestions. Comments received from the workshop have been considered in preparing a final general regulatory guide (R.G.1.174) and its accompanying Standard Review Plan (Chapter 19), for risk-informed applications, and the issuance of these two documents is the subject of
this notice. Comments received from the workshop on application-specific guidance documents for technical specifications, inservice testing, an.1 graded quality assurance are currently being considered. These guidance documents will be issued at a later date.
EFFECTIVE DATE: [ insert the date 30 days from publication of this notice.]
1 Comments and suggestions in connection with items for inclusion in guides currently being developed or improvements in all published guides are encouraged at any time. Written comments may be submitted to the Rules and Directives Branch, Division of Administrative Services, Office of Administration, U.S. Nuclear Regulatory Commission, Washington, DC 20555.
Copies of the regulatory guide and standard review plan section are available for inspection and copying for a fee at the NRC Public Document Room,2120 L Street N.W.
(Lower Level), Washington, D.C. 20555-0001. A free single copy of these documents may be requested by writing to the Office of Administration, Attention: Printing, Graphics and Distribution Branch, U.S. Nuclear Regulatory Commission, Washington, D.C. 20555-0001, or by Fax to (301) 415-5272. Final regulatory guides may also be purchased from the National Technical Information Service on a standing order basis. Details on this service may be obtained by writing NTIS,5285 Port Royal Road, Springfield, VA 22161. Regulatory guides are not copyrighted, and Commission approval is not required to reproduce them.
2
J I. Background l
On August 16,1995, the Commission published in the Federal Register a final policy statement on the Use of Probabilistic Risk Assessment Methods in Nuclear Regulatory I
Activities (60 FR 42622). The policy statement included the following policy regarding i
expanded NRC use of PRA:
I i
1.
The use of PRA technology should be increased in all regulatory matters to the extent supported by the state-of-the-art in PRA methods and data and in a manner that complements the NRC's deterministic approach and supports the NRC's traditional defense-in-depth philosophy.
2.
PRA and associated analyses (e.g., sensitivity studies, uncertainty analyses, and importance measures) should be used in regulatory matters, where practical within the bounds of the state-of-ths-art, to reduce unnecessary conservatism associated with current regulatory requirements, regulatory guides, license commitments, and staff practices. Where approprhte, PRA should be used to support proposals for additional regulatory requirements in accordance with 10 CFR 50.109 (Backfit Rule). Appropriate procedures for including PRA in the process for changing regulatory requirements should be developed and followed. It is, of course, understood that the intent of this policy is that existing rules and regulations shall be complied with unless these rules and l
l regulations are revised.
3.
PRA evaluat'sns in support of regulatory decisions should be as realistic as practicable 3
1 and appropriate supporting data should be publicly available for review.
4.
The Commission's safety goals for nuclear power plants and subsidiary numerical objectives are to be used with appropriate consideration of uncertainties in making regulatory judgments on the need for proposing and backfitting new generic requirements on nuclear power plant licensees.
It was the Commission's intent that implementation of this policy statement would improve the regulatory process in three areas:
1.
Enhancement of safety decision making by the use of PRA insights, 2.
More efficient use of agency resources, and 3.
Reduction in unnecessary burdens on licensees.
In parallel with the development of Commission policy on uses of risk assessment methods, the NRC developed an agency-wide implementation plan for application of probabilistic risk assessment insights within the regulatory process (SECY-95-079). This implementation plan included tasks to develop a series of Regulatory Guides (R.G.) and Standard Review Plans (SRP) in the areas of:
general guidance, inervice inspection (ISI),
inservice testing (IST),
technical specifications (TS), and graded quality assurance (GQA).
4
The general regulatory guide (R.G.1.174) and its accompanying SRP section (Chapter 19), are intended to help implement the Commission's August 1995 policy on the use of risk information in the regulatory process. The subject of this notice is the finalization of these two general documents, the first in the series of risk-informed guidance documents. Together, they provide the basic framework for an acceptable approach for use by power reactor licensees in preparing proposals for plant-specific changes to their licensing bases using risk information.
The Commission conducted a workshop on August 11-13,1997, during the comment period, to provide an overview of the draft documents, to answer questions regarding their intended application, and to solicit comments and suggestions. Comments received from the workshop have been considered in preparing the final general regulatory guide (R.G.1.174) and its accompanying Standard Review Plan (Chapter 19) for risk-informed applications. Application-j specific guidance documents for risk-informed TS, IST, and GQA are currently being revised to address the public comments that were received, and these documents are scheduled to be issued in early 1998. Guidance for ISI is also being developed on a slightly later schedule. It is intended that the guidance documents will provide examples of acceptable approaches for use in risk-informed programs, and altemative approaches may be proposed.
- 11. Public comment summary and resolution.
The public comment period for the draft regulatory guidance documents on risk-informed applications expired on September 30,1997. In addition to comments received at the workshop, the NRC staff has received approximately 40 sets of written comments. Some of the more extensive comments were provided by the Nuclear Energy institute (NEI), in a letter dated l
l September 29,1997, which provided comments on behalf of the nuclear industry. In its letter, NEl commended the NRC staff for its efforts in developing the draft documents, stating that the 5
t l
l
-industry recognized the significance of the drafts in articulating a framework for the use of risk information in regulatory decisionmaking, and that the documents represent a milestone in the evolution of the regulatory process. In addition, the NEl letter expressed concern regarding l
four highlighted policy issues, the resolution of which NEl said they believe to be essential to the continued viability and the expansion of risk-informed regulation. The issues cited by NEl were:
Overall cost benefit Use of numerical acceptance guidelines Treatment of uncertainty, and PRA attributes and quality considerations Each of these areas highlighted by NEl will be addressed in the following discussion of the principalissues.
Comment letters were also received from the Electric Power Research Institute (EPRI),
the American Society of Mechanical Engineers (ASME), the owner's groups for the four reactor vendors (General Electric, Westinghouse, Combustion Engineering and Babcock and Wilcox),
one vendor (Westinghouse),18 electric utilities, one national laboratory (Oak Ridge), five technical organizations, five other private industry organizations or individuals, and two anonymous commenters. The following discussion addresses the resolution of the principal issues raised by the commenters. A more complete discussion of the comments received overall is given in the attachment to a memorandum from Mr. Mark A. Cunningham (Chief, Probabilistic Risk Analysis Branch, Division of Systems Technology, Office of Nuclear Regulatory Research) to Mr. M. Wayne Hodges (Director, Division of Systems Technology, 6
Office of Nuclear Regulatory Research) dated January 7,1998. The discussion in the attachment covers the resolution of the NRC's specific requests for comment included in the l
Federal Register notice for the workshop (62 FR 34321) and the resolution of the other issues l
raised by the commenters as well as the principal issues discussed in this announcement. The January 7,1998, memorandum is also available in the Commission's Public Document Room.
1 l
Principal Issues 4
- 1. Use of 10 Per Reactor-Year Core Damaae Freauencv (CDF) As An Acceotance Guideline d
l Issue: Comments were received indicating that the use of 10 per reactor-year core damage l
d frequency (10 /RY CDF) as an acceptance guideline was overly conservative, that the Commission's Safety Goal Policy quantitative health objectives (QHOs) would be more appropriate for use as goals, and that it was not clear how closely staff reviewers would hold applications to this numerical criteria.
1 Resolution: Revised Section 2.4.2.2, " Acceptance Guidelines," of R.G.1.174 addresses the d
use of 10 /RY CDF as a guideline in evaluating the acceptability of risk-informed applications.
d The use of 10 /RY CDF as a subsidiary goal is consistent with past Commission guidance.
1 The guidelines for assessing risk, contained in the Regulatory Guide and SRP, are based upon j
the QHOs contained in the Commission's Safety Goal Policy and upon previous Commission guidance related to implementation of the Safety Goal Policy and Regulatory Analysis
-l l
Guidelines (NUREG/BR-0058, Rev. 2). Specifically, the guideline value of 10"/RY for CDF is based upon a June 15,1990 memorandum from the Commission to the NRC staff on implementation of the Safety Goal Policy which established a 10"/RY CDF as a benchmark objective for accident prevention. The guideline value on 6CDF of 10-5 RY is based upon the
/
7
j guidance in the Commission's Regulatory Analysis Guidelines which establishes a 104/RY 4CDF as a cutoff below which the significance of safety issues is not large enough to warrant backfit analysis, assuming a reasonable accident mitigation capability.
l Accident mitigation capability is addressed via guidelines on large early release frequency (LERF). The guideline value of 10-5 RY for LERF contained in R.1.174 is based upon risk
/
analysis results presented in NUREG-1150, which calculated offsite health risks for five nuclear power plants and compared them to the Safety Goal QHOs. Analyses for all five plants calculated health risks well below the QHOs. However, if the results of this analyses were adjusted so that the offsite health risks just met the early fatality QHO (the most limiting QHO),
with allowance for the unanalyzed modes of operation (shutdown) and, in some cases extemal events, a corresponding LERF value of 104/RY is the result for those plants whose calculated offsite health risks are closest to the QHOs.
Site to site variations in LERF were judged to not be a large factor (this was also confirmed in a study reported by the Advisory Committee for Reactor Safeguards in a September 19,1997 letter to Chairman Jackson) and thus a single value for all plants is used. The guideline value of 104/RY for 6LERF is based upon the Regulatory Analysis Guidelines which, when used in conjunction with the 6CDF guidelines discussed above, establishes a cutoff below which the significance of safety issue is not large enough to warrant backfit analysis.
Figures 3 and 4 of Section 2.4.2.2 illustrate acceptance guidelines for CDF and containment large early release frequency (LERF) and indicate that for each of these metrics, three regions have been identified for use in screening acceptability of proposed changes in current licensing 8
bases. Region 111, shown in the figures and discussed in the text, has been identified as representing a sufficiently low CDF or LERF increase that, in general, program changes associated with this region may be permitted without a detailed assessment of the baseline CDF/LERF. As discussed in R.G.1.174, if there are indications that the baseline CDF and/or LERF are above the guideline values, additional evaluation would be needed even though the calculated changes in CDF or LERF are small and in Region Ill. In Section 2.4.2.3,
" Comparison of PRA Results with the Acceptance Criteria," it is stated that the acceptance guidelines (lines separating the regions) are not to be interpreted in an overly prescriptive manner and that they are intended to provide an indication, in numerical terms, of what is considered acceptable. Graduated shading has been added to the guideline figures to indicate regions in which proposed changes will be subject to gradually more intensive NRC technical and management review. Regarding the use of the OHOs, in Section 2.1, " Risk-Informed Philosophy," it is stated that the use of the QHOs in lieu of LERF in support of risk-informed applications is an acceptable approach provided that appropriate consideration is given to the methods and assumptions used in the analysis and in the treatment of uncertainties. Also, in Section 2.4.3, " Integrated Decision-Making," it is noted that Level 3 PRA information can be submitted and will be considered in support of those cases in which increased NRC management attention is needed during the review (e.g., when the calculated CDF/LERF changes and baseline values are close to the acceptance guidelines).
- 2. Definition of Risk Neutral issue: A number of comments were received indicating that there was a need for a definition of risk neutral applications and that increased NRC management and technical review should not
)
be required for risk increases below some threshold.
9 l
l J
~
Resolution: See responses to issues Number 1 and 3 addressing very small increases in risk.
- 3. Allowance for Very Small increases in Risk d
issue: Comments received stated that facilities with CDFs greater than 10 /RY should be allowed small risk increases and that the level of effort and information required in submittals was excessive for small risk increases.
kesolution: Section 2.4.2.2, " Acceptance Guidelines," addresses the treatment of small increases in risk using the metrics of CDF and LERF. As noted in the discussion for issue Number 1, this section has been revised and now includes a special category of application in which the estimated level of CDF/LERF increase associated with the application is sufficiently low such that, in general, program changes associated with this region may be permitted without a detailed assessment of the baseline CDF/LERF. This category is displayed in Figures 3 and 4 of Section 2.4.2.2.
- 4. Treatment of Uncertainties issue: Comments received stated that inclusion of uncertainty could lead to confusion regarding the decision criteria and that the use of PRA inherently takes care of uncertainty.
Resolution:' Several approaches were reconsidered for the treatment of uncertainties, and it was concluded that the approach that was described in the draft regulatory guide (DG-1061) appeared to be the most practical and useful approach at this time, although there was a need i
to clarify the text for this subject. Uncertainty is addressed in Section 2.4.2.3, " Comparison of l
10
PRA Results with the Acceptance Guidelines," in Regulatory Guide 1.174. In this section, it is noted that it is important when interpreting the results of a PRA to develop an understanding of the impact of a specific assumption or choice of model on the prediction. PRA only inherently takes care of those uncertainties modeled in the analysis. Others must be qualitatively or l
l quantitatively addressed. The impact of using altemative assumptions and models may be reasonably evaluated using appropriate sensitivity studies. The major sources of uncertainty should be understood, but it is not, in all cases, necessary to perform elaborate uncertainty evaluations (e.g, propagation of uncertainty distributions).
- 5. Quality of PRA issue: Numerous comments were received indicating concern that the PRA standards included in draft NUREG-1602 were unnecessarily high for many risk-informed applications. It was also indicated that the requirements for PRA quality were not clear and that graded levels of PRA quality should be provided for different applications.
Resolution: The issue of PRA quality is addressed in revised Section 2.4.2.1 of R.G.1.174,
" Scope, Level of Detail, and Quality of the PRA."
In this section it is stated that PRA quality should be commensurate with the application for which it is intended and with the role that PRA results play in the integrated decision process. A PRA used in a risk-informed application should be performed in a manner that is consistent with accepted practices, and be commensurate with the scope and level of detail which are also discussed in Section 2.4.2.1 of R.G.1.174.
The NRC has not developed its own formal standard nor endorsed an industry standard for PRA qual;ty, however, it supports such a standard and expects that one will be available in the future. Draft NUREG-1602, "Use of PRA in Risk-Informed Applications," was 11
cited in draft Regulatory Guide DG-1061 as a potential reference for PRA methods that could be used to support regulatory decision making. There were a number of comments indicating that the "PRA standard" represented by draft NUREG-1602 was excessive for many risk-informed app!ications not requiring sophisticated or state-of-the-art methods. While it was not intended that draft NUREG-1602 be used universally as a PRA standard, it is recognized that it would be more useful to have a standard that addresses the differing needs for PRA scope and detail depending on the application. Accordingly, draft NUREG-1602 has been removed as a reference in R.G.1.174, and a separate discussion on PRA quality has been added. This includes addressing PRA quality by the use of peer review or PRA cross comparisons. PRA peer review activities such as those that are presently being done under various industry PRA certification programs are examples. Neither peer review nor a PRA certification or cross comparison, replaces a staff review in its entirety, and licensees need to provide justification why the PRA is adequate for the proposed application. In the interim, until a consensus PRA standard is available, the NRC staff will evaluate PRAs submitted in support of specific applications using the guidelines given in Chapter 19 of the Standard Review Plan.
- 6. Low Safety Significant Comoonents Monitorina Needs issue: Comments received indicated that the draft guidance placed too much importance on monitoring of low safety significant components (LSSCs). It was also indicated that monitoring performed under the Maintenance Rule should be acceptable for risk-informed programs.
Resolution: Section 2.5, " Element 3: Define implementation and Monitoring Program," has been revised to clarify monitoring needs for LSSCs. While details for monitoring LSSCs will be provided in the application-specific guidance documents, the following principal needs should 12
be satisfied for all applications. Monitoring programs should be proposed that are capable of adequately tracking the performance of equipment which when degraded could alter the conclusions that were key to supporting the acceptance of the program. It follows that monitoring programs should be structured such that SSCs are monitored commensurate with their safety significance. Monitoring that is performed as a part of the Maintenance Rule implementation can be used in cases where the monitoring performed under the Maintenance Rule is sufficient for the SSCs affected by the risk-informed application.
- 7. Shutdown and Temoorary Plant Condition issue: Several commenters noted that the guidelines proposed did not distinguish between power operation and shutdown and did not address temporary plant conditions. Separate guidelines for these conditions were suggested.
l Resolution: In response to these comments, Section 2.4.2.2 of R.G.1.174 has been expanded to address the shutdown condition, Specific guidance for temporary plant conditions has not been added, but will be considered in a future update of R.G.1.174.
- 8. Documentation Needs issue: Many commenters stated that the documentation requirements in the drafts were excessive and unmanageable, particularly for proposals involving small changes in risk, it was also suggested that certain documentation items should not be required to be submitted for the l
i staff's initial review, provided that more complete documentation be maintained at the utility if the need were to arise later for its review.
13
Resolution: In response to the comments received, Section 3 of R.G.1.174 has been reevaluated to determine what items listed in the draft were not necessary. As a result, a number of documentation items, particularly with regard to the PRA, have been removed in the final regulatory guide, and the SRP has been revised to be consistent.
I
- 9. Overall cost benefit issue: This issue was highlighted by NEl in its comment letter and was also included in a number of other comment letters. A concern was expressed that the resources required by licensees to prepare proposals and to subsequently implement NRC approved risk-informed changes to the CLB will be too high considering the benefit in terms of burden reduction.
Resolution: The question of how cost beneficial it will be for utilities to prepare proposals for risk-informed changes to their current licensing bases and to implement such programs after review and approval by the NRC will only be fully answered after the industry and the NRC gain further experience in these types of programs. Certainly, the pilot plant program proposals that are currently being reviewed for application to technical specifications, graded quality assurance, and inservice testing and inspection, will provide useful insights into the potential cost savings available through these programs. While it is not the NRC's responsibility to ensure that such risk-informed programs are cost beneficial, it is believed that such programs can enhance safety by better focusing utility and NRC resources on the most important safety areas in reactors, and this philosophy is consistent with the Commission's Policy Statement on the use of PRA methods in nuclear regulatory activities. Duing the preparation of the final regulatory guide and standard review plan section for general guidance, attention was paid to those areas where utility resource needs could be reduced thus improving the cost-beneficial 14 I
l
aspects of the risk-informed process while still maintaining an appropriate level of safety.
Examples of sections in R.G.1.174 where this is reflected in the final guidance are Section 2.4.2.1, Quality and Scope of the PRA, in which it is stated that the level of detail required to support an application can vary depending on the application, and that not all applications require that an expensive, detailed PRA be acquired; Section 2.4.2.2, Acceptance Guidelines, where a special category of risk-informed proposal has been identified as having a sufficiently low estimated risk increase, that generally for such cases, the proposed program will be considered without a detailed assessment of baseline CDF/LERF (i.e., Region lli of Figures 3 and 4 in R.G.1.174); and in Section 3, Documentation, where some of the items that were identified in the draft regulatory guide and SRP as being needed in program submittals have been removed since they were not believed necessary.
Dated at Rockville, Maryland, this day of 1997.
For the Nuclear Regulatory Commission.
Malcolm R. Knapp, Acting Director Office of Nuclear Regulatory Research 15 i
L_m__
I
\\
o l
l 1
I l
(
I i
i i
l
)
I
h*'
[
~ 'o,,
U.S. NUCLEAR REGULATORY COMMISSION g
OFFICE OF NUCLEAR REGULATORY RESEARCH E
REGULATORY GUIDE l
.....J 1
1 Predecisional REGULATORY GUIDE 1.174 (Draft Guide DG-1961)
AN APPROACH FOR USING PROBABILISTIC RISK ASSESSMENT IN RISK-INFORMED DECISIONS ON PLANT-SPECIFIC CHANGES TO THE CURRENT LICENSING BASIS Draft H7/98 l
I 1
/
Predecisional
(
- 1. PURPOSE AND SCOPE I
1.1 Introduction The NRC's policy statement on probabilistic risk analysis (PRA)(Ref. 1) encourages greater use of this analysis technique to improve safety decisionmaking and improve regulatory efficiency. The NRC staff's PRA Implementation Plan (Ref. 2) describes activities now under way or planned to expand this use.
These activities include, for example, providing guidance for NRC inspectors on focusing inspection resources on risk-important equipment, as well as reassessing plants with relatively high core damage frequencies for possible backfits.
Another activity under way in response to the policy statement is the use of PRA in support of decisions to modify an individual plant's current licensing basis (CLB). This regulatory guide provides guidance on the use of PRA findings and risk insights in support oflicensee requests for changes to a plant's current licensing basis (e.g., request for license amendments and technical specification changes under 10 CFR 50.90-92). It does not address licensee-initiated changes to the current licensing basis which do NOT require NRC review'and approval (e o,., changes to the facility as described in the FSAR which are the subject of 10 CFR 50.59). Licensee-initiated CLB changes which are consistent with currently approved staff positions (e.g., regulatory guides, standard review plans, branch technical positions, or t'e Standard Technical Specifications) are nonnally evaluated by the staff using traditional, engineering analyses. A licensee would not be expected to submit risk information in support of the proposed change.
Licensee-initiated CLB change requests that go beyond current staff positions may be evaluated by the staff using traditional engineering analyses as well as the risk-informed approach set forth in this regulatory guide. A licensee may be requested to submit supplemental risk information if such information is not submitted by the licensee. If risk information on the proposed CLB change is not provided to the staff, the staff will review the information provided by the licensee to determine if the application can be approved based upon the information provided using traditional methods and will either approve or reject the application based upon the staff's review. For those licensee-initiated CLB changes which a licensee chooses to support (or is requested by the staff to support) with risk information, this regulatory guide describes an acceptable method for assessing the nature and impact of proposed CLB changes by considering engineering issues and applying risk insights. Licensees submitting risk information (whether on their own initiative or at the request of the staff) should address each of the principlee of risk-informed regulation discussed in this regulatory guide. Licensees should identify how chosen approaches and methods (wh:ther they are quantitative or qualitative, and traditional or probabilistic), data, and criteria for considering risk are appropriate for the decision to be made.
Finally, the guidance provided here does not preclude other approaches for requesting changes to the CLB. Rather, this regulatory guide is intended to improve consistency in regulatory decisions in areas in which the results of risk analyses are used to helpjustify regulatory action. As such, the principles, process, and approach discussed herein also provide useful guidance for the application of risk information to a broader set of activities than plant-specific chanees to a plant's CLB (i.e., generic activities), and licensees are encouraged to utilize this guidanen.. that regard.
1.2 Background
During the last several years, both the NRC and the nuclear industry have recognized that probabilistic risk assessment (PRA) has evolved to the point where it can be used increasingly as a tool in regulatory decisionmaking. In August 1995, the NRC adopted the following policy statement regarding the expanded use of PRA.
l Predecisional 2
=
The use of PRA technology should be increased in all regulatory matters to the extent supported e
by the state-of-the-art in PRA methods and data and in a manner that complements the NRC's deterministic approach and supports the NRC's traditional defense-in-depth philosophy.
PRA and associated analyses (e.g., sensitivity studies, uncertainty analyses, and importance e
measures) should be used in regulatory matters, where practical within the bounds of the state-of-j the-art, to reduce unnecessary conservatism associated with current regulatory requirements, regulato y guides, license commitments, and staff practices. Where appropriate, PRA should be
(
used to support the proposal of additional regulatory requirements in accordance with 10 CFR 50.109 (Backfit Rule). Appropriate procedures for including PRA in the process for changing l
regulatory requirements should be developed and followed. It is, ofcourse, understood that the intent of this policy is that existing rules and regulations shall be complied with unless these rules and rculations are revised.
PRA evaluations in support of regulatory decisions should be as realistic as practicable and e
appropriate supporting data should be publicly available for review.
l The Commission's safety goals for nuclear power plants and subsidiary numerical objectives are e
to be used with appropriate consideration of uncertainties in making regulatoryjudgments on need for proposing and backfitting new generic requirements on nuclear power plant licensees.
In its approval of the policy statement, the Commission articulated its expectation that implementation of the policy statement will improve the regulatory pixess in three areas: foremost, through safety decisionmaking enhanced by the use of PRA insights; through more efficient use of agency resources; and through a reduction in unnecessary burdens on licensees.
In parallel with the publication of the policy statement, the staff developed an implementation plan to define and organize the PRA-related activities being undertaken. These activities cover a wide range of PRA applications and involve the use of a variety of PRA methods (with variety includ;ng both types of models used and the detail of modeling needed). For example, one application involves the use of PRA in the assessment of operational events in reactors. The characteristics of these assessments permit relatively simple PRA models to be used. In contrast, other applications require the use of detailed models.
The activities described in the PRA Implementation Plan relate to a number of agency interactions with the regulated industry. With respect to reactor regulation, activities include, for example, guidance development for NRC inspectors on focusing inspection resources on risk-impcrtant equipment, and a reassessment of plants with relatively high core damage frequencies for possible backfit.
This regulatory guide focuses on the use of PRA in a subset of the applications described in the staffs implementation plan. Its principal focus is the use of PRA findings and risk insights in decisions on proposed changes to a plant's CLB.'
'For convenience this regulatory guide uses the definition of current licensing basis in 10 CFR 54.3.
That is, " Current Licensing Basis (CLB) is the set of NRC requirements applicable to a specific plant and a licensee's written commitments for ensuring compliance with and operation with in applicable NRC requirements and the plant-specific design basis (including all modifications and additions to such commitments over the life of the license) that are docketed and in effect. The CLB includes the NRC regulations contained in 10 CFR Parts 2,19,20,21,26,30,40,50,51,54,55,70,72,73,100 and Predecisional 3
The regulatory guide also makes use of the Commission's Safety Goal Policy Statement (Ref. 4). As discussed below, one key principle in risk-informed regulation is that proposed. increases in core damage frequency and risk are small and are consistent with the intent of the Commission's Safety Goal Policy Statement. The safety goals (and associated quantitative health objectives (QHOs)) define an acceptable level of risk which is a small fraction (0.1%) of other risks to which the public is exposed. The acceptance guidelines defined in this regulatory guide (in Section 2.4.2) are based on subsidiary objectives derived from the Safety Goals and their QHOs.
1.3 Purpose of this Regulatory Guide Changes to many of the activities and design characteristics in a nuclear power plant's current licensing basis require NRC review and approval. This regulatory guide provides the staff's recommendations for utilizing risk information in support oflicensee-initiated CLB changes requiring such review and approval. The guidance provided here does not preclude other approaches for requesting CLB changes.
Rather, this regulatory guide is intended to improve consistency in regulatory decisions in areas in which the results of risk analyses are used to helpjustify regulatory action. As such, this regulatory guide, the use of which is voluntary, provides general guidance concerning one approach that the NRC has determined to be acceptable for analyzing issues associated with proposed changes to a plants's current licensing bases (CLB) and for assessing the impact of such proposed changes on the risk essociated with plant design and operation. This guidance does not address the specific analyses needed for each nuclear power plant activity or design characteristic that may be amenable to risk-informed regulation.
1.4 Scope of this Regulatory Guide This regulatory guide describes an acceptable approach for assessing the nature and impact of proposed CLB changes by considering engineering issues and applying risk insights. Assessments should consider relevant safety margins and defense-in-depth attributes, including consideration of success criter:a as well as equipment functionality, reliability, and availability. The analyses should reflect the actual design, construction, and operational practices of the plant. Acceptance guidelines for evaluating the results of such assessments are provided also. This guide also addresses implementation strategies and performance monitoring plans associated with CLB changes that will help ensure assumptions and analyses supporting the change are verified.
Consideration of the Commission's Safety Goal Policy Statement is an important element in regulatory decisionmaking. Consequently, this regulatory guide provides acceptance guidelines consistent with this policy statement.
l In theory, one could construct a more generous regulatory framework for consideration of those risk-informed changes which may have the effect ofincreasing risk to the public. Such a framework would include, of course, assurance of continued adequate protection (that level of protection of the public health and safety which must be reasonably assured regardless of economic cost). But it could also appendices thereto; orders; license conditions; exemptions; and technical specifications. It also includes '
the plant-specific design-basis information defined in 10 CFR 50.2 as documented in the most recent final safety analysis report (FSAR) as required by 10 CFR 50.71 and the licensee's commitments remaining in effect that were made in docketed licensing correspondence such as licensee responses to NRC bulletins, generic letters, and enforcement actions, as well as licensee commitments documented in NRC safety evaluations or licensee event reports." The use of this definition is not intended to imply any increase in the types of changes that are required to be submitted for NRC approval.
Predecisional 4
l l
i include provision for possible elimination of all measures not needed for adequate protection which either do not effect a substantial reduction in overall risk or result in continuing costs.which are notjustified by the safety benefits. Instead NRC has chosen, in this regula:ory guide, a more restrictive policy which would permit only small increases in risk, and then only when it is reasonably assured, among other things, that suflicient defense in depth and sufficient margins are maintained. This policy is adopted because of uncertainties and to account for the fact that safety issues continue to emerge regarding design, construction, and operational matters notwithstanding the maturity of the nuclear power industry. These factors suggest that nuclear power reactors should operate routinely only at a prudent margin above adequate protection. The safety goal subsidiary objectives are used as an example of such a prudent margin.
Finally, this regulatory guide indicates an acceptable level of documentation that will enable the staff to reach a finding that the licensee has performed a sufficiently complete and scrutable analysis and that the results of the engineering evaluations support the licensee's request for a regulatory change.
1.5 Relationship to dtber Guidance Documents Directly relevant to this regulatory guide is the Standard Review Plan (SRP) designed to guide the NRC staff evaluations oflicensee requests for changes to the CLB that apply risk insights (Ref. 3), as well as selected application-specific regulatory guides and the corresponding Standard Review Plan chapters.
Related regulatory guides include DG-1062 (Ref. 5) on inservice testing, DG-1063 (Ref. 6) on inservice inspection, DG-1064 (Ref. 7) on graded quality assurance, and DG-1065 (Ref. 8) on technical specifications. An NRC contractor report (Ref. 9)is also available which provides a simple screening method for assessing one measure used in the regulatory guide--large early release frequency. The staff recognizes that the risk analyses necessary to support regulatory decisionmaking may vary with the relative weight that is given to the risk assessment element of the decisionmaking process. The burden is on the licensee requesting a change to their CLB tojustify why the chosen risk assessment approach, methods, and data are appropriate for the decision to be made.
Regulatory guides are issued to describe to the public methods acceptable to the NRC staff for implementing specific parts of the NRC's regulations, to explain techniques used by the staffin evaluating specific problems or postulated accidents, and to provide guidance to applicants. Regulatory guides are not substitutes for regulations, and compliance with regulatory guides is not required.
The information collections contained in this regulatory guide are covered by the requirements of 10 CFR Part 50, which were approved by the Office of Management and Budget, approval number 3150-0011.
The NRC may not conduct or sponsor, and a person is not required to respond to, a collection of information unless it displays a currently valid OMB control number.
- 2. AN ACCEPTABLE APPROACII TO RISK-INFORMED DECISIONMAKING 2.1 Risk-Informed Philosophy In its approval of the policy statement on the use of PRA methods in nuclear regulatory activities, the Commission stated an expectation that "the use of PRA technology should be increased in all regulatory l
matters...in a manner that complements the NRC's deterministic approach and supports the NRC's I
traditional defense-in-depth philosophy." The use of risk insights in licensee submittals requesting CLB changes will assist the staffin the disposition of such licensee proposals.
Predecisional 5
The staff has defined an acceptable approach to analyzing and evaluating proposed CLB changes. This approach supports the NRC's desire to base its decisions on the results of traditional engineering i
evaluations, supported by insights (derived from the use of PRA methods) about the risk significance of I
the proposed changes. Decisions concerning proposed changes are expected to be reached in an integrated fashion, considering traditional engineering and risk information, and may be based on qualitative factors as well as quantitative analyses and information.
In implementing risk-informed decisionmaking, changes are expected to meet a set of key principles.
Some of these principles are written in terns typically used in traditional engineering decisions (e.g.,
defense-in-depth). While written in these terms, it should be understood that risk analyses techniques can be, and are encouraged to be, used to help ensure and show that they are met. These principles are:
1.
The proposed change meets the current regulations unless it is explicitly related to a requested exemption or rule change.
2.
The proposed change is consistent with the defense-in-depth philosophy.
3.
The proposed change maintains sufficient safety margins.
4.
When proposed changes result in an increase in core damage frequency and/or risk, the increases should be small and consistent with the intent of the Commission's Safety Goal Policy Statement 2
5.
The impact of the proposed change should be monitored using performance measurement strategies.
Each of these principles should be considered in the risk-informed, integrated decisionmaking process, as illustrated in Figure 1.
Change is consistent with defense-in-depth philosopby Meet current regulations
,,f,gy margias s
Integrated Decisionmaking I
N V
+Q Use performance-Proposed increases in core measurement damage frequency and/or strategies to nskare small and are monitor the change consistent with the Commission's Safety Goal Pohey Statement Figure 1. Principles of Risk-Informed Regulation
- For purposes of this guide, a proposed CLB change which meets the acceptance guidelines discussed in Section 2.4.2 is considered to have met the intent of the policy statement.
Predecisional 6
(
l 1
The staff's proposed evaluation approach and acceptance guidelines follow from these principles. In implementing these principles, the staff expects that:
All safety impacts of the proposed change are evaluated in an integrated manner as part of an overall risk management approach in which the licensee is using risk analysis to improve operational and engineering decisions broadly by identifying and taking advantage of opportunities for reducing risk, and not just to eliminate requirements the licensee sees as undesirable. For those cases where risk increases are proposed, the benefits should be described and should be commensurate with the proposed risk increases. The approach used to identify changes in requirements should be used to identify areas where requirements should be increased,5 as well as where they could be reduced.
The scope and quality of the engineering analyses (including traditional and probabilistic e
analyses) conducted to justify the proposed CLB change should be appropriate for the nature and scope of the change, should be based on the as-built and as-operated and maintained plant, and should reflect operating experience at the plant.
The plant-specific PRA supporting licensee proposals has been subjected to quality controls such e
as an independent peer review or certification.'
Appropriate consideration of uncertainty is given in analyses and interpretation of findings, e
I including using a program of monitoring, feedback, and corrective action to address significant uncertainties.
The use of core damage frequency (CDF) and large early release frequency (LERF)5 as bases for probabilistic risk assessment acceptance guidelines is an acceptable approach to addressing Principle 4. Use of the Commission's Safety Goal QHOs in lieu of LERF is acceptable in principle and licensees may propose their use. However, in practice, implementing such an 5
The staffis aware of, but does not endorse here, guidelines which have been developed (e.g., by NEI/NUMARC ) to assist in identifying potentially beneficial changes to requirements.
l l
- As discussed in Section 2.4.2 below, such a peer review or certification is not a replacement for
{
NRC review. Certification is defined as a mechanism for assuring that a PRA, and the process of l
developing and maintaining that PRA, meet a set of technical standards established by a diverse group of I
personnel experienced in developing PRA models, performing PRAs, and performing quality reviews of PRAs. Such a process has been developed and integrated with a peer review process by, for example, the BWR Owners Group and implemented for the purpose of enhancing quality of PRAs at several BWR facilities.
5 In this context, LERF is being used as a surrogate for the early fatality QHO. It is defined as the frequency of those accidents leading to significant, unmitigated releases from containment in a time frame prior to effective evacuation of the close-in population such that there is a potential for early health effects. Such accidents generally include unscrubbed releases associated with early containment failure at or shortly after vessel breach, containment bypass events, and loss of containment isolation.
i This definition is consistent with accident analysis used in the safety goal screening criteria discussed in the Commission's Regulatory Analysis Guidelines. An NRC contractor's report (Ref. 9) describes a simple screening approach for calculating LERF.
Predecisional 7
A
approach would require an extension to a Level 3 PRA, in which case the methods and assumptions used in the Level 3 analysis, and associated uncenainties, _would require additional attention.
Increases in estimated CDF and LERF resulting from proposed CLB changes will be limited to e
small increments; the cumulative effect of such changes should be tracked and considered in the decision process, The acceptability of proposed changes should be evaluated by the licensee in an integrated e
fashion that ensures that all principles are met.'
e Data, methods, and assessment criteria used to support regulatory decisionmaking must be well documented and available for public review.
2.2 A Four-Element Approach to Integrated Decisionmaking Given the principles of risk-informed decisionmaking discussed above, the staff has identified a four-element approach to evaluating proposed CLB changes. This approach, which is presented graphically in Figure 2, acceptably supports the NRC's decisionmaking process. This approach is not sequential in nature; rather it is iterative.
Tpf, gal PRA
\\
j,/
,/
\\ / jj' 1
Define Submit Perform }
topnementapont Define > Engineering O y Proposed Change genitorinS Change Anotysis Program Figure 2. Principal Elements of Risk-Informed, Plant-Specific Decisionmaking 2.3 Element 1: Define the Proposed Change Element 1 involves three primary activities. Eirst, the licensee should identify those aspects of the plant's licensing bases that may be affected by the proposed change, including, but not limited to, rules and regulations, final safety analysis report (FSAR), technical specifications, licensing conditions, and i
6 One important element ofintegrated decisionmaking can be the use of an "expen panel." Such a panel is not a necessary component of risk-informed decis;onmaking; but when it is used, the key principles and associated decision criteria presented in this regulatory guide still apply and must be shown to have been met or to be irrelevant to the issue at hand.
l Predecisional 8
l I
licensing commitments. Sicand, the licensee should identify all SSCs, procedures, and activities that are covered by the CLB change under evaluation and consider the original reasons for inclusion of each i
program requirement.
When considering CLB changes, a licensee may identify regulatory requirements or commitments in its licensing bases that it believes are overly restrictive or unnecessary to ensure safety at its plant. Note that the corollary is also true; that is, licensees are expected also to identify possible cases where design and operational aspects of the plant should be enhanced consistent with an improved understanding of their safety significance. Such enhancements should be embodied in appropriate CLB changes which reflect l
these enhancements. With this staff expectation in mind, the licensee should, third, identify available engineering studies, methods, codes, applicable plant-specific and industry data and operational experience, PRA findings, and resench and analysis results relevant to the proposed CLB change. With particular regard to the plant-specific PRA, the licensee should assess the capability to use, refine, augment, and update system models as needed to support a risk assessment of the proposed CLB change.
The above information should be used collectively to provide a description of the CLB change and to outline the method of analysis. The licensee should describe the proposed change and how it meets the objectives of the Commission's PRA Policy Statement, including enhanced decisionmaking, more efficient use of resources, and reduction of unnecessary burden. In addition to improvements in reactor safety, this assessment may consider benefits from the CLB change such as reduced fiscal and personnel resources and radiation exposure. In addition, the licensee should affirm that the proposed CLB change meets the current regulations, unless the proposed change is explicitly related to a proposed exemption or rule change (i.e., a 50.12 " specific exemption" or a 2.802 " petition for rulemaking").
Combined Change Requests Licensees may make proposals which include several individual changes to the CLB that have been evaluated and will be implemented in an integrated fashion. The staff expects that with respect to the overall net change in risk, combined change requests (CCRs) will fall in one of two broad categories, each of which may be acceptable:
1.
those for which any individual change increases risk; 2.
those for which each individual change decreases risk.
For the first category, the contribution of each individual change in the CCR must be quantified in the risk assessment and the uncertainty of each individual change must be addressed. For CCRs in the second category, qualitative analysis may be sufficient for some or all individual changes. Guidelines for use in
. developing CCRs are discussed below.
The changes that make up a CCR should normally be related to one another, for example by affecting the same single system or activity, the same safety function or the same accident sequence or group of sequences, or by being of the same type (e.g., changes in TS allowed outege time). However, this does not preclude unrelated changes being accepted. When CCRs are submitted to the staff for review, the relationships among the individual changes and how they have been modeled in the risk assessment should be addressed in detail, since this will control the characterization of the net result of the changes.
Licensees should evaluate not only the individual changes but also the changes taken together against the safety principles and qualitative acceptance guidelines in Section 2.1 and Section 2.4.1, respectively, of this regulatory guide. In addition, the acceptability of the cumulative impact of the changes that make up Predecisional 9
the CCR with respect to the quantitative acceptance guidelines discussed in Section 2.4.2.2 of this guide should be assessed.
In implementing CCRs in category 1, it is expected that the risk from significant accident sequences will not be increased and that the frequencies of the lower ranked contributors will not be increased so that they become significant contributors to risk. In addition, it is expected that no significant new sequences or cutsets will be created. Also, in assessing the acceptability of CCRs, the following should be considered: (1) risk increases related to the more likely initiating events (e.g., steam generator tube ruptures) should not be traded against improvements related to unlikely events (e.g., earthquakes) even if, for instance, they involve the same safety function; and (2) risk should be considered in addition to likelihood. The staff also expects that CCRs will lead to safety benefits such as simplifying plant operations or focusing resources on the most. important safety items.
Proposed changes which modify one or more individual components of a previously approved CCR, need to also address the impact on the previously approved CCR. Specifically, the question of would the proposed modification now cause the previously approved CCR to not be acceptable needs to be addressed. If the answer is yes, the submittal should address what actions the licensee is taking with respect to the previously approved CCR.
2.4 Element 2: Perform Engineering Analysis As part of the second element, the licensee will evaluate the proposed CLB change with regard to the principles that adequate defense-in-depth is maintained, that sufficient safety margins are maintained, and that proposed increases in core damage frequency and risk are small and are consistent with the intent of the Commission's Safety Goal Policy Statement.
The staff expects that the scope and quality of the engineering analyses conducted tojustify the proposed CLB change will be appropriate for the nature and scope of the change. The staff also expects that appropriate consideration will be given to uncertainty in the analysis and interpretation of findings. The licensee is expected to use its judgment of the complexity and difficulty ofimplementing the proposed CLB change to decide upon appropriate engineering analyses to support regulatory decisionmaking.
Thus, the licensee should consider the appropriateness of qualitative and quantitative analyses, as well as analyses using traditional engineering approaches and those techniques associated with the use of PRA findings. Regardless of the analysis methods chosen, the licensee must show that the principles set forth in Section 2.1 have been met through the use of scrutable acceptance guidelines established for making that determination.
Some proposed CLB changes can be characterized as involving the categorization of SSCs according to safety significance. An example is grading the application of quality assurance controls commensurate with the safety significance of equipment. Like other applications, the staff's review of CLB change requests for applications involving safety categorization will be according to the acceptance guidelines which are associated with each key principle and which are presented in this regulatory guide, unless equivalent guidelines are proposed by the licensee. Since risk importance measures are often used in such categorizations, guidance on their use is provided in Appendix A of this regulatory guide. For such CLB changes, guidelines associated with the adequacy of programs (in this example, quality controls) implemented for different safety significant categories (e.g., more safety significant and less safety significant) are addressed in other application-specific guidance documents. Licensees are encouraged to apply risk-informed findings and insights to decisions (and potential CLB requests).
2.4.1 Evaluation of Defense-in-Depth Attributes and Safety Margins I
I Predecisional 10 z
1
O l
1 One aspect of the engineering evaluations is to show that the fundamental safety principles on which the plant design was based are not compromised. Design basis accidents (DBAs) play a central role in nuclear power plant design. DBAs are a combination of postulated challenges and failure events against which plants are designed to ensure adequate and safe plant response. During the design process, plant response and associated safo.y margins are evaluated using assumptions which are intended to be conservative. National staudards and other considerations such as defense-in-depth attributes and the single failure criterion conctitute additional engineering considerations that influence plant design and operation. Margins and der nses associated with these considerations may be affected by the licensee's proposed CLB change and, therefore, should be reevaluated to support a requested CLB change. As part of this evaluation, the impact of the proposed CLB change on affected equipment functionality, reliability, and availability should be determined.
2.4.1.1 Defense-in-Depth The engineering evaluation conducted should evaluate whether the impact of the proposed CLB change (individually and cumulatively) is consistent with the defense-in-depth philosophy. In this regard, the intent of the principle is to assure that the philosophy of defense-in-depth is maintained, not to prevent changes in the way defense-in-depth is achieved. The defense-in-depth philosophy has traditionally been applied in reactor design and operation to provide multiple means to accomplish safety functions and prevent the release of radioactive material. It has been and continues to be an effective way to account for uncertainties in equipment and human performance. Where a comprehensive risk analysis can be done, it can be used to help determine the appropriate extent of defense-in-depth (e.g., balance among core damage prevention, containment failure and consequence mitigation) to ensure protection of public health and safety. Where a comprehensive risk analysis is not or cannot be done, traditional defense in-depth considerations should be used or maintained to account for uncertainties. The evaluation should consider the intent of the general design criteria, national standards, and engineering principles such as the single failure criterion. Further, the euluation should consider the impact of the proposed CLB change on barriers (both preventive and mitigative) to core damage, containment failure or bypass, and the balance among defense-in-depth attributes. As stated earlier, the licensee should select the engineering analysis techniques, whether quantitative or qualitative and traditional or probabilistic, appropriate to the proposed 1
CLB change.
(
The licensee should assess whether the proposed CLB change meets the defense-in-depth principle.
l Defense-in-depth consists of a number of elements, as summarized below. These elements can be used as guidelines for making that assessment. Other equivalent acceptance guidelines may also be used.
l l
l Consistency with the defense-in-depth philosophy is maintained if:
e a reasonable balance among prevention of core damage, prevention of containment e
failure, and consequence mitigation is preserved over-reliance on programmatic activities to compensate for weaknesses in plant design is e
avoided system redundancy, independence, and diversity are preserved commensurate with the e
expected frequency, and consequences of challenges to the system and uncertainties (e.g.,
no risk outliers) defenses against potential common cause failures are preserved and the potential for e
introduction of new common cause failure mechanisms is assessed Predecisional l1 o
independence of barriers is not degraded e
defenses against human errors are preserved e
the intent of the General Design Criteria in 10 CFR Part 50, Appendix A is maintained.
e 2.4.1.2 Safety Margins The engineering evaluation conducted should assess whether the impact of the proposed CLB change is consistent with the principle that sufficient safety margins are maintained. Here also, the licensee is -
expected to choose the method of engineering analysis appropriate for evaluating whether sufficient safety margins would be maintained if the proposed CLB change were implemented. An acceptable set of guidelines for making that assessment are summarized below. Other equivalent acceptance guidelines may also be used.
Sufficient safety margins are maintained if:
codes and standards or alternatives approved for use by the NRC are met o
safety analysis acceptance criteria in the current licensing basis (e.g., FSAR, supporting e
analyses) are met, or proposed revisions provide sufficient margin to account for analysis and data uncertainty Application-specific guidelines reflecting this general guidance may be found in the application-specific regulatory guides (Refs. 5-8).
2.4.2 Evaluation of Risk Impact, Including Treatment of Uncertainties As noted in Section 2.1, the licensee's risk assessment may be used to address the principle that proposed increases in core damage frequency and risk are small and are consistent with the intent of the Commission's Safety Goal Policy Statement. For purposes ofimplementation, the licensee should assess the expected change in core damage frequency (CDF) and large early release frequency (LERF). The necessary sophistication of the evaluation, including the scope of the PRA (e.g., internal events only, full power only), depends on the contribution the risk assessment makes to the integrated decision-making, which depends to some extent on the magnitude of the potential risk impact. For some CLB changes for which a more substantial impact is possible, an in-depth and comprehensive PRA analysis of appropriate scope to derive a quantified estimate of the total impact of a proposed CLB change will be necessary to provid: adequate justification. In other applications, calculated risk importance measures or bounding estimates will be adequate. In still others, a qualitative assessment of the impact of the CLB change on the plant's risk may be sufficient.
The remainder of this section discusses the use of quantitative PRA results in decision making. This discussion has three parts:
A fundamental element of NRC's risk-informed regulatory process is a PRA of sufficient quality and scope for the intended application. Section 2.4.2.1 discusses the staff's expectations with respect to the needed PRA quality and scope.
Predecisional 12
l l
1 o
PRA results are to be used in this decisionmaking process in two ways - to assess (for some situations) the overall baseline CDF/LERF of the plant and to assess the CDF/LERF impact of the proposed change. Section 2.4.2.2 discusses the acceptance guidelines to be used by the staff for each of these measures.
(
One of the strengths of the PRA framework is its ability to provide a means of characterizing the impact of uncertainty in the analysis, and it is essential that these uncertainties be recognized when assessing whether the principles are being met. To provide a vehicle for consistency between submittals and the review of those submittals, Section 2.4.2.3 provides guidelines on how the uncertainty is to be addressed in the decision-making process.
The staff's decision on the proposed CLB change will be based on its independentjudgment and review I
of the entire application.
2.4.2.1 Scope, Level of Detail, and Quality of the PRA 1
1 The scope, level of detail, and quality required of the PRA is commensurate with the application for l
which it is intended and on the role the PRA results play in the integrated decision process. The more emphasis that is put on the risk insights and on PRA results in the decision-making process, the more requirements have to be placed on the PRA, both in terms of scope and in terms of how well the risk l
and/or the change in risk is assessed.
i Conversely, if a proposed change to the CLB results in a risk decrease or is very small, or if the decision could be based mostly on traditional engineering arguments, or if compensating measures are proposed such that it can be convincingly argued that the change is very small, then emphasis on the PRA scope and quality can be reduced.
Sin:e this regulatory guide is intended for a variety of applications, the required quality and level of detail may vary. One overriding requirement is that the PRA performed should realistically reflect the actual design, construction, operational practices, and operational experience of the plant and its owner. This should include licensee voluntary actions as well as regulatory requirements and the PRA used to support risk-informed decisionmaking should also reflect the impact of previous changes made to the CLB.
Scope Although the scope of the assessment of the risk implications in light of the acceptance guidelines discussed in Section 2.4.2.2 requires that all plant operating modes and initiating events be addressed, it is not necessary to have a PRA that treats all these modes and initiating events. A qualitative treatment of the missing modes and initiators may be sufficient in many cases. Section 2.4.2.3 discusses this further.
Level of Detail Required to Support an Application The level of detail required of the PRA is that which is sufficient to model the impact of the proposed change. The characterization of the problem should include the establishment of a cause-effect relationship to identify portions of the PRA affected by the issue being evaluated. For full scale applications of the PRA, this should be reflected in a quantification of the impact on the PRA elements.
For applications like component categorization, sensitivity studies on the effects of the change may be sufficient. For other applications it may be adequate to define the qualitative relationship of the impact on the PRA elements or may only require an identification of which elements are impacted.
Predecisional 13
l i
If the impacts of a change to the plant cannot be associated with elements of the PRA, the PRA should be modified accordingly. If this cannot be done, the impact of the change should be evaluated qualitatively as part of the decision-making process (or expert panel process). In any case, the effects of the changes on SSC reliability and unavailability or on operator actions should be appropriately accounted for.
PRA Quality In the current context, quality will be defined as measuring the adequacy of the actual modeling. A PRA used in risk-informed regulation should be performed correctly, and in a manner that is censistent with accepted practices, commensurate with the scope and level of detail n. quired as discussed above. One approach a licensee could use to assure quality is to perform a peer review of the PRA. In this case, the submittal should document the review process, the qualification of the reviewers, a summary of the review findings, and resolutions to these findings where applicable. Industry PRA certification programs and PRA cross-comparison studies could also be used to help ensure appropriate scope, level of detail and quality of the PRA. If such a program or studies are to be used, a description of the program, including the approach and standard or guidelines to which tne PRA is compared, the depth of the review and the make-up and qualifications of the personnel involved should be provided for NRC review. Based on the peer review or certification process and on the findings from this process, the licensee should justify why the PRA is adequate for the present application in terms of scope and quality. Neither a peer review nor a certification or cross comparison replaces a staff review in its entirety, although the more confidence the staff has in the review that has been performed by or for the licensee, the less rigor should be expected of the staff review.
The NRC has not developed its own formal standard nor endorsed an industry standard for a PRA submitted in support of applications governed by this regulatory guide. However, the NRC supports ongoing initiatives to develop a standard and expects that one will be available in the future. In the interim, the NRC staff will evaluate PRAs submitted in support of specific applications using the guidelines given in Chapter 19 ofits Simdard Review Plan (Ref. 3). The statTexpects to feed back the experience gained from these reviews into the standards development process so that ultimately a standard can be developed that is suitable for regulatory decisionmaking as described in this guide. In addition, the references and bibliography provide information that licensees may find useful in deciding on the acceptability of their PRA.
2.4.2.2 Acceptance Guidelines The risk acceptance guidelines presented in this regulatory guide are based on the principles and expectations for risk-informed regulation discussed in Section 2.1, and are structured as follows. Regions are established in the two planes generated by a measure of the baseline risk metric (CDF or LERF) along the x-axis, and the change in those metrics (ACDF or ALERF) along the y-axis (Figures 3 and 4), and acceptance guidelines are established for each region as discussed below. These guidelines are intended for comparison with a full scope (iaciuding internal events, external events, full power, low power and shutdown) assessment of the change in risk metric, and, when necessary, as discussed below, the baseline value of the risk metric (CDF or LERF). However, it is recognized that many PRAs are not full scope and the use ofless than full scope PRA information may be acceptable as discussed in Section 2.4.2.3 of this regulatcry guide.
I Predecisional 14 j
l J
\\
l l
g N, e... l
/
s.. < i s ui....,
g j
7 a t e...
i e 4
s...
n<4.
..er-
'R F(,lo N I a a. t < u.. u i.... i... p.. s 1 n. e..... e n 10, s,.,,s,.,.,i,,i,.,,,..,-
}.
M,. t t I ir A taisill% %.lli tspi,1 p ';
... i, i... < io i
.a
- i,.. t <....... i.... n i... e a...
4 10 l
105 10" CDF=*
Figure 3 - Acceptance Guidelines
- for Core Damage Frequency (CDF) 1 l
3 R. e... 8 m
s..<i.
..e, ui....a cd 1 u r e..... i s l
]
- i.. t ( u... u t, e.s e s i.. p. n s..i 4 s.i < i.. e n 4
g yg, y9 % g
~1 u i e e... s e s s... s ii<
.....e.-
4 l
10
- w n i in.i,i, iii, u,,pn i
- i $ I<'Y.E.' i$.I.'i...n. n 10"
'Ty b yg,.
y;q REGION. III:..
10 10-5 LERF "*
4 Figure 4 - Acceptance Guidelines
- The analysis will be subject to increased technical review and management attention as indicated by the darkness of the shading of the figure. In the context of the integrated decision making, the boundaries between regions should not be interpreted as being definitive; the numerical values associated with defining the regions in the figure are to be interpreted as indicative values only.
Predecisional lS
There are two acceptance guidelines, one for CDF and one for LERF, halb of which should be used.
l The guidelines for CDF are:
If the application can be clearly shown to result in a decrease in CDF, the change will be considered to have satisfied the relevant principle of risk-informed regulation with respect to CDF. (Because Figure 3 is drawn on a log scale, this region is not explicitly indicated on the figure.)
When the calculated increase in CDF is very small, which is taken as being less than 104 per reactor year, the change will be considered regardless of whether there is a calculation of the total CDF (Region III). While there is no requirement to calculate the total CDF, should there be an indication that the CDF may be considerably higher than 104 per reactor year, the focus should be on finding ways to decrease rather than increase it. Such an indication would result, for example, if: (1) the contribution to CDF calculated from a limited scope analysis, such as the JPE, and, if appropriate the IPEEE, significantly exceeds 10d; (2) there has been an identification of a potential vulnerability from a margins type analysis; or (3) historical experience at the plant in question has indicated a potential safety concern.
When the calculated increase in CDF is in the range of 104 per reactor year to 10-3 per reactor year, applications will be considered only ifit can be reasonably shown that the total CDF is less than 10d per reactor year (Region II).
Applications which result in increases to CDF above 10-5 per reactor year (Region I) would not normally be considered.
AND The guidelines for LERF are:
If the application can be clearly shown to result in a decrease in LERF, the change will be considered to have satisfied the relevant principle of risk-informed regulation with respect to LERF. (Because Figure 4 is drawn with a log scale, this region is not explicitly indicated on the figure.)
When the calculated increase in LERF is very small, which is taken as being less than 103 per reactor year, the change will be considered regardless of whether there is a calculation of the total LERF (Region III). While there is no requirement to calculate the total LERF, should there be an indication that the LERF may be considerably higher than 10-5 per reactor year, the focus should be on finding ways to decrease rather than increase it. Such an indication would result, for example, if: (1) the contribution to LERF calculated from a limited scope analysis, such as that the IPE, and, if appropriate the IPEEE, significantly exceeds 10-5; (2) there has been an identification of a potential vulnerability from a margins type analysis; or (3) historical experience at the plant in question has indicated a potential safety concern.
When the calculated increase in LERF is in the range of 104 per reactor year to 104 per reactor year, applications will be considered only ifit can be reasonably shown that the total LERF is less than 10-5 per reactor year (Region II).
Predecisional 16
Applications which result in increases to LERF above 104 per reactor year (Region 1) would not normally be considered.
These guidelines are intended to provide assurance that proposed increases in CDF and LERF are small and are consistent with the intent of the Commission's Safety Goal Policy Statement.
As indicated by the shading on the figures, the change request will be subject to an NRC technical and management review which becomes more intensive the closer the calculated results are to the region boundaries.
The guidelines discussed above are applicable for full power, low power and shutdown operations.
However, during certain shutdown operations when the containment function is not maintained, the LERF guideline as defined above is not practical. In those cases, licensees may use rnore stringent baseline CDF guidelines (e.g.,10-5 per reactor year) to maintain an equivalent risk profile or may propose an alternate guideline to LERF that meets the intent of Principle 4.
The technical review that relates to the risk evaluation will address the scope, quality, and robustness of the analysis, including consideration of uncertainties as discussed in the next section. Aspects covered by the management review are discussed in Section 2.4.3, Integrated Decision Making, and in:lude factors that are not amenable to PRA evaluation.
2.4.2.3 Comparison of PRA Results with the Acceptance Guidelines The purpose of this section is to provide guidance on how to compare the results of the PRA with the acceptance guidelines described in Section 2.4.2.2. In the context of the integrated decisionmaking, the acceptance guidelines should not be interpreted as being overly prescriptive. They are intended to provide an indication, in numerical tenns, of what is considered acceptable. As such, the numerical values associated with defining the regions in Figures 3 and 4 of this regulatory guide are approximate values that provide an indication of the changes that are generally acceptable. Furthermore, the state of knowledge, or epistemic, uncertainties associated with PRA calculations preclude a definitive decision with respect to which region the application belongs in based purely on the numerical results. The intent in making the comparison of the PRA results with the acceptance guidelines is to demonstrate with reasonable assurance that Principle 4, discussed in Section 2.1, is being met. This decision must be made based on a full understanding of the contributors to the PRA results, and the impacts of the uncertainties, both those that are explicitly accounted for in the results and those that are not. This is a somewhat subjective process, and the reasoning behind the decisions must be well documented. The following discussion provides guidance on what should be addressed. First, the types of uncertainty that impact PRA results, and methods typically used for their analysis are briefly discussed. More details can be found in the references in the bibliography.
Types of Uncertainty and Methods of Analysis There are two facets to uncertainty that, because of their nature, must be treated differently when creating models of ecmplex systems. They have recently been discussed under the terms aleatory and epistemic I
uncertainty. The aleatory uncertainty is that addressed when the events or phenomena being models are characterized as occurring in a " random," or " stochastic" manner, and probabilistic models are adopted to describe their occurrences. It is this aspect of uncertainty that gives the Probabilistic Risk Assessment the probabilistic part of its name. The epistemic uncertainty is that associated with the analyst's confidence in the predictions of the PRA model itself, and is a reflection of his assessment of how well the PRA model represents the actual system being modeled. This has been referred to as state-of-knowledge l
17
uncertainty. In this section, it is the epistemic uncertainty that is discussed; the aleatory uncertainty is built into the structure of the PRA model itself. Because they are generally characterized and treated differently, it is useful to identify three classes of uncertainty that are addressed in, and impact the results of PRAs: parameter uncertainty, model uncertainty, and completeness uncertainty. Completeness uncertainty can be regarded as one aspect of model uncertainty, but because ofits importance, it is discussed separately. The references in the bibliography may be consulted for additional information on definitions of terms, and approaches to the treatment of uncertainty in PRAs.
Parameter Uncertainty Each of the models that is used, either in developing the PRA logic structure, or to represent the basic events of that structure has one or more parameters. Typically, each of these models (e.g., the Poisson model for initiating events) is assumed to be appropriate. However, the parameter values for these models are often not known perfectly. Parameter uncertainties are those associated with the values of the fundamental parameters of the PRA model, such as equipment failure rates, initiating event frequencies, and human error probabilities that are used in the quantification of the accident sequence frequencies. They are typically characterized by establishing probability distributions on the parameter values. These distributions can be interpreted as expressing the analyst's degree of belief in the values these parameters could take, based on his state of knowledge, and conditional on the underlying model being correct. It is straightforward and within the capability of most PRA codes to propagate the distribution representing uncertainty on the basic parameter values to generate a probability distribution on the results (CDF, accident sequence frequencies, LERF, etc.) of the PRA. However, the analysis must be done to correlate the sample values for different PRA elements from a group to which the same parameter value applies (the so-called state-of-knowledge dependency - see Ref. 10).
Model Uncertainly The development of the PRA model is supported by the use of models for specific events or phenomena. In many cases, the industry's state of knowledge is incomplete, and there may be different opinions on how the models should be formulated. Examples include approaches to modeling human performance, common cause failures, and reactor coolant pump seal behavior upon loss of seal cooling. This gives rise to model uncertainty. In many cases, the appropriateness of the models adopted is not questioned and these models have become, de facto, the standard models to use. Examples include the use of Poisson and binomial models to characterize the probability of occurrence of component failures. For some issues where alternate models are well formulated, PRAs have addressed model uncertainty by using discrete distributions over the alternate models, with the probability associated with a specific model representing the analysts degree of beliefin that model as being the most appropriate. A good example is the characterization of seismic hazard, where different hypotheses lead to different hazard curves, which can be used to develop a discrete probability distribution of the initiating event frequency for earthquakes. Other examples can be found in the level 2 analysis. Another approach to addressing model uncertainty has been to adjust the results of a single model through the use of an adjustment factor. However it is formulated, an explicit representation of model uncertainty can be propagated through the analysis as for parameter uncertainty. More typically, however, particularly in the level 1 analysis, the use of different models would result in the need for a different structure (e.g., where different thermal hydraulic models are used to determine success criteria). In such cases, uncertainties in the choice of appropriate model are typically addressed by making assumptions and/or, as in the case of the component failure models discussed above, adopting a specific model.
PRAs model the continuum of possible plant states in a discretized way, and are, by their very natuce, approximate models of the world. This results in some random (aleatory) aspects of the 'world' not being addressed except in a bounding way, e.g., different realizations of an accident sequence corresponding to different LOCA sizes (within a category) are treated by assuming a bounding LOCA, time of failure of an operating component assumed to occur at the moment of demand, etc. These approximations introduce biases (uncertainties) into the results.
18
l l
l l
In interpreting the results of a PRA it is important to develop an understanding of the impact of a specific assumption or choice of model on the predictions of the PRA. This is true even in cases where the model l
uncertainty is treated probabilistically, since the probabilities, or weights, given to different models would be subjective. The impact of using alternate assumptions or models may be addressed by performing appropriate sensitivity studies, or they may be addressed using qualitative arguments, based on an understanding of the contributors to the results and how they are impacted by the change in assumptions or models. The impact of making specific modeling approximations may be explored in a similar manner.
Comoteteness Uncertainty Completeness is not in itself an uncertainty, but a reflection of scope limitations. The result is, however, an uncertainty about where the true risk lies. The problem with completeness uncertainty is that, because it reflects an unanalyzed contribution, it is difficult (if not impossible) to estimate its magnitude. Some contributions are unanalyzed not because methods are not available, but because they have not been refined to the level of the analysis ofinternal events. Examples are the analysis of some external events and the low power and shutdown modes of operation. There are issues however, for which methods of analysis have not been developed, and they have to be accepted as potential limitations of the technology. Thus, for example, the impact on actual plant risk from unanalyzed issues such as the influences of organizational performance cannot now be explicitly assessed.
The issue of completeness of scope of a PRA can be addressed for those scope items for which methods are in principle available, and therefore some understanding of the contribution to risk exists, by either supplementing the analysis with additional analysis to enlarge the scope, using more restrictive acceptance guidelines, or by providing arguments that, for the application of concern, ti.e out-of-scope contributors are not significant. Acceptable approaches to dealing with incompleteness are discussed in the next section.
Comparisons with Acceptance Guidelines i
The different regions of the acceptance guidelines require different depths of analysis. Changes resulting in a net decrease in the CDF and LERF estimates do not require an assessment of the calculated baseline CDF and LERF. Generally, it should be possible to argue on the basis of an understanding of the contributors and the changes that are being made that the overall impact is indeed a decrease, without the need for a detailed quantitative analysis.
If the calculated values of ACDF and ALERF are very small, as defined by Region 111 in Figures 3 and 4, a detailed quantitative assessment of the baseline value of CDF and LERF will not be necessary.
However, if there is an indication that the CDF or LERF could considerably exceed 104 and 10 5 j
respectively, in order for the change to be considered, the licensee may be required to present arguments as to why steps should not be taken to reduce CDF or LERF. Such an indication would result, for example,if: (!) the contribution to CDF or LERF calculated from a limited scope analysis, such as the IPE, and, if appropriate the IPEEE, significantly exceeds 10dand 10 5 respectively;(2) there has been an identification of a potential vulnerability from a margins type analysis; or (3) historical experience at the plant in question has indicated a potential safety concern.
l For larger values of ACDF and ALERF, which lie in the range used to define Region II, an assessment of j
the baseline CDF and LERF is required.
i 19
The level of detail required in the assessment of the values and the analysis of uncertainty related to model and incompleteness issues, to demonstrate compliance with the numerical guidelines, will both j
depend on (1) the CLB change being considered, and (2) the importance of the demonstration that
{
l principle 4 has been met to the decision to grant the change. In Region Ill of Figures 3 and 4, the closer j
the estimates of ACDF or ALERF are to their corresponding acceptance guidelines, the more detail will
{
be required. Similarly, in Region II of Figures 3 and 4, the closer the estimates of ACDF or ALERF and CDF and LERF are to their corresponding acceptance guidelines, the more detail will be required. In contrast, if, as an example, the estimated value of a particular metric is very small compared to the acceptance goal, a simple bounding analysis may suffice, with no need for a detailed uncertainty analysis.
Because of the way the acceptance guidelines were developed, the appropriate numerical measures to use in the initial comparison of the PRA results to the acceptance guidelines are mean values. The mean values referred to are the means of the probability distributions that result from the propagation of the uncenainties on the input parameters and those model uncertainties explicitly represented in the model.
While a formal propagation of the uncertainty is the best way to correctly account for state-of-knowledge uncenainties that arise from the use of the same parameter values for several basic event probability models, under certain circumstances, a formal propagation of uncertainty may not be required ifit can be demonstrated that the state-of-knowledge correlation is unimportant. This will involve, for example, a demonstration that the bulk of the contributing scenarios (cutsets or accident sequences) do not involve multiple events that rely on the same parameter for their quantification.
Consistent with the viewpoint that the guidelines are not to be used prescriptively, even if the calculated ACDF and ALERF values are such that they place the change in Region I or II, it may be possible to make a case that the application should be treated as ifit were in Region II or III if, for example, it is shown that there are unquantified benefits that are not reflected in the quantitative risk results. However, care should be taken that there are no unquantified detrimental impacts of the change, such as an increase in operator burden. In addition, if compensatory measures are proposed to counter the impact of the major risk contributors, even though the impact of these measures may not be estimated numerically, then such arguments will be considered in the decision process.
While the analysis of parametric uncen., is fairly mature, and is addressed adequately through the use of mean values, the analysis of the model and completeness uncertainties cannot be handled in such a formal manner. Whether the PRA is full scope or only partial scope, and whether it is only the change in metrics or both the change and baseline values that need to be estimated, it will be incumbent on the licensee to demonstrate that the choice of reasonable alternate hypotheses, adjustment factors, or modeling approximations or methods to those adopted in the PRA model would not significantly change the assessment. This demonstration can take the form of well formulated sensitivity studies, or qualitative arguments. In this context, " reasonable" is interpreted as implying some precedent for the
. alternate, such as use by other analysts, and also that there is a physically reasonable basis for the alternate. It is not the intent that the search for alternates should be exhaustive and arbitrary. For the decisions that involve only assessing the change in metrics, the number of model uncertainty issues to be addressed will be smaller than for the case of the baseline values, when only a ponion of the model is affected. The alternates that would drive the result towards unacceptableness should be identified and sensitivity studies performed or reasons given as to why they are not appropriate for the current application or for the particular plant. In general, the results of the sensitivity studies should confirm that the guidelines are still met even under the alternate assumptions (i.e., change generally remains in the appropriate region). Alternatively, this analysis can be used to identify candidates for compensatory actions or increased monitoring. The licensee should pay particular attention to those assumptions which impact the parts of the model being exercised by the change.
20
When the PRA is not full scope, then it is necessary for the licensee to address the significance of the out-of-scope items. The importance of assessing the contribution of the out-of-scope portions of the PRA to the base case estimates of CDF and LERF is related to the margin between the as-calculated values and the acceptance guidelines. When the contributions from the modeled contributors are close to the guidelines, the argument that the contribution from the missing items is not significant must be convincing, and in some cases may require additional PRA analyses. When the margin is significant, a l
qualitative argument may be sufficient. The contribution of the out-of-scope portions of the model to the change in metric may be addressed by bounding analyses, detailed analyses, or by a demonstration that the change has no impact on the unmodeled contributors to risk. In addition, it should also be demonstrated that changes based on a partial PRA do not disproportionally change the risk associated with those accident sequences that arise from t'ie modes of operation not included in the PRA.
One alternative to an analysis of uncertainty is to design the proposed CLB change such that the major sources of uncertainty will not have an impact on the decision-making process. For example, in the region of the acceptance guidelines where small increases are allowed regardless of the value of the baseline CDF or LERF, the proposed change to the CLB could be designed such that the missing modes of operation or missing initiating events that are missing from the analysis would not be affected by the change. In this case incompleteness ceases to be an issue. Similarly, in such cases, it will not be necessary to address all the model uncertainties, but only those that impact the evaluation of the change.
Ifjust a Level 1 PRA is available, in general only the CDF is calculated and not the LERF. An approach is presented in Reference 9 which allows a subset of the core damage accidents identified in the Level 1 analysis to be allocated to a release category that is equivalent to a LERF. The approach uses simplified event trees that can be quantified by the licensee on the basis of the plant configuration applicable to each accident sequence in the Level 1 analysis. The frequency derived from these event trees can be compared to the LERF acceptance guidelines. The guidance in the approach described in Reference 9 may be used to estimate LERF in only those ases when the plant is not close to the CDF and LERF benchmark values.
2.4.3 Integrated Decision-Making The results of the different elements of the engineering analysis discussed in Sections 2.4.1 and 2.4.2 must be considered in an integrated mant.cr. None of the individual analyxs is sufficient in and ofitself.
In this way, it can be seen that the decisi an will not be driven solely by the numerical results of the PRA.
They are one input into the decisionmaking and help in building up an overall picture of the implications of the proposed change on risk. The PRA has an iv.portant role in putting the change into its proper context as it impacts the plant as a whole. The PRA analysis is used to demonstrate that principle 4 has been satisfied. As the discussion in the previous section indicates, both quantitative and qualitative I
arguments may be brought to bear. Even though the different pieces of evidence used to argue that the principle is satisfied may not be combined in a formal way, they need to be clearly documented.
In Section 2.4.2.2, it was indicated that the application would be given increased NRC management attention when the calculated values of the changes in the risk metrics, and their baseline values when appropriate, approached the guidelines. The issues addressed by management, and that would, therefore, be expected to be addressed in the submittal, will include:
1 The cumulative impact of previous changes and the trend in CDF (the licensee's risk e
management approach);
e The cumulative impact of previous changes and the trend in LERF (the licensee's risk management approach);
l 2,
l l
The impact of the proposed change on operational complexity, burden on the operating staff, and overall safety practices; Plant-specific performance and other factors, including, for example, siting factors, e
inspection findings, performance indicators, and operational events; and Level 3 PRA information, if available; The benefit of the change in relation to its CDF/LERF increase; e
The practicality of accomplishing the change with a smaller CDF/LERF impact; and The practicality of reducing CDF/LERF, in circumstances where there is reason to e
believe that the baseline CDF/LERF are above the guideline values (i.e.,104 and 10-5 per reactor year).
2.5 Element 3: Define Implementation and Monitoring Program Careful consideration should be given to implementation and performance-monitoring strategies. The primary goal for this element is to ensure that no adverse safety degradation occurs because of the changes to the CLB. The staff's principal concern is the possibility that the aggregate impact of changes which affect a large class of SSCs could lead to an unacceptable increase in the number of failures due to unanticipated degradation, including possible increases in common cause mechanisms. Therefore, an implementation and monitoring plan should be developed to ensure that the engineering evaluation conducted to examine the impact of the proposed changes continues to reflect the actual reliability and availability of SSCs that have been evaluated. This will ensure that the conclusions which have been drawn from the evaluation remain valid. Further details of an acceptable process for implementation in specific application areas are discussed in application-specific regulatory guides.
Decisions concerning implementation of changes should be made in light of the uncertainty associated with the resuits of the traditional and probabilistic engineering evaluations. Broad implementation within a limited time period may bejustified when uncertainty is shown to be low (data and models are adequate, engineering evaluations are verified and validated, etc.), whereas a slower, phased approach to implementation (or other modes of partial implementation) would be expected when uncertainty in evaluation findings is higher and where programmatic changes are being made which potentially impact SSCs across a wide spectrum of the plant, such as in IST, ISI and graded QA. In such situations, the potential introduction of common cause effects must be fully considered and included in the submittal.
The staff expects licensees to propose monitoring programs that include a means to adequately track the performance of equipment which when degraded can affect the conclusions of the licensee's engineering evaluation and integrated decision-making that support the change to the CLB. The program should be capable of trending equipment performance after a change has been implemented to demonstrate that performance is consistent with that assumed in the traditional engineering and probabilistic analyses that
. were conducted tojustify the change. This may include monitoring associated with non-safety related SSCs, if the analysis determines those SSCs to be risk significant. The program should be structured such that: (1) SSCs are monitored commensurate with their safety importance, i.e., monitoring for SSCs
- categorized as low safety significant may be less rigorous than that for SSCs of high safety significance; (2) feedback ofinformation and corrective actions are accomplished in a timely manner; (3) degradation in SSC performance is detected and corrected before plant safety can be compromised. The potential impact of observed SSC degradation on similar components in different systems throughout the plant should be considered.
The staff expects that licensees will integrate, or at least coordinate, their monitoring for risk-infonned changes with existing programs for monitoring equipment performance and other operating experience on their site and throughout the industry. In particular, monitoring that is performed as part of the 22
Maintenance Rule implementation can be used in cases where the monitoring performed under the Maintenance Rule is sufficient for the SSCs affected by the risk informed application. If an application requires monitoring of SSCs not included in the Maintenance Rule, or have a greater resolution of monitoring than the Maintenance Rule (component vs. train or plant level monitoring), it may be advantageous for a licensee to adjust the Maintenance Rule monitoring program rather than to develop additional monitoring programs for risk-informed purposes. In these cases, the performance criteria chosen should be shown to be appropriate for the application in question. It should be noted that plant or licensee performance under actual design conditions may not be readily measurable. In cases where actual conditions cannot be monitored or measured, an approach should be implemented by striving to use whatever information most closely approximates actual performance data. For example, a hierarchy for establishing a monitoring program with a performance based-feedback approach may consist of a combination of the following:
1.
Monitoring performance characteristics under actual design bases conditions (e.g., reviewing actual demands on EDGs, reviewing operating experience) 2.
Monitoring performance characteristics under test conditions that are similar to those expected during a design basis event 3.
Monitoring and trending performance characteristics to verify aspects of the underlying analysis, research, or bases for a requirement (e.g., measuring battery voltage and specific gravity, inservice inspection of piping) 4.
Evaluating licensee performance during training scenarios (e.g., emergency planning exercises, operator licensing examinations) 5.
Component quality controls including developing pre-and post-component installation evaluations (e.g., environmental qualification inspections, RPS channel checks, continuity testing of BWR squib valves)
As part of the monitoring program, it is important that provisions for specific cause determination, trending of degradation and failures and corrective actions be included. Such provisions should be applied to SSCs in a way that is commensurate with their importance to safety as determined by the engineering evaluation that supports the CLB change. A determination of cause is needed when performance expectations are not being met or when there is a functional failure of an application-specific SSC which poses a significant condition adverse to quality. The cause determination should identify the cause of the failure or degraded performance to the extent that corrective action can be identified that would preclude the problem or ensure that it is anticipated prior to becoming a safety concern. It should address failure significance, the circumstances surrounding the failure or degraded performance, the characteristics of the failure, and whether the failure is isolated or has generic or common cause implications (as defined in Ref. I1).
Finally, in accordance with Criterion XVI of 10CFR Pan 50, Appendix B, the monitoring program should identify any corrective actions to preclude recurrence of unacceptable failures or degraded performance below expectations. The circumstances surrounding the failure may indicate that the SSC failed because of adverse or harsh operating conditions (e.g., operating a valve dry, over-pressurization of a system) or
[
failure of another component which caused the SSC failure. Therefore, corrective actions should also i
consider SSCs with similar characteristics with regard to operational, design, or maintenance conditions.
l The results of the monitoring need not be reported to the NRC, but should be retained onsite for inspection.
23
2.6 Element 4: Submit Proposed Change Requests for proposed change to the plant's CLB typically take the form of requests for license amendments (including changes to or removal oflicense conditions), technical specification changes, changes to or withdrawals of orders, and ct mges to programs pursuant to 10 CFR 50.54 (e.g., QA program changes under 10 CFR 50.54(a)). Licensees shculd: (i) carefully review the proposed CLB change in order to determine the appropriate form of the change request; (ii) assure that information required by the relevant regulations (s) in support of the request is developed; and (iii) prepare and submit the request in accordance with relevant procedural requirements. For example, license amendments should meet the requirements of 10 CFR 50.90,50.91 and 50.92, as well as the procedural requirements in 10 CFR 50.4. Where the licer ree submits risk information in support of the CLB change request, that information should meet the guidance in Section 3 of this regulatory guide.
Licensees are free to decide whether to submit risk information in support of their CLB change request.
Where the licensee's proposed change to the CLB is consistent with currently-approved staff positions, the staff's determination will be based solely on traditional engineering analysis without recourse to risk information (although the staff may consider any risk information which is submitted by the licensee).
However, where the licensee's proposed change goes beyond currently-approved staff positions, the staff will normally consider both information based upon traditional engineering analysis as well as information based upon risk insights. If the licensee does not submit risk information in support of a CLB change which goes beyond currently-approved staff positions, the staff may request the licensee to submit such information. If the licensee chooses not to provide the risk information, the staff will review the proposed application using traditional engineering analysis and determine whether sufficient information has been provided to support the requested change.
In developing the risk information set forth in this regulatory guide, licensees will likely identify SSCs with high risk significance which are not currently subject to regulatory requirements, or are subject to a level of regulation which is not commensurate with their risk significance. It is expected that licensees will propose CLB changes that will subjec: these SSCs to appropriate level of regulatory oversight, consistent with the risk significance of each SSC. Specific information on the staff's expectations in this regard are set forth in the application-specific regulatory guides.
2.7 Quality Assurance As stated in Section 2.4, the staff expects that the quality of the engineering analyses conducted tojustify proposed CLB changes will be appropriate for the nature of the change. In this regard, it is expected that for traditional engineering analyses (e.g., deterministic engineering calculations) existing provisions for quality assurance (e.g.,10CFR50, Appendix B for safety-related SSCs) will apply and provide the appropriate quality needed. Likewise, when a risk assessment of the plant is used to provide insights into i
the decisionmaking process, the staff expects that the PRA will have been subject to quality control.
To the extent that a licensee elects to use PRA information to enhance or modify activities affecting the j
safety-related functions of SSCs, the following, in conjunction with the other guidance contained in this guide, describe an acceptable way to ensure that the pertinent quality assurance requirements of 10CFR50, Appendix B are met and that the PRA is of sufficient quality to be used for regulatory decisions:
utilize personnel qualified for the analysis a
utilize procedures that ensure control of documentation, including revisions, and provide
=
for independent review, verification or checking of calculations and information used in 24 1
the analyses (an independent peer review or certification program can be used as an important element in this process) provide documentation and maintain records in accordance with the guidelines in Section
=
3 of this guide provide for an independent audit function to verify quality (an independent peer review or certification program can be used for this purpose) utilize procedures that ensure appropriate attention and corrective actions are taken if assumptions, analyses, or information used in previous decision making is changed (e.g.,
licensee voluntary action) or determined to be in error.
Where performance monitoring programs are used in the unplementation of proposed change to the CLB, it is expected that those programs will be implemented utilizing quality provisions commensurate with the safety significance of affected SSCs. An existing PRA or analyses can be utilized to support a proposed CLB change, provided it can be shown that the appropriate quality provisions have been met.
- 3. DOCUMENTATION AND SUBMITTAL 3.1 Introduction To permit the staft's audit to ensure that the analyses conducted were sufficient to conclude that the key principles of risk-informed regulation have been met, documentation of the evaluation process and findings are expected to be maintained. Additionally, information submitted should include a description of the process used by the licensee to ensure quality and some specific information to support the staffs conclusion regarding the acceptability of the requested CLB change.
3.2 Archival Documentation Archival documentation should include a detailed description of engineering analyses conducted and the results obtained, irrespective of whether they were quantitative or qualitative, or whether the analyses made use of traditional engineering methods or probabilistic approaches. This documentation should be maintained by the licensee, as part of the normal quality assurance program, so that it is available for examination. Documentation of the analyses conducted to support changes to a plant's CLB should be maintained as lifetime quality records in accoraance with Regulatory Guide 1.33 (Ref.12).
3.3 Licensee Submittal Documentation To support the staffs conclusion that the proposed CLB change is consistent with the key principles of risk-informed regulation and NRC staff expectations, the following information is expected to be submitted to the NRC:
A description of how the proposed change will impact the CLB (Relevant principle: CLB changes meet regulations.)
A description of the components and systems affected by the change, the types of changes proposed, the reason for the changes, and results and insights from an analysis of available data on equipment performance (Relevant staff expectation: All safety impacts of the proposed CLB change shall be evaluated.)
25
9 i
A reevaluation of the licensing basis accident analysis and the provisions of 10 CFR Parts 20 and 100, if appropriate (Relevant principles: CLB changes meet the regulations; sufficient safety margins are maintained; defense-in-depth philosophy.)
l An evaluation of the impact of the change in licensing bases on the breadth or depth ofdefense-in-depth attributes of the plant (Relevant principle: Defense-in-depth philosophy )
Identification of how and where the proposed change will be documented as part of the plants licensing basis (e.g., FSAR, TS, licensing conditions). This should include proposed changes and/or enhancements to the regulatory controls for high risk-significant SSCs which an not subject to any requirements, or where the requirements are not commensurate with the SSCs risk-significance.
The licensee should also identify:
Those key assumptions in the PRA that impact the application (e.g., licensee voluntary actions),
elements of the monitoring program, and commitments made to support the application SSCs for which requirements should be increased A description of the information to be provided as part of the plant's licensing basis (e.g., FSAR, TS, licensing condition)
As discussed in Section 2.7 of this guide, if a licensee elects to use PRA as an element to enhance or modify its implementation of activities affecting the safety-related functions of SSCs subject to the provisions of Appendix B to 10 CFR Part 50, the pertinent requirements of Appendix B will also apply to the PRA. In this context, therefore, a licensee would be expected to control PRA activity in a manner commensurate with its impact on the facility's design and licensing basis and in accordance with all applicable regulations and its QA program description. An independent peer review can be an important element of ensuring this quality. The licensee's submittal should discuss measures used to ensure adequate quality, such as a report of a peer review (when performed) that addresses the appropriateness of the PRA model for supporting a risk assersment of the CLB change under consideration. The report should address any analysis limitations that are expected to impact the conclusion regarding acceptability of the proposed change. The licensee's resolution of the findings of the peer review, certification, or cross comparison, when performed, should also be submitted. For example, this response could indicate whether the PRA was modified or justification as to why no change was ne:essary to support decisionmaking for the CLB change under consideration. As discussed in Section 2.4.2, the staff's decision on the proposed license amendment will be based on its independentjudgment and review, as appropriate, of the entire application.
In order to have confidence that the risk assessment conducted is adequate to support the proposed change, a summary of the risk assessment methods used should be submitted. Consistent with current practice, information submitted to the NRC for its consideration in making risk-informed, regulatory decisions will be made publicly available, unless such information is deemed proprietary and justified as such. The following information should be submitted and is intended to illustrate that the scope and quality of the engineering analyses conducted to justify the proposed CLB change is appropriate to the nature and scope of the change:
A description of risk assessment methods used; 26
The key modeling assumptions necessary to support the analysis or that impact the application; The event trees and fault trees as necessary to support the analysis of the CLB change; and
=
A list of operator actions modeled in the PRA that impact the application and their error i
probabilities.
Submitted information summarizing the results of the risk assessment should include:
The effects of the change on the dominant sequences (sequences that contribute more than 5 l
percent to the risk) in order to show that the CLB change does not create risk outliers and does not exacerbate existing risk outliers.
An assessment of the change to CDF and LERF, including a description of the significant contributors to the, change.
Information related to assessment of total plant CDF - the extent of the information required will depend on whether the analysis of the change in CDF is in Region 11 or Region III of Figure 3.
The information could include quantitative (e.g., IPE or PRA results for internal initiating events, external event PRA results if available) and qualitative or semi-quantitative information (results of margins analyses, outage configuration studies).
1 Information related to assessment of total plant LERF - the extent of the information required will I
=
depend on whether the analysis of the change in LERF is in Region II or Region Ill of Figure 4.
The information could include quantitative (e.g., IPE or PRA results for internal initiating events, external event PRA results if available) and qualitative or semi-quantitative information (results of margins analyses, outage configuration studies).
Results of analyses that show that the conclusions regarding the impact of the CLB change on plant risk will not vary significantly under a different set of plausible assumptions.
A description of the licensee process to ensure PRA quality and a discussion as to why the PRA is of sufficient quality to support the current apphcation.
i Cumulative Risks As part of evaluation of risk, licensees should understand the effects of the present application in light of past applications. Optimally, the PRA used for the current application should already model the effects of past applications. However, qualitative effects and synergistic effects are sometimes difficult to model.
The tracking of changes in the risk (both quantifiable and non-quantifiable) due to plant changes would provide a mechanism to account for the cumulative and synergistic effects of these plant changes and would help to demonstrate that the proposing licensee has a risk management philosophy where PRA is notjust used to systematically increase risk, but is also used to help reduce risk where appropriate and where it is shown to be cost effective. The tracking of cumulative risk will also help the NRC staffin the monitoring of trends.
t Therefore, as part of the submittal, the licensee should track and submit the impact of all plant changes I
that have been submitted for NRC review and approval. Documentation should include:
27
The calculated change in risk for each application (CDF and LERF) and the plant elements (SSCs, procedures, etc.) affected by each change; Qualitative arguments weie used tojustify the change (if any) and the plant elements affected by these arguments; Compensatory measures or other commitments used to helpjustify the change (if any) and the plant elements affected; and A summary of the results from the monitoring programs (where applicable) and a discussion on how these results have been factored into the PRA or into the current application As an option, the submittal could also list past changes to the plant (but not submitted to the NRC) that reduced the plant risk, especially those changes that are related to the current application. A discussion of whether these changes are already included in the base PRA model should also be included.
3.4 Implementation Plan and Performance Monitoring Documentation As described in Section 2.5, a key principle of risk-informed regulation is that proposed performance implementation and monitoring strategies reflect uncertainties in analysis models and data.
Consequently, the submittal should include a description and rationale for the implementation and performance monitoring strategy for the proposed CLB change.
28
i o
REFERENCES l.
USNRC,"Use of Probabilistic Risk Assessment Methods in Nuclear Activities: Final Policy Statecent," FederalRegister, Vol. 60, p. 42622, August 16,1995.
2.
" Quarterly Oatus Update for the Probabilistic Risk Assessment Implementation Plan," SECY 234, Octobe-14,1997.7 3.
Use of Pro' ab;listic Risk Assessment in Plant-Specific, Risk-Informed Decisionmaking: General Guidance. SRP Chapter 19, December 1997.8 4.
USNRC, " Safety Goals for the Operations of Nuclear Power Plants; Policy Statement," Federal Register, 51 FR 30028, August 4,1986.
5.
USNRC,"An Approach for Plant-Specific, Risk-Informed Decisionmaking: Inservice Testing,"
Draft Regulatory Guide DG-1062, June 1997.s 6.
USNRC,"An Approach for Plant-Specific, Risk-Informed Decisionmaking: Inservice Inspection," Draft Regulatory Guide DG-1063, October 1997.a 7.
USNRC,"An Approach for Plant-Specific, Risk-Informed Decisionmaking: Graded Quality Assurance," Draft Regulatory Guide DG-1064, June 1997.8 8.
USNRC,"An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," Draft Regulatory Guide DG-1065, June 1997.s 9.
W.T. Pratt, et al., "An Approach for Estimating the Frequencies of Various Containment Failure Modes and Bypass Events," Draft NUREG/CR-6595, December 1997.s 10.
Apostolakis, G. and Kaplan, S., " Pitfalls in Risk Calculations", Reliability Engineering, Vol. 2, j
pages 135-145,1981.
11.
A. Mosleh et al.," Procedures for Treating Common Cause Failures in Safety and Reliability Studies," NUREG/CR-4780, Volume 2, January 1989.8 12.
USNRC," Quality Assurance Program Requirements," Regulatory Guide 1.33, Revision 2, February 1978.8 I
l
' Copies are available for insp ction or copying for a fee from the NRC Public Document Room at 2120 L Street NW.,
Washington, DC; the PDR's mailing address is Mail Stop LL-6, Washington, DC 20555; telephone (202)634-3273; fax (202)634-3343.
l Requests for single copies of draft or active regulatory guides or of draft NUREG documents (which may be reproduced) or l
for placement on an automatic distribution list for single copies of future draft guides in specific divisions should be made in writing to the U.S. Nuclear Regulatory Commission, Washington DC 20555-0001, Attention: Printing. Graphics and l
l Distribution Branch, or by fax to (301)415-5272.
1 1
29
__--___m______
9 f
BIBLIOGRAPHY' l.
S. Kaplan and B.J. Garrick, "On the Quantitative Definition of Risk", Risk Analysis, Vol.1, pages 11 - 28, March 1981.
2.
"PRA Procedures Guide", NUREG/CR-2300, USNRC, Washington, D.C., January 1983.
3.
G.A. Apostolakis, " Probability and Risk Assessment: The Subjectivist Viewpoint and Some Suggestions", Nuclear Safety,19(3), pages 305 - 315,1978.
4.
G.W. Parry and P.W. Winter," Characterization and Evaluation of Uncertainty in Probabilistic Risk Analysis", Nuclear Safety,22(1), pages 28 - 42,1981.
5.
" Approaches to Uncertainty Analysis in Probabilistic Risk Assessment", NUREG/CR-4826, Jan.
1988.
6.
Reliability Engineering andSystem Safety, Vol 23, (1988), special issue on the meaning of Probability in Probabilistic Safety Assessment.
7.
" Severe Accident Risks: An Assessment for Five U. S. Nuclear Power Plants", NUREG 1150, U.
S. Nuclear Regulatory Commission, Washington D. C., January 1991.
8.
A Review ofNRC Staff Uses of Probabilistic Risk Assessment", NUREG-1489, March 1994, Appendix C.6.
9.
Proceedings of Workshop 1in Advanced Topics in Risk andReliability Analysis, Model Uncertainty: Its Characteri:ation and Quantification, held in Annapolis, Maryland, October 20-22,1993, University of Maryland Press,1996.
10.
Reliability Engineering andSystem Saf:ty, Vol. 54, nos 2 and 3, November / December l996, Special issue on Treatment of Aleatory and Epistemic Uncertainty.
' The citations in this bibliography provide an oveniew of uncenainty analysis in PRA, and themselves contain extensive references.
30
4
=
APPENDIX A USE OF RISKIMPORTANCE MEASURES TO CATEGORIZE STRUCTURES, SYSTEMS, AND COMPONENTS WITH RESPECT TO SAFETY SIGNIFICANCE Introduction For several of the proposed applications of the risk-informed regulation process, one of the principal actisities is the categorization of structures, systems, and components (SSCs) and human actions according to safety significance. The purpose of this appendix is to discuss one way that this categorization may be performed to be consistent with Principle 4 and the expectations discussed in Section 2.1.
Safety-significance of an SSC can be thought of as being related to the role the SSC plays in preventing the occurrence of the undesired end state. Thus the position adopted in this regulatory guide is that all the SSCs and human actions considered when constructing the PRA model (including those that do not necessanly appear in the final quantified model, either because they have been screened initially, assumed to be inherently reliable or have been truncated from the solution of the model) have the potential to be safety significant, since they play a role in preventing core damage.
In establishing the categorization, it is important to recognize the purpose behind the categorization, which is, generally, to sort the SSCs and human actions into groups such as those for which some relaxation of requirements is proposed, and those for which no such change is proposed. It is the proposed application that is the motivation for the categorization, and it is the potential impact of the application on the particular SSCs and human actions and on the measures of risk which ultimately deternunes which of the SSCs and human actions must be regarded as safety-significant within the context of the application. This impact on overall risk should be evaluated in light of the principles and decision <,iteria identified in this draft guide. Thus, the most appropriate way to address the categorization is through a requantification of the risk measures.
l However, the feasibility of performing such risk quantification has been questioned for those applications for which a method for the evaluation of the impact of the change on SSC unavailability is not available. An j
acceptable alternative to requantification of risk is for the licensee to perform the categorization of the SSCs and human actions in an integrated manner, making use of an analytical technique, based on the use of PRA importance measures, as input. This appendix discusses the technical issues associated with the use of PRA importance measures.
Technical Issues Associated with the Use ofImportance Measures In the implementation of the Maintenance Rule and in industiy guides for the risk-informed applications (for example, the PSA Applications Guide), the Fussell-Vesely Importance, Risk Reduction Worth, and Risk Achievement Worth are the most commonly identified measures in the relative risk ranking of SSCs. However, in the use of these importance measures for risk-informed applications, there are several issues that should be addressed. Most of the issues are relat.d to technical problems which can be resolved by the use of sensitivity studies or by appropriate quantification techniques. These issues are discussed in detail in the sub-section below. In addition, there are two issues, namely a) that risk rankings apply only to individual contributions and not to combinations or sets of contributors, and b) that risk rankings are not necessarily related to the risk changes which result from those contributor changes, that the licensee should be aware of and should make sure that they have been addressed adequately. When perfonned and interpreted correctly, component-level l
importance measures can provide valuable input to the licensee.
i l
l A-1 I
l l
l O
Risk ranking results from a PRA can be affected by many factors, the most important being model assumptions and tehniq= = (e.g., for modeling of human reliability or common cause failures), the data used, or the success criteria chosen The licensee should therefore make sure that the PRA is of sufficient quality.
In addition to the use of a " quality" PRA, the robustness of categorization results should also be demonstrated for conditions and parameters that might not be addressed in the base PRA. Therefore, when importance measures are used to group components or human actions as low safety-significant contributors, the information to be provided to the analysts performing qualitative categorization should include sensitivity studies and/or other evaluations to demonstrate the sensitivity of the importance results to the important PRA modeling techniques, assumptions, and data. Issues that should be considered and addressed are listed below.
. Truncation limit: The licerme should determme that the truncation limit has been set low enough so that the truncated set of nummal cutsets contain all the significant contributors and their logical combinations for the application in question and be low enough to capture at least 95 percent of the CDF. Depending on the PRA level of detail (module level, comycist level, or piece-part level), this may translate into a truncation umit from 1E-12 to 1E-8 per reactor year. In addition, the truncated set of nummal cutsets should be determmed to contain the important application-specific contributors and their logical combination..
Risk metrics: The licensee should ensure that risk in terms of both CDF and LERF is considered in the ranking process.
Completeness of risk model: The licensee should ensure that the PRA model is sufficiently complete to address all important modes of operation for the SSCs being analyzed. Safety significant contributions from internal events, external events, and shutdown and low power initiators should be considered either by using PRA or other engmeermg analyses.
Sensitivity analysis for component data uncertainties: The sensitivity of component categorizatims to uncertamtics in the parameter values should be addressed by the licensee. Licensees should be satisfied that SSC categorization is not affected by data uncertamties.
Sensitivity analysis for common cause failures: CCFs are modeled in PRAs to account for d-aht failures of rMaa%t components within a system. The licensee should detemune that the safety significant categorization has been performed taking into account the combined effect of associated basic PRA events, i
such as failure to start and failure to run, including indirect contributions through associated CCF event probabilities. CCF probabilities can affect PRA results by enhancing or obscuring the importance of 3-...-.=.ts. A u-.; ---.t may be ranked as a high risk contributor mainly because ofits contribution to CCFs, or a wmycret may be ranked as low risk contributor mamly because it has negligible or no contribution to CCFs.
Sensitivity analysis for recovery actions: PRAs typically model recovery actions especially for dominant accident sequences Quantification of recovery actions typically depends on the time available for diagnosis and perfornung the action, training, procedure, and knowledge of operators. There is a certam degree of subjectivity involved in estunating the success probability for the recovery actions. The concerns in this case stem from situations where very high success probabilities are assigned to a sequence, resulting in related components being ranked as low risk contributors. Furthermore, it is not desirable for the categorization of SSCs to be affected by recovery actions that sometunes are only modeled for the dominant scenarios.
j Sensitivity analyses can be used to show how the SSC categorization would change if all recovery actions were removed. The licensee should ensure that the categorization has not been unduly affected by the modeling of recovery actions.
A-2
f*
Multiple component considerations: As discussed previously,importance measures are typically evaluated on an individual SSC or human action basis. One potential concern raised by this is that single-event unportance measures have the potential of dismissing all elements of a system or group despite the system or group having a high importance when taken as a whole. (Conversely, there may be grounds for screening out groups of SSCs, owing to the ummportance of the systans of which they are elements.) There are two potential approaches to addressing the multiple mpt issue. The first is to derme suitable measures of I
system or group importance The second is to choose appropriate criteria for categorization based on component-level importance measures. In both cases, it will be necessary for the licensee to demonstrate that the cumulative impact of the change has been adequately addressed.
While there are no widely accepted defmitions of system or group importance measures, if any are proposed, the licensee should make sure that the measures are capturing the impact of changes to the group in a logical way. As an example of the issues that arise consider the following. For front-line systems, one possibility would be to derme a Fussell-Vesely type measure of system importance as the sum of the frequencies of sequences involving failure of that system, divided by the sum of all sequence frequencies. Such a measure would need to be interpreted carefully if the numerator included contributions from failures of that system due to support systems Similarly, a Bimbaum-like measure could be dermed by quantifying sequences invohing the system, conditional on its failure, and summing up those quantities. This would proside a measure of how often the system is critical. However, again the support systems make the situation more complex. To take a two-division plant as an example, front-line failures can occur as a result of failure of support division A in conjunction with failure of front-line division B. Working with a figure of merit based on " total failure of support system" would miss contributions of this type.
In the absence of appropriately dermed group level importance measures, reliance must be made on a qualitative categorization by the licensee, as part of the integrated decisianmMag process, to make the appropriate determination.
Relationship ofImportance Measures to risk changes: Importance measures do not directly relate to changes in risk. Instead, the risk impact is indirectly reflected in the choice of the value of the measure used to deternune whether an SSC should be classified as being of high and low safety significance. This is a concern whether unportances are evaluated at the c=anaent or at the group level. The PSA Application: Guide suggested values of Fussell-Vesely importance of.05 at the system level, and.005 at the c=,aanant level for example. However, the criteria for categornation into low and high significance should be related to the acceptance criteria for changes in CDF and LERF. This implies that the criteria should be a function of the base case CDF awl LERF rather than being fixed for all plants. Thus the licensee should demonstrate how the choice of criteria are related to, and conform with, the acceptance guidelines described in this document. If e -t --~t level criteria are used, they should be established taking into account that the allowable risk mcrease associated with the change should be based on simultaneous changes to all members of the category.
SSCs not included in the final quantified cutset solution: Importance measures based on the quantified cutsets will not factor in those SSCs that have either been truncated, or were not included in the fault tree models because they were screened on the basis of high reliability. SSCs that have been screened because their credible failure modes would not fail the system function can be argued to be ummportant. The licensee must make sure that these SSCs are considered.
A-3
t t
Standard Review Plan Chapter 19
[h\\++,,,..*,!
STANDARD REVIEW PLAN UNITED STATES NUCLEAR REGULATORY COMMISSION s
OFFICE OF NUCLEAR REACTOR REGULATION Predecisional SRP Chapter 19 Use of Probabilistic Risk Assessment in Plant-Specific, Risk-Informed Decisionmaking:
General Guidance Draft 1/7/98
r i
[% \\
UNITED STATES NUCLEAR REGULATORY COMMISSION
(
)
STANDARD REVIEW PLAN
,,,/
OFFICE OF NUCLEAR REACTOR REGULATION l
l l
19.0 USE OF PROBABILISTIC RISK ASSESSMENT IN PLANT-SPECIFIC, RISK-INFORMED DECISIONMAKING: GENERAL GUIDANCE INTRODUCTION This chapter of the standard review plan (SRP) identifies the roles and responsibilities of organizations in the U.S. Nuclear Regulatory Commission (NRC) that participate in risk-informed reviews of licensees' proposals for changes to the current licensing basis (CLB)' of nuclear power plants. The SRP identifies the types of information that may be used in fulfilling an organization's responsibilities and provides general guidance on how the information from a probabilistic risk assessment (PRA) can be combined with other peninent information in the process of making a regulatory decision.
The guidance in tiiis document is a logical extension of current NRC policy on the use of PRA in regulatory activities which is documented in the Commission's PRA policy statement and implementation plan (Refs.1-3). In developing this SRP chapter, the staff considered the NRC's guidance on the use of PRA in risk-informed regulatory applications as documented in Regulatory Guide (RG) 1.174 (Ref. 4) as well as the relevant industry guidance documented by the Electric Power Research Institute (EPRI) in its "Probabilistic Safety Assessment (PSA) Applications Guide" (Ref. 6).
In addition, this chapter references other SRP chapters that provide additional guidance for reviewing specific applications of PRA in regulated activities.
In the process of risk-informed decisionmaking, the NRC will rely on the approach discussed in this chapter. Above all, the design, construction, and operational practices of each plant are expected to be consistent with its CLB. In addition, the risk evaluations performed to justify regulatory changes are expected to realistically reflect these plant-specific design, construction, and operational practices. The PRA analyses should be as realistic as practicable and, when interpreting the results of those analyses, the staff should account for the impact of the most significant uncertainties. The results of these risk I
For convenience this SRP chapter uses the definition of current licensing basis in 10 CFR 54.3. That is.
" Current Licensing Basis (CLB) is the set of NRC requirements applicable to a specific plant and a licensee's written Commitments for ensuring Compliance with and operation within applicable NRC requirements and the plant-specific design basis (including all modifications and additions to such comitments over the l#fe of the license) that are docteted and in effect. The CLB includes the NRC regulations contained in 10 CFR Parts 2. 19. 20. 21. 26. 30. 40. 50.
- 51. 54. 55. 70, 72. 73, 100 and appendices thereto: orders: license conditions: exemptions: and technical specifications. It also includes the plant specific design-basis information defined in 10 CFR 50.2 as documented in the most recent final safety analysis report (FSAR) as required by 10 CFR 50.71 and the licensee's comitments remaining in effect that were made in docketed licensing correspondence such as licensee responses to NRC bulletins.
l generic letters, and enforcement actions, as well as licensee commitments doctanented in NRC safety evaluations or i
l licensee event reports." The use of this definition is not intended to 1mply any increase in the types of changes that are required to be submitted for NRC approval.
Predecisional 19-I Rev. 0 - January 1998
analyses will then form part of the input to the decisionmaking'pr' s, that evaluates the margin in plant capability (in both performance and redundancy / diversity). specifically,the decisionmaking process will use the results of the risk analyses in a manner that complements traditional engineering approaches, supports the defense-in-depth philosophy, and preserves safety margins. Thus, risk analysis will inform, but will not determine regulatory decisions.
REVIEW RESPONSIBILITIES The technical nature of a licensee's request will determine which technical review branch in the NRC's Office of Nuclear Reactor Regulation (NRR) will serve as the primary review branch and as such, has overall responsibility for leading the technical review, drafting the staff safety evaluation report (SER) or other appropriate regulatory document, and coordinating input from other technical review organizations. In addition, the following organizations will normally play a role in reviewing risk-informed proposals:
The Probabilistic Safety Assessment Branch (SPSB) assists the primary review branch (upon request) by reviewing the PRA information and findings submitted by the licensee. Review support includes assessing the adequacy of the scope, level of detail, and quality of the PRA used by the licensee to support the regulatory change, as well as applying risk-related acceptance guidelines to support decisiotunaking.
The Re: tor Systems Branch (SRXB) assists the primary review branch or SPSB (upon request) by providing support for accident sequence modeling, including treatment of reactivity and thermal-hydraulic phenomena, system response, and the implementation of emergency and abnormal operating procedures.
The Containment and Severe Accident Branch (SCSB) holds the primary responsibility for reviewing containment response and containment integrity information submitted by the licensee in support of a request for regulatory action.
The Emergency Preparedness and Radiation Protection Branch (PERB) holds the primary responsibility for reviewing evaluations of radionuclides contamination or public health effects submitted by a licensee in support of a request for regulatory action.
The Office of Nuclear Regulatory Research (RES) assists the primary review branch (upon request) by providing technical support in areas involving all aspects of PRA, severe accident phenomenology, and engineering studies.
The Office for Analysis and Evaluation of Operational Data (AEOD) assists the primary review branch (upon request) by providing generic and plant-specific data from operating experience regarding system / component availabilities /reliabilities, frequency of initiating events, common cause failure rates, and human error events.
The Regional Offices assist the primary review branch (upon request) by providing information on licensees' operational experience in areas of system performance, operator performance, risk management practices, and management controls.
Predecisional 19-2 Rev. 0 - January 1998
(
l l
l I.
AREAS OF REVIEW The NRC's PRA Implementation Plan as proposed in Ref. 3 (and as updated quarterly, see for example Ref. 5) identifies a wide scope of regulatory activities for which PRA proves valuable. This scope includes activities that require NRC review and approval, as well as other activities that are considered internal to the NRC and affect licensees and applicants in a less direct manner (e.g., generic issue prioritization). This SRP chapter solely concerns licensing amendment requests submitted for NRC review and approval for which PRA can play an effective role in the decisionmaking process. General review guidance for applicable activities is presenten in this SRP chapter. In addition, application-specific SRP chapters are available to provide additional guidance for several activities including the following examples:
changes to allowed outage times (AOTs) and surveillance test intervals (STIs) in plant-specific technical specifications (draft SRP Chapter 16.1) changes in the scope and frequency of tests on pumps and valves in a licensee's inservice test
+
(IST) program (draft SRP Chapter 3.9.7) changes in the scope and frequency of inspections in a licensee's inservice inspection (ISI) program (draft SRP Chapter 3.9.8)
RG 1.174 defines an acceptable approach foruse in analyzing and evaluating proposed CLB changes.
This approach supports the staff's desire to base its decisions on the results of traditional engineering evaluations, supported by insights (derived through the use of PRA methods) on the risk significance of the proposed changes. The decisionmaking process leading to the proposed change is expected to follow an integrated approach (considering traditional engineering and risk information) and may build upon qualitative factors as well as quantitative analyses and information.
As discussed later in this section, the scope of the staff review of a risk-informed application will depend on the specifics of the application. However, this scope should include reviewing the four elements suggested in Section 2 of RG 1.174. The areas of review for each of these elements are summarized as follows:
Element 1 - Define the Proposed Change: The objective of this element is to lay the groundwork for evaluating the safety impacts of the proposed change. Therefore, one area of review would be an evaluation of the proposed change in light of the CLB (i.e., evaluation of the structures, systems, and components (SSCs), as well as the plant procedures and activities that are affected by the proposed change and how these SSCs, procedures or activities relate to the CLB). In addition, an evaluation of the method of analysis and a study of available insights i
I from traditional and probabilistic engineering studies that are relevant to the proposed change would be necessary to determine if the change can be supported.
Element 2 - Conduct Engineering Evaluations: The licensees' decisionmaking process j
should factor in the appropriate traditional and probabilistic engineering insights. Reviewers should evaluate the proposed change to ensure that the defense-in-depth philosophy and sufficient safety margins are maintained, and that the calculated change in plant risk is within the guidelines specified in RG 1.174. Reviewers should also verify that insights from the Predecisional 19-3 Rev. 0 - January 1998
engineering evaluations used to justify a change have been used to improve operational and engineering decisions where appropriate, and not simply to eliminate requirements the licensee sees as undesirable.
Element 3 - Develop Implementation and Monitoring Strategies: Results from implementation and monitoring strategies can provide an early indication of unanticipated degradation of performance of those plant elements affected by the proposed change. These strategies are therefore imponant in applications where uncenainty in evaluation models and/or data used to justify the change can change the conclusions of the analysis. As such, the review scope should include provisions to ensure that the licensee has proposed an implementation ara monitoring process that is adequate to (in pan) account for uncertainties regarding plant performance under the proposed change.
Element 4 - Document Evaluations and Submit Request: Reviewers should ensure that the submittal includes sufficient information to support conclusions regarding the acceptability of the proposed change, and that the archival documentation of the evaluation process and findings is maintained and available for staff audit and review. Reviewers should also ensure that the licensee has requested the appropriate regulatory action (for example, a license amendment, an exemption, or a change to technical specifications). Where appropriate, reviewers should ensure that the submittal has documented any licensee proposed enhancements to regulatory requirements (e.g., high risk significant SSCs not currently subject to regulatory control may be subject to requirements commensurate with their risk significance). Finally, reviewers should ensure that CLB changes are appropriately included in an updated safety analysis repon, as necessary.
Application-Speci& Reviews This chapter of the SRP is intended to provide guidance for reviewing applications in risk-informed regulation where numerical values of risk indices play a relatively large role in the decisionmaking process and where a broad set of scenarios and plant operating modes may be affected. Where it is determined that an application could justify a review that is less than the full scope described in this document, reviewers should choose the relevant and applicable parts of this SRP chapter for guidance.
The necessary sophistication of the review of the PRA, its supporting analyses, and its results depends on the contribution the risk assessment provides to the integrated decisionmakmg. Application-specific SRP chapters (where available) provide additional guidance in this area.
II.
ACCEPTANCE CRITERIA This SRP chapter provides guidance for use in conducting staff reviews of PRA findings and risk insights in support of licensees' requests for changes to the CLB of nuclear power plants (e.g., requests for license amendments and technical specification changes under 10 CFR f $50.90 - 92). RG 1.174 sets forth guidance for licensees to use in implementing acceptable methods for conducting PRA and traditional engineering analyses to support proposed changes to the CLB.
To evaluate licensee-initiated CLB changes which are consistent with currently approved staff positions (e.g., regulatory guides, standard review plans, or branch technical positions), the staff normally uses Fredecisional 19-4 Rev. 0 - January 1998
~~
o f
traditional engineering analyses. Licensees would not be expected to submit risk information in suppo' tr of such proposed changes. By contrast, to evaluate licensee-initiated CLB changes which go beyond current staff positions, the staff may use traditional engineering analyses as well as the risk-informed approach set forth in this SRP chapter. In such instances, licensees may be requested to submit supplemental risk information or traditio:ial engineering information if such information is not already included as part of the original submittals. If risk information on the proposed CLB changes is not provided, the staff will determine if the application can be approved on the basis of the information provided usmg traditional methods and will either approve or reject the application based upon this information. Fc those licensee-initiated CLB changes which a licensee chooses (or is requested by the I
staf0 to support with risk information, this SRP chapter describes the scope and content of tha staff's review by considering engineering issues and applying risk insights.
Licensees submitting risk information to support changes to their CLB (whether on their own initiative or at the request of the staf0 should address each of the principles of risk-informed regulation discussed in RG 1.174. The staff should then determine if the licensees' selected approaches and methods (whether quantitative or qualitative, and traditional or probabilistic), data, and criteria for considering risk are appropriate for the decision to be made.
For each risk-informed application, reviewers should ensure that the proposed changes meet the following principles (Sections of this SRP chapter dealing with review guidance for each principle are identified in brackets):
1.
The proposed change meets the current regulations unless it is explicitly related to a requested exemption or rule change [Section 111.2.1].
2.
The proposed change is consistent with the defense-in-depth philosophy (Section III.2.1].
3.
The proposed change maintains sufficient safety margins [Section 111.2.1].
4.
When proposed changes result in an increase in core damage frequency and/or risk, the increases should be small and consis:ent with the intent of the Commission's Safety Goal Policy I
Statement [ Sections III.2.2 and III.2.3].
l 5.
The impact of the proposed change should be monitored using performance measurement I
strategies [Section III.3].
In demonstrating adherence to the above principles, reviewers should ensure that licensees address the follcwing issues as part of their submittals:
All safety impacts of the proposed change are evaluated in an integrated manner as part of an I
overall risk management approach in which the licensee is using risk analysis to improve operational and engineering decisions broadly by identifying and taking advantage of opportunities for reducing risk, and not just to eliminate requirements the licensee sees as desirable. For those cases where risk increases are proposed, the benefits should be described and should be commensurate with the proposed risk increases. The approach used to identify changes in requirements was used to identify areas where requirements should be increased as well as where they could be reduced (Section III.2.3].
Predecisional 19-5 Rev. 0 - January 1998
The scope and quality of the engineering analyses (including traditional and probabilistic analyses) conducted to justify the proposed CLB change are appropriate for the nature and scope of the change and are based on the as-built and as-operated and maintained plant, including reflecting operating experience at the plant [Section III.2.2].
The plant-specific PRA that is used to support licensee proposals has been subjected to quality controls such as an independent peer review or certification [Section III.2.2].
Appropriate consideration of uncertainty is given in analyses and interpretation of findings, including using a program of monitoring, feedback and corrective action to address significant uncertainties [ Sections III.2.2 and IIL3].
The use of core damage frequency (CDF) and large early release frequency (LERF) as bases for probabilistic risk assessment guidelines is an acceptable approach to addressing Principle 4.
Use of the Commission's Safety Goal QHOs in lieu of LERF is acceptable in principle and licensees may propose their use. However, in practice, implementing such an approach would require an extension to a Level 3 PRA in which case the methods and assumptions used in the Level 3 analysis, and associated uncertainties, would require additional attention [Section III.2.2].
Increases in estimated CDF and LERF resulting from proposed CLB changes are limited to small increments, and the cumulative effect of such changes should be tracked and considered in the decision process [Section III.2.2].
The acceptability of the proposed changes is evaluated in an integrated fashion that ensures that all principles are met [Section III.2.3].
Data, methods, and assessment criteria used to support regulatory decisionmaking are clearly documented and available for public review [Section III.4].
III.
REVIEW GUIDANCE AND PROCEDURES For risk-informed applications, reviewers should ensure that licensees' submittals meet the principles specified in Section II of this SRP chapter, and address the expectations for risk-informed 4
decisionmaking (also specified in Section II). This section provides guidance to assist reviewers in l
making this determination. For consistency, Sections III.I through III.4 present this guidance in terms of the four elements of the approach described in Section 2 of RG 1.174.
III.1 Element 1: Define the Prooosed Change In this element, reviewers should verify that the submittal provides enough information to meet the staff's expectation that all potential safety impacts have been identified and evaluated. In addition, reviewers should be satisfied that, where appropriate, the licensee has identified design and operational aspects of the plant related to the change request that should be enhanced consistent with an improved 1
Predecisional 19-6 Rev. 0 - January 1998 I
1
[
understanding of their safety significance based on the methodology u' sed to support the proposed relaxation in regulation. These enhancements should be appropriately reflected in changes to the plant's CLB (e.g., technical specification, license conditions, and FSAR).
Reviewers must also assess the proposed changes as they relate to the plant's CLB, which documents how the licensee satisfies certain basic regulatory requirements such as diversity, redundancy, defense-1 in-depth, and the General Design Criteria. This assessment should include reviewing the engineering (or other pertinent) analysis and data that identify the safety margins, and plant design and/or activities conducted to preserve those margins. If exemptions from regulations or other forms of relief are needed to implement the licensee's proposed change, reviewers should ensure that the appropriate requests accompany the licensee's submittal.
Reviewers should also verify that the licensee has identified and appropriately used available information reflecting traditional engineering concepts and principles. Among the non-PRA sources of information that should be examined to support the eva!uation of safety significance include the safety insights developed in licensing documents such as the FSAR, as well as the bases for the plant's Technical Specifications, which may include AOTs, limiting conditions for operation (LCOs), and surveillance requirements (SRs).
Where available, plant-specific data and operational information should be factored into the definition of the proposed change. Reviewers should consider the way in which the issues at hand are reflected in operational data. Useful insights from plant-specific operating experience can also be obtained from inspections that follow incidents at the facility, including incident investigation and augmented team inspections conducted by the NRC, incident assessments documented in significant operating event reports prepared by the Institute of Nuclear Power Operations (INPO), licensee followup investigations, and routine inspections by NRC resident inspectors. Inspection results can provide valuable qualitative insights in such areas as human performance, management controls, adequacy of procedures, and root causes of events, which are often difficult to treat with precision in a PRA.
Finally, as part of the initial review of the licensing amendment, reviewers should determine if the submittal adequately characterizes the impact of the proposed change (sp-cifically, if the submittal identifies all SSCs or other plant elements affected by the proposed change) and if the analyses performed and submitted by the licensees have the scope and depth to adequately characterize the impact of the change.
Licensees may submit proposals which include several individual CLB changes that have been evaluated and will be implemented in an integrated fashion. For example, individual changes may be grouped together for convenience (ease of implementation and/or review), or changes may be
. combined as risk tradeoffs (balancing risk increases with risk decreases). Changes grouped in this way should normally be related, for example by affecting the same single system or activity, the same safety function, or the same accident sequence group, or by being of the same type (e.g., changes in AOT).
However, chis does not preclude unrelated changes from being accepted. When combined change requests are submitted, the staff should conduct a detailed assessment of the relationship between the individual changes and how they have been modeled in the risk assessment. In its review, the staff should evaluate the acceptability of the individual changes and the overall impact of the combined changes with respect to the principles and expectations discussed in Sectioz. II of this SRP chapter.
Section III.2.3 discusses the review of combined change requests in more detail.
Predecisional 19-7 Rev. 0 - January 1998
4 III.2 Element 2: Conduct Engineering Evaluations t
In order to make findings regarding the acceptability of a proposed license amendment, the staff should establish its position on the basis of an integrated assessment of traditional engineering evaluations and probabilistic information. Section 2.4 of Reg Guide RG 1.174 describes the specific evaluations that the licensee is expected to perform. The scope and quality of the engineering analyses conducted to justify a proposed change should be appropriate for the nature and scope of that change.- Section 3 of RG 1.174 describes the various types of traditional engineering and probabilistic information which should be included in submittals.
The results of this element should be reviewed to determine if the.ubmittal satisfies the following principles for risk-informed decisionmakmg: the proposed change meets current regulations (unless the change is explicitly related to a requested exemption or rule change); the defense-in-depth philosophy is maintained; sufficient safety margins are maintained; and proposed increases in core damage frequency and/or risk (if any) are sraall and are consistent with the intent of the Commission's Safety Goal Policy Statement.
III.2.1 Evaluntion of@se-in-Deoth Attributes and Safety Margins Reviewers should assess the licensee's engin:ering evaluations to confirm that the principles identified in Section II are not compromised. These evaluations should include not only the traditional design -
basis accidera (DBA) analyses, but also evaluations of the defense-in-depth attributes of the plant, safety margins, and risk assessments performed to obtain risk insights and to quantify the impact of the proposed change.
III.2.1.1 Defense-in-Depth Defense-in-depth is defined as a philosophy which ensures that successive measures are incorporated into the design and operating practices for nuclear plams to compensate for potential failures in protection and safety measures. In risk-informed regulation, the intent is to ensure that the defense-in-depth philosophy is maintained, not to prevent changes in the way defense-in-depth is achieved. The defense-in-depth philosophy has been and continues to be an effective way to account for uncertainties in equipment and human performance. In some cases, risk analysis can help quantify the range of uncertainty; however, there will likely remain areas of large uncertainty or areas not covered by the risk analysis. Where a comprehensive risk analysis can be performed, it can help determine the
. approximate extent of defense-in-depth (e.g., balance among core damage prevention, conta'mment failure, and consequence mitigation) to ensure protection of public health and safety. However, because PRAs do not reflect all aspects of defense-in-depth, appropriate traditional defense-in-depth considerations should also be used to account for uncertainties.
Preservation of Multiple Barriers for Radioactivity Release Defense-in-depth can be evaluated on the basis of considerations involving the barriers that prevent or mitigate radioactivity release. Release of radioactive materials from the reactor to the environment is Predecisional 19-8 Rev. 0 - January 1998 i
prevented by a succession of passive' barriers including the fuel cladding, reactor coolant pressur'e boundary, and containment structure. These barriers, together with an imposed exclusion area and emergency preparedness, are the essential elements for accident consequence mitigation. Given these multiple barriers, safety is ensured through the application of deterministic safety criteria for the performance of each barrier, and through the design and operation of systems to support the functional performance of each barrier.
In maintaining consistency with the defense-in-depth philosophy, the proposed license amendment should not result in any substantial change in the effectiveness of the barriers. Consequently, reviewers should consider the following objectives to ensure that the proposed change maintains appropriate safety within the defense-in-depth philosophy:
The change does not result in a significant increase in the existing challenges to the integrity of the barriers.
The proposal does not significantly change the failure " obability of any individual barrier.
The proposal does not introduce new or additional failure dependencies among barriers that significantly increase the likelihood of failure compared to the existing conditions.
The overall redundancy and diversity among the barriers is sufficient to ensure compatibility with the risk acceptance guidelines.
In demonstrating that the proposal fulfills the objectives listed above, the staff expects that the proposed change will meet the following guidelines:
A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and mitigation of consequences.
The proposal avoids over-reliance on programmatic activities to compensate for weaknesses in plant design.
The proposed change preserves system redundancy, independence, and diversity commensurate with the expected frequency of challenges, consequences of failure of the system, and associated uncertainties.
The proposal preserves defenses against potential common cause failures and assesses the potential introduction of new common cause failure mechanisms.
The proposed change does not degrade the independence of barriers.
l The proposed change preserves defenses against human errors.
The proposal fulfills the intent of the General Design Criteria in 10CFR 50, Appendix A.
Reviewers can assess fulfillment of the above guidelines by using qualitative or traditional engineering arguments or by using PRA results contained in the accident sequences or cutsets.
Predecisional 19-9 Rev. 0 - January 1998
Role of PRA in Review of Defense-in-Depth i
In addition to the usual quantitative risk indices, PRAs provide important qualitative results, namely, j
the contributors to accident sequerces. For PRAs that use the fault tree linking approach these contributors are described by the accident sequence minimal cutsets. Each accident sequence minimal cutset is a combination of passive and active SSC failures and human errors that would cause core damage or a release of radioactivity. The cursets therefore directly show one particular aspect of defense-in-depth, in that they reveal how many failures must occur in order for core damage or radiological release to occur. Thus, the minimal cutsets show the effective redundancy and diversity of the plant design. For analysis approaches that use event trees with boundary conditions, the results take the form of accident sequence descriptions and typically include elements representing unavailabilities of systems (or trains of systems) rather than components. However, in most cases, cutsets providing a component level decomposition of the system (or train) unavailabilities are provided, and an equivalmce to the minimal cutset description can be established if necessary.
In most cases, events appearing in each minimal cutset are targeted by programmatic activities to ensure the reliability of the associated SSC. Specific activities that are important to maintain the reliability of a component include: IST, ISI, periodic surveillance required by Technical Specifications, quality assurance, and maintenance. Therefore, when a review of the minimal cutsets reveals areas where redundancy or diversity are already marginal, it would arguably be inappropriate to reduce the level of activities aimed at ensuring SSC performance. (The exception would arise if the licensee can show that the activities have little or no effect on SSC performance, or if it can be shown that uncertainties in the performance of the elements in this cutset are well understood and quantified. It is also possible that the licensee could propose compensating or alternative activities to provide assurance of SSC performance.) The objective of this review is to avoid completely relaxing the defense-in-depth posture at points at which the plant design has the least overall functional independence, redundancy, and/or diversity. On the other hand, in areas where a plant has substantial redundancy and diversity, i
defense-in-depth arguments used to justify relaxations should be given appropriate weight.
i As part of the defense-in-depth evaluation, reviewers should consider the effects of multiple component failures and common cause failures that could potentially result from the proposed change. For example, if the licensee proposes to reduce the requirements for all events in a cutset, reviewers should I
ensure that the effect of the change is properly modeled and that the change does not have an adverse l
effect on defense-in-depth.
Finally, in assessing the accident sequence cutsets, reviewers should devote attention to potential over-reliance on programmatic activities or operator actions that compensate for weaknesses in the plant design. For example, proposed maintenance and surveillance activities should complement and not replace proper plant design.
111. 2.1.2 Safety Margins l
In the determination of the design performance characteristics of a system, safety margin represents an allowance for uncertainty in SSC performance. Current safety analysis practices incorporate consideration of margin in most areas. As examples, many engineering standards, licensing analyses, and technical specifications take margin into account.
I Predecisional 19-10 Rev. 0 - January 1998
8 Incorporating margin can result in over-designing of component', incorporation of extra systems or s
system trains, or in conservative operating requirements for systems and components. Therefore, some licensee applications will seek to reduce this margin in some areas. Such reductions should appropriately reflect the current understanding of existing uncertainties and the potential impact of the proposed change. Therefore, in evaluating a proposed change request, reviewers should establish that the proposal fulfills the following guidelines:
The proposal meets established engineering codes and standards or NRC-approved alternatives, or deviations are justified.
The proposal meets the safety analysis acceptance criteria in the CLB, or proposed revisions provide sufficient margin to account for uncertainty in the analysis and data.
Clearly, these guidelines are closely related to the guidance provided in Section 111.2.1.3 regarding the need to maintain the CLB. The thrust of the guidance in the present section is to sensitize reviewers to the implications of relaxing the margin when evaluating the acceptability of changes to the CLB.
The level ofjustification required for changes in margin should depend on how much uncertainty is associated with the performance parameter in question, the availability of alternatives to compensate for adverse performance, and the consequences of functional failure of the affected elements. Therefore, the results derived from risk evaluations and the associated analysis of uncertainties (especially in the analysis areas and models affected by the application) will provide useful information to help in the reviewers' decisionmaking. As an example, in evaluating available safety margins, reviewers should consider the risk profile of the plant. If a proposed CLB change creates or exacerbates a situation where risk is dominated by a few elements (SSCs or human actions) or a few accident sequences, the reviewers should carefully evaluate the modeling of these elements or sequences including the modeling of uncertainties. Reviewers should consider the results from the analysis of uncertainty when determining of the acceptability of the reduction in margin from the proposed change.
In demonstrating available safety margins, licensees will, in some cases support their proposal by citing new data from plant tests or research projects, or will conduct analyses using models that are predicated on new data. The following examples illustrate situations in which data and analyses can be used effectively to support the CLB change request:
It is shown that a phenomenon of concern cannot occur or is less likely to occur than originally thought.
It is shown that the amount of safety margin in the design is significantly greater than that which was assumed when the requirement or position was imposed.
It is shown that time available for operator actions is greater than originally assumed.
(
l The reviewers' primary objective is to verify the relevance and acceptability of the new information 1
with respect to the requested CLB change. Data that directly apply to the original technical concern should be considered in the decision process. Depending on the circumstances, the cognizan: review branch may have additional specific guidance available for use in reviewing the quality and 1
acceptability of the data. However, the data or analyses must be clearly applicable to the plant and Fredecisional 19-11 Rev. 0 - January 1998
l s
i specific circumstances in which they are being applied.
l 111. 2. 1.3 Current Regulations Reviewers should ensure that the proposed change satisfies current regulations (including the General Design Criteria), unless the licensee explicitly includes a proposed exemption or rule change (i.e., a q
50.12 " specific exemption" or a 2.802 " petition for rulemaking").
The CLB also applies until the staff accepts modifications to the existing basis. It is expected that many applications will seek to modify the CLB in risk-informed submittals. Applications that seek to make qualitative changes to the CLB (such as moving components out of the scope of a required program) should be reviewed in greater detail with respect to defense-in-depth and safety margins when l
compared to applications that seek to make parametric changes (such as incremental changes to i
surveillance interval).
l 111.2.2 Rid Assessment For effective implementation of risk-informed regulatory approaches, reviewers should ensure that the licensee has demonstrated that the plant's CLB and actual operating conditions and practices are p
properly reflected in the risk insights derived using the plant-specific PRA model. Otherwise, the risk assessment may provide inaccurate or misleading information that will require careful scrutiny before use in any regulatory decisionmaking process.
l l
Development of a plant-specific, risk-informed program also requires the availability of information to identify the SSCs and human actions that contribute most significantly to the plant's estimated risk. In addition, it is necessary to be able to capture the impact of the proposed change on the elements of the PRA.Section III.2.2.1 of this SRP chapter discusses the characterization of the proposed change in terms of PRA model elements. The results of this determination of the cause-effect relationships between the proposed application and the PRA models will inelp define the scope and level of detail required for the PRA to support the application. Sections III.2.2.2 and III.2.2.3 discuss these topics.
Many applications, such as those involving changes in component test intervals, allow explicit PRA modeling of the impact of the proposed change and quantification of the expected change in risk using plausible models of the impact on SSC unavailability to the extent that the affected components are included in the plant's PRA. For other risk-informed applications, however, it may not be feasible to explicitly model the cause-and-effect relationship because the resulting actual impact on component unavailability is not clearly understood. For such applications, the use of risk categorization techniques provides a useful way to identify groups of SSCs that are less risk important to risk and, as such, are possible candidates for a graded approach to regulatory requirements. Using such a categorization approach, however, it is still necessary to understand the potential or bounding impact of the proposed change, and to assess the risk impact through bounding evaluations. In either the detailed quantification approach or the risk categorization approach, risk results should be derived from analyses of appropriate quality.Section III.2.2.4 and Appendix A to this SRP chapter present guidelines to help reviewers evaluate PRA quality. Finally, Appendix C o this SRP chapter discusses review issues related to the determination of risk contribution and component categorization.
Predecisional 19-12 Rev. 0 - January 1998
4 111.2.2. 1 Characterization of Change in Terms of PRA Model Elements.
Where quantitative PRA resuits are used as part of a risk 4nformed evaluation of a proposed change, the licensee should define the change in terms that are compatible with the risk analysis, i.e., the risk analysis should be able to effectively evaluate the effects of the change.
1 The approach to risk characterization should establish a cause-effect relationship to identify portions of j
the PRA affected by the issue being evaluated. This includes (i) identifying the specific PRA contributors for the particular application, (ii) assessing the portions of the model that should be modified for the application, and (iii) identifying supplemental analyses that could be used to support the application. This approach will help reviewers determine the scope and level of detail of analysis l
required for the remaining steps in the change process.
Table III-1 of this SRP chapter summarizes the general guidance for use in identifying elements of the j
PRA model that may be affected by an application. This guidance, presented as a list of questions, will assist reviewers in establishing a cause-effect relationship between the application and the PRA model.
The answers to these questions should be used to identify the extent to which the proposed change l
affects the design, operation, and maintenance of plant SSCs.
)
Reviewers should also verify that the effects of the proposed changes on plant elements (SSCs, operator actions, etc.) are adequately characterized in the elements of the PRA model, or by appropriate changes to the logic model structure. For full-scale applications of the PRA, for example, this should be reflected in a quantification of the impact on the PRA results. For applications like component categorization, however, sensitivity studies on the effects of the change may be sufficient. Similarly, for other applications, it may be adequate to define the qualitative relationship of the impact on the PRA elements, or it may simply be necessary to identify of which elements are impacted.
The review procedure for this element is therefore intended to verify that the submittal appropriately accounts for the effects of the changes on SSC reliability and unavailability, or on operator actions.
Where applicable, reviewers should also evaluate the modeling and quantification of the effects of the l
change ensure that the models are appropriate and that the results can be supported by plant and/or industry data.
l 111.2.2.2 Scope of Analysis The necessary scope of a PRA supporting risk-informed requests will depend on the spec.fic application. Although the assessment of risk implications (in light of the acceptance guidelines defined in RG 1.174) requires that all plant operating modes and initiating events be addressed, it is not necessary in risk-informed regulation that licensees submit PRAs that treat all plant operating modes and all initiating events. Instead, when full-scope PRAs are not available, reviewers should ensure that the submitted findings supportable on the basis of traditional engineering analyses or other plant operational information addressing modes and initiators not analyzed in the base PRA.
For plant modes and initiators not analyzed in the PRA (such as shutdown, seismic events, fire, floods and severe weather), the licensee should consider the effects of the change and provide the rationale for Predecisional 19-13 Rev. 0 - January 1998
why additional PRA analyses are not necessary. This rationale could be addressed by assessing the level of redundancy and diversity provided by the plant systems, system trains, human actions, etc. for responding to these unanalyzed initiating events. The licensee should also show that the proposed change does not introduce unanalyzed vulnerabilities and that redundancy and diversity will still exist in the plant response capability after the changes are implemented. This issue is addressed acceptably if the proposal fulfills any one of the following criteria:
The licensee addresses all modes and all initiator types using PRA.
The licensee demonstrates that the application does not unacceptably degrade plant capability and does not introduce risk vulnerabilities or remove elements of the plant response capability from programmatic activities aimed at ensuring satisfactory safety performance for plant modes and initiator types not included in the PRA.
If the proposed change impacts unanalyzed plant modes or initiator types, the licensee
+
demonstrates that a bounding analysis of the change in plant risk from the application (e.g., by qualitative arguments, or by use of sensitivity studies) meets guidelines that are equivalent to the acceptance guidelines specified in Section 2.4.2.1 of RG 1.174.
111. 2. 2. 3 Level of Detail The level of detail in a PRA required to support an application should be such that the proposed changes to the plant can be adequately characterized in the PRA model elements, as discussed in Section III.2.2.1 of this SRP chapter. In addition, the PRA should be detailed enough to account for important system and operator dependencies (functional, operational, and procedural) especially for those components affected by the application. A review of the licensee's failure modes and effects analysis and a review of plant operating and emergency procedures will be useful for this purpose.
The usefulness of PRA results in risk-informed regulation is dependent on the level of resolution of the modeled SSCs. A component-level resolution provides insights at the component level. However, if a PRA is performed at a system or train level, the insights of the PRA will be limited to that level unless it can be demonstrated that component-level insights can be bounded by system-or train-level effects.
The direct application of PRA results will therefore be limited to those SSCs that are explicitly modeled as part of the PRA basic events. Insights for SSCs that are implicitly modeled (i.e., screened out, assumed not important, etc.) shall only be used after additional consideration of the effects of the proposed change on PRA assumptions, screening analyses, and boundary conditions.
Specifically, the following relationships exist between the level of detail in the modeling of each SSC and the conclusions that can be drawn from the PRA:
If the SSCs are modeled at the basic event level, i.e., each SSC is represented by a basic event (or sometimes, more than one if different failure modes are modeled), risk insights from the PRA can be applied directly to the modeled component as long as the effects of the change are appropriately considered.
If the SSCs are included within the boundaries of other components (e.g., the governor and Predecisional 19-14 Rev. 0 - January 1998 I
1 I
throttle valves being included in the pump boundary), or if they are included in " black boxes" or modules within the PRA model, or if they are modeled as part of the calculation of human error probabilities (HEPs) in recovery actions, risk insights from the PRA can be applied if the effects of the application can be mapped onto the events (e.g., modules, HEPs, etc.) in question. In these cases it should be noted that the mapping is relatively simple if the event is "ORed" with the other module or HEP events. However, if the logic involves "AND gates,"
the mapping is more complicated.
If the SSCs are omitted from the model because of inherent reliability, or if they are not modeled at all, risk insights for these components should be obtained through an integrated decisionmaking process (such as an Expert Panel) that revisits the assumptions or screening criteria used to support the initial omission.
111.2.2.4 Quality of a PRA for Use in Risk-Informed Regulation The baseline risk profile is used to model the plant's licensing basis and operating practices that are important to safe operation. As such, the profile may provide insights into areas in which existing requirements can be relaxed without unacceptable safety consequences. It is therefore essential that the PRA adequately represent the risk profile. To complement this requirement, it is necessary to identify those elements of the plant that are responsible for reducing the risk to acceptable levels, and to adequately address those elements in the licensee's programmatic activities. Therefore; the following criteria should be satisfied in risk-informed regulation.
A reasonable assurance exists with regard to the adequacy of the PRA. That is, the PRA model properly reflects the actual design, construction, operating practices, and operating experience of the plant and its owner. This should include plant changes due to the licensee's voluntary actions, regulatory requirements, or previous changes made to the CLB.
t The results and conclusions are " robust" and, where appropriate, the licensee has conducted an analysis of uncertainties and sensitivities to show this robustness.
Key performance elements are appropriately classified, and performance is backed up by licensee actions. PRA results are dependent on plant activities. They reflect not only inherent device characteristics, but also numerous programmatic activities, such as IST, ISI, quality assurance, maintenance, etc. Use of a PRA tojustify relaxation of a requirement should therefore imply a commitment to the important programmatic activities that are needed to maintain performance at the PRA-credited levels that served as the basis for the proposed relaxation.
l Review of PRA Quality I
The submittal must demonstrate the quality of the licensee's technical analysis. Sections 2.4.2.1 and 2.7 i
of RG 1.174 provide specific guidance related to this area and serve as the basis for the staff's review I
to determine whether the PRA is of sufficient quality to support the decisionmaking process. The required PRA quality should be commensurate with the application for which it is applied and the role the PRA results play in the integrated decisionmaking process. The more emphasis that is placed on Predecisional 19-15 Rev. 0 - January 1998
the risk insights and PRA results in the decisionmaking process, the more requirements have to be i
placed on the PRA in terms of how well the licensee assesses the risk and/or the change in risk.
Emphasis on the PRA review may be reduced if a proposed change to the CLB decreases the risk or is l
risk neutral, or if proposed risk increases are calculated to be very small, or if the decision could be based largely on traditional engineering arguments, or if the licensee propve compensating measures and/or qualitative factors (such as unquantified benefits) such that it can be conviag!y ergued that the change improves safety or the risk increase is very small.
In assessing PRA quality, reviewers should evaluate the licensee's process to ensure quality. In addition, reviewers should reach specific findings regarding the quality of the PRA for each application. At a minimum, reviewers should reach these findings on the basis of a " focused-scope" evaluation that concentrates on application specific attributes of the PRA and on the assumptions and elements of the PRA model that drive the results and conclusions. Appendix A to this SRP chapter provides more detailed guidance regarding several issues that are important to the application-specific reviews of probabilistic evaluations performed as pan of risk-infonned regulation.
The robustness of the results can be determined by developing an understanding of the contributors and the sources of uncertainty that impact the results. For the proposed risk change, reviewers should irlentify the elements that increase risk and those that decrease risk, and then identify the contributors to both the risk increase and decrease. A review of the basic events, assumptions, and uncertainties involved in the increase and decrease in risk will help reviewers understand the elements that are important in determining the risk change; and thus ensure that the conclusions are robust with respect to the results obtained.
In addition to the focused-scope review, reviewers should consider the following factors in determining the need for a more detailed and larger scope staff review of the PRA:
The PRA results play a relatively significant role in the decisionmaking process, coupled with the finding that the proposed change in risk and/or the baseline risk is close to the decision guidelines as defined in Section 2.4.2 of RG 1.174.
Staff audits of the licensee's process for conducting a PR A have identified practices that could detrimentally affect the quality of the technical analysis.
Results of the licensee's analysis submitted in support of a licensing action are in some way counter-intuitive or inconsistent with results for similar plants on similar issues.
The licenree's analysis is part of a pilot application of PRA in a regulatory activity.
The PRA includes new methods that are unfamiliar to the staff.
When a staff review of the base PRA is necessary, reviewers should begin by evaluating the results and conclusions from available independent peer reviews of the PRA, including those from industry certification or cross-comparison processes. The staff review should also take into account the process used in the peer review (including the review guidelines or standards to which the PRA is compared, l
the review scope and elements, the qualification and makeup of the review team, etc.). Results from previous staff reviewe of the PRA (e.g., from previous applications) could also provide a good starting Predecisional 19-16 Rev. 0 - January 1998 i
l
)
I point. In cases where the' PRA is based on the individual plant examination (IPE) or the IPE of externally initiated events (IPEEE) models, reviewers should also be familiar with the request for additional information (RAl) issued by the staff in connection with those examinations, as well as the licensee's responses to those RAls, and the staff evaluation reports regarding the licensee's IPE and IPEEE submittals.
Reviewers could reach a finding that previous industry or staff reviews are sufficient to show that the PRA is of adequate quality in one or more of the review areas for the present application. In such cases, the scope of the review should be adjusted accordingly. However, reviewers should be aware of potential applicatica-specific differences, and of the currency of the previous review findings with respect to the current plant design and operating procedures.
l l
Quality Assurance Requirements Related to the PRA l
To the extent that a licensee elects to use PRA as an element to enhance or modify its implementation of activities affecting the safety-related functions of SSCs, appropriate quality requirements will also apply to the PRA. In this context, therefore, a licensee would be expected to control PRA activity in a manner commensurate with its impact on the facility's design and licensing basis. Section 2.7 of RG 1.174 describes the quality elements that apply to the licensee's PRA activities. Reviewers should
{
l verify that the quality of analyses and performance programs which affect safety-related equipment and activities will meet the quality guidelines described in RG 1.174.
1 III.2.2.5 Evaluation of Risk Impact l
In evaluating the risk impact from an application, reviewers should consider the proposed change in l
risk with regard to the acceptance guidelines, the cumulative and synergistic effects of the application I
on the overall plant risk profile, and the licensee's risk management philosophy. Each of these items is discussed in the following sub-sections.
I Acceptance Guidelines for Risk Impact from the Application
)
l For many risk-informed applications, the licensee is expected to perform a quantitative estimate of the total impact of a proposed action to demonstrate that Principle 4 (see Section II) has been satisfied.
Section 2.4.2 of RG 1.174 discusses the a ceptance guidelines for changes to the plant's risk. To summarize, regions are established in the two planes generated by a measure of the baseline risk metrics (CDF and LERF) along the x-axis, and the change in those metrics (ACDF and ALERF) along the y-axis (Figures 111-1 and III-2), and acceptance guidelines are established for each region as discussed below. These guidelines are intended for comparison with a full-scope assessment (including internal events, external events, and events that take place under full power, low power and shutdown conditions). However, reviewers should recognize that many PRAs are not full-scope assessments and the use of less than full-scope PRA information may be acceptable as discussed later.
l There are two acceptance guidelines, one for CDF and one for LERF, and both should be used. The guidelines for CDF are as follows:
If the application can clearly be shown to decrease CDF, the change is considered to satisfy the Predecisional 19-17 Rev. 0 - January 1998 l
]
I relevant principle of risk-informed regulation with respect to CDF. (Because Figure III-1 is drawn on a log scale, it does not explicitly indicate this regior)
When the calculated increase in CDF is very small (less than 2 x 104 per reactor year), the change should be considered regardless of whether there is an assessment of totl CDF l
(Region III). While there is no requirement for the licensee to quantitatively assess the total I
CDF, information should be provided to show that there is no indication that the total CDF could considerably exceed 1 x 10d per reactor year. Such an indication could result, for example if the contribution to CDF calculated from a limited-scope analysis (such as that from the IPE or the IPEEE) significantly exceeds 1 x 10d per reactor year, if the licensee has identified a potential vulnerability from a margins-type analysis, or if plant operating experience has indicated a potential safety concern.
When the calculated increase in CDF is in the range of 1 x 104 to 1 x 105 per reactor year, applications should be considered only if the licensee can reasonably show that the total CDF is less than 1 x 104 per reactor year (Region II).
Applications which increase CDF by more than 1 x 10-5 per reactor year (Region I) should not normally be considered.
The CDF-related guidelines listed above are to be applied together with the guidelines for LERF. That is, both sets of guidelines should be satisfied. Specifically, the guidelines for LERF are as follows:
If the application can clearly be shown to decrease LERF, the change is considered to satisfy the relevant principle of risk-informed regulation with respect to LERF. (Because Figure III-2 is drawn on a log scale, it does not explicitly indicate this region.)
When the calculated increase in LERF is very small (less than 1 x 104 per reactor year), the change should be considered regardless of whether there is an assessment of total LERF (Region III). While there is no requirement for the licensee to quantitatively assess the total LERF, information should be provided to show that there is no indication that the total LERF could considerably exceed 1 x 10-5 per reactor year. Such an indication could result, for example, if the contribution to LERF calculated from a limited scope analysis (such as that from the IPE or the IPEEE) significantly exceeds 1 x 105 per reactor year, if the licensee has identified a potential vulnerability from a margins-type analysis, or if plant operating experience has indicated a potential safety concern.
3 When the calculated increase in LERF is in the range of 1 x 10 to 1 x 104 per reactor year, applications should be considered only if the licensee can reasonably show that the total LEPS l
is less than 1 x 10-5 per reactor year (Region II).
Applications which increase LERF by more than 1 x 104 per reactor year (Region I) should not normally be considered.
These guidelines are intended to provide assurance that proposed increases in CDF and LERF are small and are consistent with the intent of the Commission's Safety Goal Policy Statement.
l l
Predecisional 19-18 Rev. 0 - January 1998
[
l
\\
The guidelines discussed above are applicable for full-power, low-power, and shutdown operations.
However, during certain shutdown operations when the containment function is not maintained, the LERF guidelines as defined above are not practical. In such cases, the licensee may use more stringent baseline CDF guidelines (e.g.,104per reactor year) to maintain an equivalent risk profile or may propose an alternative guideline to LERF that meets the intent of Principle 4.
l As indicated by the shading in Figures 111-1 and III-2, the change request should be subjected to technical and management reviews which become more intensive as the calculated results approach the region boundaries. The technical review related to the risk evaluation should address the scope, quality, and robustness of the analysis, including consideration of uncertainties. The scope, level of detail, and quality of analysis is further discussed in Sections 111.2.2.2,111.2.2.3, and 111.2.2.4 of this SRP chapter. The robustness of the results can be determined by developing an understanding of the l
contributors, the sources of uncertainty that impact the results, and their impact on whether the J
acceptance guidelines are met.
{
The necessary sophistication of thi3 evaluation depends on both the role the risk assessment plays in the decision and the magnitude of the potential risk impact. For those actions justified primarily by traditional engineering considerations and for which minimal risk impact is anticipated, a bounding estimate may be sufficient. For actions justified primarily by PRA considerations for which a substantial impact is possible or is to be offset with compensatory measures, an in-depth and comprehensive PRA analysis is generally needed.
1 Comparison of Results with Acceptance Guidelines In the context of integrated decisionmaking, the acceptance guidelines should not be interpreted as being overly prescriptive. They are intended to provide an indication, in numerical terms, of what is considered acceptable. As such, the numerical values associated with defining the regions in Figures III-1 and III-2 are approximate values used to indicate the changes that are generally acceptable.
g Furthermore, the state of knowledge (or epistemic) uncertainties associated with PRA calculations 1
preclude a definitive decision (based purely on the numerical results) with respect to which region a given application belongs. The intent in making the comparison of the PRA results with the acceptance j
guidelines is to demonstrate with reasonable assurance that the proposal fulfidis Principle 4 (discussed in i
Section II). The assessment of whether this has been demonstrated must be made on the basis of an understanding of the contributors to the PRA results, and on the impacts of the uncertainties (both those j
that are explicitly accounted for in the results and those that are not). This is a somewhat subjective process; therefore, in order to complete the assessment, reviewers must carefully document the reasoning behind the decisions.
. As discussed in RG 1.174, PRA values can be affected by particular modeling assumptions that are a response to the uncertainty regarding how to correctly model the plant response following an initiating event. Thus, it is important that uncertainties in the PRA results be taken into account in assessing the risk impact and in the risk-informed decisionmaking process to demonstrate the robustness of the results. The scope of the required uncertainty analysis is a function of the role that the quantification results play in the decision, and on the significance of the calculated change.
The general approach to accounting for uncertainty is discussed in Section 2.4.2 of RG 1.174. In that discussion, uncertainties are categorized as parameter, model, and completeness uncertainties. In Predecisional 19-19 Rev. 0 - January 1998
assessing analysis of uncertainties, reviewers should consider the types and sources of uncertainties identified by the licensee, and how those uncertainties have been addressed with reference to the decision guidelines. Specifically, review guidance is as follows.
Parameter uncertainty: Reviewers should determine whether the licensee has accounted for parameter uncertainties in an appropriate manner so that the estimated values for ACDF, ALERF, CDF, and LERF can be regarded as equivalent to mean values. However, this does not imply that a detailed propagation of uncertainties is always necessary; in many cases, it is possible to show that a point estimate is an acceptable approximation of the mean value using qualitative arguments about the risk contributors. For example, if a formal propagation has not been performed, it is necessary for the licensee to demonstrate that the result is not affected by the so-called state of knowledge correlation (specifically, that there are no significant contributing cutsets or scenarios that involve multiple events for which the probabilities are determined using the same parameter, particularly if the parameter value is very uncenain).
It is not uncommon for licensees to use point estimate values without defining probability distributions on the values. In such instances, it is not possible to characterize the point estimate as a mean value. However, for the more significant parameters, some characterization of uncenainty is essential to demonstrate that the point estimate is not an optimistic value.
I Model uncertainty: Reviewers should determine if the results are strongly impacted by the specific models or assumptions adopted for the assessment of important elements of the PRA, and whether the sensitivity analyses that have been performed (if any) are sufficient to address the most significant uncertainties with respect to these elements.
In some cases, particularly for small changes in risk or for relatively minor changes, there may be relatively few issues related to model uncertainties. In other cases, where the baseline risk values are to be estimated, the modeling issues should include all those that have a significant impact on the evaluation of the baseline risk values. Model uncertainties arise when there are several alternative approaches to the analysis of certain elements of the PRA model. They are typically addressed by adopting a specific model or making a specific assumption. In such cases, the licensee should document why the panicular model or assumption used is appropriate both for the base case risk evaluation and for the analysis of the impact of the change. In certain cases, it may be necessary to perform sensitivity analyses using alternative reasonable models or assumptions to demonstrate the robustness of the conclusions. In deciding what are reasonable alternatives, reviewers should consider whether the alternatives have some precedent and whether they have a reasonable engineering basis.
Reviewers should pay panicular attention when the characterization of a model uncenainty is such that the results fall into a bimodal or multi-modal distribution, and one or more of the modes exceeds the acceptance guidelines. The results should then be reviewed on the basis of an evaluation of the significance of the hypotheses associated with those modes that exceed the guidelines.
Completeness uncertainty: Reviewers should determine whether the licensee has adequately addressed the limitations in the PRA scope, and other completeness issues either by limiting the scope of the application, or by demonstrating that the impact of the unanalyzed portion of the l
Fredecisional 19-20 Rev. 0 - January 1998 l
l
risk on bottithe base case risk and on the change in risk is bounded or cian be neglected.
Section 111.2.2.2 of this SRP chapter discusses this further.
Cumulative and Synergistic Effects from all Applications In evaluating the licensee's submittal, reviewers should consider the effects of the proposed CLB changes in light of past CLB changes implemented by the licensee. Optimally, the PRA used for the current application should already model the effects of past applications. However, qualitative and synergistic effects are sometimes difficult to model in the PRA. Therefore, a review of changes in risk (both quantifiable and non-quantifiable) from previously submitted CLB changes would provide a means to account for the cumulative and synergistic effects of these plant changes.
For all previous changes, reviewers should consider the following factors:
the calculated change in risk for each application (CDF and LERF) and the plant elements (SSCs, procedures, etc.) affected by each change qualitative arguments used to justify the change (if any) and the plant elements affected by those arguments compensatory measures or other commitments used to help justify the change (if any) and the plant elements affected a summary of the results from the monitoring programs (where applicable) and a discussion on how these results have been factored into the PRA or into the current application the plant risk profile to ensure that the accumulation of changes has not created dominant risk contributors If the licensee's submittal includes past changes made to the plant (but not submitted to the NRC) that reduced the plant risk, especially changes related to the current application, reviewers should consider such changes in the integrated decisionmaking process. Benefits from the implementation of the Maintenance Rule can also be credited for the applicable SSCs.
f To facilitate future applications, reviewers should summarize the results from the current application using the first three bullets listed above. This summary should be kept in a database maintained by SPSB and available to all staff reviewers, project managers, and regional inspectors. To ensure uniform recordkeeping, the format provided in Table III-2 should be used for this purpose.
Beyond cumulative effects, synergistic effects are also possible, and some of these might not emerge l
from a quantification of the PRA. For example, if conventional importance ranking approaches are employed to determine the importance of SSCs, it would be possible that multiple requirements could be relaxed on certain " low" significant components under multiple applications. If the QA (potentially affecting the failure rate) and the test interval (potentially affecting fault exposure time) were to be relaxed for the same component, the component unavailability could increase more than expected (since failure rate and fault exposure time combine multiplicatively in the calculation of unavailability). If the effects of QA on failure rate could be quantified convincingly, this would be addressed explicitly, but Fredecisional 19-21 Rev. 0 - January 1998 l
l l
this cannot presently be ensured. 'As a result, potential exists that different applications might' lead to unintended and unquantified synergistic effects on the unavailability of a given component.
Synergisuc effects on a given element can be addressed by showing that the basic event model adequately reflects the effects of programmatic activities, and that the calculated unavailability, propagated through the PRA, is consistent with the needed performance with regard to the risk indices i
and the defense-in-depth concept. However, it is more straightforward simply not to allow for the relaxation of multiple programmatic requirements on a given component, unless demonstrable justification is provided that the risk contribution from the component is negligible for conditions covered by the set of requirements. For example, if IST is relaxed on a given component, it would be preferable not to relax QA as well, unless good arguments are given for allowing both.
Risk Manage:wnt One of the goals of the review should be to ensure that in the course of the licensee's engineering evaluations, principles of risk management are appropriately applied in the process of evaluating changes to current regulatory requirements. For the purposes of this SRP chapter, " risk management" refers to an approach to decisionmaking about safety that seeks to allocate available resources and worker dose in such a way as to minimize the risk to public health and safety from plant operations.
The staff should recognize that there is a point of diminishing returns in risk reduction and that some residual risk will be associated with plant operation. Nonetheless, reviewers should expect that licensees will make an effort to identify reasonable and cost-effective measures to control this residual risk as part of the risk-informed regulatory process.
Therefore, as a staff expectation, the process of risk management in risk-informed decisionmaking should not be biased toward eliminating requirements to the exclusion of enhancements that would convey a worthwhile safety benefit. Licensees are expected to apply risk insights in an unbiased way, and licensees who do not satisfy subsidiary safety objectives (as defined in RG 1.174) are expected to seek safety enhancements in conjunction with risk-informed applications.
Therefore, when risk increases are proposed, reviewers should consider plant performance and past changes to the licensing basis to ensure that there is no pattern for a systematic increase in risk.
Insights on the licensee's operational practices, management controls, risk management programs, plant configuration control programs, or performance monitoring programs from previous applications can be obtained from the NRC project managers, the NRC regional offices, or documentation of NRC inspection activities.
111.2.3 Intecrated Decisionmakin_e Process The acceptability of the proposed changes should be reviewed and determined in an integrated fashion.
Staff reviewers should verify that the licensee has used the results of the traditional engineering analyses and the risk assessment to ensure that the submittal fulfills the principles listed in Section II of this SRP chapter. Since the roles played by the traditional analyses and the risk analyses in the decisionmaking process determine the scope, quality, and robustness required of those analyses, examination of the appropriate inputs and assumptions in the analyses may be necessary for reviewers to conclude with reasonable assurance that the proposal fulfills the stated principles.
l Predecisional 19-22 Rev. 0 - January 1998 l
When appropriate, the integrated decisionmakirig process should include implementation and monitoring strategies that are used to provide confidence in the results of the underlying engineering analyses. In addition, licensees can take compensatory measures which reduce risk to offset incompleteness or uncertainties in the analysis. Compensatory measures can also be used to offset a quantifiable increase in risk with non-quantifiable but expected improvements in safety.
To ensure that the important assumptions used in the engineering analysis to justify the CLB change remain valid, the integrated decisionmaking precess should ensure that the licensee maintains an appropriate set of programmatic activities (e.g., IST, QA, ISI, maintenance, monitoring) for important elements of the plant response capability. In addition, performance of compensating SSCs should be ensured (through programmatic activities) when these SSCs are used to help justify the relaxation of requirements for other SSCs.
The process used by licensees to integrate traditional and probabilistic engineering evaluations for risk-informed decisionmaking is expected to be well-defined, systematic, and scrutable. Appendix B to this SRP chapter presents review guidance and staff expectations for the licensee integrated decisionmaking process.
In evaluating the acceptability of a proposed change, reviewers should also addrcss the following factors:
j l
the cumulative impact of previous changes and the trend in CDF and LERF (the licensee's risk l
=
management approach) the impact of the proposed change on operational complexity, burden on the operating staff, and overall safety practices l
l plant-specific performance and other factors, including for example, siting factors, inspection findings, performance indicators, operational events, and Level 3 PRA information if available 1
the benefit of the change in relation to its CDF/LERF increase, and whether it is practical to l
a accomplish the change with a smaller CDF/LERF impact l
l practical actions that could reduce CDF/LERF when there is reason to believe that the baseline l
=
CDF/LERF are above the guideline values (i.e.,10d and 10'5 per reactor year)
Review of Combined Change Requests In assessing combined change requests, reviewers should evaluate the acceptability of each of the individual changes with respect to the defense-in-depth and safety margin guidelines discussed in Section III.2.1 of this SRP chapter. In addition, reviewers should evaluate the overall risk impact of the combined changes using the guidelines discussed in Section 111.2.2 of this SRP chapter.
1 In evaluating 'he overall (i.e., combined) risk impact, reviewers should take into account the relationship bet veen the individual changes. For example, in combined change requests for which l
individual changes that increase risk are compensated for by other changes that decrease risk, reviewers should evaluate and understand the major contributors to both the risk increase and risk Predecisional 19-23 Rev. 0 - January 1998 l
decrease, including the analysis assumptions and uncertainties fom each contributor that might affect the decision process. Combining risk impacts from the individual contributors is prudent when the contributors are closely related in terms of analysis assumptions and uncertainty. Contributors could I
also be related if they impact on the same plant functions, for example. Conversely, for contributors that are not closely related, risk impacts from each change should be evaluated on an individual basis.
Finally, combined changes should not trade many small risk decreases for a large risk increase (i.e.,
create a new significant contributor to risk). It is expected that implementation of combined change requests will improve, or at least maintain, the overall plant risk profile. A desirable risk profile is one in which no contributors are overly dominant. Therefore, proposed changes should not create or exacerbate a risk imbalance either in terms of dominant plant elements (SSCs or operator actions) or accident sequences.
III.3 Element 3: Develop Implementation and Monitoring Strategies Implementation and monitoring strategies are important in most risk-informed processes since they can provide an early indication of unanticipated degradation of SSCs or other plant performance factors under the proposed changes. In addition, these strategies may be needed to ensure that the plant will effectively maintain the performance of SSCs that are relied upon to justify the proposed change to the CLB. Section 2.5 of RG 1.174 provides guidance for the suggested process related to this issue.
The primary goal of the monitoring program should be to ensure that no adverse degradation occurs because of the changes to the CLB. These programs should therefore address the possibility that the aggregate impact of changes which affect a large class of SSCs could lead to an unacceptable increase in the number of failures attributable to unanticipated degradation, including possible increases in common cause failure mechanisms.
Reviewers should evaluate the implementation and monitoring strategies on the basis of findings obtained from the traditional engineering and probabilistic evaluations. When broad implementation is proposed over a short period of time, reviewers should verify that this is consistent with the traditional engineering evaluations, defense-in-depth considerations (including common cause failure), and risk evaluation models and assumptions. When there is a need to gain additional performance insights given a change in requirements, reviewers should verify that the licensee has proposed a phased approach to implementation. If this phased approach invdves plan implementation for different SSC groups at different times, reviewers should also assess the basis for the licensee's grouping criteria, keeping in mind the potential common cauce failures.
Monitoring should be applied to SSCs in a manner commensurate with their imponance to safety as determined by the engineering evaluation that supports the CLB change. This monitoring should be contingent on the reliability / availability allocated to SSCs in the risk model (or on performance of operators, where appropriate) used to support the proposed change in regulation. As such, reviewers should ensure that the chosen performance criteria are consistent with the level of performance allocated in the risk analysis.
When monitoring that is already being performed as part of the Maintenance Rule implementation or as part of other plant programs is also proposed for the current application, reviewers should ensure that Predecisional 19 24 Rev. 0 - January 1998
the monitoring ~ proposed is sufficient for the SSCs affected by the risk-infoimed application, and the performance criteria chosen are appropriate for the application in question.
As part of the evaluation of the licensee's monitoring program, reviewers should assess the proposed provisions for cause determination, trending of degradation and failures, and corrective actions. The program should be structured such that feedback of information and corrective actions is accomplished in a timely manner, and degradation in SSC performance is detected and corrected before plant safety can be compromised. In cases where monitoring detects degradation, there should be provisions for a trending and corrective action program, or for the SSCs to be refurbished, replaced, or tested / inspected more often (or : combination of these initiatives). The preferred initiative should be selected on the basis of determination regarding the cause of the degradation (whether it is generic, age-related, etc.).
Reviewers should evaluate if the information gathered during monitoring activities is extensive enough to provide a timely indication of component degradation. Since many components are inherently quite reliable, the limited tests on a limited number of similar components may not provide adequate data, especially for newer plants where aging effects may not be detected until the proposed program is fully in place (and the advantages of a phased implementation are lost). One approach to ameliorate this concern would be to include performance data for similar SSCs at other plants with a range of operating times to expand the applicable database over a range of component ages. Such a program would be expected to improve the better chance of early detection of SSC reliability degradation.
Reviewers should evaluate the impact on plant risk and SSC functionality, reliability, and availability given the licensee's proposed implementation and monitoring plan. The benefits from the implementation and monitoring programs should be balanced against any negative impact on risk.
Finally, reviewers should consider the criteria to be applied in deciding what actions are to be taken in cases where performance falls below that predicted by the supporting evaluations. Corrective action procedures should be in place before implementation of the proposed program.
III.4 Element 4: Conduct Staff Evaluation of Submittal In order for the staff to reach a conclusion regarding the acceptability of the proposed CLB change on j
the basis of the review guidance presented in earlier sections, the licensee must submit or make available sufficient engineering and licensing information. In addition, the licensee should request appropriate regulatory action. Requests for proposed changes to the plant's CLB typically take the form of requests for license amendments (including changes to or temoval of license conditions),
tecimical specification changes, changes to or withdrawal of orders, and changes to programs pursuant to 10 CFR 50.54 (e.g., QA program changes under 10 CFR 50.54(a)). Reviewers should determine if (i) the form of the change request is appropriate for the proposed CLB change, (ii) the licensee submitted the information required by the relevant regulation (s) in support of the request, and (iii) the request is in accordance with relevant procedural requirements. For example, license amendments should meet the requirements of 10 CFR 50.90,50.91, and 50.92, as well as the procedural requirements in 10 CFR 50.4. Where the licensee submits risk information in support of the CLB change request, that information should meet the guidance in Section 3 of RG 1.174.
r Licensees have a choice of whether to submit resuhs or insights from risk analyses in support of their CLB change request. Where the licensee's proposed change to the CLB is consistent with the currently Predecisional 19-25 Rev. 0 - January 1998
{,
approved staff positions, reviewers should reach their determination solely on the basis of traditional engineering analysis without recourse to risk information. (Reviewers may, however, consider any risk information submitted by the licensee.) Where the licensee's proposed change goes beyond currently l
approved staff positions, reviewers should consider both information derived through traditional l
engineering analysis as well as information derived from risk insights. If the licensee does not submit risk information in support of a CLB change which goes beyond currently approved staff positions, reviewers may request that the licensee provide this information. If the licensee chooses not to provide the risk information, reviewers will evaluate the proposed application using traditional engineering analysis and determine whether the licensee has provided sufficient information to support the requested change.
In risk-informed change proposals, licensees are expected to identify SSCs with high risk significance which are not currently subject to regulatory requirements, or are subject to a level of regulation which is not commensurate with their risk significance, or voluntary actions that are key to decisionmaking.
In addition, licensees are expected to propose CLB changes that will subject such SSCs or voluntary actions to the appropriate level of attention, consistent with their significance. Application-specific regulatory guides set forth specific information on the staff's expectations on this issue. Reviewers should ensure that this application-specific guidance is followed. If there is no guidance, reviewers should determine whether any commitments for enhanced requirements / controls are appropriate for such SSCs or voluntary actions, and ensure that those commitments are reflected in the licensing basis.
Update of the Safety Analysis Report Reviewers should enm that the proposed changes, when approved by the staff, will be appropriately included in future spdates to the licensee safety analysis report. In addition, the licensee should identify important assumptions (including SSC functional capabilities and performance attributes) which play a key role in supporting the acceptability of the CLB change. Since the continued satisfaction of these assumptions is necessary to maintain the validity of the safety evaluation, reviewers should verify that such assumptions are reflected by licensee commitments which are incorporated into the safety analysis report. Reviewers should also verify that the licensee has submir.ed revised FSAR pages, as necessary. This revision should include all the programmatic activities, performance monitoring aspects, and SSC functional performance and availability attributes which form the basis of the request.
This material should also identify those SSCs for which performance should be verified (including nonsafety-related SSCs for which performance and reliability provide part of the basis for the CLB change).
Considerations Related to the National Environmental Policy Act In accordance with 10 CFR Part 51, the staff's review process should address environmental protection regulations, such as those from the National Environmental Policy Act (NEPA). Reviewers should use NRR Office Letter 906, Revision 1, and 10 CFR 51.25 to determine how the NEPA requirements are to be addressed. If it is determined necessary, an environmental assessment (EA) should be prepared to assess whether an environmental impact statement (EIS) is required, or whether the staff can reach a finding of no significant impact (FONSI). It is expected that, if all of the guidance and acceptance criteria provided in RG 1.174 are satisfied, the staff should normally be able to reach such a finding for the proposed CLB change.
Predecisional 19-26 Rev. 0 - January 1998
Table III-1 (page 1 of 3)
Questions to Assist in Establishing the Cause-Effect Relationship2 LEVEL 1 (IhTERNAL EVENTS PRA)
Initiating Events Does the apphcation imroduce new initiating events?
Does the application address changes that lead to a modifmation of the initiating event groups?
Does the application necessitate reassessment of the frequencies of the initiating event groups?
Does the application increase the likelihood of a system failure that was bounded by an inicating event group to the extent that it needs to be exphcidy considered?
Success Criteria Does the application necessitate modification of the success entena?
Does the modification of success enteria necessitate changes in other enteria, such as system interdependencies?
Event Trees Does the application address an issue that can be associated with a panicular branch, or branches on the event trees, and if so, is the branchmg structure adequate?
Does the applicanon necessitate the introduction of new branches or top events to represent concerns not addressed in the event tree's?
Does the applicanon necessitate consideration of reordering brancL points (i.e.. does the apphcation affect the sequence <!cpendent failure analysis)?
System Reliability Models Does the application impact system design in such a way as to alter system reliability models?
Does the apphcation impact the support functions of the system in such a way as to alter the dependencies in the model?
Does the application impact the system performance and, if so, is that impact obscured by conservative modeling techniques?
Parameter Database Can the application be clearly associated with one or more of the basic event defmitions, or does it necessitate new basic events?
Does the application necessitate a specialized probability model (e.g., time dependent model, etc.)?
Does the application necessitate modifications to specific parameter values?
Does the application introduce new component failure modes?
Does the application affect the component mission times?
Does the application necessitate that the plant-specific (historical) data be taken into account, and can this be easily achieved by an update of the previous parameters?
Does the applicanon involve a change which may impact parameter values, and do the present estimates reflect the current status of the plant wuh respect to what is to be changed?
l Dependent Failure Analysis l
l Does the application introduce or suggest new common cause failure contributions?
Does the apphcation introduce new asymmetries that might cr arc subgroups within the CCF component groups?
Is the application likely to affect CCF probabihties?
2 Information from Section 3.3 of the EPRI "PSA Applications Guide" provided substantial input to this table.
Predecisional 19-27 Rev. 0 - January 1998 l
l
{
a s
l Table III-1 (page 2 of 3) l' Questions to Assist in Establishing the Cause-Effect Relationship l
Human Reliability Analysis Does the application involve a procedure change?
Does the application involve a new human action?
Does the apphcation change the available time for human actions?
Does the application affect the human action dependency analysis?
Does the application climinate or modify an existing human action?
Does the application introduce or modify dependencies between plant instrumentanon and human accons?
Is the application concerned with events that have been screened from the model, either in whole or in part?
Does the application impact a particular performance shapmg factor (PSF), or a group of PSFs, and are they exphcitly addressed in the estimanon approach (e.g., if the issue is to address trainmg, is training one of the PSFs used in the human rehability analysis)?
Does success in the applicanon hinge on incorporanng the impact of changes in PSFs and, if so, do the current estimates reflect the current status of these PSFs?
Is it possible that t!'e particular group of human error events that is affected by the change being analyzed has been truncated?
Does the change address new recovery actions?
Internal Flooding Does the application affect the screening analysis (e.g., does the application result in the location of redundant trains or components into the same flood zone)?
Does the application introduce new flooding sources or increase existing potential flood inventories?
Does the application affect the status / availability of flood nungation devices?
Does the apphcation affect flood propaganon pathways?
Does the apphcation affect critical flood heights?
Quantification Does the apphcanon change any of the basic event probabilities?
Does the applicanon change relative magnitudes of probabilities?
Does the application only make probabihties smaller?
Is the new resuh needed in a short-ume scale?
Does the applicanon necessitate a change in the truncation limits for the model?
Does the applicanon affect the delete terms" used durmg the quannfication process? (More specifically, does the application introduce new combinations of mamtenance actions or operating modes that are deleted during the base case quannficanon process usmg the delete funcnon?)
Does the application affect equipment credited for operator recovery actions (including credit for inter-system or inter-unit crossties)?
Analysis of Results Does the application necessitate an assessment of uncertainty, and is it to be quahtative or quantitative?
Are there uncertainties in the application that could be clarified by the application of sensitivity studies?
Does the applicanon strategy necessitate an importance analysis to rank contributions?
Does the applicanon necessitate the performance of an importance, uncertainty, or sensiavity analysis of the base case PRA?
Plant Damage State Classification Does the applicanon impact the choice of parameters used to defm' e plant damage states?
Do the key plant damage states (KPDSs) utilized adequately represent the results of the Level 1 analysis by includmg the plant damage states that have a significant frequency of occurrence?
Have those plant damage states that have been eliminated in this process been assigned to KPDSs of higher consequence (e.g.,
likelihood oflarge early releu)?
Predecisional 19-28 Rev. 0 - January 1998
l 1
Table III-1 (page 3 of 3)
Questions to Assist in Establishing the Cause-Effect Relationship Level 2 (CONTAINMENT ANALYSIS PRA)
Have new containment failure modes identified by the application been addressed in the PRA? Are potential changes accounted for?
Are any dependencies among containment failure modes bemg changed?
e Does the application involve mechanisms that could lead to containment bypass?
e Does the application involve mechanisms that could cause failure of contamment isolation?
Does the application direcdy affect the occurrence of any severe accident phenomena?
Does the application necessitate use of risk measures other than large early release?
e Does the application change equipment qualification to the point where it affects tuning of equipment failure relative to containment failure?
Does the applicanon affect core debris path to the sump / suppression pool or to the other portions of the containment?
e Do the selected source term categories adequately represent the revised contamment event tree (CET) endpoints? Are CET e
cndpoint frequencies changed enough to affect the selection of the dominant / representative sequence (s)in the source term binning process?
Does the application affect the tirning of release of radionuclides into the environment relative to the irunation of core melt and relative to the time for vessel rupture?
l l
LEVEL 3 (CONSEQUENCE ANALYSIS PRA)
Does the application necessitate detailed evacuee doses?
e Are individual doses at specific locations needed for this applicanon?
e is evacuation or sheltering being considered as a mitigation measure?
e Are long-term doses a consideranon in this applicanon?
EXTERNAL EVENTS PRA (H5anrd Analysis)
Will the changes introduce external hazards not previously evaluated?
e Will the changes increase the intensity of existing hazards sigmficantly?
e l
e Arc design changes modifying the structural response of the plant being considered?
e Does the change impact the availability and performance of necessary mitigation systems for an external hazard?
Does the application significantly modify the inputs to the plant model conditioned on the external event?
e e
Are changes being requested for systems designed to mitigate against specific external events?
Does the application involve availability and performance of contamment systems under the external hazard?
SHUTDOWN PRA 1
e Will the changes affect the scheduling of outage activities?
i e
Will the changes affect the ability of the operator to respond to shutdown events?
e Will the apphcation affect the reliability of equipment used for shutdown conditions?
Will the changes affect the availability of equipment or instrumentation used for contmgency plans?
e Predecisional 19-29 Rev. 0 - January 1998 I
4
Table III-2 Risk-Informed License Amendment Cumulative Risk Tracking Form Plant Docket Lead Reviewer Branch Phone Mailstop References (amendment application, SER, etc.)
1 Type of Amendment Briefly Describe Amendment Request.
O Tech Specs D Inservice Testing o Inservice Insp a Other (specify)
List plant elements affected by the change.
if a quantitative risk assessment was performed, provide the calculated change in risk (ACDF or ACDI*" and ALERF or ALERI*D).
List qualitative arguments used tojustify change request (if any) and plant elements affected by these arguments.
List compensatory measures or other commitments used to justify change request (if any) and plant elements affected.
On the basis of quantitative arguments, qualitative arguments, and compensatory measures, is application a risk increase, risk neutral, or a risk decrease?
Provide core damage probability (CDP) and large early release probability (LERP) for changes that temporarily affect risk (technical specification changes, for example). Specify the time period that the condition will exist.
Predecisional 19-30 Rev. 0 - January 1998
l t
,,2....
- %.t hamer-g es..a r d u
, n e m...,
4 s in all ( h ures REGION I
- 'i h < a n.
.s i.. p 4. i.
5 10
- %. i s s v. a ll ( k n g-
- st ai r i te s ilsalits w illi i r s pr t 1
,,El t.. i.a sel.n r ( la 1
- 1. a s k ( ' u.a. u l.e les r 4.u p a i t s 104
~
105 10 CDF "*
d
(
Figure III-I Acceptance Guidelines
- for Core Damage Frequency (CDF)
A 7 k re...n a t.s.
- %. < h a n e r - g is..
cd d
, R er i..n il y
p
... a u a h.... = r.
- 1...h n
n....,
l " '" "'" ".' is a h n e e s R F G 10 N I ttns 4
10 2-
$$ ~. < ' tr u' l< w oh k r en '
- i $. I<'Y.I.' i. e i.n p a, e-107 m,.ygg ~, q.cy g yp REGION ^ III i
10-'
105 LERF "*
t l
l Figure III-2 Acceptance Guidelines
- for Large Early Release Frequency (LERF) l
- The analysis will be subject to increased technical review and management attention as indicated by the darkness of the shading of the figure. In the context of the integrated decisionmaking, the boundaries between the regions should not be interpreted as being definitive; the numerical values associated with defining the regions in the figure are to be interpreted as indicative values only.
Predecisional 19-31 Rev. 0 - January 1998 l
l
IV.
EVALUATION FINDINGS The results of the reviewers' evaluation should reflect a consistent and scrutable integration of the W
probabilistic considerations and traditional engineering considerations provided by the licensee or applicant and developed independently by the reviewers. To reach a finding of acceptability, reviewers will generally need to show that in light of a small or non-existent increase in risk and a reduced level q
of conservatism, defense-in-depth and sufficient safety margins are maintained. Findings of acceptability should be supported with logical bases built from an evaluation of the considerations given in Section 111 of this SRP chapter. Reviewers should also confirm that sufficient information is provided in accordance with the requirements of this SRP chapter, and that the evaluation supports the following conclusions, to be included in the staff's safety evaluation repon.
General The proposed change meets the current regulations unless it is explicitly related to a requested e
exemption or rule change.
The proposed change is consistent with the defense-in-depth philosophy.
e The proposed change maintains sufficient safety margins.
e When proposed changes result in an increase in CDF and/or risk, the increases are small and e-consistent with the intent of the Commission's Safety Goal Policy Statement.
The impact of the proposed change is monitored using performance-based strategies.
e All safety impacts of the proposed change are evaluated in an integrated manner as part of an overall risk management approach in which the licensee is using risk analysis to improve operational and engineereig decisions broadly by identifying and taking advantage of opponunities for reducing risk, and not just to eliminate requirements the licensee sees as undesirable. For those cases where risk increases are proposed, the benefits have been described and these benefits are commensurate with the proposed risk increases. The approach used to identify reduced requirements was also used to identify if there are areas where requirements should be increased.
The scope and quality of the engineering analyses (including traditional and probabilistic analyses) conducted to justify the proposed CLB change are appropriate for the nature and scope of the change and are derived on the basis of the as-built, as-operated and as-maintained plant, including operating experience at the plant.
The plant-specific PRA supponing licensee proposals has been subjected to quality controls such as an independent peer review or cenification.
Appropriate consideration of uncenainty has been given to analyses results and interpretation of findings, including the use of a program of monitoring, feedback, and corrective action to I
address significant uncertainties, where applicable.
Fredecisional 19-32 Rev. 0 - January 1998
i CDF and LERF are used as bases for probabilistic risk assessment guidelines for addressing Principle 4. If the Commission's Safety Goal QHOs have been used in lieu of LERF, the l
implementation of such an approach included justification of the methods and assumptions used l
in the analysis and treatment of uncertainties.
Increases in estimated CDF and LERF resulting from proposed CLB changes are limited to small increments, and the cumulative effects of such changes are tracked and considered in the decision process.
The acceptability of the proposed changes has been evaluated in an integrated fashion that ensures that all principles are met.
Data, methods, and assessment criteria used to support regulatory decisionmaking are clearly documented and available for public review.
Definition of the Pronosed Change Adequate traditional engineering and probabilistic evaluations are available to support the proposed CLB change. Plant-specific and relevant ir Lstry data and operational experience also support the proposed change.
Cause-effect relationships have been identified to adequately link the application with the evaluation models, and the proposed models can effectively evaluate or realistically bound the effects of the proposed change.
Information from engineering analyses, operational experience, plant-specific performance history have been factored into the decisionmaking process.
Evaluations of Defense-In-Depth Attributes and Safety Margins Defense-in-depth is preserved (for example, system redundancy, diversity, and independence are maintained commensurate with the expected frequency ard consequence of challenges to the system; defenses against potential common cause failures are maintained and the introduction of new common cause failure mechanisms is assessed; and defenses against human errors are maintained).
Sufficient safety margins are maintained (for example, NRC-approved codes and standards are met or deviations justified; and safety analysis acceptance criteria in the CLB are met, or proposed revisions provide sufficient margin to account for analysis and data uncertainty).
Current regulations have been met, or the proposed exemption is acceptable.
Scone of Risk Analysis The licensee's risk analysis satisfactorily addresses all mode / initiator combinations, or Predecisional 19-33 Rev. 0 - January 1998
l The licensee's risk analysis does not analyze all mode / initiator type combinations. However, in e
each instance, the licensee has demonstrated that o
suitably redundant and diverse plant response capability is maintained for significant initiators in these modes and sufficient elements of the plant response capability are subject to programmatic activities o
to ensure suitable performance Level of Detail of Risk Analysis The PRA is detailed enough to account for important system and operator dependencies.
e Risk insights are consistent with the level of detail modeled in the PRA.
e Ouality of the PRA There is reasonable assurance of PRA adequacy, as shown by the licensee's process to ensure e
quality and by a focused-scope application-specific review by the staff.
Results are robust in terms of uncenainties and sensitivities to the key modeling parameters.
e Key performance elements for the application have been appropriately classified and e
performance is backed up by licensee actions.
Evaluation of Risk Impact If the risk-informed application assesses whether it meets Principle 4 by evaluating the change e
to risk quantitatively, then the following applies:
o The application either decreases plant risk, or if an application increases risk, the increase is within the guidelines defined in RG 1.174. The cumulative and synergistic effects on risk from the present and previous applications have been addressed. Licensee risk management practices are being followed to minimize the risk from plant operations.
In either of the above cases, an appropriate consideration of uncertainties is provided in o
support of the proposed application. The licensee showed that even taking into account the uncertainties in the analysis, the evaluation of the change in risk was robust in that there can be confidence in the conclusions drawn with respect to nature of the change compared with the acceptance guidelines. This argument was supported either by explicit propagation or by a qualitative and/or sensitivity analysis showing that no event contributing to the change in risk is subject to significant uncertainty.
If the risk-informed application is based on a qualitative assessment of the change to risk, the e
application is shown to result in a decrease in plant risk, or is risk neutral, or CDF and LERF increases are shown to be acceptable on the basis of bounding evaluations or sensitivity studies.
Predecisional 19-34 Rev. 0 - January 1998
8 Integrated Decisionmaking Process
~
Results from traditional engineering analyses and risk analyses have been used to ensure that e
the principles for risk-informed decisionmaking have been met.
Potential analysis limitatior.s, uncertainties and conflicts are resolved by use of conservative e
results, or by use of appropriate implementation and monitoring strategies, or by use of appropriate compensatory measures.
The integrated decisionmaking process is well-defined, systematic, repeatable, and scrutable.
e Implementation and Monitoring Strategies The implementation process is commensurate with the uncertainty associated with the results of e
the traditional and probabilistic engineering evaluations.
A monitoring program which could adequately track the performance of equipment covered by e
the proposed licensing changes was established. It was demonstrated that the procedures and evaluation methods will provide reasonable assurance that performance degradation will be detected and that the corrective action plan will ensure that appropriate actions can be taken before SSC functionality and plant safety is compromised. Data from similar plants will be used if needed.
In addition to the tracking of performance of SSCs affected by the application, the performance e
monitoring process also includes tracking the performance of SSCs which support the underlying basis for the decisionmaking.
l Licensee Submittal The submittal includes sufficient information to suppon conclusions regarding the acceptability e
l of the proposed change.
1 The appropriate regulatory action was requested. In addition, peninent information on the e
CLB change will be included in the safety analysis report, technical specifications, or license conditions, as necessary.
The licensee has appropriately committed to the imponant progranunatic and performance l
assumptions in the PRA and engineering analyses which served as the basis of the CLB change.
These include compensatory actions used to justify the CLB change and any new regulatory requirements for high risk significant SSCs not otherwise subject to existing requirements, l
commensurate with their risk significance. These commitments are reflected in revisions to the l
safety analysis repon and/or technical specifications, or the staff has imposed appropriate licensee conditions.
Fredecisional 19-35 Rev. 0 - January 1998
8 V.
IMPLEMENTATION The following is intended to provide guidance to applicants and licensees regarding the NRC staff's plans for using this SRP chapter.
Except in those cases in which the applicant or licensee proposes an acceptable alternative method for demonstrating that a proposed CLB change is acceptable, the method described herein will be used by the staff in its evaluation of risk-informed changes to the CLB.
VI.
REFERENCES 1.
NRC Policy Statement, "Use of Probabilistic Risk Assessment Methods in Nuclear Regulatory Activities," 60 Federal Register (FR) 42622, August 16,1995.
2.
" Framework for Applying Probabilistic Risk Analysis in Reactor Regulation," U.S. Nuclear Regulatory Commission, SECY-95-280, November 27,1995.
3.
" Proposed Agency-Wide Implementation Plan for Probabilistic Risk Assessment,"
U.S. Nuclear Regulatory Commission, SECY-94-219, August 19,1994.
4.
"An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Current Licensing Basis," Regulatory Guide (RG) 1.174 (Draft Guide 1%1), December 1997.
5.
" Quarterly Status Update for the Probabilistic Risk Assessment Implementation Plan,
U.S. Nuclear Regulatory Commission, SECY-97-234, October 14, 1997.
6.
"PSA Applications Guide," Electric Power Research Institute, EPRI-TR-105396, August 1995.
)
l Predecisional 19-36 Rev. 0 - January 1998 l
l l
1 l
APPENDIX A GUIDANCE FOR A FOCUSED-SCOPE APPLICATION-SPECIFIC PRA REVIEW As stated in Section III.2.2.4 of this SRP chapter and in Section 2.4.2 of RG 1.174, PRAs that are used in risk-informed submittals to determine risk significance or risk impact should be shown to be of adequate quality. In risk-informed regulation (RIR), licensee submittals are expected to utilize an integrated process which combines risk insights from a PRA, together with insights from traditional engineering analyses, supported by performance monitoring and feedback. The quality of the PRA required to support this process is commensurate with the roles the risk insights play in the final decisionmaking.
Staff evaluation of a licensee's sk-informed application submittal is expected to include a review of the licensee's process for PRA quality assurance. Where necessary, this should be supplemented by a general review of the event and fault tree models, data on SSC failures and common cause failures, mission success criteria, initiating event analysis, human reliability analysis, and sequence quantification including the analysis of uncertainties. These reviews should be sufficiently detailed to give the staff confidence that the PRA appropriately reflects the plant's CLB and actual operating conditions and practices. Results from previous staff reviews (e.g., from prior applications or from IPE/IPEEE reviews) and from industry reviews (e.g., from independent peer reviews, certification processes, or cross comparisons) should be used, as appropriate.
In addition to the general overall review described above, staff reviewers are expected to perform a focused-scope review of the risk analysis on an application-specific basis. This appendix provides review guidance for the likely elements of a PRA which may affect or be affected by proposed changes to the CLB. Reviewers should choose the relevant parts of this appendix, guided by the application-specific SRP chapters (where available) and by the cause-effect relationship described in Section III.2.2.1 of this SRP chapter.
For additional background on the PRA review, the reader is referred to the bibliography provided in Section A.11 of this appendix.
A.1 Initiating Events a.
Area of Review Whciher or not a PRA includes a particular initiating event depends on the scope of the PRA, the frequency of the given event, the plant systems or other features available to mitigate the event, and the consequences of the event if unmitigated. Proposed plant changes could affect the frequency of initiating events, the probability of mitigating event initiators and, in some cases, event consequences.
In addition, plant changes could potentially introduce new initiating events or increase the importance of events that were previously screened out.
b.
Review Guidance and Procedures For risk-informed applications, reviewers should determine if the licensee followed a systematic Predecisional 19-A1 Rev. 0 - January 1998 l
.___.__.___________.________________U
approach to determine if initiating events and anticipated plant response are affected by the proposed changes. Reviewers should also determine if the licensee's process includes provisions to evaluate whether the proposed changes can (i) increase the frequency of an initiator already included in the PRA; (ii) increase in the frequency of initiators that were initially screened out in the PRA; (iii) introduce new initiating events; or (iv) affect the grouping of initiating events. These considerations are discussed in more detail in the following paragraphs.
Applications that change the frequency of an initiator or the ability of the plant to respond to event initiators are relatively easy to model in the risk analysis if the initiators are already included in the base analysis. In such cases, the licensee should have evaluated the impact of the changes directly from the risk model.
In cases where initiators are not included in the original risk analysis based on screening analyses, the licensee should have determined if initiating events previously screened out because of low frequency might now be above the screening threshold as a result of a proposed application. Plant changes could increase the frequency of initiating events that were relatively infrequent to begin with, or these changes could affect SSCs or operator actions that were credited 'vith the satisfactory mitigation of initiating events. If initiating events increased in frequency as a result of an application to the point where it became important (i.e., could no longer be screened out), reviewers should verify that the licensee has modified the scope of the analysis to reflect this change.
Low frequency of an event, by itself, is not usually sufficient as a criterion for screening purposes:
The consequences of non-mitigation of the events also play a big part in this process. For example, interfacing system loss-of-coolant accidents (ISLOCAs) are often assessed as low-frequency events.
However, because of their impact on public health and safety, these ISLOCAs can be important.
Therefore, for potentially high-consequence events, even if the event frequency is below a screening criterion, the features that lead to the frequency being low (for example, surveillance test practices, startup procedures, etc.) should be takea into account in reviews of PRA applications.
The licensee should also have evaluated proposed plant changes to determine if the changes could result in initiators that are not previously analyzed in the PRA. For example, changes might enhance the potential for spurious operation of components which might, in turn, cause initiating events, or changes might increase the likelihood for operator errors of commission which could result in plant trips. If the licensee identified mechanisms for producing new initiators, reviewers should ensure that the licensee added those initiators to the risk analysis so that their impacts can be analyzed.
In PRAs, initiating events are usually grouped according to the systems required to respond to the transient. This implies that success criteria for plant systems and operator responses are similar for all
. events in a group. In addition, events may be screened out when it can be shown that they are bounded in probability and consequence by other similar events. In evaluating risk-informed applications that affect initiating events, reviewers should ensure that grouping criteria used in the base analysis have not been invalidated by the proposed plant changes or, in the case where this is not true, the licensee has made appropriate changes to the event groupings.
Finally, the reader should note that many PRAs model initiating events as single basic events or " black boxes." In RIR, it is preferred that the licensee model initiating events (especially those that result from the loss of support systems) using a falt tree (or equivalent) approach so that system Fredecisional 19-A2 Rev. 0 - January 1998
dependencies are fully' understood and accounted for. If this is not the case, reviewers should be aware of the combination of SSC failures or other events that could lead to the " failure" of the black box.
This would lead to a better understanding of the risk contributors and is especially important in risk categorization applications.
c.
Evaluation Findings Reviewers should verify that the information provided and review activities conducted support the following conclusions:
The licensee has adequately considered the effects of proposed changes on the frequencies of initiating events analyzed and those previously screened out.
The licensee has demonstrated that the changes do not result in new initiating events or, if new initiators have been identified, these have been added to and analyzed in the risk model.
The licensee has accounted for the proposed changes in the grouping of initiating events.
The decisionmaking process considered the dependencies between the initiating events and the plant's mitigation systems.
A.2 Accident Sequence Analysis mvent Trees) a.
Area of Review Although the evaluation of risk change from most applications will usually not necessitate changes to the event tree stmeture or logic, reviewers should be aware that there will be some changes, particularly those involving changes to plant procedures, which might cause a restructuring of the event sequence logic.
In addition, the application may isolate pan of the PRA that is dependent on specific initiating events.
Thus, these initiating events and their associated event trees would have a proportionately greater impact on the evaluation of the change in risk. In this case, these event trees could be candidates for a higher level of scrutiny. For example, if the changes involved the addition or subtraction of a diesel generator, the review would focus on the station blackout event tree and its associated structure and logic. Similarly, if changes involve modification to procedures to cross-tie electrical buses, the review might focus on the loss of offsite power event trees.
b.
Review Guidance and Procedures Event tree sequence models are used to model the responses of plant systems and operations personnel to initiathig events. When the CLB change request requires the review of event trees, it is important that reviewers become familiar with their structure, and with the assumptions embedded in them. In particular, it is important to identify assumptions or approximations that might impact the application.
Such assumptions and approximations are not always explicitly documented. The guidance provided below discusses approaches that reviewers can adopt to assess the appropriateness of the modeling of 1
Predecisional 19-A3 Rev. 0 - January 1998 l
4
the CLB change in the event trees.
Reviewers should familiarize themselves with the structure of the event trees and the associated assumptions that are used in the construction of the event trees. Specific issues to consider should ialude the conditions created by the initiator and the chronological requirements for systems operation and/or operator responses for the different event tree branches. Reviewers should be satisfied that, if simplifications or assumptions were made in the structure and logic of the event trees, these would remain justifiable in light of the CLB change.
Reviewers should also study the functional and physical dependencies for each phase of the sequence and, at the same time, the interaction between operators and systems as the sequence unfolds. The timing of the events and time dependencies should also be understood. A review of the general structure and philosophy underlying the pertinent plant emergency and abnormal operating procedures will provide valuable insight on the validity of the event tree structure and logic.
Specifically, reviewers should ensure that the following factors are addressed in the evaluation of CLB change:
The event trees reflect changes (if any) to the initiating event groupings.
The models and analyses are consistent with the as-built and as-operated plant, i.e., the functions necessary for safe shutdown are included, relevant systems are credited for each function, and plant emergency operating procedures (EOPs) and abnormal operating procedures (AOPs) are correctly represented. In addition, where the proposed change affects any of these elements, the change is properly modeled.
Changes to the CLB could affect the dependencies (functional, phenomenological, and operational) among the top events in the event trees. Section A.4 of this SRP chapter presents additional detail concerning the review of the dependent failure analysis.
Time-phased evaluation is normally included for sequences with significant time-dependent failure modes (e.g., batteries for station blackout sequences) and significant recoveries (e.g.,
AC recovery for SBO sequences). The impact of the CLB change on event timing that could change the stmeture or logic of the event trees should be understood.
It is expected that the success criteria used in the event trees will not be affected by many of the changes to the CLB. In cases where CLB changes could affect the success criteria for front-line or support systems, reviewers should verify that these criteria (hardware requirements, number of trains required, etc.) remain consistent with the required performance criteria (flow, response time, etc.) related to functional requirements. However, even in cases where the CLB change does not affect the success criteria, reviewers should be aware that the success criteria used in the base PRA analysis could affect the conclusions made in the evaluation of the change in risk from the CLB change. For example, a component in a three-train system might not be risk-significant if mission success was contingent on the successful operation of one out of the three trains, but this component could become more risk-significant if the success criterion was two-out-of-three or three-out-of-three trains. Section A.5 discusses the review of the success criteria used in accident sequence modeling.
Predecisional 19-A4 Rev. 0 - January 1998 1
1
c.
Evaluation Findings Reviewers should verify that information provided and review activities conducted support the following conclusions:
The licensee has adequately considered the effects of proposed changes on the structure and logic of the event trees.
The licensee has addressed the effects of the application on sequence dependent failure analysis, sequence timing, and success criteria.
A.3 System Modeling Analysis Gault Trees)
I a.
Area of Review l
1 Fault trees are used to depict the logical interrelationships of credible plant events (component hardware failures, human errors, or other pertinent events) that can lead to particular failure modes of plant systems in the context of their environment and operation. In RIR, the majority of proposed changes would only be expected to impact the parameters that are used to quantify the event probabilities modeled in the fault trees. In such cases, the change will not affect the fault tree logic i
models themselves. However, in cases where the change in the CLB relates to a system design change, I
or where the licensee is proposing temporary changes that require reconfiguration of the system into ones that are not currently modeled, the revised fault trees should be one focus of the staff's review.
Other considerations of which reviewers should be aware in the area of system analysis are whether the application can impact support functions in such a way as to alter the dependencies in the model, and whether the application can impact system performance to an extent that would require changes to the fault tree logic or modeling assumptions.
b.
Review Guidance and Procedures When the review of one or more of the system logic models becomes necessary, this review should include a study of the appropriate system notebooks from the base PRA to understand the modeling characteristics that may be affected by the change. It should also include an evaluation of the licensee's process for modeling the system change as well as a spot-check of the revised system models and results. Reviewers should verify that, in modeling the CLB change, the licensee appropriately modified the system logic models to reflect changes in the plant's configuration including changes to the system design, system performance characteristics, system alignments, operational procedures, and operational philosophies. In particular, reviewers should address the following considerations:
The analysis of the CLB change should account for the effects of the change on the definition of system success. That is, if the proposed application affects component configurations, l
expected operability conditions, failure modes and their effects, and alternative success and potential failure paths, these should be taken into account. In addition, the licensee should show that the justification used in the original analysis to exclude components, component l
l Predecisional 19-A5 Rev. 0 - January 1998 l
l
(
1 failure modes, or flow diversion paths, etc. remain valid in light of the proposed CLB change.
The analysis should also identify and account for changes that could affect environmental conditions that could cause system failure (e.g., room temperature, containment pressure, etc.).
The analysis should account for interfaces with other systems and dependence on support functions; this is particularly important if dependencies on motive power, control power, component cooling, room cooling, or any interlocks have been altered by an application. Other dependencies that licensees should consider include the dependency on automatic system initiation and the conditions that must exist for automatic start, essential manual actions to initiate or control the system, and the resources required to fulfill mission success (e.g., water sources, air, fuel oil, etc.). When applicable, licensees should factor these dependencies into the analysis of the change.
When proposed CLB changes deal with proceduralized test and maintenance actions or applicable technical specification conditions, the modeling of test and maintenance unavailabilities and the modeling of restoration errors for the affected systems / components should be reviewed. Changes to the frequency of each test or maintenance activity, its approximate duration, the components repositioned for the action, the verification activities post test and maintenance, and the availability of the system during the test procedure should have been factored into the change analysis.
Operational history (i.e., plant-specific operatiom1 experience) should be considered in the review of the system models and especially in the review of how the proposed CLB change will affect system operation. Considerations like recurring check valve problems (e.g., back-leakages), water hammer events, or flow blockages by sludge or debris should also be considered in the analysis.
The potential for common cause failures including those potentially resulting from the change should have been evaluated and modeled where appropriate. Review guidance for the evaluation of common cause failures is provided in Section A.7 of this SRP chapter.
The function of the modeled system should remain consistent with that required in the cver/
tree models. Success criteria and event sequence conditions should be correctly modeled asa consistent with the definition in the event trees.
When fault tree solutions in the form of function cutsets are available, an efficient way to review for the logic in system models is to study the cutsets produced by the solution of the linked fault trees (i.e.,
the fault tree formed by linking the support system fault trees to the system fault tree). In performing
. this visual inspection, reviewers should compare the results with expectations based on their understanding of functional and support system dependencies. The effects of events such as operator i
actions or common cause failures can also be easily verified by an inspection of the function cutsets.
When expected combinations of failures are not present, reviewers should check to see if these failures have been modeled, or if they have been truncated during model solution, or if the fault tree logic is incorrect (e.g., an AND gate in place of an OR gate). In short, a review of cutsets can be one way to focus further reviews on other parts of the system modeling analysis.
1 i
Fredecisional 19-A6 Rev. 0 - January 1998
c.
Evaluation Findings Reviewers should verify that information provided and review activities conducted support the following conclusion:
The evaluation of the CLB change adequately reflects changes in the plant hardware or procedures, including changes to the system design or alignments, system performance characteristics, support system dependencies, and operational procedures or operational philosophies. Where applicable, these changes are appropriately included in the PRA system models.
A.4 Dependent Failure Analysis l
a.
Area of Review 1
Accident progression models and system models should correctly account for dependencies between systems and operator actions needed for accident mitigation. Proposed changes to the CLB could affect these dependencies; therefore, the evaluation of the risk change should also consider system-operator dependencies. However, since the modeling of these dependencies requires detailed knowledge of the plant systems and procedures, it will not be practical (nor is it intended) for reviewers to verify that all dependencies have been included in the CLB change evaluation. Instead, reviewers should verify that the evaluation utilized a comprehensive and systematic process to look for these dependencies.
Reviewers should rely on their experience with CLB change analyses or PRAs of similar plants, but should be aware that dependencies are in many cases plant-specific, and will depend on plant-specific system capabilities and interactions, procedural guidance, and timing of potential accident sequences.
b.
Review Guidance and Procedures l
Review guidance in this section consists of a discussion of the dependencies that could be important and that could be affected by CLB changes. Although most CLB changes will not alter the original PRA dependent failure analysis, some design or procedure changes could introduce new dependencies or affect existing ones. Therefore, reviewers should be cognizant with regard to the following types of dependencies that could exist and could affect the results of the change analysis:
l l
l Functional Dependencies: These dependencies occur because the function of one system or l
component depends on that of another system or component. Functional dependencies include interactions which can occur when the change in the function of a system or component causes a
. physical change in the environment which results in the failure of another system or component.
Functional dependencies include the following examples:
shared component dependencies (e.g., systems or system trains that depend on a common intake or discharge valve) actuation requirement dependencies (e.g., systems that depend on common actuation signals,
=
common actuation circuitry, or common suppon systems like AC or DC power or instrument air for initiation or actuation) and conditions needed for actuation (e.g., low RPV water level).
Predecisional 19-A7 Rev. 0 - January 1998 Il
4 4
isolation requirement dependencies (e.g., conditions that could cause more than one system to isolate, trip, or fail) including environmental conditions (temperature, pressure, and/or humidity), temperature and pressure of fluids being processed, water level status, and radiation levels.
power requirement dependencies (e.g., systems that depend on the same power sources for motive power) cooling requirement dependencies (e.g., systems that depend on the same room cooling subsystem, or the same lube oil cooling subsystem, or systems that depend on the same service water or component cooling water train for cooling) indication requirement dependencies (e.g., systems that depend on the same pressure,
=
temperature, or level instrumentation for operation) phenomenological effect dependencies (e.g., conditions generated during an accident sequence
=
that influence the operability of more than one system), including generation of harsh environments that result in protective trips of systems, loss of pump net positive suction head (NPSH) when containment heat removal is lost, clogging of pump strainers from debris generated during a LOCA, failure of components outside the containment following containment failure attributable to harsh environment inside the containment, closure of safety relief valves in BWRs on high containment pressure, and coolant pipe breaks or equipment failures following (or resulting from) containment failure operational dependencies (e.g., unavailability of the suppression pool cooling mode for a train of the residual heat removal system when the system is in the low pressure coolant injection mode)
Reviewers should look for evidence that the licensee properly considered the above types of dependencies in the evaluation of the CLB change. In most cases, these dependencies should be explicitly included in the fault tree or event tree logic models; however, in some cases, a quahtative evaluation process may be sufficient.
Human Interaction Dependencies: These dependencies could become important contributors to risk if operator error can result in multiple component failures. Past PRAs show that the following plant conditions could lead to human interaction dependencies that can become important:
tests or maintenance that require multiple components to be reconfigure
=
multiple calibrations performed by the same personnel post-accident manual initiation (or backup initiation) of components that require the operator to
=
interact with multiple components Reviewers should verify that the licensee's evaluation of risk from proposed changes to plant procedures or changes to operator training included a process to identify these (or similar) activities, l
Predecisional 19-A8 Rev. 0 - January 1998
and that the licensee evaluated the activities that could be risk contributors.
Component Hardware Failure Dependencies: These dependencies, usually referred to as common cause failures (CCFs), cover the failures of usually identical components which may be caused by design, manufacturing, installation, calibration, or operational deficiencies. CCFs are treated quantitatively by common cause failure probabilities or other dependence quantification approaches.
Section A.7 of this SRP chapter presents review guidance related to CCFs.
Spatial Dependencies: Multiple failures could be caused by events that fail all equipment in a defined space or area. These spatially dependent failures include those caused by internal flooding, fires, seismic events, missiles (e.g., turbine missiles), or any of the other external event initiators. In cases where these events could affect the results of the CLB change evaluation, and where these events are not modeled in the PRA, the dependencies resulting from the unmodeled initiators should be evaluated qualitatively as part of the integrated decisionmaking process. Section 111.2.2 of this SRP chapter discusses the required scope of the PRA in more detail. In addition, the CLB change request should include the licensee's consideration of the common influences on component operation such as adverse environment (including excessive temperature, humidity, radiation), inadequate space, inadvertent or spurious sprinkler operation, or routine equipment travel near major components. Reviewers should verify that the CLB change request has used a systematic process to identify potential spatial challenges that could result in muhiple failures of SSCs.
c.
Evaluation Findings Reviewers should verify that information provided and review activities conducted support the following conclusion:
l l
Dependencies between system and operator interactions have been properly accounted for in l
the evaluation of the CLB change. Where appropriate, these dependencies have been included in the accident progression models (event trees) and the system analysis models (fault trees).
A.5 Determination of Success criteria a.
Area of Review Guidance in the PRA policy statement and in RG 1.174 stipulates that realistic analysis should be used in PRA implementation. The following discussion is intended to sort out what is meant by " realistic" analysis of success criteria by reference to SAR analysis.
In order to fulfill its intended purpose, SAR analysis is ordinarily based on a set of assumptions containing significant embedded conservatism. SAR analysis also reflects a postulated single active failure, in addition to whatever event initiated the sequence. When an SAR analysis shows a successful outcome, there is good reason to believe that (apart from beyond-single-failure scenarios) the system l
will meet or exceed performance requirements for the initiating event considered.
Applying the SAR mission success criterion in a PRA would be conservative, in the sense that the probability of failure to meet this performance standard would be greater than probability of failure to Predecisional 19-A9 Rev. 0 - January 1998 l
l l
l
e e
meet a more realistic performance standard. Howeverl re-analyzing event sequences with conventional SAR tools would be too burdensome to apply to the large number of scenarios that are defined in the course of a PRA. In addition, the rather specialized computer codes used in SAR analysis may not be appropriate in beyond-single-failure scenarios. Traditionally, development of mission success analyses in PRAs has ranged from the use of faster running models that might not have the same level of quality assmance as the conventional SAR tools, to the extrapolation of results from analyses performed on similar plants.
In order to satisfy the Commission's guideline, then, reviewers should find that the licensee has not distorted the PRA insights by using a systematically conservative bias in mission success criteria, and that mission success criteria used to justify changes to the CLB have a sound technical basis.
b, Review Guidance and Procedures When it is determined that the results and conclusions of a risk-informed application are especially sensitive to the choice of mission success criteria, or if the modeling is particularly controversial, reviewers should evaluate the relevant success criteria and the basis for each.
If the basis is analytical, it may be appropriate to evaluate of the code and the input data used. When it is determined that the computer codes used have not received adcquate licensee or other industry review, closer examination of the models should also be considered.
The models, codes, and inputs used to determine mission success criteria should meet QA standards that are consistent with generally accepted methods. Standards shald include configuration control of the analysis inputs and results. The standards do not have to be tic same as the standards applicable to SAR analysis, but they should be explicit (i.e., engineering calculations and codes should be verified and quality assured) and they should be formalized as part of the licensee's QA program.
In cases where the basis for the success criteria is lacking, reviewers should either request additional licensee justification or seek independent analysis. Licensee justification could include the use of alternative plausible models to justify the conclusions (thus addressing the model uncertainty), or the re-design of the CLB change such that the change is not affected by the choice of success criteria.
Some mission success criteria can validly be extrapolated between similar plants when a firm basis for the criteria is created at the first plant and when the licensee shows that plant-specific features do not invalidate the comparison.
On an application-specific basis, reviewers should determine whether the definition of the system success criteria will be affected by the application-specific elements or by the elements in the same minimal cutset or accident scenario as the application-specific element. Reviewers should ensure that the success criteria are not so optimistic that they underestimate the required number of components (i.e., overestimate the size of the minimal cutset).
c.
Evaluation Findings In cases where conclusions are sensitive to the mission success criteria, the staff's safety evaluation report should contain fm' dings equivalent to the following.
i Predecisional 19-A10 Rev. 0 - January 1998 l
t
'A technical basis has been established for the mission succe'ss criteria used in the analysis.
Analytical elements of the technical basis have received an appropriate level of configuration control and quality assurance. Where comparison with analogous criteria from other plants is possible, this comparison has been justified.
A.6 Use of Appropriate Data a.
Area of Review In risk-informed applications, it is important that the licensee use appropriate SSC failure data. While plant-specific data is preferred, for plants with little operating history, the only choice might be the use of generic data. Furthermore, when the impact of the change is being modeled as a modification of parameter values, sufficient plant-specific data may not exist to support the modification. The data-related issues are summarized as follows: a) if the impact of the application is to be modeled as a change in parameter values associated with basic events representing modes of unavailability of certain I
SSCs, these changes should be reasonable and should be supported by technical arguments including plant-specific and generic operational information (when available); and b) the impact of the change should neither be exaggerated nor obscured by the parameter values used for those SSCs unaffected by the change.
(
I b.
Review Guidance and Procedures It is to be expected that, for a PRA that has undergone a technical review, parameter values will have been judged to be appropriate, whether they have been evaluated using generic or plant-specific data.
However, since the review was focused on the PRA as a base case model, a different perspective on i
the appropriateness of parameter values may be required for specific applications. Therefore, in l
evaluating PRA applications, reviewers should focus on those parameter values that have the potential I
to change the conclusions of the analysis. For example, parameters associated with SSCs that appear in the same cutsets or scenarios as the affected SSCs have the potential to distort the conclusions by decreasing the assessed importance of the change if their values are too low, or by increasing it if their values are too high. Similarly, parameters that contribute to the cutsets or scenarios that do not contain affected SSCs can decrease the importance of the change by being too high, or increase it by being too low.
The failure rates and probabilities used, especially those that directly affect the proposed application, should appropriately consider both plant-specific and generic data. The staff expects that these values will be consistent with generally accepted values from PRAs of similar plants, or the licensee should
- justify significant deviations on the basis of plant-specific factors. "Significant" in this context can be defined as no greater than a factor of 3 for the mean values of the failure rate or failure probability.
The focus of the review should be on those parameter values that have a significant impact on the results as discussed above, and that deviate significantly from the generally accepted norm.
If the reviewer decides that a more detailed review of the parameter values is appropriate, the following i
guidance applies. For plant-specific data, reviewers should determine how the licensee used plant records to estimate the number of events or failures, the number of demands, and the operating or standby hours. Reviewers should verify the consistency between the definitions of failure modes and Predecisional 19-A11 Rev. 0 - January 1998 l
l i
l t
component boundaries used in the risk analysis and the corresponding definitions used in the plant records. When reviewing generic data, it is important to verify that the plant component is typical of the generic industry component. In cases where generic failure rates are used in combination with plant-specific data like test intervals, reviewers should verify that the generic data are applicable for the range of plant data used.
When evaluating the impact of the change, it is important for reviewers to recognize the assumptions that have gone into developing the PRA model. For example, two models are commonly used for events representing the unavailability of a standby component on demand; the standby failure rate model and the constant probability of failure on demand model. The constant probability of failure on demand parameter may be estimated on the basis of an assumed number of demands, implying an average test interval. Use of such a model to investigate the impact of extending test intervals can result in large differences between the unavailabilities of components for which the test intervals differ significantly. Reviewers should be sensitive to this effect, and should ascertain that licensees use appropriate models and parameters for such evaluations.
As another example, in considering plant-specific failure data, poorly performing individual components may have been grouped with other components, allowing their poor performance to be averaged over all components of that type. Poor performance may arise because of inherent characteristics of one member of what would otherwise be considered a uniform population, or may arise because components are operating in a more demanding environment. If these components are grouped together with others for which the operating conditions are more favorable, the failure rates used for the poor performers could be artificially lowered. If requirements are relaxed on the basis of the group failure rate, reduced programmatic attention to these poor performers could lead to a greater-than-expected probability of experiencing an inservice failure of one of these components.
Reviewers should be aware of such effects, and should ensure that the components are grouped appropriately.
When the impact of the change is modeled as a change in the parameter values associated with specific basic events representing modes of unavailability of SSCs, reviewers should focus on whether the change in parameter values is appropriate and reasonable. The licensee is expected to document the rationale behind the change in parameter values, and that rationale should be carefully reviewed.
If generic values are used for the base case parameter values which are candidates for change, reviewers should verify that the conditions under which the generic data apply do not correspond to those which would be more appropriate for a plant with the change incorporated. This should only be a real concern if the plant being changed is somewhat atypical with respect to the issue being addressed by the change. This would not be a concern if plant-specific data were used.
Finally, to validate the data used to justify CLB changes in risk-informed applications, it is important for licensees to monitor the performance of components affected by the application. This monitoring should be performed as the proposed application is phased in. For very reliable SSCs, it may be necessary for the licensee to review available operating experience at other plants for applicability to the licensee's plant to expand the operating experience database. Reviewers should ascertain that the monitoring program is capable of demonstrating that the performance of the components or systems is in accordance with what has been assumed.
Predecisional 19-A12 Rev. 0 - January 1998
___J
i
- c. Evaluation Findings
~
Reviewers should verify that information provided and review activities conducted support the following conclusions:
The failure rates and probabilities used, especially those that directly affect the proposed application, appropriately consider both plant-specific and generic data that are consistent with generally accepted values from PRAs of similar plants, and deviations (if any) have been justified on the basis of plant-specific factors.
The licensee has systematically considered the possibility that individual components could be performing more poorly than the average associated with their class, and has avoided relaxation for those components to the point where the unavailability of the poor performers would be appreciably worse than that assumed in the risk analysis.
The changes to the parameter values impacted by the application are both justified and reasonable.
Data used to support changes to the CLB are supported by an appropriate performance monitoring program.
A.7 Modeling of Common Ca= Failures a.
Area of Review Common cause failures (CCFs) represent the failures of components that are caused by common influences such as design, manufacturing, installation, calibration, or operational deficiencies. Since CCFs can fail more than one component at the same time and can occur with greater probability than would be predicted by the product of the individual component failure probabilities, they can -
significantly contribute to plant risk.
l l
Risk-informed applications that cover SSCs as a group have the potential to affect the CCF probabilities of SSCs within the given group. For the affected components, CCF probabilities could be low or might not even be included in the baseline PRA models based on the operational and engineering evidence driven by current requirements. With proposed changes, there should be assurance that the j
CCF contribution will not become more significant. In addition, the assessment of the impact of the change can be affected by the CCF probabilities for other components, and can either be exaggerated
. or obscured depending on the CCF probabilities.
b.
Review Guidance and Procedures Reviewers should verify that the PRA addressed potentially significant CCFs and that, where applicable, the CCF modeling has incorporated the effects of the proposed changes. Staff evaluation should include a review of the process used to select common cause component groups.
Specific review guidelines related to risk-informed applications and the assessment of the change are as Predecisional 19-A13 Rev. 0 - January 1998
follows:
Reviewers should verify that industry and especially plant-specific experience involving the failure of two or more components (especially for the application-specific components) from the same cause was anslyzed and incorporated into the risk model where appropriate.
For relevant applications, reviewers should check that licensees have appropriately modeled the CCF of groups of equipment that were proposed for the change. In cases where the effects of the application on CCF cannot be easily evaluated or quantified, reviewers should establish that performance monitoring is capable of detecting CCF before multiple failures are likely to occur subsequent to an actual system challenge. In addition, to reduce fault exposure times for potential common cause failures, phased or incremental implementation should be considered as part of the effon to protect against CCF.
Reviewers should ensure that the impact of the change is not inappropriately made insignificant by the choice of CCF probabilities for SSCs unaffected by the change. This can occur in two ways. First, the cutsets or scenarios containing : vents which represent failures of SSCs affected by the change may include CCF contributions from other SSCs which are too small.
Second, the contribution of cutsets or scenarios which do not contain affected SSCs may be anificially increased by having CCF contributions that are too large so that the impact of the change is obscured. These cases will impact applications involving risk categorization by lowering the relative contribution (and imponances) of the affected SSCs. An understanding of these effects can be obtained from sensitivity analyses performed by removing the peninent CCFs or by using more realistic vclues for the CCFs.
A common modeling approximation is to include CCF contributions only from that combination of SSCs which fails the function of the system. For example, if system success is defined as success of one out of four components, usually only a sirgle term representing a CCF of all four components is included. If the success criterion were two out of four, the corresponding CCF term would represent failure of any three or all four SSCs in the group.
While probabilistically this usually corresponds to the dominant contributions, care has to be taken when the application relies on assessing the impact on risk of having one train unavailable. In this case, the effective success criterion of the remaining part of the system changes, so that in the case of the one-out-of-four system, a CCF of three SSCs becomes a possible contributor. The impact of not modeling the lower-order CCF contributors should be investigated. Note that this can impact applications for which the justification of the change relies on risk categorization, as well as those that require an evaluation of changes to risk.
. c.
Evaluation Findings Evaluation findings should include statements to the following effect:
Common cause failure has been suitably addressed, and the licensee has systematically identified component groups sharing attributes that correlate with CCF potential and that affect the application.
Wher applicable, the licensee's performance monitoring program addresses a phased Predecisional 19-A14 Rev. 0 - January 1998 l
implementation approach to reduce the potentia, for increased incidence of CCFs attributable to the proposed change.
A.8 Modeling of Human Performance a.
Area of Review The results of a PRA, and therefore the input it provides to risk-informed decisionmaking, can be very strongly influenced by the modeling of human performance. Plant safety depends significantly on human performance, so it is essential that the PRA treat it carefully. However, the modeling of human performance, typically referred to as human reliability analysis (HRA), is a relatively difficult area; Significant Variations in approach continue to be encountered, and these can yield significantly different estimates of human error probabilities (HEPs) for what appears to be similar human failure events.
The particular values used for HEPs can siraificantly influence results of the assessment of the impact of a proposed change.
In addition to the quantification issue, there are questions related to what kind of human actions can appropriately be credited in the context of a particular regulatory finding. As an example, suppose that PRA results appear to support relaxation of requirements for a component based on the argument that even if the component fails, its failure can be recovered with high probability by operator actions outside the control room. The issues of concern here are whether the modeling of the operator action and the evaluation of the failure probability is appropriate, and whether this kind of credit is the sort of compensating measure that is intended by staff guidance to supportjustification of a relaxation. One further issue involves the impact of human performance which is not explicitly modeled, but is implicit in certain parameter values. An example is the influence of human performance on initiating event frequency. The causes of initiating events are typically not addressed; their impact is included in the frequency in an implicit way.
b.
Review Guidance and Procedures Reviewers should understand the potentially signifiernt human performance issues that might be affected by the applicat on and how these are reflected in the PRA. This understanding requires a i
review of the approach ased to estimate human error probabilities.
The HRA can impact the assessment of the change in several ways. First, the change may directly affect the human failure events (HFEs). Second, the HFEs may represent responses to failures of the SSCs impacted by the ch.mge. Finally, HFEs unrelated to the change can obscure or exaggerate the j
impact of the change (depending on their values) by inappropriately increasing or decreasing the value of the accident sequences t:naffected by the change.
When the change directly impacts the HFEs (e.g., as a result of a procedure change or a change in operating practice), reviewers should ensure that the licensee appropriately model the impact; that is reviewers should ensure that the hcensee addressed the following questions:
whether new human actions are introduced or whether existing actions are modified or eliminated i
Fredecisional 19-A15 Rev. 0 - January 1998 1
1
whether the change affects factors assumed to impact the likelihood of failure (usually called performance shaping factors or PSFs), including: the quality of the procedures; the cues available to the operators; the quality of the information (instrumentation) available to the operators; the quality of the human-machine interface; the location of the interface (s); the complexity of the task; the conditions or context within which the operators are responding, including previous failures, previcus actions, etc.; the time available to perform the task; the quality of the training (type and frequency) on the specific evert the crew interactions and the potential for recovery from errors; and the stress on the operators whether the human action dependency analysis is affected whether the application introduces or modifies dependencies between plant instrumentation and a
human actions whether the screening analysis is affected a
When HFEs represent responses to failures of the SSCs impacted by the change, reviewers may want to focus their resources on these HFEs in the following ways:
Identify any human actions that compensate for events affected by the proposed application, and ensure that the licensee did not claim inappropriate credit for these events. For human actions that are used to compensate for a basic event probability increasing as a result of proposed CLB changes, licensee actions to ensure operator performance at the level credited in the risk analysis should also be a part of the CLB change.
Ensure that appropriate justification is provided when the licensee takes credit for post-accident recovery of failed components (repair or other non-proceduralized manual actions, such as manually forcing stuck valves to open). Reviewers should also ascertain whether the identified recovery action is an obvious, feasible (given the time and physical constraints), and supportable by plant programs such as training.
Ensure that the licensee assessed whether the conditions under which the human actions are to be performed have changed significantly so that the HEP should be modified.
Reviewers should also be aware that the impact of the change can be obscured if the accident sequences which do not contain affected SSCs are artificially increased in value by HEPs that are too large.
These cases will impact applications involving risk categorization by lowering the relative contribution of the affected SSCs. An understanding of these effects can be obtained from sensitivity analyses performed by removing the peninent HEPs or by using more realistic values for the HEPs.
Another consideration associated with the potential masking of important SSCs is that the SSCs might not be included in the model used to perform the evaluation of risk. This can happen in several ways:
Cutsets or scenarios containing the SSCs may be truncated because HEPs in the same cutset or scenario are too low. Such truncation should only be a concern if the logic model was not re-solved to determine the change in risk (for example, in applications that depend on SSC risk Fredecisional 19-A16 Rev. 0 - January 1998
{
ranking using h pre-solved equation). The preferred resolution to this wotild be a request for l
re-solution with the appropriate changes made to all affected SSCs. Section A.9 of this SRP chapter discusses this in more detail.
SSCs may not be included in the logic model structure because HEPs are so high that they are assumed to dorainate the unavailability of a function, and therefore the associated hardware is not modeled. However, the hardware could still be a contributor to the calculation of risk importance. For example, the hardware (as a group) will have the same risk importance (in terms of Risk Achievement Worth) as the associated HFE. This suggests that the licensees should identify the important operator actions for applications in RIR, as well as the equipment required to perform the specific function associated with the action. The equipment should then be dispositioned in accordance with its importance in achieving that function.
For some complex groups of operator actions (e.g., the response to an ATWS in a BWR, or the choice to go to recirculation rather than RHR in response to a small LOCA in a PWR), the PRA analysts may have chosen to adopt a bounding approach to the accident scenarios which precludes having to address subsequent actions. This could mean that the equipment associated with those actions might be overlooked in the change process.
c.
Evaluation Findings The staff safety evaluation report should include language equivalent in effect to the following:
The modeling of human performance is appropriate.
Post-accident recovery of failed components is modeled in a defensible way. Recovery probabilities are realistically quantified. The formulation of the model shows decisionmakers l
the degree to which the apparently low risk significance of certain items is dependent on credit for recovery of failed components (restoration of component function, as opposed to actustion of a compensating system).
When human actions are proposed as compensatory measures as part of a proposed CLB change, licensee actions to ensure operator performance at the level credited in the risk analysis j
(e.g., by training, procedures, etc.) are also a part of the CLB change.
A.9 Secuence Ouantification a.
Area of Review The staff would not generally anticipate the need to perform a detailed review of the quantification of the change in risk; however, some details of the quantification process should be confirmed.
Specifically, reviewers should be confident that the licensee's evaluation process is sufficient to account for the potential effects of a CLB change on modeling simplifications and assumptions made during the quantification of risk. In addition, the staff should ensure that the chosen sequence truncation limits are appropriate so that important sequences are not discarded and final results are not sensitive to the chosen truncation limit.
Predecisional 19-A17 Rev. 0 - January 1998
=
b.
Review Guidance and Pr6cedures l
Reviewers should verify that model simplifications and assumptions made during the quantification l
process are properly accounted for in evaluating of the change in risk, as illustrated by the following l
examples-l 1
Reviewers should ensure that the licensee accounted for model asymmetries during the application of the PRA models. Asymmetries could result from modeling assumptions (e.g.,
assuming one train to be the operating train, and the second train to be the standby train), from differences in support system alignment, or from actual differences in system design or operating procedures. The licensees should have accounted for these asymmetries when evaluating changes to the affected systems.
Reviewers should ensure that, if cutset/ sequence deletion is performed during quantification, these are correctly. addressed in the assessment of risk change. In some quantification processes, cutsets that contain combinations of maintenance actions that are disallowed by the Technical Specifications are deleted from the accident sequence equations after the merging of functional cutset equations. This is done to avoid undue conservatism. If the PRA application deals with Technical Specification allowed outage issues, reviewers should confirm that any impact on such deletions have been correctly addressed.
Reviewers should ensure that, if operator recovery actions are incorporated after the initial quantification, these actions are still valid in light of the proposed CLB change. Section A.8 of this SRP chapter discusses this in more detail.
Circular logic in fault trees will cause the quantification process to abort. This is a problem for systems such as the emergency service water system, which provides cooling to the emergency diesel generators, but requires power from those diesel generators when offsite power is lost.
Another example is the mutual dependency between the DC and AC power systems. In situations such as these (i.e., when the physical situation has embedded circular dependencies),
analysts have to break this circularity to allow for model solution. For CLB changes that affect systems affected by circular logic, reviewers should investigate the manner in which the circularity was broken (usually in the sequencing of functions in the event tree) and should verify that the dependency is still being accounted for in the evaluation of the risk change.
Sequence Truncation The staff prefers that licensees calculate the change in risk from the application by requantifying the
. base PRA model so that the potential effects of originally truncated events can be accounted for should they become important as a result of an application. If the licensee did not requantify the model, or if the application depended on the risk ranking of SSCs from a pre-solved equation, reviewers should use the guidelines provided below.
Reviewers should be assured (either by documentation provided in the licensee review or by an independent analysis) that cutset or scenario truncation did not introduce errors into the application l
results or the logic of the PRA that affects the application. Staff review could also involve performing (or reviewing) sensitivity studies where the truncation limit is lowered for the dominant sequences and Predecisional 19-A18 Rev. 0 - January 1998
event initiators, and studying the resultant cutsets or scenarios to see if there are any hidden dependencies or unusual / unexpected event combinations (especially if these involve components affected by the proposed application).
Staff review could also include comparing a list of the events affected by the application that is in the final truncated cutset equations to the list of application-specific basic events used in the fault tree and event tree models. This yields a list of events that did not make it past the truncation process.
Documentation should be available to enable reviewers to determine the reason truncated events are not important to risk.
Finally, in PRA models where common cause failures and human dependencies are incorporated at the sequence level after a truncated set of minimal cutsets has been obtained, reviewers should verify that the truncation criteria used in the PRA do not lead to cutsets involving application-specific components being truncated that could be important if common cause failures or human dependencies are considered.
c.
Evaluation Findings Reviewers should verify that the information provided cad review activities conducted support the following conclusions:
The CLB change is appropriately modeled and is properly quantified.
The licensee has satisfactorily established that conclusions are not adversely affected by truncation either because (i) the change in risk from the application was calculated by the requantification of the base model, or (ii) if model requantification was not performed, or 'f the application depended on the risk ranking of SSCs from a pre-solved cutset equation, the following apply:
The truncation criterion is sufficiently low to ensure stable results, that is, the magnitude o
of the CDF or release frequency will not change as a result of lower truncation limits, and the grouping of SSCs into risk categories will not be affected.
The components affected by the application are, for the most part, not truncated out of the o
model. In cases where they are, a qualitative assessment can demonstrate the reasons why they are unimportant to risk.
A.10 Modeling of Containment Resnonse and Changes in Large Early Rclease Freauency a.
Area of Review The purpose of this section is to provide guidance for use in reviewing the licensee's evaluation of changes in LERF stemming from proposed changes to the CLB.
In general, only a subset of CDF sequences will be affected by a CLB change. Whether or not this subset contributes significantly to LERF depends on several plant-specific characteristics. This section Predecisional 19-A19 Rev. 0 - January 1998
j
=
focuses on the characteristics that strongly affect LERF, and identifies review approaches based on these characteristics. It also provides guidance to help reviewers identify the major items related to functional plant capability that directly affect the potential for large early release; to direct reviewers in establishing whether the proposed changes to the CLB can affect this capability; and to determine whether the licensee has appropriately addressed these items in estimating changes in LERF.
b.
Review Guidance and Procedures There are several ways in which a CLB change can significantly alter LERF, including those that:
Change the frequency of containment bypass sequences (e.g., steam generator tube ruptures and interfacing system LOCAs).
Change the frequency of core damage sequences that pose severe challenges to containment (e.g., sequences resulting in elevated reactor coolant system (RCS) pressure during core damage and at vessel failure).
Change the performance of systems involved in containment safety functions (e.g., containment isolation, containment heat removal, containment sprays, hydrogen control, etc.).
Change the performance of systems or operator actions that affect accident management strategies (e.g., depressurization, venting, etc.).
Change the frequency of core damage sequences occurring at shutdown with containment functionality reduced.
The guidance provided below focuses, for each plant type, on particular examples of these general categories.
Based on previous PRAs, draft NUREG/CR-6595 developed some insights on the factors that most strongly affect the estimated likelihood of a large early release. Although plant-specific details may become significant in some cases, it was found that plants of each major containment type tend to be similar in the types of sequences that could lead to a large early release, reflecting strengths and weaknesses of that containment structure and particular features of the core damage sequences that characterize that plant type. Based on these insights, draft NUREG/CR-6595 presents a screening approach to evaluate the frequencies of dominant containment failure modes and bypass events. The purpose of this approach is to provide estimates of LERF, given certain characteristics of core damage sequences as input.
The review approach presented in this SRP section builds upon the underlying insights from draft NUREG/CR-6595. For each major containment type, particular considerations are suggested for attention in the review process. However, it is not intended to suggest that these considerations exhaust the technical issues that affect the potential for large early release. For example, where plant-specific PRA Level 2 analyses exist, these could provide further insights into LERF considerations for that plant.
For each major containment type, the factors that most strongly affect the potential for large early Fredecisional 19-A20 Rev. 0 - January 1998
release (given that a core damage sequence is underway) are as follows:'
PWR Large Dry:
Containment bypass Containment isolation RCS depressurization Emergency core cooling (ECC) restoration before vessel failure PWR Ice Condenser:
Containment isolation Containment bypass Hydrogen igniters RCS depressurization ECC restoration before vessel failure BWR Mark I and II:
Containment isolation Containment bypass Venting Containment heat removal: decay heat Containment heat removal: ATWS RCS depressurization ECC restoration before vessel failure BWR Mark III:
All MaricI and Mark II issues Igniters It should be noted that, at some BWRs, many sequences that result in vessel breach have a significant probability of also failing the containment. Also, the reader should note that a loss of containment heat removal may significantly contribute to CDF.
In reviewing the calculation of change in LERF for a given plant type, reviewers should consider the following factors:
Containment Bypass:
Whether the proposed change affects systems that are credited in the prevention of, or in response to an initiating event involving a steam generator tube rupture (SGTR) or an ISLOCA.
Whether the proposed change affects the frequency or severity of transients that could result in induced steam generator tube ruptures (ISGTR) (i.e., tube rupture in the course of an accident, caused by elevated temperatures and/or elevated pressure differentials). If the CLB change does not directly affect steam generator tube integrity, and the steam generators in the plant are not experiencing significant degradation, only a qualitative analysis may be needed to ensure that the risk ofISGTR is not significantly increased by the proposed change. However, if the plant has suffered a steam generator tube rupture, or has been shut down because of excessive steam generator tube leakage, or has detected tubes which do not meet applicable ASME Code requirements for structural integrity, or has repaired a significant amount of tubes u a result of free span degradation, the application should provide a more thorough analysis of the effects of the proposal on the risk associated with ISGTR.
Predecisional 19-A21 Rev. 0 - January 1998
Containment Isolation:
Whether the proposed change affects systems that perform or suppon the isolation function.
Whether the proposed change affects systems that prevent or mitigate core damage sequences initiated during periods of reduced containment functionality (e.g., shutdown).
Whether the proposed change affects the ability to restore containment function during such periods (e.g., AC power, plant procedures, etc.).
Igniters:
Whether the proposed change affects the igniters or any applicable suppon systems.
ECC Restoration Before Vessel Failure:
If credit was taken in the estimate of LERF for recovery of cooling before vessel failure, whether the proposed change affects performance of any cystem thus credited (including suppon systems).
Whether the proposed change affects other accident management strategies credited in the PRA (e.g., external vessel flooding).
RCS Pressure at Vessel Failure:
.Whether the proposed change affects the capability to depressurize the RCS.
Venting:
Whether the proposed change affects the capability to vent the containment.
Containment Heat Removal:
Whether the proposed change affects systems credited in containment heat removal (including front-line and suppon systems).
Whether the proposed change affects the frequency or severity of ATWS sequences.
For each of the above considerations that apply, reviewers should ascenain that the licensee adequately evaluated the effects and took them into account in calculating the change in LERF.
c.
Evaluation Findings The safety evaluation repon should contain findings equivalent to the following.
I Predecisional 19-A22 Rev. 0 - January 1998
The calculation for the chahge in LERF resulting from a CLB change has systematically taken into account the dominant causes of containment failure. In particular, the calculation has considered: bypass sequences; sequences posing relatively severe challenges to containment, or sequences occurring during periods of reduced containment functionality (shutdown);
performance of systems involved in containment safety functions, including containment heat removal, sprays, isolation, and restoration of containment functionality (shutdown); and performance of systems involved in accident management strategies.
A.11 Bibliceraphy This section provides a list of documents of that the staff could use as reference or background material during the review process. This bibliography is divided into general categories in the areas of:
desirable PRA r.ttributes, review of the PRA, uncertainty and sensitivity analyses, and use of the PRA in risk ranking. In addition, a bibliography is provided for each of the review categories discussed in Sections A.1 through A.10 of this appendix.
General-Desirable PRA Attributes EPRI TR-105396, PSA Applications Guide, Electric Power Research Institute, August 1995 EPRI TR-106575, Development of a Quality Pedigree Process and Application to the Duane Arnold Energy Center Probabilistic Safety Assessment, August 1996 (proprietary document -
contact EPRI for availability)
IAEA Safety Series No.50-P-4, Procedures for Conducting Probabili., - %y Assessments of Nuclear Power Plants (Level 1), International Atomic Energy Agency,1992 NUREG-1150, Severe Accident Risks: /n Assessment for Five U.S. Nuclear Power Plants, January 1991 NUREG-1489, A Review of NRC Staff Uses of Probabilistic Risk Assessment, March 1994 NUREG-1560, Individual Plant Examination Program: Perspectives on Reactor Safety and Plant Performance, October 1996, Draft for Comment NUREG-1602, The Use of PRA in Risk-Informed Applications, April 1997, Draft for Comment NUREG/CR-2300, PRA Procedures Guide, January 1983 NUREG/CR-2815, Probabilistic Safety Analysis Procedures Guide, Volumes 1&2 Revision 1,
=
August 1985 USNRC, Regulatory Review Group Risk Technology Application, Volume 4 Predecisional 19-A23 Rev. 0 - January 1998
General-Review of the PRA BWROG, Report to the Industry on PSA Peer Review Certification Process: Pilot Plant Results, Boiling Water Reactor Owners' Group, January 1997 EPRI TR-100369, Individual Plant Examination Review Guide, February 1992
+
IAEA-TECDOC-832, IPERS Guidelines for the International Peer Review Service, Second edition, October 1995 NUREG-1335, Individual Plant Examination: Submittal Guidance, August 1989
=
NUREG-1407, Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities, May 1991 NUREG/CR-348N, PRA Review Manual,1985 General - PRA Uncertainties ad Sensitivity Studies Apostolakis, G.A., " Probability and Risk Assessment: The Subjectivist Viewpoint and Some Suggestions," Nuclear Safety,19(3), pages 305 - 315,1978.
Apostolakis, G.A. and Kaplan, S., " Pitfalls in Risk Calculations," Reliability Engineering, Vol. 2, pages 135 - 145,1981.
Kaplan, S., and Garrick, B.J., "On the Quantitative Definition of Risk," Risk Analysis, Vol.
1, pages 11 - 28, March 1981.
NUREG-1489, A Review of NRC Staff Uses of Probabilistic Risk Assessment, Appendix C.6, March 1994.
NUREG/CR-2350, Sensitivity Analysis Techniques: Self Teaching Curriculum, June 1982 NUREG/CR-4836, Approaches to Uncertainty Analysis in Probabilistic Risk Assessment, a
January 1988 Parry, G.W., and Winter, P.W., " Characterization and Evaluation of Uncertainty in Probabilistic Risk Analysis," Nuclear Safety, 22(1), pages 28 - 42,1981.
Proceedings of Workshop 1in Advanced Topics in Risk and Reliability Analysis, Model
=
Uncencinty:Its Characterization and Quant @ cation, held in Annapolis, Maryland, October 20-22,1993, University of Maryland Press,1996.
Reliability Engineering and System Safety, Vol. 54, nos 2 and 3, November / December 1996, Special issue on Treatment of Aleatory and Epistemic Uncertainty.
Predecisional 19-A24 Rev. 0 - January 1998
l General-Use of PRA for Risk Ranking NUREG/CR-3385, Measures of Risk Importance and Their Applications, July 1983 Vesely, W.E., "The Use of Risk Importances for Risk-Based Applications and Risk-Based l
Regulation," in proceedings of PSA '96, Park City Utah, September 1996 1
Initiating Events EPRI NP-2330, ATWS-A Reappraisal, Part 3, Frequency of Anticipated Transients,1982 NSAC-182, Loss of Offsite Power at U.S. Nuclear Power Plants Through 1991, March 1992 NUREG-1032, Evaluation of Station Blackout Accidents at Nuclear Power Plants, June 1988 NUREG/CR-3862, Development of Transient Initiating Event Frequencies for Use in
=
Probabilistic Risk Assessments, May 1985 NUREG/CR-5032, Modeling Time to Recovery and Initiating Event Frequency for Loss of Offsite Power Incidents at Nuclear Power Plants, January 1988 NUREG/CR-5928, ISLOCA Research Program Final Report, July 1993 Accident Sequence Analysis (Event Trees)
NUREG/CR-2300, PRA Procedures Guide, Chapter 3.4, January 1983 System Modeling Analysis (Fault Trees)
NUREG-0492, Fault Tree Handbook, January 1981 NUREG/CR-2300, PRA Procedures Guide, Chapter 3.5, January 1983 l
Dependent Failure Analysis NUREG/CR-2300, PRA Procedures Guide, Chapter 3.7, January 1983 l
l Determination of Success Criteria i
l EPRI TR-100741, MAAP Thermal-Hydraulic Quantification Studies, June 1992
=
EPRI TR-100742, MAAP BWR Application Guidelines, June 1992 I
Predecisional 19-A25 Rev. 0 - January 1998 l
EPRI TR-100741, MAAP PWR Application Guidelines for Westinghouse and Combustion Engineering Plants, June 1992
. MAAP 3.0B Users Manual, Fauske & Associates, Inc. March 1990 NUREG/CR-5535 Volumes 1-5, RELAP5/ MOD 3 Code Mrnual, June 1990 NUREG/CR-5673 Volumes 1-4, TRAC-PF1/ MOD 2 Code Manual,1994 Valente, J.U. and Yang, J.W., MAAP 3.0B Code Evaluation Final Repon, BNL Report FIN L-1499, Brookhaven National Laboratory, October 1992 WCAP-10541, Revision 1 Reactor Coolant Pump Seal Performance Following Loss of All AC Power, Westinghouse Electric Corporation Use of Appropriate Data EPRI TR-100381, Nuclear Plant Reliability: Data Collection and Usage Guides, April 1992 IAEA-TECDOC-478, Component Reliability Data for Use in Probabilistic Safety Assestment,
- October 1988 IAEA-TECDOC-504, Evaluation of Reliability Data Sources, April 1989
=
IAEA-TECDOC-508, Survey of Ranges of Component Reliability Data for Use in Probabilistic a
Safety Assessment, June 1989 IEEE-STD-500, Guide to the Selection and Presentation of Electrical, Electronic and sensing Component Reliability Data for Nuclear Power Generating Stations, Rev.1,1984 INEL-95/0035, Emergency Diesel Generator Power System Reliability 1987-1993, Idaho National Engineering Laboratory, February 1996 NUREG/CR-1025, Data Summaries of Licensee Event Repons on Pumps at U.S. Commercial Nuclear Power Plants, Rev.1,1982 NUREG/CR-1363, Data Summaries of Licensee Event Repons of Valves of U.S. Commercial
.=
Nuclear Power Plan:s,1982 NUREG/CR-1740, Data Summaries of Licensee Event Reports of Selected Instrumentation and Control Components at U.S. Commercial Nuclear Power Plants, January 1,1976 to December 31 1981, 1984 NUREG/CR-3867, Data Summaries of Licensee Event Reports ofInverters at U.S.
Commercial Nuclear Power Plants, January 1,1976 to December 31 1982, 1984 Predecisional 19-A26 Rev. 0 - January 1998
NUREG/CR-4126, Data Summaries of Licensee Event Reports of Protective Relays and Circuit Breakers at U.S. Commercial Nuclear Power Plants, January 1,1976 to December 31 j
1983, Draft,1985 j
T-Book,3rd edition, " Reliability Data of Components in Nordic Nuclear Power Plants,"
Published by ATV Office, Vattenfall AB, Sweden,1992 Modeling of Common Cause Failures IAEA-TEC-DOC 648, Guidelines for Conducting Common Cause Failure Analysis in Probabilistic Risk Assessment,1992.
l INEL-94/0064, Common Cause Failure Data Collection and Analysis System, Draft, December 1995 NUREG/CR-4780 Volumes 1 & 2, Procedures for Treating Common Cause Failures in Safety and Reliability Studies, January 1988 Modeling of Human Performance Chien, S.H., et. al., "Quantification of Human Error Rates Using SLIM-Based Approach,"
IEEE Founh Conference on Hwnan Factors and Power Plants,1992 EPRI NP-3583, Systematic Human Action Reliability Procedure, June 1984
+
EPRI NP-6937, Operator Reliability Experiments Using Power Plant Simulators, Volumes 1-3, July 1990 (proprietary document - contact EPRI for availability)
EPRI RP-2170-3, Human Cognitive Reliabi'ity Model for PRA analysis, December 1984 (draft)
EPRI TR-100259, An Approach to the Analysis of Operator Actions in Probabilistic Risk Assessment, June 1992 (proprietary document - contact EPRI for availability)
EPRI TR-101711, SHARPI - A Review of Systematic Human Action Reliability Procedure, December 1992 (proprietary document - contact EPRI for availability)
NUREG/CR-1278, Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plant Applications, August 1983 1
NUREG/CR-2254, A Procedure for Conducting a Human Reliability Analysis for Nuclear Power Plants,1983 NUREG/CR-2986, The Use of Performance Shaping Factors and Quantified Expert Judgement Fredecisional 19-A27 Rev. 0 - January 1998 l
\\
1 in the Evaluation of Human Reliability: An Initial Appraisal,1983 NUREG/CR-3518, SLIM /MAUD: An Approach to Assessing Human Error Probabilities Using Structured Expert Judgement, Volumes 1 & 2, 1984 NUREG/CR-4772, Accident Sequence Evaluation Program - Human Reliability Analysis Procedure, February 1987 Sequence Quantification NUREG/CR-2300, PRA Procedures Guide, Chapter 6, January 1983 IEEE Standard 1012-1986, IEEE Standard for Software Verification and Validation Plans NUREG/BR-0167, Software Quality Assurance Program and Guidelines, February 1993 Modeling of Containment Response and Changes in Large Early Release Frequency NUREG-1570, Risk Assessment of Severe Accident-Induced Steam Generator Tube Rupture, Draft for Comment, May 1997 NUREG/CR-6595, An Approach for Estimating the Frequencies of Various Containment Failure Modes and Bypass Events, Draft, November 1997 Predecisional 19-A28 Rev. 0 - January 1998
APPENDIX B INTEGRATED DECISIONMAKING Risk-informed applications are expected to require a process to integrate traditional engineering and probabilistic considerations to form the basis for acceptance. In order for this decisionmaking process to be effective in rendering accurate representations of plant safety and risk, the staff anticipates that licensees will have documented guidance to ensure consistent and defensible results. Such guidance would also allow staff reviewers to reconstruct the logic and events involved in the integration process.
This appendix discusses issues that the staff should address during reviews of the licensees' integrated decisionmaking process (sometimes referred to as the " expert panel" process).
a.
Area of Review Staff reviewers are expected to evaluate proposed changes to the CLB by taking into account both traditional and probabilistic engineering considerations. For each change, reviewers should evaluate the licensee's justification for the change and the process by which the results were obtained. In many pilot risk-informed applications, licensees have justified changes to the CLB through the use of integrated decisionmaking panels (or expert panels) especially in cases where there are broad applications of PRA and traditional engineering results over a large number of plant elements (SSCs, operator actions, etc.). A review of the licensee's integrated decisionmaking process would ensure a better understanding of the reasons, assumptions, approaches, and information used tojustify changes to the CLB.
b.
Review Guidance and Procedures Since the licensee's integrated decisionmaking process is responsible for justifying the acceptability of the proposed changes to the CLB, the staff anticipates that licensees will document the process in a relatively formal fashion. The staff may not routinely audit all of the licensee's findings or recommendations, but the documentation should exist to support such a review, and should be maintained for the life of the plant or until such time at which the recommendations are invalidated by later changes.
Staff expectations of the integrated decisicuaking process Reviewers should ensure that the licensee's decisionmaking process contains the following attributes:
The process should be well-defined, systematic, repeatable, and scrutable. This process should be technically defensible and should be sufficiently detailed to allow an independent party to reproduce the major results.
Deliberations should be application-specific. The objectives proposed for the integrated decisionmaking process for a particular application (particularly, how the results are to be utilized) should be well defined and relevant to the given application.
Predecisional 19-B1 Rev. 0 - January 1998 l
l l
1
4 4
Membership in the decisionmaking team should include experienced individuals with demonstrated skills and knowledge in relevant engieering disciplines (depending on the application), plant procedures and operations, plant systeur (including operational history),
system response and dependencies, operator training and response, details of the plant-specific PRA, and regulatory guidance.
The decisionmaking team should have been advised of the specifics of all proposed changes and the relevant background information associated with the licensing action. In addition, since the judgement will depend, in part, on the results of a risk analysis, it is important that all team members be provided with an interpretation of the results of the risk model and the potential limitations of that model.
The licensee's integrated decisionmaking process should take into account the principles and expectations described in Section 2.1 of RG 1.174.
In formulating the findings, the licensee should account for both probabilistic and traditional engineering considerations. This should include information from the risk analysis, traditional engineering evaluations and insights, quantitative sensitivity studies, operational experience and historical plant performance, engineering judgment, and current regulatory requirements.
Potential limitations of the risk model should be identified and resolved, in addition, the licensee should individually consider and evaluate all SSCs that are affected by the proposed application but are not modeled in the PRA, on the basis of guidelines similar to those provided later in this appendix or in Section C.2 of Appendix C to this SRP chapter. Finally, the licensee's conclusions should be sufficiently robust with regard to different plausible assumptions and analyses.
When findings or conclusions depend, in part, on the use of compensatory measures, the licensee should justify why the compensatory measures are an appropriate substitute for a proposed relaxation in current requirements. The compensatory measures should also become part of the plant's licensing basis.
Technical information basis for applications involving risk quantification or risk categorization The staff expects that the information base supplied to the integrated decisionmaking panel will be capable of supporting the findings that should be made in the context of the specific risk-informed application. For example, in risk quantification and risk categorization applications, the following guidelines should be applicable.
At least the Level 1 portion of the internal events PRA should be formulated in such a way as to suppon quantification of a change in risk (ACDF and ALERF) and importance measures, and should provide qualitative information (e.g., minimal cutsets) adequate to support defense-in-depth findings.
There should be an inventory of plant response capability for probabilistically significant operating modes and initiating event categories (internal, external, flood, fire, seismic, etc.).
Given a full-scope Level 2 PRA, this requirement could be satisfied by an inventory of event tree success paths, with an indication of the mission success criteria, systems, and SSCs Predecisional 19-B2 Rev. 0 - January 1998
involved in each path. Lacking a full-scope Level 2 PRA, surrogate inforrhation should be developed for unanalyzed areas, along the lines described in Section 111.2.2.2 of this SRP chapter. This requirement is necessary in order to show the safety functions performed by SSCs (or other plant elements) affected by the application.
Causal models (determination of cause-and-effect relationships) should be developed to support an evaluation (qualitative or quantitative) of the change in risk as a function of the application.
This is necessary in order to relate the application to actual risk indices.
Documentation ofinputs to the decisionmaking panel should be part of the process. Reviewers should verify the scope and depth of the information base, especially information supplied regarding modes and/or classes of initiators unanalyzed in the PRA.
Treatment of SSCs not modeled in the PRA PRAs do not model all SSCs involved in performance of safety functions for various reasons.
However, this should not imply that unmodeled SSCs are not important in terms of contributions to plant risk. For example, SSCs are omitted in some. cases because the analysts take credit for programmatic activities that ensure a low failure frequency for that item or a short fault exposure time' in the event that it does fail. In such cases, even though the PRA results will not reflect the SSC at all, it would be inappropriate to conclude that the programmatic activity is unimportant.
Consequently, one task of the integrated decisionmaking panel is to extrapolate from the PRA and other information sources to draw conclusions about SSCs that are not modeled in the PRA. This does not mean that the panel is to impute to the PRA high-level results that were not generated in the analysis; however, it does mean that if a success path is modeled in the PRA, the panel is justified in reasoning that unmodeled SSCs in that path are relied upon. If items were screened from the PRA, the panel should be aware of the screening process, in order to avoid violating the basis for the screening.
For SSCs not modeled in the PRA, reviewers should verify that the decisionmaking panel has performed the following tasks:
Review the PRA assumption base for instances in which initiators were screened out on the basis of credit for SSCs affected by the application.
.1 1
Review plant operating history for initiating events that might have been prevented by the proposed application.
Review plant operating history for failures of mitigating system trains attributable to events that might have been prevented by the proposed application.
Review accident sequence modeling for instances in which early termination of the analysis I
obscured challenges to affected SSCs that would normally come into play later than the termination point.
Possible dispositions of the above tasks include the following results:
' Predecisional 19-B3 Rev. 0 - January 1998
.o
The item will not affect initia' ting event frequency or mitigating system performance under reasonably foreseeable circumstances, and the proposed change is warranted.
Although unmodeled, the item already receives and will continue to receive programmatic attention commensurate with its significance. In cases where reduced commitments are proposed, adequate justification is provided for this reduction.
The item does not currently receive sufficient programmatic attention, and may be subject to tighter controls.
Reviewers should verify that the safety significance of SSCs not modeled in the PRA (but affected by the proposed application) are appropriately characterized and justified.
Addressing limitations of the risk analysis One objective of the integrated decisionmaking process is to overcome certain limitations of the PRA.
However, this does not include substituting the analyst's judgment for essential PRA results. One reason for developing PRA models is that the complexity of many facilities makes judgment difficult in many contexts.
Generally, if the PRA highlights a plant vulnerability, this should be taken seriously and should not be discounted on the basis of judgment. If the analyst can show that the PRA representation of a vulnerability is invalid, then the PRA should be modified, and the licensee should work with the results of the revised PRA.
To address the issue of credit for unmodeled systems that would change a PRA result, the preferred method is to alter the PRA to take the credit. Reviewers should be aware that cases may potentially arise in which credit for an unmodeled system would be seriously complicated by issues of shared support systems, environmental conditions, or other factors such as spatial interaction issues or operator interaction dependencies.
To address the issue of making decisions about SSCs that might influence plant response in unmodeled modes or to unmodeled initiators, the acceptable approach is to proceed on the basis of a structured representation of plant response that shows at least qualitatively the initiating events that may pertain, the systems available to respond to each, the functional dependencies of these systems, and the backups l
available in the event of failure of any particular SSC. While it is possible to accept program J
reductions for SSCs that are explicitly shown to play no role in unanalyzed modes, it is more difficult l
to accept reductions for components that do play a role in unanalyzed (e.g., shutdown) modes. For such instances, conservative methods will be considered prudent.
To address instances in which a PRA model exists but is considered misleading, caution is indicated.
I An example would be to down-classify SSCs from a PRA result (i.e., state that a high risk contributor is actually a low contributor), on the basis of paneljudgment. It is not acceptable to place on the record both a PRA and a finding that clearly contradicts it. Although the panel is not expected to take the PRA as absolute truth, the test should be whether the record establishes a clear basis for a finding.
A technical argument that begins with the misleading PRA result and furnishes supplementary information sufficient to justify a relatively minor change to a PRA result, or a qualified interpretation l
Predecisional 19-B4 Rev. 0 - January 1998 l
1
of a PRA result, is satisfactory. A cursory technical argument leading to a conclusion that qualitatively contradicts a major PRA result is an unsatisfactory record.
c.
Evaluation Findings The following language (or language equivalent to this) should appear in the SER, or exceptions should be noted and explained:
The integrated decisionmaking process is appropriate. Appropriate information was available, suitable issues were raised, the disposition of these issues was systematic and defensible, and the documentation of the findings is traceable and reviewable in principle, so that the basis for conclusions and recommendations is available for scrutiny and review.
The evaluation of risk significance represents appropriate consideration of probabilistic information, traditional engineering evaluations, sensitivity studies, operational experience, engineering judgment, and current regulatory requirements.
The technical information basis was adequate for the scope of the application. In particular, the analysis of success and failure scenarios was adequate to identify the roles played by the SSCs affected by the application, the quantification of the frequency of these scenarios was adequate to establish the safety significance of the SSCs, and the causal models were adequate to establish the effects of the proposed changes in the program.
The safety significance of components affected by the proposed application but not modeled in the PRA was evaluated in a systematic manner. This included a search of components that might contribute to initiating event occurrence, mitigating system components that were not modeled in the PRA because their failure was not expected to dominate system failure in the baseline configuration, and components in systems that do not play a direct role in accident mitigation but do interface with accident mitigating systems.
4 The process applied by the licensee to overcome limitations of PRA was appropriate. Where j
decisions were made that do not follow straightforwardly from the PRA, a technical basis was provided that shows how the PRA information and the supplementary information validly combine to support the finding. No findings contradict the PRA in a fundamental way.
1 l
{
l l
1 l
l 1
l l
Predecisional 19-B5 Rev. 0 - January 1998
APPENDIX C l
CATEGORIZATION OF PLANT ELEMENTS WITH RESPECT TO SAFETY SIGNIFICANCE l
[
For several proposed applications in the risk-informed regulation, one of the principal activities is the l
categorization of SSCs and human actions with respect to their safety-significance. This appendix discusses how to review approaches that may be used in this categorization process.
l The first review consideration is the definition of safety-significance as it applies to SSCs and human actions for a specific application. A related, but not identical concept, is that of risk significance. For example, an individual SSC can be identified as being risk-significant if it can be demonstrated that its failure or unavailability contributes significantly to the measures of risk (e.g., CDF and LERF).
Safety-significance, on the other hand, can be thought of as being related to the role the SSC or human action plays in preventing.the occurrence of the undesired end state. Thus, the SSCs and human l
actions considered when constructing the PRA model have the potential to be safety significant, since they play a role in preventing core damage or large early release. These SSCs and human actions may include those that do not necessarily appear in the final quantified model because they have initially been screened, are assumed to be inherently reliable, or have been truncated from the solution of the model. In addition, there may be SSCs or human actions not modeled in the PRA that have the potential to be safety significant because they play a role in preventing core damage or large early release.
In reviewing the categorization, it is important to re::ognize its underlying purpose. Categorization is generally intended to sort the SSCs or human actions into two general groups; those for which some change is proposed, and those for which no change is proposed. It is the potential impact of the application on the particular SSCs and human actions and on the measures of risk which ultimately determines which SSCs and human actions should be regarded as safety-significant. Since different applications impact different SSCs and human actions, it is reasonable to expect that the categorization could be different for different applications. Thus, the question being addressed by the application is, for which groups of SSCs and human actions can the change be made such that there will be no more than an insignificant increase in the risk to the health and safety of the public. This impact on overall risk should be related back to the criteria for acceptable changes in the risk measures identified in RG 1.174. It is those groups for which changes can be made that satisfy these criteria that can be regarded as low safety-significant in the context of the specific application. Thus, the most appropriate way to address the categorization is through a requantification of the risk measures. However, the feasibility I
of performing such risk quantification has 1,een questioned for those applications for which a method for evaluating the impact of the change on SSC unavailability is not obviously available.
In such instances, an acceptable alternative to requantification of risk is to categorize SSCs and human actions using an integrated decisionmaking process (such as the use of an Expert Panel), with PRA importance measures as input. This appendix discusses the issues that reviewers should address for this approach. Section C.1 discusses the technical issues associated with the use of PRA importance measures, and Section C.2 discusses the use of the importance measures by the decisionmaking panel.
l Predecisional 19-C1 Rev. 0 - January 1998 i
_A
C.1 Use of Mnonance Macures a.
Area of Review
- In' the implementation of the Maintenance Rule and in many industry guides for the risk-informed -
applications, the measures most commonly identified for use in the relative risk ranking of SSCs and human actions include the Fussell-Vesely Importance, Risk Reduction Worth, and Risk Achievement Worth. However, in using of these importance measures for risk-informed applications, several issues should be addressed. Most of these issues relate to technical problems that can be resolved through the use of sensitivity studies or appropriate quantification techniques, as discussed in detail later in this section. In addition, there are two issues that reviewers should ensure have been adequately addressed, namely i) that risk rankmgs apply only to individual contributions and not to combinations or sets of contributors, and ii) that risk rankings are not necessarily related to the risk changes which result from those contributor changes. When correctly applied and interpreted, component-level importance measures can provide valuable input to the integrated decisionmaking process.
b.
Review Guidance and Procedures Risk ranking results from a PRA can be affected by many factors, the most important being the model assumptions and techniques (e.g., for modeling of human reliability or common cause failures), the data used, or the success criteria chosen. Reviewers should therefore evaluate the licensee's PRA as part of the overall review process. Appendix A to this SRP chapter presents guidance for this review.
In addition to using a PRA of appropriate quality for the application, the licensee should demonstrate the robustness of risk ranking results for conditions and parameters that might not be addressed in the base PRA. Therefore, when importance measures are used to group components or human actions as low safety-significant contributors, the information to be provided to the integrated decisionmaking process should include sensitivity studies and/or other evaluations to demonstrate the sensitivity of the ranking results to the important PRA modeling techniques, assumptions, and data. In assessing this information, reviewers should consider the following issues:
Different risk metrics Reviewers should ensure that the licensee's ranking process adequately considered risk in terms of both CDF and LERF.
Completeness of risk model Reviewers should ensure that, when determining safety significance contributions using an internal events PRA, the licensee also considered external events, as well as shutdown and low-power initiators, either by PRA modeling or by the integrated decisionmaking 1
process (as detailed in Section C.2 and Appendix B to this SRP chapter).
(
Sensitivity analysis for component data uncertainties:' The licensee should have addressed the -
sensitivity of component categorizations to uncertainties in the parameter values. Reviewers should be satisfied that SSC categorization is not affected by data uncertainties.
Sensitivity analysis for common cause failures: CCFs are modeled in PRAs to account for dependent failures of redundant components wi.hin a system. As discussed in Appendix A to this SRP chapter, CCF probabilities can impact PRA results by enhancing or obscuring the importance of componen*s.
This should be addressed by the review. A component may be ranked as a high risk contributor mainly Predecisional 19-C2 Rev. 0 - January 1998
because of its contribution to CCFs, or a component may be ranked as a low risk contributor mainly because it has negligible or no contribution to CCFs. In RIR, removing or relaxing requirements may increase the CCF contribution, thereby changing the risk impact of an SSC.
Consideration of multiple failure modes: PRA basic events represent specific failure events and failure modes of SSCs. Reviewers should verify that the licensee performed the categorization by takir:c into account the combined effects of all associated basic PRA events (such as failure to start and failure to run), including indirect contributions through associated CCF event probabilities.
Sensitivity analysis for recovery actions: PRAs typically model recovery actions especially for dominant accident sequences. Quantification of recovery actions typically depends on the time available to diagnose the situation and perform the action, as well as the adequacy of the licensee's training, procedures, and operator knowledge. Estimating the success probability for the recovery actions involves a certain degree of subjectivity. The concerns in this case stem from situations where very high success probabilities are assigned to a sequence, resulting in related components being ranked as low risk contributors. Furthermore, it is not desirable for the categorization of SSCs to be impacted by recovery actions that sometimes are only modeled for the dominant scenarios. Sensitivity analyses can be used to show how the SSC categorization would change if recovery actions were removed.
Reviewers should ensure that the categorization has not been unduly impacted by the modeling of recovery actions.
Truncation limit: Reviewers should verify that the licensee set the sequence truncation limits low enough so that the truncated set of minimal cutsets or scenarios contains the significant contributors and their logical combinations for the application in question. Depending on the level of PRA detail (module level, component level, or piece-part level), this may translate into a truncation limit from 10-"
to 10~8 per reactor year.
Multiple component considerations: As previously discussed, importance measures are typically evaluated on the basis of individual SSCs or human actions. One potential concern that arises from this practice is that single-event importance measures have the potential to dismiss all elements of a system or group, despite the system or group having a high importance when taken as a whole. (Conversely, there may be grounds for screening out groups of SSCs, owing to the unimportance of the systems of which they are elements.) Two potential approaches are used to address the multiple component issue.
The first is to define suitable measures of system or group importance. The second is to choose appropriate criteria for categorization based on component-level importance measures. In both cases, it will be necessary for the licensee to demonstrate that the cumulative impact of the change has been adequately addressed.
While there are no widely accepted definitions of system or group importance measures, it is likely that some licensees will develop new system or group measures. If any are proposed, reviewers should ensure that the measures logically capture the impact of changes to the group. As an example of the issues that arise, consider the following. For front-line systems, one possibility would be to define a Fussell-Vesely type measure of system importance as the sum of the frequencies of sequences involving failure of that system, divided by the sum of all sequence frequencies. Such a measure would need to be carefully interpreted if the numerator included contributions from failures of that system as a result of support systems. Similarly, a Birnbaum-like measure could be defined by quantifying sequences involving the system, conditional on its failure, and summing up those quantities. This would provide a Predecisional 19-C3 Rev. 0 - January 1998
\\
I measure of how often the system is critical. 'However, the support systems again make the situation more complex. To take a two-division plant as an example, front-line failures can occur as a result of failure of support division A in conjunction with failure of front-line division B. Working with a figure of merit determined by the " total failure of suppon system" would miss contributions of this type.
l In the absence of appropriately defined group level importance measures, reliance should be made on the integrated decisionmaking process to make the appropriate determination (see Section C.2).
Relationship of importance measures to risk changes: Importance measures do not directly relate to changes in risk associated with implementation of a set of changes proposed in an application. Instead, the risk impact is indirectly reflected in the choice of the value of the measure used to determine whether an SSC should be classified as being of high or low safety significance. This is a concern whether importances are evaluated at the component or group level. Therefore, the criteria for categorization into low and high significance should be related to the acceptance guidelines for changes in CDF and LERF. This implies that the criteria should be a function of the base case CDF and LERF, rather than being fixed for all plants. Thus, reviewers should determine how the choice of criteria relates to, and conforms with, the acceptance guidelines described in RG 1.174. If component level criteria are used, they should be established taking into account the fact that the allowable risk increase associated with the change should be determined on the basis of simultaneous changes to all members of the category.
c.
Evaluation Findings The SER should incorporate language equivalent to the following, and exceptions (if any) should be noted and explained.
The information provided to the integrated decisiotunaking process with regard to determining the risk importance of contributors for a specific application is robust in terms of model inputs and assumptions including issues like the use of the use of both CDF and LERF, completeness of the risk model, and sensitivity of the results to data uncertainties, common cause failure modeling, modeling of human reliability, and truncation limits used.
The categorization addresses the effect of the change on groups of components in a way that is compatible with the risk acceptance guidelines.
C.2 Role of Integrated Decisionmaking in Comoonent Categorization a.
Areas of Review While probabilistic importance analysis can provide valuable information regarding categorization of SSCs or human actions, it should be supported and supplemented by an evaluation based on traditional engineering considerations. This will require using the qualitative insights obtained from the PRA, and considering the maintenance of the defense-in-depth philosophy and sufficient safety margins. One important element of this integrated decisionmaking can be the use of an " expert panel." This section provides guidelines for reviewing the licensee's integrated decisionmaking process in the area of importance categorization, and it supplements the general guidance in Appendix B to this SRP chapter.
Predecisional 19-C4 Rev. 0 - January 1998
s b.
Review Guidance and Procedures Identification of functions, systems, and components important to safety: The PRA can provide significant qualitative insights that emerge simply from considering whether and how systems are invoked in particular scenarios. If a front-line system is credited in success paths, it is "important" in some sense, and at least some of its SSCs must also be important in some sense, even if a given single-event importance measure does not reflect this. However, the real imponance of a system is a function of whether alternative, diverse systems that could fulfill the same function. Those systems which are the only means of providing the function would be considered more imponant than those for which there are viable alternatives. A system that suppons an imponant front-line system could also be considered imponant. This does not mean that all such systems cannot be candidates for relaxing current requirements; however, it does mean that components in system trains credited in the PRA should be explicitly considered during the integrated decisionmaking process.
Either by evaluating the licensee's documentation or by conducting an independent verification, reviewers should complete the following steps:
Identify all systems that are relied upon in plant response to an initiating event, whether explicitly modeled in the PRA or not (e.g., room cooling systems, and instrumentation and control systems associated with indications rather than control may not be modeled), and j
identify the function (s) they perform or suppon.
Determine whether failure of components screened out on the basis that they are elements of "unimponant" systems could affect a system that is relied upon in the plant's response to an initiating event.
Reviewers should then verify that at least some elements of each of the important systems identified above are considered " safety significant." If this is not the case, reviewers should ascenain what performance is allocated to these items in the PRA, and whether the programmatic activities allocated to these elements are commensurate with the given performance level. If a system is identified as being imponant, but none of its elements is, reviewers should carefully evaluate the licensee's justification.
q l
As an example, consider the case of a system that contains many redundant flowpaths. Single-event
{
importance analysis will tend to dismiss the flowpaths one at a time, effectively dismissing the group as a whole. The focus of the above guidance is that the redundant flowpaths (considered as a subsystem, and recognizing the function they perform), are imponant and deserve some attention, even though I
conventional importance measures would not highlight them. However, in the case of redundant systems, the solution need not always be to assign every redundant path to the high-risk contributor l
category. In this example, especially if the paths are essentially similar, it is arguably necessary to i
consider common cause failure. Thus, a program that addresses common cause failure potential by monitoring component performance may provide the necessary protection against loss of the function, while still allowing a decrease in some level of commitment on the individual members of the group.
Verification of low safety significance: In evaluating the qualitative risk-informed categorization, reviewers should consider the integrated decisionmaking process and criteria used by the licensee.
In reviews of the licensee's determination of low safety significance for SSCs or operator actions, reviewers should verify that the licensee appropriately applied risk importance measures and accounted Predecisional 19-C5 Rev. 0 - January 1998 l
for the results of sensitivity studies. Reviewers should also verify that the licensee considered and compensated for factors such as potential inadequate scope and level of detail of the PRA (see Sections III.2.2.2 and III.2.2.3 of this SRP chapter). Finally, reviewers should verify that, in categorizing an SSC or operator action as low safety significance, the licensee considered the defense-in-depth philosophy and available safety margins. Section 111.2.1 of this SRP chapter presents review guidance on these topics.
For SSCs not modeled in the PRA, reviewers should verify that the licensee's process determined that the following conditions apply for each SSC that has been proposed as a candidate for relaxation or removal of current requirements:
The SSC does not perform a safety function, or does not perform a support function to a safety a
function, or does not complement a safety function.
The SSC does not. support operator actions credited in PRAs for either procedural or recovery actions.
The failure of the SSC will not result in the eventual occurrence of a PRA initiating event.
The SSC is not a part of a system that acts as a barrier to fission product release during severe accidents.
The failure of the SSC will not result in unintentional releases of radioactive material even in the absence of severe accident conditions.
If any of the above conditions apply, or if SSC performance is difficult to quantify, the licensee should have used a qualitative evaluation process to determine the impact of relaxing requirements on equipment reliability and performance. This evaluation should include identifying those failure modes for which the failure rate may increase, and those for which detection could become more difficult.
Reviewers should then verify that the licensee provided one or more of the following (or similar) justifications:
a qualitative discussion on how the change is consistent with the defense-in-depth philosophy and how the change maintains sufficient safety margins a qualitative discussion and historical evidence why these failure modes may be unlikely to occur a qualitative engineering discussion on how such failure modes could be detected in a timely fashion a discussion on what other requirements may be useful to control such failure rate increases a qualitative engineering discussion on why relaxing the requirements may have minimal
=
impact on the failure rate increase Predecisional 19-C6 Rev. 0 - January 1998 I
L_______
c.
Evaluation Findings The SER should incorporate language equivalent to the following, and exceptions (if any) should be noted and explained:
The categorization of the SSCs or human actions has adequately captured their significance to safety, and has been performed in such a way that the potential impact of the proposed application results in at most a small increase in the risk to the health and safety of the public.
The input to the integrated decisionmaking process derived from importance measures has been utilized, taking into account the known limitations of importance calculations, and the results have been supplemented by appropriate qualitative considerations.
The integrated decisionmakmg process explicitly recognized systems invoked in plant response to initiating events, and ensured that components within these systems are considered for progranunatic attention in areas (IST, ISI, etc.) appropriate to their performance characteristics and the level of performance needed from them.
l Predecisional 19-C7 Rev. 0 - January 1998 t
I Staff Requirements Memoranda dated June 5,1997 and November 18,1997 9
i I
(
Action: Morrison, RES/
4o n %'o,,
,/
Collins, NRR ~
UNITED STATES Cys: Callan.
/
((
NUCLEAR REGULATORY COMMISSION Jordan o
wAsmNovow.o.c. rosss Thompson Norry Blaha June 5, 1997 cares or Twr Ross, AEOD stentrAny Paperiello, NMSS l
t MEMORANDUM TO:
L. Joseph Callan Exec iv Dir ctor for Operations FROM:
.de --
John
. Hoyl, Secretary
SUBJECT:
ST F REQUIREMENTS - SECY-97-077 - DRAFT REGULATORY GUIDES, STANDARD REVIEW PLANS AND NUREG DOCUMENT IN SUPPORT OF RISK INFORMED REGULATION FOR POKER REACTORS
\\
guides, standard review plans and NUREG document fo public comment period.
4ED0')- (RES/NRR)
(SECY Suspense:
6/13/97) 9600025 for conducting public workshops.Tha staff should provide the commissio 9600026 conducted during the public comment period should be ofThe public workshop (s) t tha approaches described in the documents.cufficient duration and dep I
In addition, on its plans for training the NRC staff 1)the staff should provide the Commiss on the risk-informed ragulatory approach (es) etendard review plan documents and.:) contained in the regulatory guidance and in overall PRA methods and tochniques.
Particular attention should be given to increasing b2aic user-level knowledge of PRA methods at the regional level.
4EDO-)- (RES/NRR)
(SECY Suspense:
9/30/97) 9700212 Tha staff should continue to evaluate the proposed decision criteria and the methods of ensuring conformance to the criteria.
Tha staff should also develop guidance on how to confirm the occumptions and analyses used to justify current licensing basis chnnges.
(RES/NRR) 9700213 SECY NOTE:
THIS SRM, SECY-97-077, AND THE COMMISSION VOTING RECORD CONTAINING THE VOTE SHEETS OF ALL COMMISSIONERS WILL BE MADE PUBLICLY AVAILADLE 5 WORKING DAYS FROM THE DATE OF THIS SRM.
' T 7 0 $f h l0 '
g utn M,
n z.- 1, e ;n IN RESPONSE, PLEASE iJ *MAhu
- t 08 November 18, 1997 MEMORANDUM TO:
L. Joseph Callan Executive Director for Operations PROM:
John C. Moyle
/s/
i EUBJECT:
STAFF REQUIREMENTS: BRIEFING ON PRA IMPLEMENTATION PIAN, 10:05 A.M. WEDNESDAY, OCTOBER 15, 1997, COMMISSIONERS CONFERENCE ROOM, ROCKVILLE, MARYLAND (OPEN TO PUBLIC DTTENDANCE)
The Commission was briefed by the NRC staff on recent accomplishments, the status of on-going activities, and future tasks in the staff's efforts to ensure timely and integrated agency-wide use of PRA technology and methodology.
in NRC regulatory activities. The commission encouraged the staff to continue to improve the agency's PRA activities and to provide appropriate review and j
feedback mechanisms to ensure that PRA is appropriately used in a l
i risk-informed regulatory framework and centinues to foster a risk-informed regulatory process.
3 l
The Commission also re?.:ssted that the staff:
in their forthcoming paper identifying the issues raised during e
the workshop on NRC's draft guidance documents include a discussion of how much variability and what degree of uncertainty in PRAs performed by licensees can be tolerated for regulatory purposes in a risk-informed regulatory framework.
y (EDO)
(SECY Suspense 12/31/97) address at the next periaM e briefing on the PRA Inglementation e
Plan the extent to which the commission's objective of establishing a risk-informed regulatory program has been communicated effectively to the NRC staff and to licensees and othsr external stakeholder.
(EDO)
(SECY Suspense: 5/06/98) l l
4 I
9 H u /Oltri 2pf>-
7
.o cc:
Chairinan Jackson Consnissioner Dieus Consnissioner Diaz Consnissioner McGaffigan OGC CIO CFO OCA OIG Office Directors, Regions, ACRS, ACNN, ASlaP (by E-Mail)
l l
I
O e
~
Letter from Advisory Committee on Reactor Safeguards rogarding " Proposed Final Regulatory Guide 1.174 and Standard Review Plan Chapter 19 i
for Risk-Informed, Performance-Based Regulation," dated December 11,1997
wuuvuuuuuu NUCLEAR REGULATORY COMMISSION
(,
ADVISORY oOMMITTEE ON REACTOR SAFE!uARDS o
CtASHIN3 TON, D. C. 20885 y,,
December 11. 1997 I
The Honorable Shirley Ann Jackson Chaiman U.S. Nuclear Regulatory Comission Washington, D.C. 20555-0001
Dear Chairman Jackson:
~
SUBJECT:
PROPOSED FINAL REGULATORY GUIDE 1.174 AND STANDARD REVIEW PLAN CHAPTER 19 FOR RISK-INFORMED. PERFORMANCE-BASED REGULATION i
)
During the 446th and 447th meetings of the Advisory Comittee on Reactor Safeguards. November 6-7 and December 3-6, 1997. respectively, we met with representatives of the NRC staff to review proposed final Regulatory Guide 1.174 "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Current Licensing Basis." and Standard Review Plan (SRP) Chapter 19 (General Guidance) for risk-informed, performance-based regulation. We discussed the staff's reconciliation cf public comments on the subject documents including proposed changes to address policy issues under consideration by the Commission.
Our Subcommittee on Reliability and i
Probabilistic Risk Assessment (PRA) met with the staff and industry representatives on October 21-22 and November 12-13. 1997, to discuss these matters. We also had the benefit of the documents referenced.
Conclusions and Recommendations 1.
We recomend that Regulatory Guide 1.174 and associated Standard Review Plan Chapter 19 be approved and issued for use by the industry and staff.
i 2.
The modification of the acceptance guidelines to allow consideration of very small increases in CDF (core damage frequency) and LERF (large, early release frequency) for a broader range of the total CDF or LERF values is appropriate.
t l
3.
The decisionmaking process described in Regulatory Guide 1.174 and. in particular. its treatment of quantified and unquantified uncertainties, is l
sound.
The staff has correctly focused on identifying the important sources of uncertainty and determining their impact on decisions, rather c$9fi& ddib5-fl7
o 2-than simply using the final distribution as the sole basis for decisionmaking.
4.
The staff discussion of PRA quality in these documents is appropriate. We agree Lith the staff position that the assessment of the scope and quality of the probabilistic analyses should focus on whether they are adequate for the purpose intended.
As we stated in our report dated March 17,1997, we believe that this new process and these documents are a significant achievement that will contribute to the safe and efficient use of nuclear power.
We believe that these documents will evolve as experience is gained. We again urge the staff to seek innovative applications of the risk-informed approach to regulation so that this Regulatory Guide and the associated Standard Review Plan Chapter will be tested and improved upon in practice. We request the staff to brief the Comittee periodically on this regulatory activity.
Sincerely, R. L. Seale Chairman References-1.
Memorandum dated November 24, 1997, from M. Wayne Hodges. Office of Nuclear Regulatory Research. NRC and Gary M. Holahan. Office of Nuclear Reactor Regulation. NRC, to John Larkins. ACRS.
Subject:
" General Regulatory Guide (DG-1061) and Standard Review Plan (SRP-Chapter 19) for Risk Informed Regulatory Decisionmaking for Plant Specific CLB Changes."
with attachments, as follows:
Proposed Final Regulatory Guide 1.174 (Draft Guide DG-1061) dated November 25, 1997. "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Current Licensing Basis."
Proposed Final Standard Review Plan Chapter 19. Revision N. dated November 25. 1997. "Use of Probabilistic Risk Assessment in Plant-Specific. Risk-Informed Decisionmaking: General Guidance."
s
. 2.
Draft SECY dated November 7,1997, from L.
Joseph Callan Executive Director for Operations NRC, for the Commissioners, " Final Regulatory Guidance on Risk-Informed Regulation: Policy Issues."
Memorandum from M. Cunningham to M. Wayne Hodges
" Summary of the Resolution of the Overall Comments Received on the General Risk-informed Draft Regulatory Guide and Standard Review Plan," dated January 7,1998 4
1
.t MEMORANDUM TO:
M. Wayne Hodges, Director Division of Systems Technology Office of Nuclear Rogulatory Research FROM:
Mark Cunningham, Chief Probabilistic Risk Analysis Branch Division of Systems Technology Office of Nuclear Regulatory Research
SUBJECT:
SUMMARY
OF THE RESOLUTION OF THE OVERALL COMMENTS RECEIVED ON THE GENERAL RISK-INFORMED DRAFT REGULATORY GUIDE AND STANDARD REVIEW PLAN f
The purpose of this letter is to document the stars overall review of the comments received from the public following the workshop held in August,1997, to discuss the stafs draft guidance documents on risk-informed regulatory applications. Discussed herein are the comments received on draft Regulatory Guide DG-1061, "An Approach For Using Probabilistic Risk Assessment in Risk-informed Decisions On Plant-Specific Changes To The Current Licensing Basis, " and the accompanying draft Standard Review Plan, Draft SRP Chapter ig, "Use Of Probabilistic Risk Assessment in Plant-Specific, Risk-Informed Decisionmaking: General Guidance."
In addition to the comments received at the workshop, the NRC staff has received approximately 42 sets of written comments. Attachment 1 is a list of the organizations and individuals that contributed to the public comments; however, it should be noted that some organizations commented on only a limited set of the documents issued for comment. Comment letters were received from the Nuclear Energy institute, (NEI), the Electric Power Research Institute (EPRI),
the American Society of Mechanical Engineers (ASME), the owner's groups for the four reactor vendors (General Electric, Westinghouse, Combustion Engineering and Babcock and Wilcox),
one vendor (Westinghouse),18 electric utilities, one national laboratory (Oak Ridge), five technical organizations, five other private industry organizations or individuals, and two anonymous commenters.
I is a discussion of the stars resolution of the comments. The discussion is organized into three parts: (1) stars resolution of major issues, (2) responses to individual comments and concems from nuclear utilities, industry organizations and members of the
. general public, and (3) responses to the stars questions in the areas specifically requested to be commented on in the Federal Register Announcement for the workshop (62 FR 34321). The discussion on the major issues in Attachment 2 is the same as that included in the Federal Register Notice for the final issuance of Regulatory Guide 1.174 and the accompanying SRP.
This document does not discuss the comments received on the application-specific draft guidance documents such as IST and Technical Specifications. Comments for these topics will be discussed separately when the application-specific regulatory guides and SRPs are finalized.
Cmments teceived on draft NUREG-1602, "The Use of PRA in Risk-informed
Applications," are also not addressed sitt e that document will not be finalized at this time, but will be used as input to staff PRA standards development activities.-
Attachments: As stated CF Y
N PD Y
N R
Distribution: DST Chron BHardin MCaruso MCunningham TLKing, GHolahan, GMizuno DOCUMENT NAME:p:\\comsatt2J05 Te receive a copy of this docuument, indicate in the box: "C" = Co r/ without enclosures "E" = Copy with enclosures "N" = No copy 0FFICE RES/PRAB RES/ DST NAME MCunningham TLKing DATE 01/07/98 01/ /98 01/ /98 01/ /98 01/ /98 0FFICIAL RECORD COPY (RES File Code) RES
r t
COMMENTS ON REGULATORY GUIDES AND SRPs RECEIVED BY THE STAFF' (listed by set of comments received)
- 1. Oak Ridge National Laboratory
- 2. Oak Ridge National Laboratory (additional comment set) i
- 3. Detroit Edison
- 4. Jerry J. Cohen
- 5. TU Electric (Commanche Peak)
. PLG, Inc.
6.
- 7. Entergy
- 8. New York Power Authority -
g.
Northeast Utilities System
- 10. Combustion Engineering Owners Group
- 11. Southem Califomia Edison
- 12. The B&W Owners Group
- 13. The Nuclear Energy Institute
- 14. Jebsen/Kukielka/Mattem
.15. Performance Technology
- 16. Commonwealth Edison Company
- 17. Carolina Power & Light Company l.
18.. Westinghouse i
ig. The Electric Power Research Institute
- 20. Baltimore Gas and Electric Company
-- 21. North Atlantic Energy Service Corporation
- 22. Oak Ridge National Laboratory (additional comment set)
- 23. Holloway-Atomic Weapons Establishment
- 24. Detroit Edison (additional comment set) l
- 25. PECO Nuclear
- 26. Tennessee Valley Authority
- 27. The Wesley Corporation
- 28. Westinghouse Owners Group
- 29. Duke Power Company
- 30. Houston Lighting & Power-South Texas
- 31. Arizona Public Service - Palo Verde
- 32. Patricia Campbell-Winston & Strawn
- 33. John G. Stampelos
- 34. Anonymous # 1-
- 35. Anonymous # 2
- 36. Gregg E. Joss
_37. Randy Fitsgerald - Winston & Strawn
' 38. Frank Krowzack - Commonwealth Edison Company 4
'In some cases only a limited set of regulatory guides and SRPs were addressed in the comments, e.g., some commenters did not provide comments on DG-1061 or SRP Chapter 19.
Al-1
- 39. Boiling Water Reactors Owners Group
- 40. American Society of Mechanical Engineers 41, TU Electric - Commanche Peak (additional comment set)
- 42. Global Nuclear Alert Group d
Al-2
DISCUSSION OF RESOLUTION OF PUBLIC COMMENTS l
- l. PRINCIPAL ISSUES This discussion is the same as that given in the Federal Register Notice for the finalization of Regulatory Guide 1.174 and the accompanying SRP.
d
- 1. Use of 10 Per Reactor Year Core Damaae Frecuency As An Acce&nce Ge!&!ine.
}ggg: Comments were receivedIrdcating that the use of 10* per reactoryear(ry) core damage frequency (10 Vry CDF) as an acceptance guideline was overty conservative, that the quantitative health objectives (QHos) would be more appropriate for use as goals, and that it was not clear how closely staff reviewers would hold applications to this numerical criteria.
d Resolubon: Revised Sechon 2.42.2," Acceptance Guidelines," of RG 1.174 addresses the use of 10 /ry CDF as a guideline in evaluating the acceptability of risk-informed applications. The use of 10"/ry CDF as a subsidiary goal is consistent with past Commission guidance. Figures 3 and 4 of Section 2.4.2.2 illustrate acceptance guidelines for CDF and containment large early release frequency (LERF) and indicate that for each of these metrics, three ragions have been identified for use in screening acceptability of proposed changes in current licensing bases.
Region ill, shown in the figures and discussed in the text, has been identified as representing a sufficiently low CDF or LERF increase that, in general, program changes associated with this region may be permitted without a detailed essessment of the baseline CDF/LERF. As discussed in RG 1.174, if there are indications that the baseline CDF cnd/or LERF are above the guideline values, additional evaluation would be needed even though the calculated chinges in CDF or LERF are small and in Region Ill. In Section 2.4.2.3, " Comparison of PRA Results with the Acceptance Criteria," it is stated that the acceptance guidelines (lines separating the regions) are not to be j
interpreted in an overty prescriptive manner and that they are intended to provide an indication, in numerical terms, of what is consxiered acceptable. Graduated shading has been added to the guideline figures to indicate regions in which proposed changes will be subject to gradually more intensive NRC technical and management review.
Regarding the use of the QHOs, in Section 2.1,
- Risk-informed Philosophy,"it is stated that the use of the QHOs in lieu of LERF is an acceptable approach provided that appropriate consideration is given to the methods and i
Assumptions used in the Level 3 analysis and in the treatment of uncertainties. Also, in Section 2.4.3, " Integrated Decision-Making," it is noted that Level 3 PRA information can be submitted and will be considered in support of those cases in which increased NRC management attention is needed during the review (e.g., when the calculated CDF/LERF changes and baseline values are close to the acceptance guidelines).
. 2. Definition of Risk Neutral
}ggg: A number of comments were receivedIrdcating that there was a need for a definition of risk neutral applications and that increased NRC management and technical review should not be required for risk increases below some threshold.
Resolution: See responses to issues Number 1 and 3 addressing very small increases in risk.
- 3. Allowance for Very Small increases in Risk A2-1
issue: Comments received stated that facilities with CDFs greater than 10'/ry should be allowed small risk increases and that the level of effort and information required in submittals was excessive for small risk Increases.
Resolution: Section 2.4.2.2, " Acceptance Guidelines," addresses the treatment of small increases in risk using the metrics of CDFand LERF. As noted in the discussion for issue Number 1, this section has been revised and now includes a special category of application in which the estimated level of CDF/LERF increase associated with the application is sufficiently low such that, in general, program changes associated with this region may be permitted without a detailed assessment of the baseline CDF/LERF. This category is displayed in Figures 3 and 4 of Section 2.4.2.2.
- 4. Treatment of Uncertainties issue: Comments received stated that inclusion of uncertainty could lead to confusion regarding the decision criteria and that the use of PRA inherently takes care of uncertainty.
Re:olution: In response to this comment the staff considered several attemative approaches to the treatment of uncertainties, and it was concluded that the approach that was described in the draft regulatory guide (DG-1061) cppeared to be the most practical and useful approach at this time although there was a need to clarify the text for this subject. Uncertainty is addressed in Section 2.4.2.3, " Comparison of PRA Results with the Acceptance Guidelines,"in Regulatory Guide 1.174. In this section, it is noted that it is important when interpreting the results of a PRA to develop an understanding of the impact of a specific assumption or choice of model on the results.
The impact of using attemative assumptions anj models may be reasonably evaluated using appropriate sensitivity studies. The major sources of uncertainty should be understood, but it is not always necessary to perform elaborate uncertainty evaluations (e.g, propagation of uncertainty distributions).
- 5. Quality of PRA lssue: Numerous comments were received Indicating concern that the PRA standards included in draft NUREG 1602 were unnecessarily high for many risk-informed applications. It was also indicated that the requirements for PRA quality were not clear and that graded levels of PRA quality should be provided for 1
different applications.
I Resolution: The issue of PRA quality is addressed in revised Section 2.4.2.1 of RG 1.174, entitled, " Scope, Level of Detail, and Quality of the PRA." In this section it is stated that PRA quality should be commensurate with the application forwhich it is intended and on the role that PRA results play in the integrated decision process. A PRA used in a risk-informed application should be performed in a manner that is consistent with accepted practices, and be commensurate with the scope and level of detail which are also discussed in Section 2.4.2.1 of RG 1.174. The NRC has not developed its own formal standard nor endorsed an industry standard for PRA quality, however, it supports such a standard and expects that one will be available in the future. Draft NUREG-1602, "Use of PRA in Risk-informed Apphcations," was cited in draft Regulatory Guide DG-1061 as a potential reference for PRA methods that could be used to support regulatory decision making. There were a number of comments indicating that tb
'PRA standard" represented by draft NUREG-1602 was excessive for many risk-informed applications not requiring s:phisticated or state-of-the-art methods. While it was not intended that draft NUREG-1602 be used universally cs a PRA standard, it is recognized that it would be more useful to have a standard that addresses the differing needs for PRA scope and detail depending on the application. Accordingly, draft NUREG-1602 has been removed as a reference in RG 1.174, and a standard is being planned in a joint effort with the industry. Other means for ctddressing PRA quality include the use of peer review and PRA cross comparisons. PRA peer review activities A2-2
such as those that are presently being done under various industry PRA certification programs are examples.
N:ither peer review nor a PRA certification or cross comparison replaces a staff review in its entirety, and licensees nsed to provide justification why the PRA is adequate for the proposed application. In the interim, until a consensus l
PRA standard is available, the NRC staff will evaluate PRAs submitted in support of specific applications using the guidslines given in RG 1.174 and Chapter 19 of the Standard Review Plan.
- 6. LSSC Monitorina Needs lwu,: Comments receivedindicated that the draft guidance placed too much importance on monitoring of Icw safety significant components (LSSCs). It was also indicated that monitoring performed under the M*intenance Rule should be acceptable for risk-informed programs.
Resolution: Section 2.5, " Element 3: Define implementation and Monitoring Program, has been revised to clarify monitoring needs for LSSCs. While details for monitoring LSSCs will be provided in the application-specific guidance documents, the following principal needs should be satisfied for all applications. Monitoring programs should be proposed that are capable of adequately tracking the performance of equipment which when degraded could alter the conclusions that were key to supporting the acceptance of the program. It follows that monitoring programs should be structured such that SSCs are monitored commensurate with their safety significance.
Monitoring that is performed as a part of the Maintenance Rule implementation can be used in cases where the SSCs affected by the risk-informed application are also covered under the Maintenance Rule.
- 7. Shutdown and Temporary Plant Condition Ivu v Several commenters noted that the guidelines proposed did not distinguish between power operation and chutdown and did not address temporary plant conditions. Separate guidelines for these conditions w:re suggested.
Rscolution: In response to these comments, Section 2.4.2.2 of R.G.1.174 has been expanded to address the shutdown condition. Specific guidance for temporary plant conditions has not been added, but will be considered in a future update of R.G.1.174.
- 8. D? cementation Needs issun: Many commenters stated that the documentation requirements in the drafts were excessive and unmanageable, particularly forproposals involving small changes in risk. It was also suggested that certain documentation items should not be required to be submitted for the staff's initial review, provided that more complete documentation be maintained at the utility if the need were to arise later for its review.
Resolution: In response to the comments received, Section 3 of RG 1.174 has been reevaluated to determine what items listed in the draft were not necessary. As a result, a number of documentation items, particularly with regard to the PRA, have been removed in the final regulatory guide, and the SRP has been revised to be consistent.
- 9. Overall cost benefit inun: This issue was highMqhted by NElin its comment letter and was also included in a number of other commentletters. A concern wss expressed that the resources required by licensees to prepare proposals tnd to subsequently implement NRC approved risk-informed changes to the CLB willbe too high considering th2 benefit in terms of burden reduction.
Resolution: The question of how cost beneficialit will be for utilities to prepare proposals for risk-informed changes to th:ir current licensing bases and to implement such programs after review and approval by the NRC will only be A2-3
d fully answered after the industry and the NRC gain further experience in these types of programs. Certainly, the pilot plint program proposals that are cunently being reviewed for application to technical specifications, graded quality cssurance, and inservice testing and inspection, will provide useful insights into the potential cost savings available through these programs. While it is not the NRC's responsibility to ensure that such risk-informed programs are cost beneficial, it is believed that such programs can enhance safety by better focusing utility and NRC resources on the most important safety areas in reactors, and this philosophy is consistent with the Commission's policy statement on the use of PRA methods in nuclear regulatory activities. During the preparation of the final regulatory guide and standard review plan section for general guidance, attention was paid to those areas where utility r: source needs could be reduced thus improving the cost-beneficial aspects of the risk-informed process while still maintaining an appropriate level of safety. Examples of sections in RG 1.174 where this is reflected in the final guidance are Section 2.4.2.1 entitled, " Quality and Scope of the PRA", in which it is stated that the level of detail r; quired to support an application can vary depending on the application, and that not all applications require that cn expensive, detailed PRA be acquired; Section 2.4.2.2, " Acceptance Guidelines", where a special category of risk-informed proposal has been identified as having a sufficiently low estimated increase in CDF and LERF, that g:nerally for such cases, the proposed program will be considered without a detailed assessment of baseline CDF/LERF (i.e., Region 111 of Figures 3 and 4 in RG 1.174); and in Section 3, " Documentation", where some of the it:ms that were identified in the draft regulatory guide and SRP as being needed in program submittals have been ramoved since they were not judged as necessary.
II.
RESPONSES TO INDMDUAL COMMENTS AND CONCERNS EXPRESSED BY NUCLEAR UTILITIES, INDUSTRY ORGANIZATIONS AND THE GENERAL PUBLIC Tha table below contains responses to public comments on draft general guidance documents that were issued for public comment in June 1997 (62 FR 34321). These documents included Draft Regulatory Guide DG-1061 and draft St:ndard Review Plan (SRP) Chapter 19. While all comments submitted to the staff have been reviewed, explicit responses are provided here for those comments that reflected significant issues and concems regarding the staff's proposed approach, including differing views on an issue. In reviewing the comments received, the staff observed similar comments from multiple sources in many cases. In the table that follows, the text provided under the
" Comment" heading in column 2 is taken from one source, and best captures the similar concems or issues expressed by the other sources listed in column 3. The acronyms for the sources listed in column 3 of the table are d fincd below.
Acronym Definition APS Arizona Public Service Co.
AWE Atomic Weapons Establishment (United Kingdom)
B&WOG Babcock and Wilcox Owners Group BG&E Baltimore Gas and Electric BWROG Boiling Water Reactors Owners Group P. Campbell Patricia Campbell CEOG Combustion Engineering Owners Group CP&L Carolina Power and Light Comed Commonwealth Edison Co.
DEC Detroit Edison Company DPC Duke Power Co.
El Entergy Operations Inc.
EPRI Electric Power Research Institute GNAG Global Nuclear Alert Group A2-4 l
l l
l Jebsen M. al Jebsen, Kukeilka & Mattern
)
NEI Nuclear EnergyInstitute NYPA New York Power Authority North Atlantic North Atlantic Energy Service Corp.
Northeast Utilities Northeast Utilities System ORNL Oak Ridge National Laboratory
- Performance Technology Performance Technology PECO PECO Energy Co.
PLG PLG Inc.
~SCE Southern California Edison WC The Wesely Corporation l
WOG Westinghouse Owners Group / Westinghouse Electric j
workshop Workshop Comments (from transcript) l l
)
I i
l A2-5
S o
t ye l l s
e rb s a c
aela 'n s na i
ea oO r a sH4, t
d gvi 2
a i
s h
ug at iQ7 t
e m
1 eh y
l s
e r
r d e nb mh1 t
u os shait.
t n
ad otfG s
t a o ynCoR l i wn ut c a e f
e i
gd e
nl h n
f m
e t
n 9
e e at si a n u
ts e e r
1 s
ucf o r,d o
t n
qit e
t e c e c ed ps a i t h
r o
r at s s t
n l
f r nvu e
e p
n i
p s
e pe el h
y d a t
c o c et e
gt nwe t
ci i r l
l r
e i
l f
a a si o R
mo eH wd o i c p
d h
n p or C
f a mh t
f d
. o s al e
t e
a md P
a et t n
l R
S ovt mi inl o ed a e a
s n s
t mG rih e
l a u h
s d s y s
c o S
r gis e n uet d e i
t pn yi Garf n
e s
t a
a i
a a e f
h yr cle a
t c ui d
.kS s r l
s r
s n oi s s e c n
d ne eP u eis e n u
g e r 'n ri ia r n gh qrla e gi o a c d
t n
nefo oc i r a s is f u af sGan s es f
s a
i i
a mee sa m 1
sl yt d
t t ct p f e m e
si f ai e e f
r m
6 f
0 a ehf c a co h er e e a c t
l t
n sic Tp 1
S r vS a
-G 1
A D 6
n e
o t
2 l
c A
b s e
at j
e e
e n
b c s c s c s Te u
a i t i t i n e n e n e n
a n a n m
S l
pe pe t
l l
pe m
ed ed ed ci ci ci o
c u c u c u ag a g a g C
c i
l s
b e
i u
P e
it c
l i
i c
e t
t o
r c y U
n t
u ng a
t l
1 GG ao s
t 6
s o
a A
0 e
S mlo e
OO A hG s
r n h
1 WRIRPt oh n
&WPYo&S G
t f
o r c r
r LP e e o
p PT N
BBENNPA D
s s
e a
R f
d e
o k
s l
e l
f n cd i
s w
e r
fi s
f o n e e y vel it i
a it a s v
s n
t st ai ic e
obla e
S t
epbt l
n bl m d
n ue c o i e ai l
ee l
i qc rjP e
c ab f e v t
s a
oa oic.
F s y
di e
r m
l t
l Dd v s
e t
lo t f a yo n u e o gf o Cu a u
l m
noh rG.
i h
o e
f t o
yt a ee h
i o
mt si yt a c y
h o.
v t
t t
n nr is t s e
C mdiednie e gn a a o w yd r
e sf t
s P
l oli ib a m ut ea s/
a 2
r e c alvd uS e m pb l n4 we e
t s
t e
u e
- o r h ei e a oct g aEl c h un h t
r c o e n
l Tt got S P a nr PI lai m.
uN 1
2 3
f!lll l
l
nr e
n o
c o
i f
n it s
e r
a c
c eF c o
i g
fd r
u nRn i
o.
e d
a ut e n
e aE d ng t
t e cr hLi e
e a i
c u
d g c a ei gf m il i
s r r c l
i n np oe n
l e
l e
a a f i r
f e o f p -
h u
mFt s e c r s n p
d -
i s
hl yD m et p
et a r n m rCo b
e a nh e a e
r yi t g
dl f vef po a s nn s
i 9
t yud mh oe nnn i
i 1
e r
nov s
sb oio l l t
c ni os o edi s t
oa e
rb m at e r
t ena si t
r t
a p
o e
mced es oa e f nr i
r t
rd a
t l t
c ei eo n s e ad ua s
f h
lb s e e rb m fi n C
a e e s o t
s ei e nc t inb n ah s mo t
P pl i
e t
e e e oh oce R
cd v ci a pd r, t S r p l
t n e n o
S a uh vio
.f m
a a gs h
ep s d a t
sh e e s
f t
c g n wf ei x i
t el e a
s r
n n o oo r a eiHe gvr s s
a a et a
og d
dt h r a s
s eF n n pc gc
.u id a i
r d
v if el ais l
t e
.a n
f cl f pnh f s s c a s
pet nn a
f f
f aAm a a a oot my t
t t
s s
1 s
s e f
sii s s o 6
ek.y ui emct eii c c c r
9 h s e h o o s
h e e r u
Tiv Tsdj Tdd o 1
r G
1 AD 7
n e
o 2
l A
b s at e
e e
n c s c s c s Te ne n e n e a n a n a n m
i t i t
t i l
l l
pe pe pe m
ed ed ed ci ci ci o
c u cu c u a g a g a g C
c i
lbu P
o t
s G
G G
O e
G O
G G
I o
ENVWO &E CE W
p NGTBWBC SC B
seR r
F f
e o
s f
Dt ei l
s u
Fl us a
sCl al y e
t t
e a o Dmal.
hl d
n Cs va u
a S
n s
n s l
nb i
na e c c s s p leoa r
ya i i f
s e n s
or t if yhh o d
t id o.
f e e ya t
t s ol ci ue nF e vmn e
&e nnh wr s
ai e
ir gs a R
a ea c t
r
. c oawt u e b F, E os t
n t
c mf ue moi ys e n.
ri nt t
a neRL ik ;c e g pr ons r
r a r et t
P abE r
s os n g
m et i c
s fi R tpd L o e
e ur i
F g wd al a
il e niS A
t elu F
nRnml Ce s ud o c/
c i
oEa or Rv n gi c eG c odd i
r o e oe u h n h
n p As aC PLcff Nr c r gi sR 4
5 6
1llIi!!ll!
)l i
4 l
k a
7 l
l c e a c f ab mi 1
ri n
ot r sh e
1 ns c c
r e G
s ye oe e r
oc R
t e
e mn i
sd a vd a
f e.
tc nd t
l e e n
n op ob nl ad it s
ni a
e a
t c
mt 1
l i
4 c i
ot F e r n c
2 a e e e a v
aRd pm i
na t
l u
pe o
ah El oe t t s
ich c
i n eL n t
g nt c n t i 9
e c/
i s a n.
e mnF e an r
i o
1 a
P e y Si uaDb o
ec t
r cd m
f wl np e
oiC d s
i o
i t o o
u nl ed t
s d gi u
c e t
e p p
e s s ns nb n3 o
ol l
a a a e
h feh pa e
i gs d e mio h
t t
i r a v f
C d ant uc ehG t
e a
t s
t h h gn a ny cL et as e
P nec st si e i
t ot pe t
R eh n
t t f xh u
e a e o i
mt vi d o hl a et S
t e yi t l t
eS s a eh f
t aa t
r t
l t
a si d
e ih f
pirl mt vw e eh d
t i
t a
pa uri ih t
r r
ul c mfom e
i t e
f a
rk d
s s
d s oun b s
d t i e si oc n vl at ci u a r e a e c d
h t d h n ml s
f s
r t n
f 4 r e s i
fi s e e s
ot f 7 p a 'e gw in a e r
f s.
h yl hk a
e a
a a1 e
eles s
t t
e a
1 s1 r l
r n n e f r f
m 6
e ad f
f 0
hGd e e e a v a e u i
a i
1 TRatnhic h h e t
t o
l Tcr S c g St l
G 1
AD 8
n e
2 o
l A
b s e
e e
e at n c s c s c s c s Te ne n e n e n e a n an a n a n m
i t i t i t
l t i l
l l
pe pe pe pe m
ed ed ed ed ci ci ci ci o
c u c u c u c u a g a g a g a g C
c i
lbu P
o t
s G
G G
e O G G
O G O
G s
A n
R O AA R O W
CI N A G l
S o
BC NGTBC B
DN G TWA seR st e c d
e t
f e a ef ue ma r
f s p t s o
b s nu r
a nmn n eat
- u o
p t
ei o emcem s4 s f m i
i r
S ic es r
es e vet b ebl eo ri ge g
i a e vi l
pc t
l d pi s l
a pF ei ch od.
t ot nb i
s l
a i
f a
s c et t
uh e wanuD nO l
o unj;.
oAQ al t
rC ib n
nmcb mg s
r s
I s P oet e
e l
ut d e
n i
a mc nl e d "n uy onyn pR o t
t i e s e e
a u rl t
opt ns gi a e s rkl od.
l c ph e a o o /r yidiaid s s
i i
qrl m
i r nb0 e e s u n w3 i
e c et s4 u al s t
ri t
l l l
b go loe u et akr c e a -
f t
l c
vs nt fE ai u nn Rof s e l
l r
Ait o1 S csii Alee oird
" a r
t 0
7 8
9 1
j lll 1l lll
iAF f
4i e
s a
7l Rg r
a t
v t
n ni d
ef 1
u in
.Ea et S
9 i
m Lh c
s1 e
me l
rf 1
a a
f e
nCr lpe r
i r ot d m Go gei a
f cSl ur Rn nt el.
a p gl d mn g. ofo n eh ino h a a e oa n
i ch a mt c e t
id ivs a it e a
" Ch si yd ot yp c r lap ym c e o.
n gl l
c ei 9
vehl y a et v
r a
e e h
mRa r
aj o
t e
t 1
b c
d ni sS o l
t t
t vp r
r t
v n r
a ot p
iuim a
oe e el e
h Cnd u geb yd yb i h s s t
t r nRo t
e e p
sR r n q h u e
t s
l a/
s inl t
a s
iNooe d
p v
i t
r n s e
" 46 n
n e ic a
l isf n
r e
io el 7 0d a od n h
ior e s s g d
- e i i ehi t
s 1
C it ime a
a1. E r it u r n
n mg id r s ei e e is g p t
s I
s P
oeh m m dd
" G ni d
e o e g ad a prpwoa sh l
a nt pc n R
laR Cd d a n f
f niy h o n S
a g et i mn f
t f
af a
n e e c a at s aB t
si s t
sih r ah t
pi L
s s eh.
S et t
f Si r o
r t
t e r t
e c
o 9C d ml a rl
. c a
r a
. od a l
t c s p
e r F y r
s e a g
t ish 1
s r
r e
n e DRrgm e
o a
d e c nt i s
c et n
r e odd orh i
t e a f
/ a s e
,f e e C7l r
d gr c n a
e int e."p r
e po d v d
g n
a. ye g r
s at s
t n0 e e ai i
s
- r r s
,a a
i S.l me g
ah s a ai eEa e i r gI h id d em t
r a
e d
t Un ml hcg hi 1
t f hd T
e f
f f n n c s t
a 6
P n l
r oa nin f
f f
f 0
a a r c o a
ara a a a ah a o o n ueG S
SS c S q ct wc S
a" uh h o
t t
t h
t t
n r 1
Si c r
-G 1
ADn e
o lb s at e
e e
e e
n c s c s c s c s c s Te n e n e n e n e n e t i a n a i a in a i a n n
n m
l t i t
l t
l t
l l
pe pe pe pe pe m
ed ed ed ed ed ci ci ci ci ci o
c u c u c u c u c u a g a g a g a g a g C
c i
lbu P
o l
t le G
s b
e d
G G Gm Od s
E L
E n
C S m
& O &
Oa W
o P P o
P L
E.
&m C
o p
D A C
f d
n i
f lu o
r y n
l it l
e a
oc a
yc i
t o
f n r
s e
m ya r n S
h r
f "s.
gms o
s o
e e t
n i t a a ei n u n r f bd p i
a e y y
a.
q e e l
le e c g h
e sa mie o t
r Ra oi s
t df n n c e v f ob c r
c o
/
s gm i
a a h
4 a
- d al gg.
idh ot "
o c u at l i ue s
0 s e E et y a e u
ed n nf ni v c
t i
s n n o
oisi n
y gg s
t l
s I
e o Rmb r
di a it e e vn v e e a n
u
/ a a ei rf a
e" al s ii r mt
= e c p al 4 d n dl a
id gdll ilpnh ed s ut o
vn e
a ic c le e Fb d u 0 e s
- r a ou rk m n
Dt n g E o e rb t ji s
pi ib u o o
Cnfue r
1 c r P"
n i "s Apwogc r
i r 2
3 4
5 1
1 1
1 1
1
p e
nh k e oe oma y g
p ui n
i r a t
s 4 nh qch e ms a
5 t t r et r
t a
e nt s ir e c e r i r a tpr e r
sf r l
r oa nh f 9 poh t
r a e e g ea t i et o5 n
F e h pr n sh p a e e e inn gii t e
P a e os e o ct t 0 ioe c
r nl h Cs at m
.n ei r 5 t
af e ct a Rhi e
,ve a
p a )y a P
f r n t
t Ryat a n n F
ak4 n g pR msl d t
at od oi C a n a7 on pi aF e( pu s
S s y h a m1 c al sC xB a g w
,t i
i l
uil 0
t p
rh a o1 o c v a0 eL d
7 n gvb 8 e ei r e Gf yo e1 nC e "c 9
n e 1
e x s
t 1
a m2 ige a o s
v wr e u 4
a ni r
u o s
7Rlynp f
a -
h s s eii s t t
r 4 s7 t
a l
c t
n ni n
p s
r h e e e
7 e9 e n p fi d e 1
e i s s a ot d oi bI r
e d
h 1
s n poip t
1 h Y
i t 1
d
.d o
n oe t d eC ihi pt us p
o t
,dGf e t
s us g n-e s a
a dCl reR n
h GeEulyd aRosuh N i
s e e o t
t r
r v oe un e e t
t e e ogci 4.
t C
ras vp n x s l
e r
t h
t t
g d r t
n np7 a c s e xi ei f er ns r n m P
ot in ai u a w s "s n "s h in is o Ah a
a a e
t m1 t
nt s ed ope c h
n r ei eb o f
ai oi i
od Rc pe1 r
R o
t e x s c s yu c
c eG Hh a al q e
P r S
io a s s
d.
f t
e a
s a d
t
.fb eb pe ot gh c"
a a
R s
r sl e n t
f r e u e e u c e S Bt gt g mr f
h t
t s
nt l
a l
cd od a n gsi gon m
.L s n ni s s e is ni a
e r
ni o e d
r n n
r v ni s wa s
si s g
n s u
i o
t oa it e
ad n a t id u eCe nt n n
e n rf d
t d
nh s oh c
h si ef e a ed a o
o t
ci,u o r
o ch c eh ni f s nd id e cAc t
d r
yd gd g
,i t i d c f a e
i t
a od v y
a n yl l
r l
n r
. a r ei a ed e t
s n
r c
,o u a s na pe c i
t 1
e o gi o omn d ioi t t
s f
e n e e a e n mt a
c r e o a
r r
un t
e np e e t d a a c ge s n s si 6
h pnipe r f it o
a r
r l
n s
d s e n
t ni f ib r nr i
0 mad mvfiod s
e n iu e pa e ue u t
e t
af e
u t
e mc c c oc h o x e e n ehd e n
1 I
t c at di g Sd a"
il "
ni Tc Gh e rb l
t G
1
-A Dn e
o e
e e
e l
g g
g g
b s n
n n
n at a
a a
a n
h h
h h
Te c
c c
c m
e e
e e
n n
n n
m i
i i
i f
f f
f o
e e
e e
d d
d d
C c
i l
s b
i e u
t i
c i
P l
i l
t t
o nle U
ab t
t
't p
s s
Am a
e G
G O
Lh a he sn AA AA C
&t C t
I I
r r
o ENV C ENVE P o.
N o
p NGTW NGTP CNP s
eR e
t d
f a
e l
f e
p a
eR ni u c
o h
r a
t 4
o,
i g
F is t
t c s n
o.
5 o s r h
nC.
uh t
s e S
s t
nt e
,c o0 t
gAe aBmr e
ns e
r i d e
1 ct s
1 d
0 aP u Li o nt c"
o isf g
RC L
,in n
ri d
6 nSi P
o od G cRn Ff
. ni a s a ot ns 1 h s
t I
f a e
d n
d u
r o n s
o iAl oi Coe o s o u
a i
n t
DryP o ni t ia t o ot gR v mat 0 n ia Ei a
e ic p a
orl ci t
a 1
t c
eP el m d r n o wc fi pu e pi iv d p o "5 iv px df t
e i
oiogs f
9 a pol n r e n mi p
ei pr e e e oe o
e c
a pml l
x op sf e poc x p r s0 r n o EteFA Ud a t l
e s P u5 P ot i
6 7
8 9
1 1
1 1
f
e ce n r h
u r s
b ws o e
Di it qf i
t l a
a l
r h
g B
ld oi f e o ed nt ogs mn okj e
r L
u n
Hn molo i moo a nv s e i
r nl C
o et
. o af o it a e r
woo oll i m t
r e
d p ni gnn a at t
h s
e n owe c n e mr nf a d or t
eit f
r o.
o af a
s e r e o
eMpr n
a t
s t
i t
n al or t
t gd) oh pf e 9
e e laS p
s n s
e n sA it n
miw t
e l
u ci nR nol gm a
d r
.i n
gwt n
1 a
oc ad oo e
hi ie e n a i P e
r a e t
r r
ni r n t
t c u gvd.
omis a e at v oe a t
e n u i
r mmys ol e y p
f q in e ed t
rhi a o c g f mn in r
ur oe u
c a
r t
r a
r s
g t
t ip P 'e c oad s o n l
e od of s
s t
i h
r s c u n s e la xl i o y e
di ela c C
og ep r
p nl c pe e o a e e e n ed c e e P
pl oat h s e
t a a et nhi h e vn t
n e n S
in gwe g l i i w (n u o shl n
s t
t R
n ei u l
b e
r s
t u
c d e e u
go e ub wd c
l l
id ni wqye e e
r n
e we ai t
t s a a y p r zt ya ie el i e r
f t
s f u r
l v
hl e
s is ai la efymri a
a h e e
v ed c
o h d
ah r
gr ki t
t t
l n
e dl f
oh v
ri r s t
s d
ish et e
e h p oin e
t o
4d s n nh o e.
nt t
s d
ms a oi n e m7 g
a e i
i c
Tc f n h d t n
k r
n r
r e1 y
o m pio h
oi fi o e a s
i r t
t s
r f
a 1
f r
1 gn ind r a a
le e a o n s.
d r a o
ei wwu t
l e
d ai id.
t t
- e p ic ahGb n
s l
1 e
g a pl uf 6
n u k
t Rpgla h 0 ova e e6 uit e a p t f i
s 0
s lo c af p
i a n Uv Rt it a
At oc e v
T1 wrehh r
1 s
t t
-G 1
ADn e
n n
o e
e o
ito l
g g
it b s n
n a
a at a
a t
t n
Te h
h n
n c
c e
e m
e e
m m
n n
u u
m i
i c
c f
f o
e e
o o
d d
d d
C c
i lbu P
l l
o a
a t
t t
G s
e e
es n
n E
E O G n
e e
&WOS s
s o
b b
G G&EP p
e e
J J
B BBCA seR x
d id h
wtodl f
lu t
c f
u yn Au s
r o
n e
ln c s io Rm r
a u
a o
o s e o h e pw rAof e v o
t f
h S
n P
s s g i
si p
ore s n ntsB uaA K f
itn a e f
t o
gd ot r
d P s ehL ch
,x lo n psl f oiip s
c0i nr m gC id d 5 h e d
a of a e is os v o it n
sh ri nhed r
d et e n s ai s s
l ma pd.
e wP ei n.
t iui e
r t
u r
r qk gs o o Ad sh h s t
r P pe t
ol nd n u l
hl
. e ai a e e t
a e s hf i
t mt nR n
r r igs yt et c
t s
ui s
t d
fi gn a akCanh i mngnr lc m u e la g i
TiF a
nd c u l
r e o nb oq ab ah r eish e t
s 0 e
uh r ou e
L ucb Sir 1 Rb lCs c we c s Dr 0
2 3
1 2
2 2
2 a
i
P s is ei e it r
hf pt a Re ni h e s t
a e -
v Ts ys ic h
t io e ge S
n el f
eh e e el r d t
r d
a
. f t k h c p a it n pl e e
t o ct n efl n
a a ab a sfia ed on n dl i
l 4 lt ii mgy ui a yl c r 7 s po mn n sd iuia u e p w
e gt lp 1
rS od i i n
e r
i t
t fi t
ell is i
p c r uI a
t t
s 9
el p a
r 1
oi y n
h a
gc. e t
h a
is pwl Gt c 1
s s ie h e a
r Rd n t
r e ei isf t d s
d oin e
f eh f
s s s a a
9 r c o1 ot e n
e ly e e t
o e e m ub o
l ga vl p
sdT yr c c it t
n ni o t
a ni d
i te rl o is a a a l
t r
s r n id oa n o
r h
on oa.
l a
p f md pd vt a t
eil C
is of s
a di et vh m
e c n c einl f
ai n r c s u
ot a P
v s mn e e
e f
a mo a
r u s a
m h P n t
a a R
w S
t bi qa h r r l
R e n a
t t
S nf guu a nh y os c sS h i s s
c a a
f pr s
i e
t f
a r s o z n s ut e
s uil o
t pad t
a e
e qh p f
e s ii a
h n
e wd r
e z wg r
et ye gci g d h r
t d
gt lot c t
a d ic r n h
i n c a ahi s oi o n oa il m
is ahf n
,pa a ed h s d
ws d
p9 i
ud r
pt d
s e
d a
lo eQi t
u f iu n
s r
1 a
f nr ei z
mh s
vt lp e
s h sh w, f
r t
f g
e oh s e e ed g a
et le a mf t
a e
t s
t 1
e u e oh s
e p d h i
6 d a mat e 'f pCni t
e c md p ov h o on m 9
h o o
r h a eS nCcGt Ttsd S wr T d s a e e
1 I
G 1
y A D hp n
e n
o o
s b s io l
t lo at a
g i
n n h
t i o p
n Te n
r e
ei t
l m
m e a a
n r
u lu e
m c
iga n
o o
n v e
d e e g
C c
i lbu P
o t
ses E)
G n
E WK O
o C
U p
A(
W S
seR l
l a
a f
r f
e c
f e s o n b
,i e
h r a
nt o
n s d
c e t
e n ei ym e
a ms S
ge s t
i m
a -
c.
f e a o d
o u a
o e mhi wsl e nd pn e l
s s r
e w
oa nl n ab l
n e
k et ic e r
f e ai pns a r sf s
v d e e et y b a ih et t
a mut ei oA e a e c) o c s qi pe r sd s
l t
int m hi c i R y.
d e wS n
t r
ot f t
si s
r l
r u oys u aP t
u t
s fi a
e c a
c r oi ih r s s
n s ol n a o el o a e s
s s icl hl e mvat li pos h
mb f e u
le t
ip t
a r t
t t
m c
n gmsh i mah h r a f imish) ni atpe ni l
e oe imn t
s ci gt ge b et e f
r it ab n cS n
n t
u o eT isi e efii o t
S s cT( Ummd e mmw nd rh il u
f I ( pt 4
5 6
2 2
2 1
e ue p
t a
e sh n
a h h s t e
ei r e.
t h
i f
s rl yo m
b e r
,d t
e h
o r
e u rf t
e d
t f
e y et lu n u
v o e of h a e c v ai t
t i
d s t
s r s
o e a e e wh e
oc wut u h
wd.
i s
s f
ch ic t
e i m y
e r t
t Ha oa a a c
i oHet m wl nat e e 9
n p
.b e
n p iot pc t
o s a r
t s n t
m ti s c
h e
s a e a 1
iopeh at r
t a c cf s i o
y b r t
r n a e g ie p yr l
o tpe ic o l
a oh n sh'.
e e v nt al t
i p t
cid r t i on s oa wm pr d p
r t iu r
h l
c n
ci e c pu ir e
i a
po a
ei pr gaf a sd un g
s t
h t
t t
s e a s
o e
e s i
s s e et C
ih r t ivnh wt m ei r
t eh a
s u
i t
n r
ui s
i ct t
iet s
P s gt ow.
v s r a m A eh s y ui a
c h s ni ct R
t ei r y
c or s a o c
c t pt a nt e m R n n i
l i
t S
wa oe s
h ya b o P
a s
l r oe u cl o
Tiu sC f
pi t
t s t e
t f
e a v e gd rd r n
. og e
o e a l
t a
eh e ei s pr r
t e
eh r
t on e
c ic r
gs d ma mr e
gi s
cl r
i a w u
a p s e e e s n d
a e n g 'o A is e p is gi e e w
n t
n d
dd nhi o a i d n t
a t
t o
e o a
e et n p rsR f
ir n
f lwa di k
e t
t r a f
s f
s a
fa a ur aiP ai n
pl et mf t
s e
o u t
r in a t
t 1
s ot nn pet e s
o s n m
ic r
m 6
e k e oc n lc e
e e o pt t
0 h
c ed n ou h o h c a
pr s
a 1
Tab a uc n TCu Ti s
Ap n
t G
1 y
y y
A D h
h h
p p
p n
o o
o e
o s
s s
l o
o o
b s i
h i
e l
l l
at h
i h
c n
Te p
p p
n s a e l
l l
m r
a a
a t
r r
r r u e
e e
os m
n n
n pae o
e e
e m m g
g g
i C
c i
lbu P
o t
s G
e d
5 O
9 s
G G E R
9 n
S o
O Om E
P o
C W
1 p
WA WC S
B 6,
s 1
e t
R l
u s
s f
e s
la e
g t
f n
e a
s l
c c
. e.
A r
u n
d dd a
e f
o n
l t
a f
ei e t
f mt d o e
e s o
h ed us S
o un a n i
n c owi n
a civgu 2
d
. n ir n t
s s
c a o.
l e
2 rd oc ni d s t
g e a os e e ndf ot e a e a n lu
. o i
t r nb 6
s t
i e
et r po 2
t a
r ya atym o n r
a nnt c c h
ii o
id 4
pe e.
hi s,
s.
c t
t lu R
l mig ci r t
s s
poa l
up u n ef r e et nd e
t "yis "n isd po ior ai s s e o c
n mn i o c
F t
s ps u a P a e e m mh ni sl h t
e a e t
t n a oir ps 0
l r
a e e qi t
ah e e
Rr a vimna r
t v
p ei e t
t r p t
a 6
t mel e
cb r
r S c
/ ni mm pi a r e o
o uai 3
r s
e mc et e ws r
r xr si u
c aAe o n uprdi r ps pa p Gr qmT g
c e t
a t
o o e o upc x u eSi mle p oe oS s
r mir a Rf r cI AumP c Tc b os E
r t
7 8
9 0
2 2
2 3
e s
d c d ci i
l f l if e
n u
o u
i i
g e o c c c
o n
d i
e e n w "s.
i s n phsh pi n
e e
oe s
ei s
t s r t l ibd i p 'n or s
e e
s tat ef icos r e
.d d n et np e rd l
s r n ni r nis io s oe o x u u uei s e e.
n pf gmcb i
i on t
r s t t
s a eps a s e
t i r
n pi s o c
t si n ma rk eot m mi ic ut c a n i
s c i
y l
s e i
l l
s a mn p
s osbi e pwm p
e pl y cRd cf oymh t
t i a al n e u a
u aCr l
s o ow ne a e ai c r r 9
e" ud ne n v o e
r : oeyetaCs e
i b
i rd l
f s r ehl d e c 1
e oiwk i
ues e g s
d t
t e v
k f gh y d nih d a n r
a e nc t
nt s aoet o
e e
l oai r t v
ne vp a b
a i i i l t
l r s t ear n a n o
r, e l p
pih a
t r eh p o
d aih a ii t a
c nsh is p t
t rdi y
pvwic pa u ni t t A
l h
i e
n e g e
f r e s h
df i
C pd o ot a Re e e
t wir el si l
a t
t t
n.
b b n a id c
d oP oet yos p s
r l
s n e nf nb n aHl y P
at r y
e e
l i l
t I e od i r e
at n
s o e/
R n
.h m
m m.ne wo e it ui ts e
t rl eb s af s g m
S mmr oct s o e et a
et upni ud c r c nes c ne i
t a of e
i ne v
n eh s
l i
f o
t s nud u a
dd er mia mt a
a a
n gh pouooeq d
t s
at d
ut a ug e
r unt s na h
e s ec b
ucih iuc n s
i c ys a r d
fi i
l n
aKid t
- c goat gos l
i d
sd nshabi t
o l i d u o
ki d un l
la a
p r
e us
, s e neqo n en s
n tr pr i
of ei n vl e o c es o ci e
i r
Pid r a t
f t
a a
r Rne gt pn e a g nd nd u i
i s
t ail it a e e
1 AUc n e e u iegr wm w dd vc dd n m
i 6
on di 0
Led eh r r or diur o ua a
i Ah rbTla cHfo e e
u n
Agpc Agg S
1 t
G 1
n n
n n
A D o
o o
o 4
i i
i i
n s
s s
s 1
e i
i i
i o
c c
c c
2 l
e e
e e
b s d
d d
d A
at n d
d d
d Te e
e e
e t
t t
ta g a g a g a g m
r n r n r n r n gi gi gi gi m
ek ek ek ek t
a t
a t
a t
a o
nm nm nm nm C
i i
i i
c i
lbu P
o t
p s
o e
G hs L
s E )K AA k
n I
r W
ENV o
P o
U p
A(
NGT w
C s
eR l
t l
ws o
i ff nw w n
h h i
o a
s os o
A n
t t
P nh n e
Rni np o
o o
c t
S Rl gi ri oe a
t at n n
Pi a d
Ar na ea o a
s u e -
e ul uis d e mel c n Ln isl cl c a t
o ni i
i Ae ua a c u a r v vt ve g rf ue a e r
" g n e n ed o
g o
d s en o
e e n s g i nu e e ;e n r
t o
n hi e vt vi m o t
e e o niri gf i
t e r e.
ci ni el c dipn nt et d s ah e e dh ai a e s mt e d
g a
at ici s e t
t t
on ih uc dl i l v
u r
nwod ial a u c nid c
a ig o u o l
o cin r u u
f of n n r
uuue r Whi n
n a e P me pg Gqs qb p I
1 2
3 4
3 3
3 3
s s
g goiq f
,i e n nt h e
. w h n e.
k eTr i(i a
i i
a u a
e t
md d.
t e v n e e e m
i r
s e o r r d
inis p
gr e e t
a n p
e o ipm i r e
a f
l o
cb r u d f r s n ga ad a n o
r me 1
idi wt oa 9
s d
e m r
v ge o7.
t unt 4 t
b al s. m io a e o n.
e t
n n x
c n1 n c o e
o si e
ts d ei t
t nb a 1
a e a
l i
ri p
a 4 i c
e gh l
a y
7 e nGr et )
di lp o
h e
1 hiR i r
9 e
u gd wp l
t t
it 1
n q
e n C
ia ins g e s a ya 1
i r
f on r e
e e r P
d Ge pis a ih Tl h a s
,t 4 p d
e Rgc u 7 a n
u R
m ni m
t h
e c
e a r o et o d 1 S
m
.i C
e s t
s h
r e1 t
r u
n s f l
ee p c
b n a i
tf s
e u ipG P d e g g R
vma n
a a
luh o
pR r
e t
a o i a
S a
f n
h uf s
o la p si n c o t
d n
ct a on s o d
o eh a m a
i md s
t hid x
p et n e
n s
sl oe x f e e r
f t
e e e a
e naib e a c a t
ct t
r e si n
t nl n
1 e
c osd n s a u e
o a
polu a s
c 6
m L op o r iut h iu i
h ic ed ed 0
a r
e m
o r
h 1
S A pi w f Tga Tgt
-G 1
n n
n n
A D o
o n
s is io o
i i
o c
c is i s e
i i
c c
l e
e e
e b s d
d d
d at n d
d d
d Te e
e e
e t
t t
t a g a g a g a g m
r n r n r n r n gi gi gi gi m
ek ek ek ek t
a a
a a
t t
t o
im i m n m i m n
n n
C i
c i
lbu P
o t
le l
se b
G m
s E) n a
o O
C WK P
U T
p W
P A(
S se I
R s
s "s d e
n r n a
f s
o o
f u
Ai f iot igo nl s
u t
a e
s n e c
ei ia e
ah Ra7 c c b
r t
h t
P S
gL n e gll t
s a,m ad ai ns e nG iut u
d d
w q h" ynd.
oi si od s
uk a r
t a e aA et el a
pe n
c e et o gAdR d
f e
ei n n e
a a vf t
t eRnP
" d si e a a sn oe h
d p.
e n s t
P a s nt c t d d
e t
iur e ic r n
e g h d min e r t
s eje o o ta n et e get r eib l
ps f p rihh w e s c t
t ni ut e
e a
s x
s a lyt e
u ni e c e l
s r
ef b
o e s r ppdii ef q
a h v h e s r e ue f e a
e pn Mor Cbin e
S a a wr Td" ab 5
6 7
8 3
3 3
3
n e aF i
1 y -
b o
,i rt 1
r e s pne a s Gt n pe a a
r n
h Refe A m s
Ani n e e
md R Ata e ro e
s f
P
,nn
- 4. lpo 2 mt 2 5 o e.
c s 9 cid 9
no n l
e e5 s l
o oct v6 u rh 1
it e x le oe t
r c r e Riv e r
e e a e m rCa e
o/Vw s
t sh f
G c
p n nt cEfoi h
a oe i
f oHi h
di n c
aR t
e ai s
e um oUe. p C
s r
s sl r
i t
s ua e pN c nt P
c vt p
n e n R
is e e a n e v a d ed g
uEl i
S sh o in d q p
e e s t
t f
At dd r s e t
s ad n uFa a
.h e
ul pu r
s t s
c e y o d
e u
o s
binhBt e
s r e e sd gd d d
gvb e
e n
a ie f n nn g re n
ai a f
a sl a
t a
g e a i
d as r t
a 1
b c.
S e d
e u md o f
h f
fat eiis 6
f f
p aRe h vt oc a
f 0
a s
1 S sPd T eEMen t
t t
r S
G 1
n A D iso n
e i
o c
l e
b s d
at d
n Te e
ta g 2
2 m
r n l
l gi e
e m
ek v
v a
e e
t o
n m L
L C
i c
i lbu P
e o
c y t
n g a o s
G e
mlo O
G s
r n oh R
AA n
f I
W ENV o
r c e e p
PT B
NGT seR d
t d l
f f n e
n uo 1
f i
d n
6 oh a
a d o -
l v
a e
u e
e s o
0 h t d t
t nt s
. go I
l s g 1
t e e a S
a c s
nt n e Gw mt d a
n inh y
b e i c i
r e
e a r A pf ad s
t oc dd t
ir t
r h 2
it l
opd o n Ds upf Rmed i
e t
id n a t
o e a o f nb pic l
d e o ;u m c P
u e n u gp l
ue oa e
e e v
c of l
l ah od f
BpAs r
t p
t e rdi e
e e at t n
r s
l s v ni pR e g
r n
- u n q d it lyt et n ge a
i n
b t
ge ioi e
eh a lsl e mn ixl P n
n i
e oa min at e r i c ve r
ai e
ah diii v.
d h2 t l
c c n t
a a s e i oe l
f a r n
p r
F edl s fl ct nb lpr s o nf a ou h u VR pl edh l
e t
mpn mh u n u
paf v et r a e t
o PE p
c s e vh e v e o po e n cRL AcL n w o e ei P et dEd n iS a c2 t i 9
0 1
3 4
4 l
)
EA R
gn a n it ib h 7R s
e 5
s e4 RR m
n ni t
sI ah UP.
r r
a s t e
it r
yw1 F i
tsNed ef d
oh.
eIfl e
op y
lak1 C o
t e
c o t
e s pet t a t
s 0
a eh a. mig 1 r d n
a e r mf f
a on a e e9 r r r
r h
t s
af r o nRr od b e mo o
d t
r r e
s c0 a
r p
n n t
i ni r e t
f fl n
p e o ei f
o r
, iod ein5 r
a a e e p or n n d
c unt aikRl a (p (s s
r u t
9 a nd o e p n
c o misF e
t a
u 1
c io n n pe i
ci mh o r e r rCwcd r
a o
s rh n
a s t
rl e et d
s n a p r
h ad a ot e
di o ate e e0 ei mre t
ic e w f r e
n mf e
1 t
nhdi s
e e o b
a mi t
fi r a v s s elpa f
p b
c n c
s c ot e ei ai f i t n
e o ol ed imio n n a
r t
s a
c a wy t
t Mnd isi a o.
h eC bd d n h
nl yu ei ui ul a l
h a idi n
e lpe r t
C l
e t
pic ua e v
e pe a
ol gt d i
mh v r n gge mt n t
a l
v t
n nh ui n r o
oodi it P
iwe t
i s p c
t c mty s e u e
c o cf lun t
d R
c p
mb t
r S
is r e,a it eb e s n o eh uf j
s ph d ue b
edid i wo pmt o ou e
o r e s a h
po e c e s
e f
d f t
r t
c i
t s os s
ui oa s r r d
f s e c a t
o e
ivd n i
e u r o e
a eh s e e
h qv c
h r
i T
e o si s ont mt r
vTl r ed l
e ylps s s a r r r
c f
r r ie uo nl pa d
le s a
y s
n imn ed a po o
.ff s a 9
d ff e cl ows n d
b n ad h gr e
0 o ot ic n ai e ot e n a e
5i n
T it ah d t
wnl a r f i s g.
F mni s
r t
a
,t s loe s d dk a f
r a
f iu a oe Rat cl h
s e a at mh a
r i
a 1
s ic q
t t
h t r p t
c 6
e lp0 r e n e r4 si i f r
r 2 e n
ot i e ut s 7
Cr h n n c e ot u f
r er px e 0
h p6 e h o a1 f i geihh n
t 0
n e eh 1
T a1 b Tmu S1 i wi 1
s gct t
r nt G
1 A Dn n
e o
e l
d e
e b s r
c c
at u
g g
n n
n b
n n
Te ai ai e
mr mr m
o o
e r
r s
t t
oi oi n
f n f n m
e r o r o o
ic e
e C
l pm pm c
i l
h b
c u
e P
T e
o c
t n
s G
G a
G O
O m
e Gr n
AA R O W OfS E
P s
o EC I
o E NVWI CE& E eP C
T r
p N GTBESPB CPA S
S s
eR e
si s
s f
A A
C s
b y
i t
f r
t ea a
eR Ry n
Sd it e a rh l
t fi e a w
l e
fP Pi t
r e
S u ob sd h t
o S
df d la yf m.
yo a
n t
r ls y
e o e uh e e c eh sl e et e t c r t
mi ic c a vu s
e ys qt r a
k n nt a go ni e r v nh oo a o f Ae a l
at ol e n p g
i rd e t
s c el pme g ort a
ei ei it d
mh s
s e a n u n
eP n
t at ini ur r i c
in ld c a r l
r a n s o ou e p?
,f gt n nd a
uf s r d
c a
pa :
t o
r n id x ge ei d ai e y or c n e e mnd i l
r it h ed t
a at pr p md n et t
t i s pei s
e ol o u r
ai
, ci
,t t
n eit e yr d ei oiib t f i kb m dl gu pf ml siA a
ai a s n
f d n i ob r i
t i
r idb c
e ol h
,t s ol or bAoR e r u or evsRmP P c mr Wd oah s a u u
e n c Gc pi s 2
3 4
4 4
4
v wel w
l r a o
t t r
n s
a e e e
o e ).
h nh it b et r
t a
a t
n sd g g n
ic o e u n i lp i
l n
n m
oI r n
o
.o p
h a o it s ei s a
t c n i
e s s c nC e
gh oCa oS h
n 9
n p p
mS t
S i
tr f
1 ro2 sS ont o
r f, pi a e
n e
it l
f e
gmt n
a r c r
v n
t o e si i t
oi u
p ml f
r fi t
e o yf n a
a d
h e
g n
t e
h e n t it ffi c
a n a o s e
C n
o s
y h
al 4 m r et T
l e
P md 7
ie e
vf r o 1
e e a R
o l
c hl f m n
t s
a 1
S r
d r
t Ga h e w e s e
t n c m ic o ei f
P g Rr wul gi f
a
. e o
df c
d e,
inf r
s(
e e o in e r
t r
p e s d e a
e s s r e e p r a c d
gi s
u r n e e t
s o s
oa eh n
a n r
si ut nf a
id t
s c a
ct e
m gt s r a e e
m 1
r id p mowfo f a t
f e 6
f f
0 a c t
t n
s s r
a c e
ol e t i 1
S u Ar c la p Sd
-G 1
-A Dn e
o l
e e
e b s c
g c
g c
g at n
n n
n n
n n
Te ai ai ai mr mr mr o
o o
m r
r r
t t
t oi oi oi m
f n f n f n r o r o r o e
e e
o pm pm pm C
c i
lbu P
o t
s G
G e
O G
O d
s G
E n
W A A O
EC WO G S ECm I
o EN V CE&E O P CP o p
B NG T SPBCWA SDC seR e
tc r
f
. d t
n e o
f ga gt k o of s f
y n
n t
n i m n n is f
a t
i r
r a r
gs a u e
r d
n ut ot ou o c e m S
ia et on.
t i i c t
i lu i c ai oA n
r s
d t o.
t f
l vi l
a o ooh e nRn l
r n yo in n t
a f
t r
sC e
o gwih a
t
,P a
n ch ofiic ndApB e eR i
s f
s mi mi,i ynd oluRo L nnhdN s
f n u u
ot r e
i u oe o e yl e
s ad.
mop Csif ud gn t
d yc y d ct si s
t h
n a ob n ef nl g nf o e
ms nn o n n r r
ot ot ei al n a a ci n ge a i
e oi e msi it n s mt o ms s
e nb e s ei u s
e p i
t a e wi vt q t
s rl r r
s e c gr gl gm mi l
n e
u d
t
'n lyoi w o
l f oCi u gn c n u r
s f
e u o u w
r n
a r e
rl h d o rh oh s o po e oa n a s c
o erS c e e n e t h Da pI P oS a rb L pc c c ad r c
e wi t
l 5
6 7
4 4
4
y ara h
gmk dU C r
n t
d n
a s su e ri aN i
gr s
P d
lwor st R e
t s
n or o f
faS c
i n
n pf or o
e o
d d r
k ny t
t it c oi ai ann p
a t
r r
a ai la p
w o
c p
i t
e r
l ya u s c4 ie p
lt c q a n7 v
9 om p
ii f
a1 e
in r ici t
1 d
e c a a
lpeie t
n d
r r
ei1 r
g n
oo e
x c c iz u S
gG R
t r
v e
i la t
Af n eR E9.
p p
ig 9
f s
i h P1 Ru a
e g a
m 1
f s
t h
e n rP f goo I
r e e s
r e
nt r t
C n i o
d o ie s t
i e
r f
h p c
t e o f
pnA a a b ed a
v P
ic it d
h R
c e dh r
R l
n e
CwP is n v eC e
s o n
S r
e o i
e 2 r S
e m eP f
v e m d
g e
Pi a n 0 f iR w
t a r d
R e go e
s e
f ri e
r i
6 e r nS i
a u
e S
nt 1
v Rn of e
h ri a r
ot b
d c
l d e pl n n l
n e ou G. ee c o R
g Etnb a n r
s t d
e i i
a ple e e
w e vr R e e
h e e
n 4 c 4l e e
a 7 n c
7 od d Umv f m P
s f
1 e
r e
Npa a p 1
i oh l
n uim o
.i f
t l
t sl a
1 r
6 e
i 1
1 r
f le2 e
n c
f yo a v0 e v o
0 G p e
x p
Ge af r
sl e69.
h e i
1 R e S
R u pi Dd1 n
Td t
1 a
t G
n 1
e AD t
i n
h e
o s
l
'y b s e
e y
y c
c g
g c
n n
n it it at n
n la a
en l
ai ai Te mr mr u
u g
o o
q q
A m
r r
t t
oi oi m
f n f n A
A y
r o r o e
e R
R g
o pm pm P
P er C
c En i
b ic l
m u
o P
tA o
t la s
G G n
s L
G G
O Od io e
E t
n N
AA AA GRWm G
a I
I n
o R
ENV ENV OW&o O
re p
O NGT NGTWBBC W
t s
n e
I R
h e
e h
c f
ck d r
t Gd a
w f
n cl e n r
GAE r
o e
o a
e a a u o
e o a
r leERRd yp i
f t
t c e mb oa pi v
t S
nb r dh o
yabRP nb p e
s Ua(
t d
o e s ad a
r d
r c a
aUgNt ml f e n
h I
o.
t it pNieAds d )e
'S rf t
f si r u n
a e
wt C ut e
t e
d oo.
p r
r p
R s
c o u n fh e nl.
r sR d e sf Ra y m.
E S
e i
na a ad n
c t r
i sd r e eN i c r t a
s neP gn i P
R pgw ogel e ed s e r
era I
n e n n c n e a oe E
z n a v f
i -
t r
h or y ci e e et i a it o. s et n e
P r
i r
n s
s or n o gd e y gws af ya s ai d s I
et t
at s
o a sf e n t
c c r2i 2 ui e i e pi di oe s
n omn n u i ot ei civoe0 h
n c s
la0d lpt o
o o od u
t e
c 6 u6 n pn e c a e r lt r
S min Gmibi s
l s
Rr pa1 q1 a ai Cp 8
9 0
1 4
4 5
5
ye peb e e e
f i os o
s t s
s n
poi i t
t ud t
n r a o i s l
f e
ut f ai pe n osi e e ic o rf ua r
r nl qt e cd oo ebh ea a l
yd pt r
t r t el ic yeh ct inl gc s
eh t
e ui a on e
nf r o r e h u e n ni t
c h t uofoh eb e
s fi d k gf ol t
c s r d
oin l
nd.
l l
i i
oAyn e
t f t
mwe we e t
bi o pl w cied t
n ooe sd n e.
michi at s
pd gedi t
ri 9
x n f
e t
v a a on s e
s s s n gt r y e e oh 1
e a t
oe a n c el d r d t c
r r
t r
m T
a n a c yh a et e
a at ch pe n nh s s ef p
f r
c xd a T' or s
a t ome a s t
t i t
x eaf g
s eB e e rf a nt e sh a p
n e o
el Lh sih u o s h
e c gef t
a r
p et t
t a
h p
h hf ahf e mCt we nTa e t
s n ga e e t
C r y e n n c h e
od t
a s
oTm.s h
4 c e ol rh n
a mie n t
pn t
d e e h e n s
P 7
4 h e ut t if t
e opa
.d 7 t ic R
a 1 h pu gl s
os gd c ri ne e
l s
1 r
t n u n o x o gi s
. e e S
d 1
f r oij i f e it u s a1 e
t h m
G opt e e n a ye r
f t
t l
t e aAt h e ga cGa l
r f
ia n eAe R
s c
a a
h niRiT t
n nRi lt l
t a
d b
i et n m gPRinP r
e a
ai t
r u
f n gh p
. t s
s s
adi oue d e n n c e oe d
e gi e e eh r g n e
r e 4. d d
lu s d n a e pn ed t
s t
t r
a o
u u eir h gf pa mte a t
t el n
c e2 r ac s
in oah e eih ei jmpt h
c t
t n
c gr s d r 1
s is s
t e ogyei a pi n ioi e r nl pt B n e et nm rh s
6 is d i lppi poaL at ph c e
0 h
s mpopch C n o e ou s
mis ws c n 1
T A uiad a s t
G 1
ADn e
o lb s y
y at it it n
Te la la u
u m
q q
m A
A R
R o
P P
C c
i lbu P
o t
s G
es E
O n
R E o
G WC p
B BS seR r
t d
e e
n f
n v
.h f
e s
t t
a ef f-d n
t ei d y yna oet et s a
f h
ni n en r
r
- r a e e
t e r ih oat d eih h mf S
pe rh vu ut t
n e v o c s
it t
e oi t
b et a qs f a e a a n h
t ei ng n e l
d o( e c a t
f nt ah r
e a nt s a iod i
c nh n oi Ao ct r
ts on2 s i
w gu n
isiAie0i io t
n oRf) d eh ah 6At me g t
n a e
iP r?
n c pR c w1 s s r
e n
ia gtcf o e i d "n n oPi R g "r t
c o
1 lpsf n n n lps e
omi 6
f opeGP g
s i i u t
Et u e a ioad t
ysf ya a 0l o a a r s get pr t
et t r ic a
t e
if 1
r l
cRa r n e e r
uili gl
- ele ahi eigc i
a qd a op Gv vteidUeh e ct t
r nt e u u r p e
lCr a qpa Dsle n
it c n wiNh T "t " a a e d
t 2
3 5
5
ld n id gh ito Ae e
s e
wi t
h e r e
Rr oym d - d ab t
r r c u
ek rh r
d s at gn oe o
P s a
nl o sf s et n.
k pf e a i
d e r v n.
n s
c n
ge i
a r r
n s c
h s n
gh a ot f ei ai e ai s ga inn h s i ow a ni t
hf g d t ak p
id n
t t
n r
e 9 c l
w oit l
el o a a ei s
t e
i v
si f
1 e r s s d
r id i vi h gc oet pn a c e n e r e e
miv.t a
I r
r y c. i d h
u c
r a e u l
o 1
i ie pn 9.
b oe t
qf 9
it r r uGr eli t d
pi t
.t n
ei o a wo1
. e e a r a
Ccil s
ps p e
c ui a n y l
o n p r n gp hh b r r e e t
t r
o4 r
a ep pn ivle e t
r c u
d a i Pt u 7 ai n
e a l
e t
t px pi t
p e e a mreb p e1 l
ts c i n r
a a n e a e go Rs u
n e q a1 r f c ed ef p h
ioh ph i e t
a c
t S e n s
r nt a eC t
e Gt l
t s ik t
h a oa et h e l
a,
cP Rmlya e u d a d
C e md d s c e
t t
h l
et aR n f r l
f z io d nf ic s
r t
s o a oly a s a of i
v n
P iniuf eS e oo c
f e a
e d o 4h u f
s t
s e n a sb g l
t n
r ei R
3.i Ind gugmi t
i t
t 7
s c a p
t 3 e
ai of s
t n
S d
, s s
r 1 b o s
s yoi a
is
. f o t
o o e ri el n h nh 9f t
e e a in e
it 1
t p p aA f
lwv e t
ot 1 s s n ym d
d h
Gh r
a e
n a a a n if e e e
ot R
t r
r nwnge mx i s o
Rt c e o c oeh s i
eP u
f ci e
t n w wtpd r i y d
i e
t k oaih r
.l g
a s o a t
a chhl oy n e a e d
a ;c d oy r
b m
ih n
lc d e r
,f g.
t c
ivCr el n n n
T hd e ai n
n e
s a
r ui o ad od e
a c e f
p "e me f e r ob a
e gf pi a
P e
t a
sRrpl h
yt a
oml o n
n d s
s loa t
1 s
d e
f it is t i i i' f
l rue lu r r e a a a vl 6
e povr f
h of S od e
f pn e g b
h af c o a
a n a e v g 0
h t
t u o t
h e e r
1 T aid" wo T ps oim S
qc S
n t
t d r G
1 A Dn e
o lb s y
y y
y at it it it it Te l
la a
l n
l a
a u
u u
u m
q q
q q
m A
A A
A R
R R
R o
C P
P P
P c
i lb u
P o
t s
G e
O E
n A G O s
W E
o E V O CS I
EP G
C p
N TWPA B
B S
s eR d
a t
n S
e rf s f
eA aBi T
b r
e a
h oo f
d o iR Ld S
nd f g
n h
t wn a
nt T.
olu e t
eP eCe Gi f
t a
t 1
v e S
ad r
s o a oi ih Dwe6
.d o
u t
i s e n r
t vc v0 rh t
t s
o r od nt e1 a s a e h ut nh.
n s ei i e e c
p ni p
n r i
i qa a c s r
e leg mtoe ri r
f a n f go "s
t t
r e ic e l
e c gri a a n yn isb f
n c D
oi lt oo e e t
e rl c pa pp t
s pd wApe pt s
il mooe oTb nd.
t hi t
e n 'n s
sS s
a c n s
led t
oral pc l
l s e a
wai u e u e c l
od p w
qi inDe l
i P
r a a n t
m c int aB d
r r
n e p ob 7 e o s
pt L
luh p u1
. t k d a wiveA Aq6 Ad eiA C t
ot p I
phP P "r loo e cd v
c a r oe aR Re 0iil Rs uR hf u
r o l
r c
o S o s A gf 1
pp P ua aP t
4 6
7 8
5 5
5 5
sP i
s a a s u i
d e e pe e on e
r qa e
gh nh h r r t
n gs u
a et
,d pe e
t n pl h wn a t
s r n ef r i
ui w oe a a a t
ot 2 ru a0 t
e ve e n d e r oy p
c it e s e cl a eh o6 g
nl b u wnb f t
s 1
p n
e a a
a a i
f u yclor n o vf r
e ooG ie q
c eI u ol r
cE f
a e
b a
nb s s nR g
e s a s
s si t
9 s
s n t
t
. a e o a u s n n 1
,i is e oyr p h
rU i
t r r oN t
a o f e n
e u f
nmni r
h r
f e
v s
m e n ope la s p at el e
t e ut c e s oui e
c t
o a
p p
wf nl b qed e
qr t
e i
a o
o o i
l s nd e r f
u h
h e v h
l eh d v o el t
evm e
s md af r c c c e n
C e
t n
e a d
d e
e sP s c i r a
e v y a
o h e t
p h et r
r ot P
g r
t t
e n m
sRe n at f o mli s o ia a h o d
R d r eS it a
q e
vi n
e s e u d
t e
g/
r p i
ri r S
a v
dGiu e s o e a s t
r q
dd r it e
t t
n e t
c l
Rc g v e nd paA f
r S
l n f o
eh ie o at o
e w
a e el mh R u
a d
a d
t l
f e
b c od P e
n s
e n
s t a
b s n
n oic r
d k
ed i
i a r
.t n
oh s
s c sh e o s o
d e u w
a t
l w
at sAf a nt t
n eb ie ore os s rh d e s
f it l i
e e e e c r
r e
v a
c f
a gt e
c cP n l
a a uv u v a un w
a a r
t n e o oa pe e 0
a p e ie lcd e it 1
s rr i e wr hd uh a
r r
r 6
e e
f ph s n op si ot f v
h e
pc a o
p ur t
e e
t n e Ta sh cHa ggi r 1
S s P
r I
G 1
-A Dn e
o lb s y
y at it it n
Te la la u
u m
q q
m A
A R
R A
o P
P Q
C c
i lbu c
P it o
na t
l t
se A
G G
s h
I r
o ENV o
CE p
NGT N
SC seR la f
nd d d
f y we f
or lu o r
e d
h t
ir e m a
ia t
S o
o ivr n
T t
u t
a nh a
o ye S
n s al qef it t
n n t
a u
e r s
n ei at t p
s u g
r ri a is e r l
f la r oek u nb a e
t e -
oAb c
s qo f
l Raid n pi s
t c a s t
r n
n t
eP oie d
nh u r
n r oi h
gc m l
e o ms u
r e et t
ud n o od f c c hd a
ps oif h eAs n
e n n e
o n oe n s s
gbi e f pRg a a wr.
l e e ruh iut n
d s
d v n at ki ad a
ius it eP f
o e
ql o
os u t
f h s
n i g Si oc Ga wrei Dci n
s r
p 9
0 1
5 6
6
o n a it e
h it r
e e s r et p i
h r p ei e l
ivr icl f
r r
t a
a r op i iwf c.
t e r ic e r h uo nA n
o pa u r e d
t l
on q
s r r r e h wq fd e
o a o n e t
pe f e p pl oe id a ed 0 d t c
d n ei n c
i e
5 e c el t
y e
i e
h n s t
r u a a p
nb e h
t a et r
r t
wa ai t
sf r
s r
ai a d
a gt h a s cdi t
n pnt rCe m )n T P si o t
s ni l
u sl i a aRib o r
u g f
i e a yoh e
s ui
.R o oi o lcNn n
s vs r d t
s t a nF gh e r c 9
d e o a
ri e
si s h r
oonmiC ol p s et e
o ei s t
1 o
s s s a t
c o e ot k
di r t
n n r t
r c
n e e
rf p et ic ad et oa0 e e o eb r
ch af m1 h
t mt ia ni r f wis ioe f
e nt n d
m t
t t
f p
ya e n y oi t
e o
r t
c d
ab o mt gf o t
a i
t ws a o n
s h
l s u t
t c
n n n isb i mn n s
n e
stet s et s a
el a uii n
i uh n
o e n i ia ivd d
o u
C qt e s oe it mc a la o e
o t
s r
t t
nd c4 c p t
f h p o
n e e edl ta B
P oct ei l
t e o a
bb s o l
a7 R
nhio i
rl ab o u n
ni it io e1 ix r e t
d ;k imi I
s d
v v1 d ov uyn lc n
ow
'l S
lu u edd it n c e i
t s
c a s a
. ooin a cGe g e
d mi c d
t n3 e la t
nhh c f
a r u
eRpn o
e k a s s n e 3.d s
r a
c s r c
t e e o r
pi e
t t
r e1 fi e
s nni sf it o
n d r iAn u r
s h h oocl s e
s d
nGi.
oT T c iwa a e s
o on5 pe c
h l
i a n
e0 od h
l ii f f
t d
ort s n
t t
,e o.. t ge c
t i s c Dn u d let e o n
e e s t
t s
a c werh it c r u gn n
.d e ly r
r r n e e i q l
aiP o c
a r d a r p n e m i mmd u r a
n ov a c
ah 1
al e o i uo m gu i
d rl c e d lowc f
r t
r uu och m
e gR h
6 if r
oc c t
r r
o eF d t 0
u o r c xi e s a
oo e e p
s y Wdd w nB.
nh n
GtoHa Vab e n
Cai 1
r(
I t t
G 1
-ADn e
o lb s at n Te m
m A
A A
o Q
Q Q
C c
i lbu P
o t
se G
G E
G sn AAO O
I o
ENVE G
E p
NGTC B
C seR "n
r b e a la6 e.
nt, s
f d
o u t
f r
p o
eyp G
it a
g b
,e r it a
t n
l c
D.
t l
1 i
S s "s e
ua r c u0 nie el e
s nf i
ml n oo it q1
,s u ad g7 a e
r n
r ub r r e sa n h oG i 2h c h o d
n t
e o f
d npor pc w (D ori n
r e
ooe di e r t
e h
s e p r
in a c n.
a e e wi h et h e r e t
n t
pi c ct d e ia v
n e e eivh n y
io x
ye f r a gs v t i t
let et i r o
n n
r n1 or mv a ei di h r
u ).
a6 mp la e
a e iu t
s oae "m ui e e s 2 h 0 e r
t l
Gqwr Cpa2 C1 r"
fl 2
3 4
6 6
6
e a ctyi F nt n
i h
0 a
. e h ol i
iC s
r t
i s5d yc e
c s
e ri r
s t
pc y0 e gR o e
i n v
t s
al n na c
ie F c d
i r c u af a i
1 i
t gh C a v
c e a oe s n r pi ua e n
c o
e p mvb ol p e
0 i p
b x n
r j
et d1 ad e
u e i
i r s v n e
d B
s s t
pu e e
d m
i mh h a mr io a
e t
r a v
ri n
x pt t
i r oowi i
oh 9
r ef d o r f a
d f
1 s or i d pn et n
fn a is rf e l
r o sh n i cb.
p it im.
e ai e
n isTi f ak n o t
r e
r t
e a. mie a eB p
n h s s
,b ei idb x A
r r t d e t
p hb Ce el ef od id pl ic r d d a
o lp l
d h
it eRt r u n ocl h
e e o nt c u n 0
w Nd d h on a o e 5
e u n
C t
p h oi s
d ois s s e n s p r
t h h
t r
i e
s p e
t P
e nC r
a s
o e mi sA h
mt r
P.
e n e r
R e r yrocR ppd r
se grh o e o0 Rs d et S
h ob e
t rN nt f
r nlei c5 F a lwoi e c g n
e r hd e e a v a a t
n t
Cc n
fa c ic e ebh pet l
r r r e
t a
0h vh o c y t
d e nP f
r n h ot d f r
1 t
e eb o o
n s s d
o wr sl i wh d c
pe u cR
.b kiih t
r s pt o o o
s ct a t
f F e n a
,s d
s n a ah l
o u s y pn u oC ei n
'l f r n o s d
i r
ei isBl r
f f
a s r t h e0 gr a v a
a a uL v e a r s
s ed gs.
e o c1 a a t
t s
e 1
s cCe rd wn l
i n e9 lc pBvh 6
e n f
n e
t e a a c upL r
t a a h oi 0
h ohh h e0 u
ei t
a 1
T ct t
c n5 NsCS w S s THg t
G 1
-A D s
n e
e o
l b s ip l
c at n
n i
Te rp m
y t
m A
A A
fe a
o Q
Q Q
s C
c i
lbu P
o t
s GO e
E.
s W
I n
S E
R o
P G
P p
A B
E B
seR e
ro Ah f
g
.h s e f d t
e Ri t
f n
1 e v s e r y a
i 6 s ri e m P wg a a d
0 n ut t
r od c s
m r
f t
n s
S a n1 it e
s a rl s c r r f nd.
oni e
eibfo o
s l
e y
gi r
e eGe oooe i moi pt n
n e et n ic i n.
e r
c s e r nDu c
v r c rh -
ni c r t k a s u a nl ini o n si 5 af qp
)
o t
ge n q
r r or e n is r r r c ni mu e vi nir ge e u or pe e a t
a ad o pr s c e j
s7 s
h ybd t
e s n
mf s) r t
ge et e u.
pnb a
r n h ri r u
t a2 e it on b o.
f s u e e
e e
s yyn mot y
b m i
s i
o e n vvio la yd a a oe c r i
it d f is at f
it t
f o
s u e e i
l imdd io oe i ml lu l
lu y
s sl eb r
a t
t l
u p c
r a o u o a a c
r t s p Qshh n hk a m u eCe oci e
ouh lCqs( nf ad ad F q s a
Toci t
5 7
8 9
6 6
6 6
s od a o e a s
ef t
t e 'n fr n a oh t sh s t
n a l
G nic et po i gn c n lpuR r
i e
e nl ic is rk n sd o i op icF ci si a ei n s a ie p
t r
r h ma n
c ii i
t f
a pms(b f r ic i si u u fc
.i e
r f
t f me woafol pt c sd ed t
s p
n e e
n o n e nt n p e e p r
m s
t ace ivs r
r c e i e i a h ms a
t h
t k r r o 9
oei r leh un t
s e gc of phL t
m
.ni r
a t
s i n
o sf n 1
t yp
,ird iyd a oi e
n c e r t
re i Aa n vfo o f
a wk i
r s e ic t
s n d R gi i
eh a n p loi e
b it cl s
t r
a e r
P n pws p
s a p wla a s
t a
hf s ol c r
i ui p
r d a o h f C
is igo dhHiu oiu n ihl h
n c o l
c m f
h h e t
ri s e
d le t
t s et
. n gi t ig uma e t
cl r
p wu P
a h i h pi a e ic
,e s n
n nd R
h et t f
n y ai yh ye a e idf i n d r o
v i e a t
S s d n v t
r e o mk e uh n
e a n a p i s z e o ie s
r t
r s
gt p e a a f
in l
t a el e a e
ei u r
r t l t
n e h n y a
a n bbh c t
laib T ia e r
g s
t t
d o s e at e a
n s
n yn odl l
r
. mf c imr e nb m i e eh oi ei e s
a t
d e i ct s B
id wt e e t
s r
t t
y d u p
n f a a nf ail e b f t
r a
c) eC o
dl e a r
o oierd c ch g s t
a h s f
a n t
t nC a n n ad e a
ei a t
y t
1 s s e o lu mnd P t
l c
n uh f iigg c
6 e ei i ni lc g
f r r t
eiR a a a 9
h ooor on o e
oe u
t i t r
Sb gS S mm T n pvot 1
G 1
-AD s
s s
n e
o le e
lp e
l b s ip ic ic l
p c
at n
n n
n Te i
i i
r r
r p
p p
m y
y y
t t
t m
e e
e f
f f
o a
a a
s s
s C
c i
lbu P
o t
ses G
G n
AA E
I o
L ENV C
p NGT S
P seR f
e o in e
s r
n y is f
pt ly o
m.
igs h
a l
a i et m
e r
yB t
t c r n h
a o n
n aL S
ini e
ed s omt d "e si s
r t
i r e c -
ei gpC dl l
r e
a t
pdfik et y s
af ye ub eh c
pt; hi nt go al a mo s s s n s
t f
ye e i e a
l a s pa mot r
e nh l
t wt ef c s a
s go e
ma e mn c e k t s
e n r ic s n e
c iga o ni a sh s n c si a g s
h ci r
t p
n e oo r
t c
sl n "n
isl o
e pa cd qa a
t r
c ed l
t e
e u n irb e i
l x
uib owh r
nf s m m yn n e f
c i
et d miswch a e t
r nl a
e t
o ai r ia t
d le r
e r
r u
m u c e sd u e
oa elodhi m d a e po f
t f
ai q T "m h h h
mn a
u e o
s rl e
Ah uii S r gr e
ws s
t " a r t
0 1
2 7
7 7
l
r ed oh e m 9
9 i' ev I.
f t
s u f
g Y
Y i
s t
e e
1 a
c or r C
C t
a l
t nt d E
E Gi a
a cdd wa ali S
S Ra e ur p
mb v i
i in qt e a n
n lo f o i
r ly y
yot la n o it lt t
l t
e eh a el i
i c s i
ic i s u c
c 9
d t uc i
a s
lp lp lp e fi 1
nd me nly f
x x
xhi r
h a a e
e et d s wh n e
a a
e e
e we t
h t
u u
u r
p fAa g s
s s oa f
s s
sl a
aRn n i
i i
l t
oi a a h
d Pi t
s n is is s
t h s
C ei u h
h ih at e
pc t
t t h s h
e o P
t c d b ).
d d
d e
o t
s u R
e
,t e
e e
s e s c
e. c s
s s
n s S
nl h ga s
s s i i l
a ut. p e
e el r
r r e s d f n (e m d
d d d e t
s f
iu a o yi d
d di a
r r
gns a o a
a a u gd s
s s
d y d
a mwn d h a
a a e al e
d et e s
ri h
h hl e
b o v t
n is i
s e
f f
fi i
t t
vs eh x
r f
f f
a e e po e a
a a e is a t
t t
t t
rl l
o h
s s
sf si 1
t s gc et yn mt is i7.
shl 6
i s
t n s 7
t a a i
a 0
s f-oh h8 h 8 hi n u i
n 1
uos T2 T2 T wa q I
t G
1
-A Dn s
s s
s e
o d t d
t d
t d
tn l
n n
n n
n n
n e
e e
e b s a
a a
a at v
v v
v n
ne n e n e n e Te wl wl wl wl a
a a
a m
o n o n o n o n d r d r d r d r m
t e
t e
t e
t e
ut ut ut ut o
h x h x h x h x s e s e s e s e C
c i
lbu P
o t
p s
o e
G h
G s
s n
E AA k
AA G C
ENV o
ENV O I
r I
op NGT w
NGTW S
seR n
f vl e r r
r n
ior rl f
ed ic e
s e
e a e r w
J.
wicb o s
a a uv e o
a o
c i
f f
ot o s t
h oin s
it e o n
c t
e s
r n a
d p r
pat k S
h a t
g is oo r
si r e s t-r s s s
f
'n it ot a a pei noly fi ie e w f x e
s a
- l r
t t
os a Fit v a o et r t
o a.
os yn dAu e
t di r
l r
oo n
t Nnf io c ak Rn n e.
a r n ad nf s R qd ei E oah s p o w s.
n f e a s
t ieP s
c ni t
eaAa Lc ut n ef sl eir o
p
.i f
sl ad q
o s
ot it a
v l
l neb nin n
oi sd n nR d nt un t
t d
t r et e f-wP e o c qo ws s
a w n wy ei e n u m o os ci e c
it i
u o uis r
o a oa sd di t
po h s ni s ei t
d d r u n is e s s ed l
t d w yi n Ft i c c oid t
t t
e n ad x t
a o s t l
nd e
t t
d s
a u e v n e e s t
ouoa a u Dub o
l u
u n s t
l Mhl nt uh h r e n
h vd o ob h s a a s qs Cs abi Cga a S s e a ct at 3
4 5
6 7
7 7
7
e e 7 e n
v Rh mi 1 i S
rd t
t n
1 o e a
d of it Gl le ni t
b a
s Ra e ia r
r i
c ur ek t
s nqt e wis e
if o d
l ie rd yot d ve s t
it el n ehi 9
ic s u a r t
r uc f
f i
e g a
1 lpel ot f
v n r
xhi is i t
s et d n n e e
ni eh t
e we e
a t
t p
u r
r n
s loa h
t r
a sl e
o o i
t r d cf h
a a pn s
a e g t h C
m h n ih a t
s t h s o
t d
e c ws i P
t n
e ai R
e s u gi a
e s n vl r s
S s n s ipr leT e
i ei t
r le s w.
s o e s
f d d led s e a
di e r
via d r
a u e
gd gsi4.
u d
s d y v
e a e al o
d P u3 b o v b
s oR g2 e
d hl a
S y7 i
t n
fi i
f s r
t t
x f
a a e s a s
f r e o9 t
i t
a a e s t
1 sf si t
l yn e
s e aY t
tp l
6 shl h
t a a m
e at uC i
0 hi n u a
hh f gE Twa q S
TCorS e
1
-G 1
-A Dn s
s e
o d
t.
d t l
n e.
n n b s a
a e at v
v w
n n e n e e
Te wl wl v
i s
a a
e s m
o n o n r e d r d r t
e t
e f c m
ut ut fa o o
h x h x r
t s e s e s p C
c i
lbu P
o t
ses O
n C
o E
l l
p E
E P
seR s
s ;
f y
dA a s r
r n
f s
t lt n,e nR d
d e o.
a v
e n
n api ed e w d
u w k
s t
e s
S s o e o
a ye nAimm u ie ei e
v t
t rd af m
ia t
r nt ni aRir e va ia ca t
d d
h o
b eh f
l Auh o nl n P ff r
t ri h
l t
n Rs h s ai a r ir s on iwmur p l
cl w
e et i
l e et lp r e P
,ie m
,id c mh n mk rh v ge s
n s os a a n w wlei yl ui ige e s s
t a c vhi n e
e r n s n t
t h et r s
t a n vi t
f a o
n y in o
.t vinaii o vhl gi e e n
s ni r c a t
ib o ipc wt b
e r t la l
le t
r e r t
e u n n a
s t
el s
e e s ri d t d e is mm e s el ef n c u e r
vn mek u u iiume i n t
al g e v oo f
s ri on e n e o a e i
e o Cffid c ur u L cii mvr Gl n r c s n r
7 8
9 7
7 7
iah ed P e e,
n Rh mi t
t i e xd S
rd t
t n s e n n
o e a
a d of if e e b
t o
ile ni s
rh d r i r s
f a c a
t ek c s n oh s
t wie t
e s
i t
a os e d ive s e rd m
d s t r
i s e t
n ehi ei f
1 ich aA 9
a r t
t ff e g a
mR t
c ot ci P
vn s
r ah y is in n e t
wr n r
e ni a eh t
p oi e
t yt t r
t p
s a
ihi la r h
t n
c r
a e
o o d
u r
l cf h
oge pn t
C a e g r,pe h m
h n t
e n f-o r
s t i v
P ol o c ws in l
ei a e a a R
ws s
n e gin vll r S
oi i t
ipr a
e eT Hmyt
. mgs w.
t a
s o loe lo e s
f ed s e r
e eCot vi ad.
h ugsi4 e
d v
e n
r y
d P u3 o
gmh a oc oRg2 b
d b
n a
r ed is y
t S
r7 rf t
e f s a
s f
f r e o9 a
adAt a e s r
t s
e aY t
e t
t vRo 1
e s
6 m
eiP e at uC p
p l
h r
p 0
a h ef u gE hh f e 1
S Td os TC ors G
1 AD n
e o
l b s w
w w
at Te ie i
ie n
e v
v v
s s
s e s e s e s m
r e r e r e f c f c f c m
fa o o
f f
a a o o
r r
r t
t t
s p s p s p C
c i
l b
u P
o t
s G
es G
O n
G AARG o
O S
I P
ENVWO p
W A
NG T BW se R
f f
f n e
i e im s
s s f
or n
is B
y h
t v
h o o Ll t
a e
w t
a a s w t
n ei t
t e n a
C n we o ef e r a t
s h e
't S
r o c
h ul k
wl,a e
e nh t
a rf s r
ui w
h r a t
u c
t o
sh s a i a s n v
n ut is a g af wu w t
n c e n eif f
e c nne yoh f t r.
s l
o ei r e vyo oAh aCoy r
e l
eRw Rn r nt e
op yt at c
n i n c r d n akd opw pbihl t
a a sbi icP d
a e a s o n i o s
n u n nNi s
s t
e s n m d et a b
a ni y di u r i c io ei mn a t
e t
ial c goo d
t t
- t l
v e n n or e e edi e a r it a e e nl o u e ed sb e t
s t
nt mnt ur of gn e e e a r v o ps mb oivn el si t
s c
e r utpe a
pp fi f
r s rih i min u qeh s u e e r e t
u fa n cE pd e c a qf a
f oe ps k
t t
e qe c t
si t
ooP n op ois oe ic eh cf t
n c t
e n wia S ri ga pwi Sdl r t
a o S cdI r
i 0
2 1
8 8
8
\\lilllliI) jll ll n
e o.
s i4 r
ost u
ie s sfa7 G
P e e hla o d
f m1 R
Rh m f
d t
a t
et r1 t
o o
S r
di n t
n t
s e
fG o
n mio t
d of a
k en n
chir e
ns b t i
l s
i i
s u u ot e n d
i r -ek m e s o l
a d rhi e
t e
wir o
r s efTd s a s
t e
a d
e r nfoe e
r g
e r
b s. b o
d ve o c s r i
et o
i s r r p
n eh r i
eo.
a oc r
a r t p
t f
l l
9 sb ps o
f h u s
1 d
e e c
eg og t d d e e erd n
vn i
i it i e e u i
n e
nt ny s nnn wh r s r
eh e s ol n
niei i si c cdi a
a t
oi r
e e r t
e p
At t
a e
h t nr bd n c l
s a e b
e o
t a
Rs ul rd c s.
un o n
s c
s pn ef 3 4 pa ci a
h P e a l
s a
a C
e c vi h 9.
m h a2 n s l
f ingp ca ed 1
s h
c o
t t a n m i r c ws s7 sl P
ye t
i pe o t
et t R
mve pe e a e9 e
b c e
ct gi h
es oaf k t
p n vleeT Y msue n l
sd S
frh a c s
a i
C t
o ih pr s
w.E ych a f
n n o e ed hC led s l
s c s
a o ah t
eS ei a y ct e fP viad nd ot i
r ta icnb oR e
si n o rf u
e mb o
nS d gP ui it d
ut pa i
l o R gd os ps s t d
r o
s ye r r a o un s i
d i t t
S n
f pod s n f s r z f ogn s
i a
f r eor a
n es e u
a e s t a
a c in a i
f t
c i
h ue c
t t adi n
s4 s
e a t
m 1
et s
l r
f c
i7 ph u t
ui l
6 mt nt d
eat gm e nl n 0
o a a
h o h oh 1
hh f e u c g 1
St ct A1 TCor s Tcini s
-G 1
A D 9
n 2
e o
2 lb s w
w w
w A
at Te v
ie e
e n
e i
i i
v v s v
s s
s m
es es es e s r e r e r e r e T c f c f c f c m
f f
f fa o a o a o a o o
r r
r r
t t
t t
s p s p s p s p C
c i
lbu P
o t
s G
G O
G G
esn AA W
AA AA I
I I
o ENV ENV ENV p
NGT B
NGT NGT se R
s d
f n
i s
s e
f o
s edi l
a ed t
e n
w ys una c
t b e y
c l
o s e e
r s s at sb di e e e s
e ad o
S l
t epeAl i
vr Aa mv p
n cd ue upc w
r t
a e
dd l
i e
d s RpnioRi wdt ol or s oo e
r e e t
e r
or nr rP n i
et r uh x r
P ue s pnt e s a posi e pp v
jiao a
d a r
el f s c s edi epe s v at h
- ee r umee n i
t ws ;a nrk r
r nL ah b e n.
e i t e mioa a not abig r
i
- d e
ua d
r e u
r m
oh afd e dlyws c
d q
t s
ed ya s e nme vnn r a r t
shf eb i
s s r el bi et eei e z e ;
t a s l
a s t
r u e e i "n agn ri r
a ic mdi wd ic.
c s et s s w
t e ad ogg n
e e r e
i l
c r
Cf a s a e nl pc uh r e i
l i
'n k uuvn n l
s enr i
c goea a eh a a Re e ngvib pos f
i t d v o o eh rhh a
nid e r or er u r
t p
Ape wa r s pc c Dwmw Nisnt Dd c or r
3 4
5 6
8 8
8 8
g t
t d wo g
dif t a
t r
e e at r7.
i a
o e s
e r e8 d ch h a
n d s h bd t
oc2 e et n u l
9.
iat a n pn -
s r f
f s a o t
a o5 n n e mu7 sh o et i gs r r
u c r
i t 0 o
d ei o9 s n a
r 5 cdi c a e
Y is e a v
a e vd et o uh d s n oihh d r la c n e pR s
cC p
aF iei r
t n
uh a p r aE ly p vr t
o t
sC n e ocfooS lu t
o al ie w
r r
9 a0 ia t
pd f e ah t
d t ct t o
1 e1 t
ndl n pn shi nh.
r u o e e e u ua a Terd a s
i r
s t
c ei oo y
nt d lt s
nbf h c 1
t 7. ma s
r e
is ir n u s cf2 n
o t
s n us a i8 uF p a s p
o al e afa2 a2 n i
e hi gh c R m s,
a t
s n
ed r
t t
e e ns s7 r 7 hEi lt h
r v it i
e e
ad e n n e
e9 c9 L ous d r ei e e a C
e t
h s o c
n
/ s nt s
iyT Y uYt Fl eh ubif r
s P
is o
a r g
.C u
t t
l n yE oCjDsAt r e a et R
o ohhh et S hS ofi Et Ci c
t d
Ra c
f t
S e
t t
t d n ot P p n
c n
ot hfi t
ii t
a t
c o
,a ai ad m
s a e f
le a
rh ott r d o ni sh s
i r at et h a
r o n e wl e e r
t s
d r
r ov d
e n pi ef a c s p1 i
n s ut e
t o
pr wot u u a
a s u oi p2 t
n s s
t t
t 2h ab n
d ni a e on imf c e
si s -
t s
,e a n
f a c vh i
t iob oi f 7 ymt n
t t
9l r
it d
a e sf
- t u s a -
t s a u r a
f f
sYiut ib e t d a a n ps e ly c
r c
t 1
si b r oi r s cl r
i o ot n s
di u
eCl 6
e n e
s ci r pi pn u 9
h o h er sh uf r
n o hE x a mof h e e 1
Tc Tt vdi si TS e vic o s
G 1
A Dn e
o lb s w
y y
at n e
t tn Te v
in ia i
s a
e s t
t m
r e r
r f c e
e m
fa o c
c o
r n
n ts p u
u C
c i
lbu P
o t
se G
G n
AA A A O
s C
I I
o ENV E NV E
p NGT N G T P
seR h e s
o d
t t
f e y.
l n
s ga
% o.
t t
f n
f y i i t
ui yo n.
t n
a t
s n
o ot nm a
t d edi
.i in lpia h pn mdio uf d
s r
ei c or t
t oa mt t
S n r e a
f t
s s
r c i rd i f
t s
a ot s e e n c ri r
ait oa c n
o ue r ei eeS e osi rf e
s e t
f
- t e
f ui e ys f
w qlph mi c c. n yc e c a 'n nmt e s
t c
c r
d t
c n nt t
e e e e a u n ul o pnl et ib mt n
loi r ei p d e
nF sUioo r
vt o a a r u s fif o mwt met n ipe oc e ql iuoc o
. t e
r i
s s n
.isd u
t e i ur n
r t
t h e a gt f t s
gn u nt e a s c
cdl a
owr c f
ci s nla on pt ii n
s el nl e la v
d o nAi ue al t
n ei pt a
s e
r c vi a
u t
n o pch i mt md le n s
vs h t h Ry s
i t
ot mr t
n a r r el c s a n a ed oie n c cA Pl t
f v pe c pe a
i a
o d pnxxt xe e s iue s nl uRf t
a u r
t n
U gb ei p m DmP oa Ca a a e e a Et s r r
it 7
8 9
8 8
8
r E
f S
7.
5 G
e o 61 t
6 R
foe d
e 8 R0 u
n m2 C1 g
gd a
/ -
n in o7 s9 GG lps i y.
y 1
r ED e
t on 2
r 2
oY Rn po it ia f
C Ui a p nt 7
e 9
eE Nd o r e r 9
ur S e
c u mc t
t d n p n
Y 1
r d
d u
ie e f
u C
e n a lc e
n b a m
r r
e a
E d n pa t
g p
n n S
y1 a
ni x
s a
oi n
2 h
it a
i m2 iB E e t
d v
x r
a e n
7 e i
. e t
r o
is C
nt A h 9 d
P mfoR is t
i d ys e r v n r
l Y
o e al s
t P
u a
r p s i R
e c
hC pp w
s s e S
lpmh is t
e E
eA c9 t
d sS ms e1 e
c e tf I
n e
ge n
n i ni h
r a
. a e
d e a
t e
t r
sh S
eS d
ot s
s a
s iu e n
d e c e w.
gc l
p e e n s
s h
t r
a o
d gme e
o n l lp ipP t
e n o a
l C
n at e r
a is nl g.
ki n e t
c or d le p 7
a it laR a
a m
8 c
i h 1
mS f le o r
fi 6
2 c
f f
f l
di c
a -
a p r d 9
a c dh 7
t p
on t
x n t
1 S ei S9 S a Aw F a G
1 A Dn e
o lb s y
y y
y y
at t
t t
t t
n n
n n
n n
Te ia ia ia a
ia i
m t
t t
t t
r r
r r
r e
e e
e e
m c
c c
c c
o n
n n
n n
u u
u u
u C
c i
lbu P
o t
s G
es O
G O
d G
G E n
C A A W IR O
Om I
E EN V &
P o
o p
P NG T B E
W WC s
eR f
d l
f d
n u
a yAn e
of o
ira e o h r.
f p
tS d
e e
o c y s o f y cP n
e m
ly le nt t
yt t
n r
n a
s t
v a ia s e a gh pl t
n ci e
s s
f oi e d
t nt n s e o
o v u 0
n od iut ujt iwis e e
5 s pe ge d r e it o
r or a
t t it d ya gi d
l t
n ef r c
n pc 1
a s
oi i a e n i t t
e n
1 ot u
n nn r e c i
t r
j t
n ys.
o u d o u miei p e n Gai r
y r
el nl g mt mo o n e a
. E ga at m g2 ai t
r s s t
s a c n
pn t
t d r ei p il e Ra t
r s t i l
i o el n p
'n f uu pe e me nt e Cet c c p r
a oa o
sl Uoc ci r a a v n
Rv c n m oe a r n e s o t
e e a e Wt L Nh Auimin Dc r v Npun e c r
r t
0 2
3 4
1 9
9 9
9 9
lll11ll jl{l 1!
l!
W e
h m
dn e
dd t
o v
e n a r
r o
-Ft aF o
f s
9.
b i
RmFD a in d
a 1
EiRC e
eg vr y
l Ls vr o e n/iEn r a t
l ed e
eF sLi em mp me a
t eDi s
s e a r
i sd e b
y y rh oi d
s u e
sCyn g at nC q
a la an o e m
h l" nF a e
r e
mf eP f r a
m s a a h
l s s bR Dc.
e e i
e my t
n eS mb Ce s 9
tn gs l
t e
ui vd n
n h
t 1
s s a n o
e a yiai nt n t
e n h a en m
h e r ss e i
r r
r t
t l e
o bl m
c ve e ed di 2 4 l
t c gt i t
0 7 yi o
a "r nnog l
e c a
a u 6
a w p
u l
t c
1 mt mouat 1
d l
o 1
i s F )e, h h
ue s e G
s s t
cic c r C
l g
E G h e e
i y
s n t
s s
r
. veya a
R 4
P c nh.
P a
n e
ohlat R
evp Ue a c o
v7 t
t t
b n p i
1 ah a e oe h
h e p
g s
S urd
.N t t
c t
s s
f s o e
in1 di yc a p -
tf o
eh age wt a
b r s gt e
eRid i a r
t t
c pn n
v e f
e ai a
i f
r e d n d n e
r et h t
n et r
s os o
eI S
i t id a s d
ef n oi l
nt w.
i rd s c e s
e s
r s e t
s s
o s e o n e
f e aos n r
d gif i
s e e v n o e
ea t (
sf a n
a ad c
ki r
s s og c r a
sb f nl ct g
ea a
dl o e n a a n o a
i e
s t a
a ri c
a pa a sF 1
fil ef fi r
d eh uR r
6 f
t e
f f l ior f
t a v e e a p a
uc c eE 0
a r t
t p
t e
h Giitoh nn L
1 S pl Rt S a S
t
-G 1
AD 2
e n 3-o l
2 bs A
at y
y y
y y
t t
t t
t n
n n
n n
n Te i
i i
i i
a a
a a
a m
t t
t t
t r
r r
r r
e e
e e
e m
c c
c c
c o
n n
n n
n u
u u
u u
C c
i lbu P
o t
s G
G G
es A
O O
O n
P R
R W
E E
o Y
W W
C C&
p N
B B
S SB seR d e o s
r n
f o
g y
f e
e l
i.
1 t
r ut h
g f
t n
t c
6 a a s a
s i
ai y0 s o gi t
n S
ie in hl s t
s h
s t
t n1 e s o yk.
e gya f i t
a s n
r c nt h s
hl l
i -
ni t e
y d o c e age l
s c
s r ai ninc nl t
u n r zi i
t i
a si p nl nc a w eDn y
a n di t ai al r
s s t
t ai il a no l
l i t r a rl a a e umc t
r2i rd c
t l
s n o a a yi uuem n
ni n e oi e
0 epn rd n
ad ne gr c c s t
s r
r pat u
n n
s n
r t p c n6 aa g
r d t ni1 eu co e eia ofo u u
ib yt n
o ge n y uh 1 1 t
n ff o
i l
t t
r t r a cG66 b t
a o d o i i t
nt a e 2
adf aE00 nh gt vmceh s
at e
e s
i i
c i
d si og mat yl n a l
t r n ei t sk u
oR1 1
e l
i pc u s e
l s
r vl ys npul r
u apl v pU G G sao r of e a
e ul i
pl d e e p a r e e om h os a r r
a Ac eh r en n L aNDDeh P pi Sbf s Tpr ai s
r t r t 5
6 7
8 9
9 9
9 9
9
u C
s od f
f f
df iris u n e oo a
e ch o E
e e
t s
r t
s n
t t
si ih s s oS a oi d
ci u d n n at e nt a q e e e es t
t r h ie ndi nh n el e t
meTt s
n s a i r i
c a mu o
s t f
n r
vt cd e e r a c r e af
.i et r oo1 ol i
a s n ed pr 2 s a e r ed s t
r t
c g nt t n r eibd p2 n
n e e a oe t
a imp a
i e o eh hi c i
a t
n e a7 ehl b
t a
t n
d e 9
t i
r e 9
a n h 's ut o c u gn nd at fY r t s
t t
a n a n olif 1
r iv r r e e f
po aC eh e hi it r
c e oe ot e
nb rd f sE b
r d a pt t
s r t
a n h a e a c e
t us pi s
eS ycF it t
p a
t ge n n
a i
gh on h n u
n e pet n
t o
i msR i r ut a
n a
x r
a o
h i ed c rd is eE t
s e e t
c o d cf e cL r n f e.
C ad e gi l
a s
h n k.
e ef r 7 ei i
uf ad s cioh i t
d 8
r u
s s t
P n2 r
t nt t a odi d nir u
t s
r el h n a c ai a u a goo R
oh c s s
h u n
t t
7 f
- a. bi gFi gc n e
ei yc9 S
t t
hf ne yed s
s n pdlpnY sDe t
e ef h ly a
o nb n nTl gi C s i x lc d C et t
u a
f c o e s i
t a
p a
a e
ai e
u dd r e r s in l
gS r
r os e e
.f lwi t '
l uE e e or aicd ys sf c d
pis l
,i prhl i t
rf s we vs n i
oa e d
a et e on n
y o e ei f t shi t iat n r l
e nt d
vI h.t a ri k
lul s it t
a c
n a
l t
i s a c ei n r e it a
sf t
e a7 c a vm nh a e o n a a ntat r8 ah s
at mf ia c
t r oh imn e2 f f t
1 b
n r
di f
a y d r et s lp w
uc -
a a e r 6
e s
f ia c ai b
0 h e r s
u e n e a x h ef uf n7 t
e mv Glc ut b e 1
Tt vos ou9 S s t
r G
1
-A Dn e
o lb s y
y y
at t
t t
n n
n n
Te ia ia ia m
t t
t r
r r
e e
e m
c c
c o
n n
n u
u u
C c
i lbu P
o t
s G
G G
e O
O O
sn W
W GW o
O &
p B
B WB se d
s y
R t
t f
n is t f
a yya in r
e o
a f
l a
k pe lah t
t yf d
si g
e t
t r r e f n w
e e e
c r i
S r
le n n a a a w o c v e di inil s
f r
yol n
h oe P a d
t h e u et s
n n n sb bh md e(is e a ia os. i n
g t
sl e
nd r f
u.
a a e l
t e
lu r
t o
w4 o
is yd e
r
- ed l
l o ow met t
e r
eE c e na d
t n nd c sh ct b0 nd a o f
ei n n
t s o e
u e e g oin a
i mt e b d n 1
e my t
r -
n ni =
s s
s n t
t y;
a e n et a gFl e c e v
r at e e sl h s
r n p i u
), aDoo uf o a g r a ni Tuo Gm4 mC gnt s Cah 0
2 1
0 0
0 1
1 1
Ill.
RESPONSES TO SPECIFIC REQUESTS FOR COMMENT ON PROPOSED DRAFT REGULATORY GUIDE AND SRP Public responses to the following questions were specifically requested in the Federal Register Announcement for tha workshop (62 FR 34321), and the questions were also included in the handout materials for the workshop att:ndees. The questions were categorized into the areas of (1) Overall Approach, (2) Engineering Evaluation and (3) Draft NUREG-1602.
NEl was the only organization that provided a complete point-by-point response to the questions posed in the Federal Register Notice for the workshop. The staff believes that, in general, the NEl responses reflect the views of the industry on the topics forwhich the staff requested input. The responses are briefly summarized below. For each question / issue, a cross reference to the applicable comments and responses in Table A-1 is provided along with a brief statement regarding the current resolution of the issue, usually in RG 1.174. Many of the issues included in the staff's question list were addressed as principal issues in Section I above, and for such cases, r;f;rence will be made to the discussion in Section I.
Qu stions for the inservice testing, technical specifications and graded quality assurance risk-informed activities were also included in the Federal Register Notice, but those areas will not be discussed here. Comment resolution for those topics will be addressed when their regulatory guides and SRP sections are finalized in early 1998.
1)
Overall Approach:
A) Question: Is it appropriate to apply the Commission's Safety Goals and their subsidiary objectives on a plant specific basis?
Applicable Comments and Responses: See comment (s) 1 and 9 in Table A-1.
Re:ponse: In the response to this question, it is noted that the industry has acknowledged a role for the Safety Gorls on a pisnt specific basis in the screening criteria of the EFRI PSA Applications Guide. A concem is given that the staff appears to be planning to use the CDF subsidiary objective as a risk " cap" or ceiling rather than a goal.
R:colution: See discussion for item 1 under Section I, where it is indicated that the staff proposes to allow for some flexibility in the use of the subsidiary objectives for screening applications.
B) Question: Is it appropriate to allow, under certain conditions, changes to a plant's CLB that increase CDF cnd/or LERF?
Applicable Comments and Responses: See comment (s) 3,4,12 and 14 in Table A-1.
Re:ponse: Yes. A demonstrated substantial margin often exists between computed risk levels and the QHOs.
Resolution: Figures 3 and 4 of RG 1.174 indicate conditions in which increases in CDF or LERF may be acceptable to the staff.
C) Question: Is the level of detailin the guidance contained in the proposed regulatory guides and SRPs clear and sufficient, oris enore detailed guidanco necessary? What level of detallis needed?
Applicable Comments and Responses: See comment (s) 32 through 35 and,37,38 and 82 in Table A-1.
Re:ponse: The level of detail is, in many instances, insufficient, vague or open ended thus being subject to the l
l A2-34 l
1 l
discretion of the specific NRC reviewer involved in reviewing a licensee's proposal.5 Also, guidance is not always consistent with what has been required of the pilot plants.
Resolution: The staff has made an attempt to clarify the guidance throughout R$ 1.174 based on the comments i
received. The pilot plants that are still under review are being reviewed against the current guidelines in the final vIrsion of RG 1.174 (revised from the draft DG-1061). The application-specific guidance documents (e.g., IST, TS) are presently being rewritten to respond to comments received during and after the workshop and to also be consistent with the final guidelines in RG 1.174. The pilot plant applications that are still under review will also be reviewed against the revised application-specific guides, and so there should not be inconsistency. In many areas ths staff's review of the pilots has provided insights for revising the draft.
D) Question: Are the four elements of the risk-informed process described in the regulatory guides and SRPs clearand sufficient?
Applicable Comments and Responses: See comments 26 through 29 in Table A-1.
Response: The four elements arie appropriate, but the clarity and sufficiency of the accompanying guidance is not consistent from application to application.
Resolution: The finalization of the application-specific regulatory guides and SRP sections is ongoing. In revising these documents, it is intended to improve the clarity of each guide based on the comments received and to ensure I
thIt the guidance in each is consistent with RG 1.174.
E) Question: Is the guidance on the treatment of uncertaindes clear and sufficient, oris additional guidance nec:ssary? What additionalguidance is needed?
Applicable Comments and Responses: See comment (s) 88 through 102 in Table A-1.
Response: No; the guidance is not clearin this area. In the response, an approach is suggested for dealing with uncertainty.
Re=lution: See item 4 in Section 1.
F) Question: Is guidance on the acceptability and treatment of temporary changes in the CLB (i.e.,
temporary changes in risk) needed? If so, what guidance and acceptance guidelines should be included?
Should the guidance be different for full-power operation vs. a shutdown condition?
Applicable Comments and Responses: See comment (s) 16 in Table A-1.
Re2ponse: Guidelines on the treatment of temporary changes in risk are essential to some applications. In the Rssponse, some ideas about how this might be done are proposed.
Resolution: See item 7 in Section 1.
G) G.uestion: Is it appropriate to use the definition of " current licensing basis" included in 10 CFR 54 "Lic:nse Renewal"In these RGalSRPs? What other definition would be more appropriate?
1 Applicable Comments and Responses: See comment (s) 17 in Table A-1.
Response: The response states that it is not believed that the use of the 10 CFR 50.54 definition is appropriate.
The definition should be limited to NRC regulations, orders, license conditions, exemptions and technical 5 It should be noted that there were other comments made that the draft guidance was too specific in some areas not allowing enough flexibility for licensees to use different approaches.
A2-35
~
i specifications.
R :colution: 10 CFR 50.54 (" Conditions of licenses") is not the correct reference for the definition of current liznsing basis, and the staff believes that the limited definition given above is not sufficient. The correct reference for the definition is 10 CFR Part 54 (more specifically 10 CFR 54.3) which is the definition given in Section 1.2 of RG 1.174. RG 1.174 has been clarified to make clear that the term " current licensing basis" from 10 CFR Part 54 is being used for convenience and that it is not intended to imply any change in the regulatory status of commitments.
H) Question: Should licensees be reauired to submit risk information in support of proposed changes to their CLB7 Applicable Comments and Responses: See comment (s) 22 through 24 and comment 81 in Table A-1.
Re:ponse: No, not as a matter of policy. PRA information should be used as appropriate to the change being considered.
)
Resolution: Section 1.1 of RG 1.174 dicusses this in more detail.
I i) Question: Are the guidelines for quality described in DG-1061 sufficient to ensure appropriate quality in th: e activities that support proposed changes to the CLB for safety rolsted systems, structures and comronents? Are the appropriate provisions from 10 CFR 50, Appendix B, " Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants" applied to the PRA?
Applicable Comments and Responses: See comment (s) 61 through 68 in Table A-1.
]
Raponse: The draft guidelines appear to be consistent with most current utility programs with the possible cxception of the record retention requirements. However, additional guidance is needed.
Resolution: In risk-informed promsses govemed by RG 1.174 and SRP Chapter 19, quality in PRAs will be assured in the near future through the use of the acceptance criteria that have been incorporated in the SRP. Specifically, the guidance suggests that licensees subject their PRA to a peer review, an industry PRA certification process, or PRA cross-comparison study. Such processes and studies will help eliminate, or at least identify the sources of variability in PRAs that are not the result of differences in the design, construction, or operation. As discussed in SRP Chapter 19, the staff will review the application of these programs, including the industry standards that have been applied and the qualifications of the personnelinvolved. The safety evaluation reports resulting from these rsviews will document the staff's assessment of quality and thus help to define the needed quality for specific applications.
The longer-term part of the staff's approach for addressing PRA quality is the development of PRA standards. As discussed in the October 1997 quarterly update of the PRA Implementation Plan (SECY-97-234), the staff is working with ASME to develop such standards. Once developed and found acceptable, it is the staff's intention to endorse thn standard in a revision to RG 1.174.
J) Question: Should a licensee's PRA be required to be included in the NRC's docket file and updated as necessary to reflect previous changes and recent operating experience?
l Applicable Comments and Responses: See comment (s) 22 through 24 and comment 83 in Table A-1.
Response No, however, in some cases, it may be necessary to re-evaluate risk-informed programs when major chInges are made to the plant or to the PRA.
A2-36 l
l
4 Resolution: Information relevant to this issue is provided in Section 3 of RG 1.174.
K) Question: What other areas, besides graded QA, Tech Specs, IST and ISI could this pmcess and these guidelines be applied to?
Applicable Comments and Responses: See comment (s) 13,16,18,21,36, and 87 in Table A-1.
Response: In the Response, it is stated that two other areas might be fruitful: (1) use of PRA to support discretionary enforcement and (2) use of PRA in evaluating USQs under 10 CFR 50.59.
Resolution: The staff is considering the need for specific activities in these areas as part its implementation of PRA in support of the inspection program.
2)
Enaineerina Evaluation:
A) Question: - Are the pmposed safety principles clear and sufficient? What should be clarified and/or cdded?
Applicable Comments and Responses: See comment (s) 69 through 72 in Table A-1.
Rrponse: The principles themselves are reasonable, but the guidance regarding them is insuffident in some crers.
Resolution: The discussion of the safety principles given in Section 2.1 in RG 1.174 has been revised to clarify the guidance regarding what is needed to demonstrate that they have been satisfied.
C) is sufficient guldence provided regarding the Intent, scope, and level of detail requested in the submittal with respect to the evaluation of the safety principles? What should be added? For example:
- 1. Question: Should there be different guidance on defense-in-depth for those items analyzed in the PRA versus those not analyzed? What should the differences be?
Applicable Comments and Responses: See comment (s) 34 in Table A-1.
Response: The PRA provides information relative to frequency of occurrence and consequences of events for use in complementing traditional defense in depth considerations.
Resolution: Section 2.4.1.1 in RG 1.174 has been revised to clarify the guidance for defense in depth.
- 2. Question: Should there be quantitetrve guidelines for determining the sufficiency of defense-in-depth and safety margins?
Applicable Comments and Responses: See comment (s) 38 and 39 in Table A-1.
Response: It is not clear how such quantitative guidelines could be developed.
l Rrolution: The sections addressing defense in depth (2.4.1.1) and safety margins (2.4.1.2) in RG 1.174 have l
been revised to clarify the guidance. Quantitative criteria are not proposed.
C) is the guidance associated with the probabilistic analysis sufficient? For example:
- 1. Question: Is additionalguidance on the use of qualitative risk evaluations necessary? What additional A2-37
e guidance would be appropriate?
Applicable Comments and Responses: See comment (s) 32 in Table A-1.
Response: This topic has insufficient guidance.
Resolution: The areas where qualitative information is discussed (including defense in depth and safety margins) have been reviewed and, in some areas, reviced to clarify the guidance. The evaluation of the proposed pilot plant programs and the safety evaluations for those programs will help to evaluate the adequacy of the present guidance en qualitative factors, and the regulatory guidance can be revised as necessary in the future as more is teamed.
- 2. Question: Are the proposed acceptance guidelines for CDF and LERF and changes in CDF and LERF appropriate? Are they too restrictive or too liberal? What guidelines would be more appropriate?
Applicable Comments and Responses: See comment (s) 4 through 12 in Table A-1.
Response: The guidelines are ambiguous and suggest that even those proposals involving infinitesimal changes in risk will present an undue burden of effort by both the staff and the licensees. This is due to the use of the baseline CDF and LERF values in the proposed acceptance guidelines where it appears that every application will h;ve to undergo increased NRC management and technical review.
Resolution: See responses in Section I to principal issues 1 and 3.
- 3. Question: Is more specific orless detailed guidance needed on comparison of PRA results with the CDF cnd LERF and the sCDF and sLERF guidelines?
Applicable Comments and Responses: See comment (s) 77, 79,91, 95, 99 and 101 in Table A-1.
Response: Guidance is generally insufficient.
Resolution: See responses in Section i to principal issues 1 and 3.
- 4. Question: Should there be additional guidance on the number of proposed risk increases which can be cubmittedin any given year?
Applicable Comments and Responses: See comment (s) 7 and 13 in Table A-1.
Response: No; this is not relevant to the risk-informed process in which the magnitude of the proposed changes cnd the insights gained by the changes are what are important.
Resolution: There are no limits given in RG 1.174 regarding the number of risk increases that can be submitted in tny given year provided that the acceptance guidelines are not violated. However, the cummulative impact of risk changes will be monitored by the staff.
Applicable Comments and Responses: None in Table A-1.
Re:ponse: No, the general definition of LERF is equally applicable to all U.S. LWRs.
Re:ponse: The set of LERF guidelines included in RG 1.174 does not distinguish between BWRs and PWRs.
A2-38
- 6. Question: Should there be separate LERF guidelines forshutdown conditions / external events? What thruld they be?
Applicable Comments and Responses: See comment (s) 73 through 78 in Table A-1.
Re:ponse: Reference is made to the response to Question 1 F.
R cclution: Section 2.4.2.2 of R.G.1.174 has been expanded to address the shutdown condition, including treatment of LERF.
- 7. Question: Should there be a guideline on long term release frequency to supplement LERF? What should it be based upon?
Applicable Comments and Responses: None in Table A-1.
Re:ponse: For cases in which long term release is the only concem, such guidance would be useful although this casa is not expected to occur very often.
Ruolution: Guidelines for such cases will be addressed in the future if and when the need occurs.
- 8. Question: Is the guidance in Appendix B of DG-1061 for estimating LERF sufficient? What else is needed? (It should be noted that the staffintends to expand this guidance to covershutdown conditions and external events).
Applicable Comments and Responses: See comment (s) 40 and 41 in Table A-1.
Re:ponse: The value of the present guidance in Appendix B is unclear. Most licensees have Level 2 PRAs. The simplified approach seems quite tedious and could provide misleading results unless augmented with plant specific data. While such simplified approaches can be beneficial, they need to be derived from plant specific data and not gsneric. Two concems regarding the approach are given in the response.
Resciution: Appendix B has been removed from RG 1.174. It is being revised and will published separately in a NUREG/CR report as reference material.
- 9. Question: Should there be acceptance guidelines for the use of PRA level 3 (segment of PRA that includes estimation of consequences / health effects and risk to the public) information? What guidelines w:Uld be appropriate?
Applicable Comments and Responses: See comment (s) 10 in Table A-1.
Re:ponse: Such guidance would be useful for plants having Level 3 PRA information, however, its development should not delay the issuance of the current guidance.
Resolution: The discussion regarding principle issue 1 discusses how Level 3 QHO calculations may be used in liru of LERF comparisons. Additional guidance for the use of Level 3 information in risk-informed activities will be considered for future revisions to RG 1.174.
- 10. Question: Should the acceptance guidelines specify a confidence level that the PRA results should meet wh:n being compared to the risk guidelines? What is an appropriate confidence level?
Applicable Comments and Responses: See comment (s) 5,88 and 91 in Table A-1.
Re:ponse: This is not necessary. Since the Safety Goals and subsidiary objectives are based on mean values, A2-39
O m:an values should also be used for developing the guidelines.
Resolution: Confidence levels are not used in RG 1.174.
- 11. Quesbon: Should a conRdence level or uncertainty lovel be used to define the " management attention" region in lieu of a CDFand LERF range?
Applicable Comments and Responses: None in Table A-1.
Response: No.
Resolution: Such levels have not been used in RG 1.174.
3)
Performance Monitcrina and Feedback:
A) Quesbon: Should the use of performance monitoring be more widelyapplied in regulation and regulatory practice, oris it suWicient to implement it through the elements described in the proposed regulatory guides?
Applicable Comments and Responses: None in Table A-1.
Response in the comments, it is stated that performance monitoring as an implementation of performance-based regulation has a much broader applicability than just for risk-informed regulation, and it should be extended to other regulatory practices as a regulatory improvement.
Resolubon: Broader use of performance monitoring is being given further consideration in a separate Commission initiative on performance based regulation.
B) Question: Je performance monitoring and Mbeck an appropriate element of the risk-informed process?
Should it be used to a greater orlester degree?
Applicable Comments and Responses: See comment (s) 43 and 46 through 49 in Table A-1.
Rseponse: Yes, it is an appropriate element, however, it should only be applied when there is a demonstrated concem over perfomance such as when the margin of safety could be significantly impacted.
Re:olution: See resolution to Principal issue 6 in Section I.
C) Guestion: Is the guidance on performance monitoring and feedback clear and sufficient? O should
. be improved?
Applicable Comments and Responses: See comment (s) 49 in Table A-1.
Re:ponse: No, the expectations are too general.
Resolubon: See resolution to PrincipalIssue 6 in Section 1. Also, additionalinformation on performance monitoring will be provided when the application-specific guidance documents are revised to reflect the received comments in cariy 1998.
1 A2-40 e
--