ML20132C550

Forwards Response to Commission Questions on Proposed Severe Accident Policy Statement (SECY-84-370).Proposed Changes Identified in Response,Per Staff Requirements Memo

ML20132C550
Person / Time
Issue date:	11/23/1984
From:	Dircks W NRC OFFICE OF THE EXECUTIVE DIRECTOR FOR OPERATIONS (EDO)
To:	Asselstine, Palladino, Roberts NRC COMMISSION (OCM)
Shared Package
ML20132C556	List: IA-85-199, Forwards Draft Rev of Policy Statement on Severe Reactor Accidents Re Future Designs & Existing Plants & Draft NUREG-1070,incorporating Policy Statement Rev,As Followup to Response to Commission Questions Per SECY-84-370 ML20132C550 ML20132D015 ML20133K245 ML20133K394 ML20133K433 ML20133K456 ML20133K564
References
FOIA-85-199, FOIA-85-A-15 NUDOCS 8412030015
Download: ML20132C550 (23)

Text

I f -t

':~7 ; 7. . e UNITED STATES *g }* 8 N ",A I p,. ; [.7 t,,,,f

f

[f3 ,s ascg*(o, o

, . , j NUCLEAR REGULATORY COMMISSION

, .g WASHINGTON, D. C. 20555 N**"* -:. / NOV 2 3 E34 MEMORANDUM FOR: Chairman Palladino Comissioner Roberts

, Comissioner Asselstine Comissioner Bernthal Comissioner Zech FROM: William J. Dircks Executive Director for Operations

SUBJECT:

STAFF RESPONSE TO COMMISSIONERS' QUESTIONS ON SEVERE ACCIDENT POLICY STATEMENT (SECY-84-370, DATED SEPTEMBER 19, 1984)

Following the Commission meeting on October 9, 1984, on the proposed policy statement, Comissioners Asselstine and Bernthal separately forwarded questions to the staff. The staff's responses to these questions may be found in Enclosures 1 and 2.

In the staff requirements memorandum, dated October 11, 1984, the Chairman also requested the staff to propose whatever changes are needed in the policy statement for a Commission decision. The proposed changes are identified in the staff responses (Enclosure 2, Questions A.1, 8.1, and B.4). These are being incorporated in a revision to the policy statement to be transmitted to you shortly.

Sped 1WiHlam J.lltitle William J. Dircks Executive Director for Operations

Enclosures:

As stateo

! cc: SECY OPE OGC l ACRS

Contact:

R. M. Bernero, NRR 492-7373 .

ca ~

s.8f.L2G3_@(.Lfgr\T

~ _ . _ - _

Enclosure 1 RESPONSES TO QUESTIONS BY COMMISSIONER ASSELSTINE REGARDING THE PROPOSED SEVERE ACCIDENT POLICY STATEMENT (SECY-84-370)

Question 1: Is there a practicable modification (e.g. , costs in the order of $200 million or less, reasonable to accomplish, either ,

accident prevention or accident mitigation) to existing PWRs  !

and/or BWRs that would make them substantially safer and more inherently safe?

. Question 2: If there is, what is the nature of that modification for PWRs and for BWRs?

Question 3: Could that modification serve as a substitute for the resolution of many or all of the outstanding safety issues?

Staff Response: There are, of course, candidates for modifications to existing plants that might make them safer. One of these is under current study in the ongoing USI A-45 program (" Shutdown Decay Heat Removal Requirements"), viz, a dedicated shutdown cooling system. We are no,t able at this time to assert that such a modification would be " reasonable to accomplish",,,but the proposed resolution of USI A-45 is expected to be issued in the Spring of 1985.

We do know, however, that some European countries have required backfitting of older nuclear power plants because of vulnerabilities identified in one or more of the following areas: response to small break loss-of-coolant accidents (LOCAs), insufficient separation and physical protection of redundant safety i trains, qualification of equipment for seismic events, LOCAs, and flooding, l .

l and capability to survive special emergencies such as aircraft crashes, major fires, gas explosions, lightning strikes, loss of the control room and sabotage.

! The decision to require backfitting was based on a combination of engineerin'g

. ' judgment, political and national sensitivities, and economics, but not on probabilistic risk assessments. For some plants, the decision was made to pro-i vide qualified equipment dedicated to certain functions in a new protected i

.- - - ._. - - - - - - . _ - - . _ _ - _ _ = .

r building, ra,ther than to upgrade the capability of existing systems. -Adding an extra package of safety systems in a new building connected to the existing plant at a limited number of p,oints, as opposed to local modifications and/or addit' ions to existing safety-related components, systems, and structures was found to reduce costs by solving several problems at once and by minimizing the downtime (and consequent replacement power costs) needed to connect the new systems.

This approach involves mainly the addition of extra cooling trains to effect the transfer of decay heat from the reactor and containment to the environment for events in which it is postulated that a large part of the existing safety systems becomes unavailable.. These extra cooling systems are usually located in new bunkered buildings that have special reinforcing and have their own

~

independent power supply, ultimate heat sink, ventilation, component cooling systems, controls, and instrumentation. This approach can achieve selected im,provements in safety with only limited modifications and interconnections to the existing plant. In most cases, the new cooling systems have automatic initiation and control for three to ten hours without any operator inter-venti'on. In addition, the bunkered buildings are usually provided with

a remote control station from which plant personnel can shutdown the reactor, l

i keep it in a cold shutdown condition, and monitor important plant parameters in case the main control room has been damaged or is not habitable.

The USI A-45 program is considering the potential benefits and costs of adopt-ing a dedicated system approach in the U.S. For PWRs, a system involving add-on high pressure injection / auxiliary feedwater trains appears to hold some

promise in terms of engineering feasibility and reduction in the probability of core melt. In addition, some PWRs may benefit from added primary or secondary pressure relief capacity and long-term residual heat removal (RHR) system 1 -

capability.

For BWRs, the staff is studying a dedicated system consisting of add-on sup-pression pool cooling and low pressure injection trains. Since in BWRs there exists a strong coupling and interaction between core decay heat removal and containment heat removal systems, it may be possible to configure a dedicated system that offers benefits for the mitigation of severe accidents as well as their prevention. However, the staff has just started to evaluate the dual use of equipment for prevention-and mitigation and is not in a position yet to pro-vide any results or recommendations. In principle, the addition of a dedicated system, designed to obviate certain vulnerabilities identified by previous PRAs and deterministic evaluations, could provide at least a partial resolution of a number of outstanding safety issues. Besides the decay heat removal issues of small-break LOCAs and transients, other safety issues that might be resolved or partially resolved at the same time include: station blackout, primary pump seal leakages, systems interactions, environmental qualification, fires, floods, seismic and sabotage concerns. Although these are not all of the outstanding

' safety issues, they represent a significant fraction of the major safety issues now under study. Other safety issues, such as pressurized thermal

, shock and containment bypass (event "V"), however, would not be resolved by this type of modification.

It is evident that the cost of such a system would be heavily dependent on decisions regarding design objectives (i.e., which issues will be addressed),

design criteria (i.e. , redundancy, seismic design, degree of operator ' inter-vention, etc.) and on plant-specific considerations (i.e. , strengths and weak-nesses of the existing design, available space and accessibility for construc-tion during operation, etc.). AsgartoftheUSIA-45 program,costestimates are being developed for backfitting a dedicated system approach for U.S.

operating plants. .0ur rough estimate at present is that costs would probably range from $50 million to $200 million per plant exclusive of interest and replacement power costs (that is, assuming that construction and connections to the existing plant could be made without significant extensions of normal refueling and maintenance outages).

There are also certain positive aspects that the staff will be exploring that could potentially offset at least some of these substantial costs. For example, the use of a dadicated system that suitably provides an additional level of functional redundancy to many of the existing safety features could relax or obviate many of the current Limiting Conditions of Operation (LCO) restrictions now in Technical Specifications. This added level of functional redundancy might not only improve overall safety but streamline and lessen existing test and maintenance downtime restrictions and thereby serve to improve overall plant availability. Such integral considerations (when

- taken alo'gn with possible savings through elimination of many outstanding separately treated, generic issues) might realize net safety benefits.

Finally, it must be noted that any add-on system would have attendant risks so that careful consideration must be given to assure a net safety benefit.

5-Question 4:

What is the estimated cost per plant of implementing the new requirements that have been approved by CRGR thus far?

Staff Response: Based on the cost information provided to the CRGR by sponsor-ing offices, the estimated cost for a plant to implement the new requirements, which the CRGR recommended that the ED0 approve, is ro^ughly $26 million dollars

($27 million for a PWR and $24 million for a BWR).

Question 5 How many items does CRGR anticipate dealing with in 1985?

Staff Response: Based on the schedule information provided by sponsoring of-fices, the CRGR anticipates deali .g with 70 proposals in 1985.

e e

Enclosure 2 RESPONSES TO QUESTIONS BY COMMISSIONER BERNTHAL REGARDING THE PROPOSED SEVERE ACCIDENT POLICY STATEMENT (SECY-84-370)

Question A.1 What are our options regarding an FDA for GESSAR-II? Must'we be constrained

.in proceeding until the Commission has approved a severe accident policy statement?

Staff Response: The severe accident review of the GESSAR-II design has been directed toward the provisions of the proposed Severe Accident Policy Statement, since no approved mechanism exists at present for conversion of the present non-forward-referenceable Final Design Approval (FDA) for the GESSAR-II design to a forward-referenceable FDA. Approval of the Severe Accident Policy Statement is necessary to provide direction, both in terms of licensing requirements and products (i.e., design approvals), for forward-referenceable FDAs and for demonstrating the acceptabiiity of new designs for nuclear power plants for severe accident concerns.

The Severe Accident Policy Statement would require reference designs, both those previously granted an FDA as well as those with no previous FDA, to be approved by the Commission in a rulemaking proceeding following the completion of the staf f's review. The staff has reconsidered this position and now believes that such approval should not be mandatory but be discretionary on the part of the Commission either on its own initiative or in response to a petition for rulemaking. This approach is consistent with the present provisions of Paragraph 7 of Appendix 0 to 10 CFR 50. The staff proposes to modify the

' policy statement accordingly.

Question A.2 If the Staff began immediately to seek " outliers" that yield, say,10 /

reactor yr core melt probabilities, what would be the character of such an effort and how long would it take for Staff to be reasonably confident that all such outliers have been discovered?

- Staff Response: The Severe Accident Research Program (SARP) is developing safety perspectives for six reference plants that cover a spectrum of plant /

containment designs. The generic conclusions in SARP will be based on these six reference plants. The purpose of a limited-scope severe accident safety analysis for each plant is to verify that generic conclusions developed in SARP are applicable.to a particular plant and to identify unique plant vulnerabilities.

Thus, this limited-scope analysis is not aimed at developing a full understanding

'of safety at a particular plant that can be.used to enhance plant operations now and in the future; but rather it is directed at a limited search for outliers.

The Accide'tn Sequence Evaluation Program (ASEP) performed under SARP has found a wide variety of support system designs such as service water and emergency power that are normally part of the balance of plant design. In addition, the plant layouts, civil structures, and plant operations are also unique for each plant.

Thus, we expect that any plant-specific vulnerabilities will likely be found in these areas rather than the nuclear steam supply systems. This approach for examining the plant for unique features is a condensed and focused effort of...

the process normally used in probabilistic assessments. The major features of the process'are:

e

(1) Systematic plant walk-through to identify unique features in the plant layout that could result in potential common cause failures, such as floods, earthquake damage, or environmental, effects.

(2) Logic analyses of specific systems or accident sequences based on prior experience or observations from the plant walk-through.

These logic analyses will include hazard analyses, failure modes and effects analyses, and event tree / fault tree developments using either the generic trees developed under ASEP to the extent feasible or procedures guides (NUREG/CR-2815, NUREG/CR-2728).

(3) Identification and simple assessment of structures and components deemed most vulnerable to initiators such as earthquakes based on experience and the plant walk-through.

(4) Qualitative assessment of the containment design with respect to strength, reactor cavity design, penetrations, and other indicators of severe accident mitigation performance using the reference plants as yardsticks.

There are abou.t 20 PRAs already in existence that cover approximately 30 units.

1 About 40 to 50 limited-scope studies would likely be necessary to extend the coverage to all units. Assuming a one year schedule to perform and document the limited-scope assessment, we estimate that it would require four to eight years to examine the remaining plants.

t We do not expect to be reasonably confident that all outliers can be discovered through limited scope studies or even full scope PRAs. We can attempt to check '

the completeness of PRAs by as. king whether two PRA teams working on one plant would'have found the same dominant contributors. Often, as our review of li-

. censee performed PRAs has shown, differences do arise. It is also relevant to ask whether PRAs would reliably have discovered the accident vulnerabilities revealed by historical accident precursor events such as the accident at TMI or the Rancho Seco " light bulb" incident in 1978. Often the answer to such questions is "no".

One of the tasks before us in the next 18 months is to improve the analysis procedures to better.the odds of discovering outliers.

1 i

e i

l i

4 V

i w- - . , - - , , - -. n, - , ._ . . - . . --. .._--. - . , .--,' -, _

/

Question A.3 e of 10~4

/ reactor yr core What is the Staff's melt probability (or, present view regarding as an alternative, 10 ug/ reactor yr significant release probability) as a broad guideline to assist in making judgments

,on the safety adequacy of plants such as Indian Point 2 & 3 and GESSAR-II?

Staff Response: Thresholds describing the acceptable frequency of severe, accidents can be of modest value as a guide to assist in making judgments of the safety adequacy of nuclear plants. The value is no more than modest because (1) accident frequency estimates are never so precise that the threshold determination is unambiguous, (2) any PRA capable of generating the frequency estimate can give rise to much more evidence - some of it more reliable - on the acceptability of the risk. A regulatory decision based upon the ensemble of such evidence is more trustworthy than if based upon any single guideline.

~4 Nevertheless, the simple guideline values of 10 / reactor year for core melt frequency and its current corollary guideline of 10-5/ reactor year for significant release frequency are useful indices to assist in making judgments on the safety adequacy of plants.

9 .

i l

l l

Question A.4 There appears to be a contradiction between the conclusion drawn in the SECY 84-370 document for operating and " pipeline" reactors, namely that the " existing plants pose.no undue risk to public health and safety" and, on the other hand, the following quote from NUREG-1070, Appendix A, page 106:

E "There is a distinct possibility of one or more additional severe accidents, beyond the one at Three Mile Island, in the remaining service life of the plants now in operation or under construction, unless the estimated accident frequency declines sharply with modifications, or has been significantly overestimated in current PRAs and actuarial inferences."

First, I am interested in whether the staff believes that this represents a contradiction. Second, if we have significantly overestimated our prediction of severe accident probability, when does the staff believe we'll be in a position to adjust the values to more realistic ones?

Staff Response:

The staff sees no contradictTon between the ~ statement " existing plants pose no undue.risktopublichealthandsafety"andthequotefromAfpendixAof NUREG-1070. The staff reads "public health and safety" as meaning offsite radiological health risk. The quote from the Appendix refers to accidents entailing severe core damage, such as TMI, and core meltdown. The quote is not restricted to accidents entailing severe offsite radiological releases. The text adjoining the quote from the Appendix attempts to reconcile the two statements. The most complete and recent PRAs suggest core-melt frequencies in

-3 ~4 -4 the range 10 / reactor year to 10 / reactor year. A typical value is 3 x 10 .

Were this the industry average, there would be a distinct possibility, more than two chances in three, of having a core melt accident in an industry of 120

, plants, each operating for 30 to 40 years. Put another way, it would suggest

! that no accidents, one accident, or two or more accidents are each roughly i

l equally likely outcomes.

t

The same PRAs suggest a very small health risk. Much of this can be at'tributed to containment, but as Appendix A shows, even if one gives no credit for mitigation by containment, the societal risk would fall at o.r below one latent casualty per reactor year for the typical site.

Neither PRA nor any other method can accurately assess for the foreseeable future whether a severe core damage accident is likely to occur. Current PRA estimates of the frequency of severe core damage accidents fall right in the middle of the gray area between the realm in which we would expect some accidents over the next.20 to 40 years.and the realm in which we would expect none. Some of the uncertainties in PRA-based accident likelihood estimation cannot wholly be eliminated in the next few years, such as the data for estimating the probabilities of accident scenarios with high l ~co.nsequences and very low frequencies. Therefore we cannot expect PRA to give an unambiguous reading of whether additional severe fuel damage accidents are to be expected or not. We can, however, expect PRAs applied to specific plants to reveal most--though not all--of the ways the subject plant may be so vulnerable to accidents as to warrant backfits or altered procedures.

4

- v - - , - - - ,w-=,---- +--- - - --- - --w - --- .-

.g.

Question A.5 On September 19, 1984 the staff reported to the Commission on the final report "Probabilistic Risk Assessment (PRA) Reference Document," NUREG-1050.

I was under the impression, that methodology was pretty much in place.

However, I note that it will be 18 months before the staff will issue

" guidance on the form, purpose and role that PRAs are to play in severe accident analysis..." (p. 7 of Policy Statement). Why will it take the

. staff so long?

Staff Response: Methodology for performing probabilistic assessments is available and is being utilized for conducting the six reference plant studies and others. Notable examples are the GESSAR-II standard plant study and the Zion / Indian Point studies. The staff has been involved in develooing procedures for these types of studies, such as NUREG/CR-2300, NUREG/CR-2815, and NUREG/

CR-2728. It is widely recognized that the methodologies are still evolving.

However, as noted in our response to Question A.2, a limited-scope probabilistic assessment'is being considered as one of the available options for evaluating existing plants. The staff has been actively engaged in discussions with IDCOR in developing a suitable approach to accomplish this objective. We expect that the remainder of FY85 will be required to evaluate the various options for the limited-scope studies that will provide an adequate level of investigation of potential outliers. This guidance is more difficult to develop because it will truncate many of the steps normally pursued in a PRA. Also, as noted in A.2, the current state-of-the-art does not yield a high level of confidence that all out-liers can be identified. We hope to improve our approach to completeness, as well as minimize the burden of severe accident safety analysis.

4

~

.g.

Output from SARP in FY85 addressing potential generic preventive and mitigative features for reducing severe accidents will be important for scoping the considerations in the decisionmaking process. Clearly defining' objectives, such as identifying the design options under study, will serve to clarify the i scope and methods that would be most cost effective in reducing severe i accident vulnerabilities. As a result, the 18-month schedule is consistent with ongoing staff and IDCOR activities related to utilizing probabilistic assessments in severe accident decisions.

9 I

e i

t e

8 f

l

Cuestion B.1 P. 4, 11, line 5. Shouldn't "could" really read "do"? That they "do" constitute the major risk was a conclusion of the WASH-1400 study. I thought the PRA effort since then further supports that conclusion.

Please comment.

. Staff Response: The staff agrees that severe accident studies performed since tne publication of WASH-1400 support its conclusion that the major portion of risk to the public from nuclear power plant accidents is associated with those mere severe than design basis events. Accordingly, the staff proposes to clarify the second sentence of page 4 to read as follows:

The focus on severe accident issues is prompted by the staff's judgment that accidents of this class, which are beyond the substantial coverage of design basis events, constitute the majo.r risk to the public associated with radioactive releases from nuclear power plant accidents.

. _ , _ __,___m _.. _ . . . . _ , _ _ _ _ _ . . _ _ _ _ _

11-Question B.2 P. 3, bullet two, line 4. Please clarify whether or not the adjective "public" modifies property? If it does, then can one interpret this

" procedural requirement" .to apply only to off-site property and not to

. financial risk associated with on-site (utility) property?

9 Staff Response: The staff does intend the adjective "public" as a modifier of

" property" and that this particular " procedural requirement" be interpreted to mean property outside the boundary of a plant's exclusion area, regardless of ownership.

The current staff guidelines as to what values and impacts should be included in regulatory analysis procedures is contained in an EDO memorandum dated April 30, 1984, to Office Directors and Regional Administrators on the subject:

" Issue Of Revised Regulatory Analysis Guidelines (NUREG-BR-00,58) To Incorporate Reference To A Handbook For Value/ Impact Assessment (NUREG/CR-3568)." Additional information on this subject is being prepared for the Commission as part of the Safety Goal Evaluation Program. l O

6 t

12 Question B.3 Re: " Cost-Effective" changes / reductions in risk (e.g., P.3 and P.6):

With a shift away from a purely PRA-based approach to " risk-reduction" decision making, how does the staff envision using a quantitative measure (if at all) that is derived from PRA considerations? For example, how exactly do you use a standard such as in NUREG-0880, Rev. 1 as a surrogate for " adverse and beneficial effects (soft attributes) of social significance."

(Note last three lines, P.6.)

Staff Response: Cost-benefit assessments are among the most practical of ways of relating PRA bottom-line results to decisions on risk reduction options. In light of the broad uncertainties in PRA, cost-benefit techniques cannot alone resolve cases in which the costs and values of averted risk are within a factor of ten or so of being equal. 'In this broad gray area in which cost-effectiveness is in doubt, other considerations such as consistency with the regulations, effectondefense-in-depth,SffectofuncertainassumptionsinthePRA,and prospects for subsequent regulatory stability become the predominant decision factors. However, for cases in which options are unambiguously cost-effective (or not cost-effective), the cost-benefit test may deserve a prominent role in the decision process.

The formula for monetizing the value of averted risk in the Commission's proposed safety goals (NUREG-0880, rev.1, FOR COPHENT) is well known to be highly conservative if it is meant to stand as a surrogate for offsite health effects alone. It has been shown to be realistic or slightly conservative as a surrogate for both health effects.and offsite radiological property damage.*.

"See, e.g., Staff testimony of Commission Question 5, Special ASLB Proceeding on Indian Point, 1982, Parts B, C, and Appendix I. See, also, NUREG-CR-2723,

" Estimates of Financial Consequences of Nuclear Power Reactor Accidents," D. R.

Strip, Sandia National Laboratories, September 1982.

13 It does not . reflect the incentives originating in the costs of cleanup of the plant or plant site, occupational exposure associated with the cleanup, the post accident replacement power costs, the business costs to the affected utility or other utilities, the lost capital investment in the subject plant, costs of possible shutdown orders for other plants, or psychological health effects offsite, nor the offsite health effects of the replacement power. It does not reflect indirect or ripple effects in realms such as economic, environmental, or national security matters. Thus, it seems appropriate that such a benefit-cost guideline should serve as a surrogate for at least sor.ie (toough scarcely all) of the " adverse and beneficial effects (soft attributes) of social significance" beyond the fatality effects treated in the Commission's proposed safety goals.

G i

e e f 4 i

l i

,---,-------~m, , , - - , , - ~ - , , -,,,-,,,,--,..-,-,-.,,,-v_..,-+-a,-.se--~ , .,<wn-,m,- - - - - . - , - - n------- - , , - , - - -

t .

14 Question B.4 i Is it really NRC's business to encourage standard designs that have i " reduced size and generating' capacity?" (P.5, 9 lines from bottom.)

Staff' Response: The staff recognizes that this is not a Commission policy and will delete this phrase from the reference sentence.

i. ,

't 4

e -

G e

I r l .

f

. Question B.5 P. 6, requirement "b." Isn't this a floating requirement' in that the priorities of the various generic requirements can change with time?

Staff Response: The priorities of the various generic requirements will, of course, change with time. The NRC staff continuously evaluates the safety requirements used in its review against new information as it becomes available.

Consequently, as time goes on, additional generic issues may be identified and others may be resolved and incorporated into the regulatory process as requirements.

As a practical matter, it would, of course, be necessary to identify those specific issues that vould require resolution on each application. This matter is to be addressed in the context of revised standardization policy.

I I

I e

9 I

l l

l I

l

Question B.6 Severe Accident Research (e.g., as discussed on P.8). The staff has i expectations of time limits on research programs but there is no indication of that here. Can we state here in the policy statement that we expect completion of the many research programs related to severe accident policy. This would aid in providing regulatory stability and suggest to those doing the research that these issues must be resolved.

Staff Response: The policy statement could, of course, be amended to reflect the expected completion of the many related research programs. The staff believes, however, that this expectation is more appropriately deal.t with in its documents that describe the program plans in more detail. These are the Long Range Research Plans (NUREG-1080), and the Nuclear Power Plant Severe Accident Research Plan (NUREG-0900). Both of these documents provide milestone schedules and completion dates for the various tasks of SARP. The staff is preparing a supplement to NUREG-0900 that will establish a schedule for implementing SARP results in severe accident decisions for future and existing plants. The first phase of SARP, initiated to provide the technical knowledge for the understanding of severe accident phenomena, is nearing completion. The second phase, directed to resolving major outstanding technical issues, is scheduled for completion in 1986.

P O

Question B.7 P. 14, bullet 1. Could you be more specific as to what constitutes a

" limited-scope" PRA in this context? Is the finding of.an outlier a sensitive function of the. completeness and depth of a PRA? Is the only complete PRA one that would fall in the category of " basic research"?

Staff Response: The staff's principal response to this question has been provided in response to Question A.2. However, the staff would make two additional observations. First, it has been our experience that the completeness and depth of any technical study of severe accident vulnerabilities, including a PRA, have important impacts on the results. We expect that the guidance developed for the " limited scope" PRA will focus the effort with respect to completeness and depth based on our experience to date consistent with a reasonable level of resource. expenditure. Second, a PRA is only complete within the boundaries of the study. The Zion and Indian Poin,t PRAs, which were performed by industry for specific evaluation of the plants, were more extensive than PRAs previously performed whether in a research context or not. However, th,e studies were not complete in an absolute sense (e.g., they omitted sabotage, some classes of human errors, and gave incomplete attention to accidents originating in failures of auxiliary systems such as control and instrumentation power supplies, component cooling water, and service water systems).

i I

,- -,. - - , - - - -. -