ML103620079

2010/12/28-Use of Risk Measures in Design and Licensing of Future Reactors

ML103620079
Person / Time
Site:	Davis Besse
Issue date:	12/28/2010
From:	Jamali K Elsevier, US Dept of Energy, Office of Nuclear Energy
To:	NRC/SECY
SECY RAS
Shared Package
ML103620074	List: ML103620075 ML103620076 ML103620077 ML103620078 ML103620079 ML103620080
References
License Renewal 2, RAS 19324, 50-346-LR
Download: ML103620079 (9)

Text

UseofriskmeasuresindesignandlicensingoffuturereactorsKamiarJamaliUnitedStatesDepartmentofEnergy,Of"ceofNuclearEnergy,1000IndependenceAvenue,Washington,DC20585,USAarticleinfoArticlehistory:Received17February2010 Receivedinrevisedform 5April2010 Accepted6April2010Availableonline10April2010 Keywords:

NuclearreactorsafetyProbabilisticriskassessment(PRA)Safetygoals Acceptancecriteria Nextgenerationnuclearplant Smallmodularreactors Frequency-consequencecurve abstractUseofinformationandinsightsfromprobabilisticriskassessments(PRAs)innuclearreactorsafetyapplicationshasbeenincreasingbythenuclearindustryandtheregulators,bothdomesticallyand internationally.Thisisadesirabletrend,asPRAshavedemonstratedcapabilitytoimprovesafetyandoperational"exibilitybeyondthatprovidedthroughdeterministicapproachesalone.Buttherecanbepotentialpitfalls.Thelimitationsofriskassessmenttechnologycanbelostthroughapproachesthatrely heavilyonquantitativePRAresults(referredtoasriskmeasuresinthispaper),becauseofthe unambiguousbutpotentiallymisleadingmessagethatcanbedeliveredbyrisk-basednumbers.Thisisparticularlytrueforfuturereactors,wherePRAsareusedduringthedesignandlicensingprocesses.Fortheseapplications,itisimportanttoensurethattheactual,defacto,orevenperceiveduseofrisk measuresinthecontextofeitherregulatoryordesignacceptancecriteriaisavoided.Whiletheissuesdiscussedherecanhaveasigni"cantin"uenceondesigncerti"cationorcombinedlicenseapplicationsforfuturereactors,theycanalsohavesecondaryimpactsoncurrentlyoperatingreactors.PublishedbyElsevierLtd.1.IntroductionProbabilisticriskassessment(PRA)resultsandinsightshavehelpedtoimprovenuclearpowerplantsafetyandoperational"exibilityformorethan30years.ThissuccesshasledtoincreaseduseofPRAsbythenuclearindustryandregulatoryauthoritiesworldwide.Whilethistrendislargelypositive,therecanbepotentialnegativeconsequencesthathavenotbeenwidelydiscussedinrelatedliterature,withsomeexceptions(e.g.,[1]).ItwasbecauseofthispositivecontributiontosafetythattheUSNuclearRegulatoryCommission(NRC)graduallyre"nedtheiroriginaldeterministic-basednuclearsafetyregulationsbyincorporatingtheuseofriskinformationandinsightswithinarisk-informedframework.Risk-informedregulationsforthecurrent"eetofoperatinglight-waterreactors(LWRs)arede"ned throughacombinationofrule-makingandpublicationoflower-tierdocuments,suchasregulatoryguidesorNRCsendorsementofcertainnuclearindustrydocuments.Thus,inarisk-informedframework,riskinformationandinsightssupple-mentthetraditionaldeterministicapproachesandformapartoftheoverallsafetycase(whichissometimesreferredtoasthesafetybasis)foranuclearplant.TheCommissionhasalsocalledforincreaseduseofPRAtechnologyinallregulatorymattersinamannerthatcomplementsNRCspredominantlydeterministicapproacheswithinthecon"nesofarisk-informedasopposedtoarisk-basedregulatoryconstruct.Someofthedistinguishingfeaturesbetweenthetwoarealsodiscussedinthispaper.ThenuclearindustryalsohasusedPRAtechniquesextensivelywithbene"cialresults,includinginthedesignofadvancedorevolutionarynuclearreactors.Thesebene"tsare,inpart,relatedtothefactthatthesesameuserscanalsocontrolandlimitthein"uenceoftheincompletesafetyinformationthatisprovidedthroughtheresultsofthePRAalone.FactorsthatareusuallynotfullyaccountedforinaPRAmodelbutaregermanetotheconsiderationofadequacyofsafetyfeaturesforaspeci"cissueoraccidentscenariomayinclude:magnitudesofrelevantsafetymargins,incorporationofdefenseindepth,potentialforcorrec-tiveorcompensatoryactions,degreeofconservatisminanalysis,andmanyothers.TheverysamePRAinformation,however,whenusedtocomplywithwell-intentionedregulatorypoliciesandapproachescanleadtosomeundesirableconsequences.Someoftheundesirableconsequencesinapplicationsinvolvingfuturereactorsarealsodiscussedbelow.PRAsprovidebothqualitativeandquantitativeinformation.Recenttrendsinthedevelopmentofnewrisk-relatedapproaches, whethertheyareperformedbytheregulatorystaff,nuclearindustry,orotherdomesticorinternationalbodies,aretowardsheavieremphasisinuseofquantitativePRAresults(interchange-ablyreferredtoasriskmeasuresinthispaper).Itiswell-knownthatquantitativeresultsofPRAs,inparticular,aresubjecttovarioustypesofuncertainties.Examplesoftheseuncertaintiesincludeprobabilisticquanti"cationofsingleandcommon-causehardwareorsoftwarefailures,occurrenceofcertainphysicalphenomena,humanerrorsofomissionandcommission,ARTICLEINPRESSContentslistsavailableat ScienceDirectjournalhomepage:www.elsevier.com/locate/ressReliabilityEngineeringandSystemSafety0951-8320/$-seefrontmatterPublishedbyElsevierLtd.

doi:10.1016/j.ress.2010.04.001E-mailaddress:

kamiar.jamali@hq.doe.govReliabilityEngineeringandSystemSafety95(2010)935-943 ARTICLEINPRESSmagnitudesofsourceterms,radionuclidereleaseandtransport,atmosphericdispersion,biologicaleffectsofradiation,dosecalculations,andmanyothers.Unlikedeterministicuncertaintiesrelatedtophysicalphenomena(e.g.,neutronics,thermal-hydrau-lics),PRAuncertaintiesarenotreadilyreducibleinmostinstances.Uncertaintiesassociatedwithphysicalphenomenacanoftenbereducedbytests,experiments,operatingexperienceonactualorprototypedesigns,orimprovementsinanalyticalmodelsorcomputationalcapabilities.Despitethiswell-knownlimitation,ifquantitativePRAresultsareusedinthecontextofriskacceptancecriteria(i.e.,whentheyarecomparedagainstasetofthresholdvaluesestablishedbyeithertheindustryortheregulator),itwouldbedif"culttocountertheunambiguousbutpotentiallymisleadingorincorrectmessagethatisdeliveredbysuchanumber-basedprocess;i.e.,implyingthatadesignisunacceptableorunsafebecauseitdidnotmeetaparticularrisk-basednumericalthreshold(labeledasariskacceptancecriterion).Animportantissuethatisoutsideofthescopeofthispaper,butisworthyofdetaileddiscussionsofitsown,isthattheintroductionandimpactofPRAsinthedesignandlicensingstagesforafuturereactorisbyandlargedifferentfromthewaythatrisk-informedregulationshavebeenappliedtoexistingreactors.Currentlyoperatingreactorshadadeterministicallyestablishedlicensingbasis(whichincludedtheplantssafetybasis)beforeplant-speci"corgenericriskinformationandinsightsweremadeavailablethroughPRAs.ThePRAsgenerallycon"rmedthattheoriginaldeterministicapproachtodesignandlicensingwasconservative(e.g.,plantscouldrespondtosomeaccidentscenariosinmannersthatwerenotcreditedinthedeterministicanalyses)andfurtheridenti"edchangesthatcouldimproveplantdesignoroperationalsafety.Meetingthedeterministicrequire-mentsmeantthatimplementationoftheirattendantprovisionsembodiedwithintheconceptsofdefenseindepth,safetymargins, conservativeassumptionsandanalyses,qualityassurance,andnumerousotherfactors(manyofwhicharenotreadilymeasur-ablewithinaPRAmodel)createdasafetycushionormarginthatprotectedtheseplantsfromuncertainties,includingthosefromunknownunknowns(forwhichaeuphemismcanbeemergingsafetyissuesasdiscussedinSection2).Ontheotherhand,PRAmodelshavetorelyonrealisticinputstoensurethatrisksigni"cantinsightsarenotobscuredbyarti"ciallybiasedresultsderivedfromtheapplicationofunevenconservatisms.Therefore,greatcaremustbeexercisedinbringingPRAsintothedesignprocesstoensurethatthefundamentalpillarsofdeterministicsafetyassuranceprocessmentionedabovearenotundulycompromised.Thus,forfuturereactors,useofriskinformationcanhaveafarmoresigni"cantimpactonthesafetybasisoftheplant,includingthepotentialtodrivesomekeydesigndecisions.Theintentofrisk-informedregulationsistoensuretheirin"uenceispositiveinsafetytradeoffdecisions.2.NRCsapproachtosafetygoalsandriskacceptancecriteriaNRCpublishedtheSafetyGoalsPolicyStatementonAugust8, 1986[2].WhilethetextofthisPolicyStatementdoesusethephraseacceptablerisk,thetitleandtherestofthediscussionswerecarefultoavoidtheuseoftheQuantitativeHealthObjectives(QHOs)ofpromptfatalities(PFs)andlatentcancerfatalities(LCFs)asregulatoryrisk-acceptancecriteria.Inother words,theselectionoftheterminologyofsafetygoalswasverydeliberate.Animportantattributeofthecalculationofplant-speci"cPFsandLCFsforcomparisonwiththedualQHOsisthatbotharebynecessityintegralquantitiesthatarederivedfromthecontributionsofallaccidentscenariosthatareconsideredintheplant-speci"cPRAmodel.TheCommissions1995PRAPolicyStatementonuseofPRAmethodsinnuclearregulatoryactivities

[3],whichwasissuedintheaftermathofthecompletionofPRAsforalloperatingnuclear plantsinaccordancewiththeIndividualPlantExaminationsGenericLetter

[4]states,inpart:TheuseofPRAtechnologyshouldbeincreasedinallregulatorymatterstotheextentsupportedbythestate-of-the-artinPRAmethodsanddataandinamannerthatcomplementstheNRCsdeterministicapproachandsupportstheNRCstraditionaldefense-in-depthphilosophy.TheCommissionssafetygoalsfornuclearpowerplantsandsubsidiarynumericalobjectivesaretobeusedwithappropriateconsiderationofuncertaintiesinmakingregulatoryjudgmentsontheneedforproposingandback-"ttingnewgenericrequirementsonnuclearpowerplant licensees.TheCommissionapprovedthestaffsWhitePaperonRisk-InformedandPerformance-BasedRegulationinMarch1999

[5],whichprovidedde"nitionsofrisk-informedandrisk-basedregulations.ItreiteratesthattheCommissiondoesnotendorseanapproachthatisrisk-based,whereindecision-makingissolely basedonthenumericalresultsofariskassessment.RegulatoryGuide1.174

[6]establishedtheframeworkforrisk-informedregulationsinapplicationsregardingmakingplant-speci"cchangestothelicensingbasis.ItsapproachensuresthatnumericalPRAresultswouldnotformthesolebasisformakingnuclearsafetydecisionsbylisting"vekeyprinciples(i.e.,meetingcurrentregulations[whichareprimarilydeterministic],meetingdefense-in-depthprinciples,maintainingsuf"cientsafetymargin,keepingincreasesinrisksmall,andperformancemonitored)thathavetobemetforarisk-informedapproach.Clearly,currentregulationsarebyandlargebasedondetermi-

nisticrequirements.Akeyportionofthesectiononscope(Section1.4)states:

yTheNRChaschosenamorerestrictivepolicythatwouldpermitonlysmallincreasesinrisk,andthenonlywhenitisreasonablyassured,amongotherthings,thatsuf"cientdefenseindepthandsuf"cientmarginsaremaintained.Thispolicyisadoptedbecauseofuncertaintiesandtoaccountforthefact thatsafetyissuescontinuetoemergeregardingdesign,construction,andoperationalmattersnotwithstandingthematurityofthenuclearpowerindustry.Thesefactorssuggestthatnuclearpowerreactorsshouldoperateroutinelyonlyataprudentmarginaboveadequateprotection.Thesafetygoalsubsidiaryobjectivesareusedasanexampleofsuchaprudent margin.Theclauseaboutcontinualemergenceofsafetyissuesforplantswithmanyyearsofoperatingexperienceisanalternativewaytostatetheconcernregardinguncertaintiesabouttheunknownunknownsthatareamoresigni"cantconcernforfuturereactordesigns.OnereasonthatRegulatoryGuide1.174hasworkedwellinapplicationisthatitwasintendedforoperatingplantswithaprimarilydeterministiclicensingbasisalreadyinplace,whichmeansthattheplantswerealreadydeterminedtobesafebeforeapplyingtheresultsofplant-speci"cPRAs.Finally,Note2ofChapter19oftheStandardReviewPlan(SRP)

[7]statesthattheQHO-surrogatesofCoreDamageFrequency(CDF)andLargeReleaseFrequency(LRF)aregoalsandnotregulatoryrequirements.ThekeyconclusionfromtheaboveisthattheNRCCommissionershavenotendorsedarisk-basedapproachtoregulationbecauseoftheuncertaintiesinquantitativeresultsofK.Jamali/ReliabilityEngineeringandSystemSafety95(2010)935-943 936 ARTICLEINPRESSPRAs.Theseuncertaintiesarelargeforcurrentlyoperatingnuclearplants,particularlyintheso-calledLevel2andLevel3PRAs.Thefactthatthelargeuncertaintiesintheestimatesofprobabilitiesforhardwarefailuresandhumanerrors,andunderstandingandprobabilisticquanti"cationofoccurrenceofsomephysicalphenomenainPRAsofcurrentlyoperatingreactorsseemlesssobecauseofrepeatedreuseshouldnotbeoverlooked.Treatmentofuncertaintiesinsevereaccidentprogressionanddelineationhasalwaysbeenlimitedinriskassessmentsperformedtodate,eveninthestudiesthatwentthefurthestinsuchanalyses,suchas NUREG-1150

[8].Anotherimportantconsideration,alsorelatedtothegeneralcategoryofuncertainties,istheissueofstate-of-the-artinPRAmethodsanddata.Thisisanissueforriskmodelingofallreactordesignsasalludedtoabove,anditisespeciallysofordesignsthatprimarilyrelyonpassivesafetyfunctionsperformedbysafety-relatedSystems,Structures,andComponents(SSCs)anddigitalsystems(e.g.,ininstrumentationandcontrol

-I&C).Thecurrentstate-of-the-artdoesnotpermitahighqualitymodeling forreliabilityevaluationsforthesesystems.Inparticular,thereisconsiderableuncertaintywithrespecttothecontributionofsoftwarecommon-causefailures(CCF)todigitalsystemrelia-bility.Forthepotentiallysaferandmorepassiveadvancedreactordesigns,itispossiblethatdigitalsystemsandhumanerrorsofcommission(dueinparttolongertimeconstants

-see,e.g.,[13])mighthaveahigherrelativeriskcontribution,acontributionthat maybedif"culttoassesswithanysigni"cantlevelofcon"dence.TheseissuesofferadditionalreasonstoapplyquantitativePRAresultsjudiciouslyforfuturenuclearplants.TheCommissionalsoofferedanothergoalof1E6/yrwithintheSafetyGoalsPolicyStatementforfrequencyoflargereleasestotheenvironmentforfurtherstaffexamination.Ade"nitionforlargereleasewasnotofferedinthatdocument[2].In[9]thestaffconsideredseveraloptionsand"nallyrecommendedthatalargereleasebede"nedasareleasethathasthepotentialforcausinganoffsiteearlyfatality.SeveralotherSECYpapers(denotespaperssubmittedtotheCommissionersbytheNRCstaff),StaffRequirementsMemoranda(SRMs),andAdvisoryCommitteeonReactorSafeguards(ACRS)letterstotheCommission(e.g.,[10])weredevotedtothissubject.TheCommissiondirectedthestafftoensurethattheirevaluationoflargereleasemagnitudebeconsistentwithACRSproposedguidelineslinkingthehierarchicallevelsofthesafetygoalobjectives,wherethelargereleaseguidelinewasconsideredthethirdlevelobjective(thequalitativeandquantitativehealthobjectivesweretheleveloneandtwoobjectives).Accordingtotheseguidelines,eachsubordinatelevelofthesafetygoalobjectivesshould:beconsistentwiththelevelabove,notbesoconservativeastocreateadefactonewpolicy,representasimpli"cationofthepreviouslevel,provideabasisforassuringthattheSafetyGoalPolicy Objectivesarebeingmet,bede"nedtohavebroadgenericapplicability,bestatedintermsthatareunderstandabletothepublic,andgenerallycomplywithcurrentPRAusageandpractice.Intheend,thestaffreachedtheoverallconclusionthatdevelopmentofalargereleasede"nitionandmagnitude,beyondasimplequalitativestatementrelatedtothefrequencyof1E6/yrisneitherpracticalnorrequiredfordesignorregulatorypurposes.Inaddition,basedupontheworkdoneevaluatinglargereleasesinNUREG-1150

[8]andotherrelatedactivities,thestaffnotedthatthegeneralperformanceguidelineof1E6/yrandtheCDFsubsidiaryobjectiveof1E4/yrarenotconsistentwiththeoriginalQHOs

[11](i.e.,theyaremoreconservative,andthedegreeofconservatismdependsonthespeci"cplant).Inaddition,theCommissionrejectedtheuseof1E5/yrofreactoroperationasaCDFgoalforadvanceddesignsinSECY-90-016[12]anditsSRM.ThisrejectionshouldbeexaminedtogetherwithaseriesofCommissionPolicyStatementson regulationofadvancedreactors.ThelastintheseriespublishedinOctoberof2008

[13]states:TheCommissionexpects,asaminimum,atleastthesamedegreeofprotectionoftheenvironmentandpublichealthandsafetyandthecommondefenseandsecuritythatisrequiredforcurrentgenerationlight-waterreactors.Furthermore,theCommissionexpectsthatadvancedreactorswillprovideenhancedmarginsofsafetyand/orusesimpli"ed,inherent,passive,orotherinnovativemeanstoaccomplishtheirsafetyandsecurityfunctions.TheincorporationofenhancedsafetymarginsmayhelpoffsettheeffectsofaddeduncertaintiesinthePRAmodeland/orinaccidentanalysesarisingfromthenoveltyofadvancedreactordesigns.[Elsewhereotherattri-butesofadvanceddesignsaredescribedas:reliableandlesscomplexshutdownheatremovalsystems;longertimecon-stantsandsuf"cientinstrumentation;simpli"edsafetysys-tems;minimizepotentialforsevereaccidentsbyincorporatingredundancy,diversity,safetysystemindependence;incorpo-ratedefense-in-depth;etc.].TheimportantaspectsofthisPolicyStatementare:(a)itcontainsonlyqualitativebutwell-provenprinciplesforenhancedsafetyofnuclearreactordesigns,and(b)itspeci"callylacksanyrisk-basednumericalcriteria.Becauseoflargeuncertaintiesofrisk-basednumericalresults,riskanalyststypicallydonotconsidervariationsoflessthanfactorsof10orsoinsuchnumbersasmeaningfulincrements.Riskexpertsmayconverttheabovepolicystatementintoacorrespondingnumericalcriterionbyprovidinganorderofmagnitudeasthesmallestdiscriminatorfordecidinghowmuchsaferadvancedreactorsshouldbefromcurrentreactors.This,however,isanon-sequiturandaprobleminherenttorisk-basedcalculations.Anorderofmagnitudeisaverylargeincrementintherealworld,andcurrentnuclearreactorsarealreadymuchsaferthananyothercomparableindustrialfacilitiesandhazardoushumanactivities.Ultra-con-servatismindesignhasaprice,botheconomicallyandoperationally.AsdiscussedinSection3,theproposednewsurrogatenumericalrisk-basedcriteriacanbefarmorerestrictivethantheQHOs.TheyarealsoquantitativelyunpredictableinrealriskspaceandnotcomparablewithQHOsastheyarenon-integralmeasuresofrisk.Theyaremorerestrictiveinthesensethatareactorthatinahypotheticalcasemayfailtomeetsomeofthenewcriteria(describedinSection3)canstillmeettheQHOsbyordersofmagnitude.InspiteoftheabovediscussionsandthebroadpolicyguidancebytheNRCCommissioners,thispapersobservationisthatthroughoutmanypublicationsofthenationalandinternationalregulatoryagenciesandcommercialentities,thereisanincreasingtrendtowardmoreprevalentuseofrisk-basedregulatoryconceptsingeneral,andtheuseofsomeformofnumericalriskthresholdsasacceptancecriteriavis-a-vissafetygoals,inparticular.Forexample,anumberofNRCstaffdocuments(e.g.,[14,15]),aswellasindustryandinternationalpublications(e.g.,[16-23]),haveemployedvarioustypesofrisk-acceptancecriteria(consistentwiththeterminologyemployed withinthedocuments)whichinvolvesomeformofafrequencyversusconsequence(FC)curve,orFCanchorpointsorregions.ItcanbeshownthattheseapproachesgenerallyestablishmuchmorerestrictivenumericalthresholdsthantheQHOs,andareappliedasnon-integralquantities.WhiletheintentionsbehindthistrendarenobleandmotivatedinpartfromadesiretoK.Jamali/ReliabilityEngineeringandSystemSafety95(2010)935-943 937 ARTICLEINPRESScontinuouslyimprovenuclearreactorsafety,andinpartfromtheCommissionPolicyStatementsonregulationofadvancedreactors

[13],theiractualimplementationcanleadtoanumberofundesirableconsequences,asdiscussedinSection3.3.Critiqueoffrequency-consequencecurvefrom NUREG-1860Thissectionpresentsabriefreviewofaspeci"csection(i.e.,thediscussiononFCcurveasapotentialriskthresholdforLicensingBasisEvents)oftherepresentativeandprobablythemosthigh-pro"le,documentamongtheinternationalreferencesmentionedabove,namelyNUREG-1860

[15],anddescribessomeissuesthatcanariseinusingsimilarapproacheswithregardto numericalriskassessmentresults.NUREG-1860doesaddressdeterministicrequirementsanddefenseindepthguidelines,buta discussionofthesetopicsisbeyondthescopeofthispaper.AnimportantpartofthereasonfortheprominenceofNUREG-1860inthesediscussionsisSECY-07-0101anditsStaffRequirementsMemorandum

[24],inwhichtheCommissiondirectedtheNRCstafftotesttheconceptofthisframeworkon anactualfuturereactordesign.ThemostlikelycandidatefortheapplicationofthisRisk-InformedandPerformance-BasedRegulatoryStructureforFuturePlantLicensingistheNextGenerationNuclearPlant (NGNP)[25].Therami"cationsofthisactioncangobeyondtheNGNPlicenseapplication,andpotentiallyhaveasigni"cant impactonallfuturereactors,particularlyadvancedreactorsthatwouldlargelyconstitutethegroupthatiscurrentlyreferredtoastheSmallModularReactors(SMRs).Moreover,theycancreateanenvironmentforraisingand/orrevisitingquestionsonwhethercurrentlyoperatingreactorsareindeedsafeenough,eventhoughthisquestionhadbeenemphaticallyputtorestwithapositiveresponseinthepast.TheissuethatthissectionexaminesiswhethertheuseofnumericalresultsofPRAs(i.e.,riskmeasures)tobecomparedagainstpre-establishedriskthresholds(i.e.,risk-acceptancecriteria),asemployedinNUREG-1860andthesimilarapproachesintheotherreferenceddocumentslistedabove,isakintomodifyingNRCslong-establishedrisk-informedregulationparadigmtowardsoneofbeingrisk-based;andwhethertheseapproachescouldleadtoother,unintendedconsequences.DiscussionsinSections2.5.1,3.2.2,6.2.2,and6.3ofNUREG-1860state:TheFCcurveisusedinthefollowingways:1.FortheselectionofLicensingBasisEvents(LBEs)(discus-sionandde"nitionprovidedin

[15]),includingfrequent,infrequent,andrareevents.

JThispapernotesthattheretentionofaccidentscenariosotherthansevereaccidentsinthePRAbeyondtheinitialscreeningstagecreatesanentirelynewtypeofPRAthatis,amongotherthings,muchlargerthanthecurrentPRAs.CurrentPRAsdonotretainforfurtheranalysisaccidentscenariosthatterminateinstatesotherthanoneofanypre-de"nedconsequencecategories,oftenreferredtoasplantdamagestates.Forcurrentplantsthesegenerallyinvolvecoredamage,basedonprede-"nedthresholds(e.g.,peakcladdingtemperatureabove

2200 1F).TheNUREG-1860PRAmethodwouldaddition-allyincludeallintermediateaccidentscenariosfrom simpleinitiatingeventstothoseintermediatescenariosthatareterminatedsuccessfullybeforereachinganyplantdamagestate,aswellasthetraditionalPRAsplantdamagestatescenarios.ThistypeofPRAcanbecomesigni"cantlylargerthanthetraditionalPRAs,depending onthespeci"csofthemethodologychosenbytheanalysisteam.Asigni"cantincreaseinthelevelandcomplexityofthePRAcanleadtoproblemsofcost,con"gurationcontrol,dif"cultyforanalysisofresultsandreview,andissuesregardingqualityassuranceoftheproduct.2.PossiblyasasurrogateriskmetrictotheQHOs,becausetheCDFmetricforLWRsisnotfullyapplicabletoalladvancedreactors(suchasthehigh-temperaturegascooledreac-tor-HTGR);and3.Asaguidetodesigners,i.e.,itrelatesthefrequencyofpotentialaccidentstoacceptable[emphasisadded]radiationdosesatthesiteboundaryfromtheseaccidents.Fig.6.2ofNUREG-1860,reproducedhereasFig.1,isanexampleofaworldwideandindustry-widetrend(documentedin Refs.[14-23]).TheACRSexpressedanumberofconcernswithearlierversionsofthiscurve

[26].NUREG-1860indicatesthatdosesinFig.1aretotaleffectivedoseequivalents(TEDEs,whichincludesthe50-yearcommitted dose)calculatedatthesiteboundaryonaperscenariobasis.Additionaldiscussionrelatedtothis"gure,andthoseinanumberofotherreferences,e.g.,[14,18,27]alsoreiterateaquestionablerelationshipbetweenanaccidentfrequencyof1E4/yr,adoseof25rem,anddesignbasisaccidents(DBAs).First,itisimportantto notethatmanytraditionalDBAfrequenciesaredemonstrablybelowthisfrequency,wheninitiatingeventfrequenciesarecombinedwiththepartialfailureprobabilitiesofsafetysystemsimposedbytherequirementsofsinglefailurecriterion.Forexample,inthelastparagraphofpage,6-7ofNUREG-1860itisstatedthat:

ywhilethoseintherangeof1-25remareassignedafrequencyof1E4peryear.TheDBAoff-sitedoseguidelinein10CFR50.34

[29]and10CFR100

[30]is25rem.[Note:Therelationshiporalackthereof,betweenadoseof25remand DBAsisdiscussedinSection5.]

ydosesintherangeof25-100remareassignedafrequencyof1E5peryear.ydosesintherange100-300remareassignedafrequencyof 1E6peryear,300-500remafrequencyof5E7peryear,andthecurveiscappedbeyonddosesgreaterthan500remat 1E7peryear.ThispaperproposesthatusingFig.1inregulatoryorevendesignapplicationsassuggestedinNUREG-1860canleadtoanumberofunintendedconsequencesfortwoprincipalreasons:(1)theuseofthelabelsofacceptableandunacceptable,and(2)comparisonoftheembeddedcriteriaagainsttheattributesofindividualaccidentscenarios(asopposedtointegralmeasuresofrisk,suchasCDForLCFs).Speci"cally:TheCommissionhaslongavoidedestablishinganykindofrisk-basedacceptancecriteriabyendorsingtheQHOsassafetygoals.Asstatedearlier,thesigni"cantrolesplayedbyboththeuncertaintiesandstate-of-the-art(bothofwhichareexacer-batedforfuture/advancedreactorswithlittleornooperatingexperience)associatedwiththePRAmodelofaplantarethemaindriversforthisdecision.Inaccountingforuncertainties,thePRAmodelcanonlyprovidesometreatmentoftheknown uncertaintiesthroughpropagationofparameteruncertaintiesandperformingsensitivitystudies(toaddresssomemodelinguncertainties),andisgenerallyincapableofhandlinguncertain-tiesassociatedwith(lackof)completenessinherenttotheK.Jamali/ReliabilityEngineeringandSystemSafety95(2010)935-943 938 ARTICLEINPRESSanalyticalmodelsandmanyotherfactors(e.g.,impactofsafetymargins).Eventhen,theuseofrepresentativeparameters(suchasthemean)associatedwiththefrequenciesandconsequencesofindividualorintegratedaccidentscenarioshaslimitationsofitsown,asthetypesandwidthsoftheunderlyingdistributions oftheinputrandomvariablesaregenerallyassignedbysubjectivejudgment.Itisclearthattheseissuesbecomemoredominantinanalysesoffuture/advancedreactordesignswithlessknowledgeaboutseveralkeyaspectsofthesafetyofthedesign,suchasthe"delityofanalysesinthermal-"uids,neutronics,"ssionproducttransport,materialpropertiesathightemperatures,componentreliabilities,andtheunknownunknowns.TheQHOshavealogicalrelationshipwiththeriskthatthe membersofthepublicareotherwiseexposedtoasarticulatedinthequalitativehealthobjectives.Theyestablishtherisksofnuclearpowerplantoperationsatasmallfractionoftherisksthatthemembersofthepublic,notthegeneralpublicatlarge,butthoselivinginthevicinityoftheplantarealreadyexposedto.Areductionintheserisksforfuturereactorsproposedbyanystakeholder(whichwouldbeconsistentwiththestatedqualitativegoaloftheCommission),shouldbewithinreasonandnotsodrasticastodeprivethesamepopulationfromthebene"tsthattheymayotherwiserealizefromoperationofthesereactors.Plant-speci"cPFsandLCFsarecalculatedforcomparison againsttheQHOs.Bothofthese,aswellasthemorewidelyusedsurrogatemetricstoQHOs,suchasCDFandLRFforLWRapplications,areintegralquantitiesthatarederivedfromthecontributionsofallaccidentscenariosthatareconsideredintheplant-speci"criskmodel.Integralriskmeasuresincorpo-rateatleastthreeimportantproperties:1.De"nitionorcharacterizationofindividualaccidentscenar-iosisdependentonboththespeci"cPRAmodel(e.g.,largefaulttree/smalleventtreeversussmallfaulttree/largeeventtree)andthespeci"cplantdesign(e.g.,complexwithmoreactivesafetysystemsversuslesscomplexwithmorepassivesafetysystems).Integratedriskmeasuresarenotsubjecttosuchdependenciesonthecalculationmodelorplantdesign.

JItwillbeachallengetoestablishcriteriatoensurethat individualaccidentscenariosarede"nedorcharacter-izedatthesamelevelofresolutionacrossdifferent plantdesignsandassociatedPRAmodelsforusewiththistypeofFCcurveconstruct.Thesystemwouldbeinherentlyunstableanddependentonsubjectiveinter-pretationsbyallsidesinadispute.2.Relativeuncertaintiesdecreasewhentheassociatedran-domvariablesaresummed,andtheyincreasewhentherandomvariablesaremultiplied.Therefore,theeffectsofuncertaintiesareminimizedwhenintegratedriskmeasuresareusedasopposedtowhenintermediateandproductquantities,suchasfrequenciesandconsequencesofindividualaccidentscenariosareused.3.Comparisonofanypartiallevelofplantrisk,suchasthosethatarebasedonindividualaccidentscenarios,againstsomequantitativecriteriacanmisinformorevenmislead.Thepotentialformisinformationislargebecauseitwouldnotbeknownastowhatfraction(isit0.001%or10%)oftheoverallintegralrisk(evenwithinthesamecategory,suchasinternalevents)isbeingcomparedagainstthecriteria.

JThus,theriskofanindividualscenariowould/shouldnot necessarilybeunacceptableifitfallsintheunaccep-tableregionofanFCcurve,becausetheQHOs(assafetygoals)mightstillbemetwithlargemargin.

JAconversecorollaryisthattheriskofindividual scenariosshouldnotnecessarilybeviewedasaccep-tableintheotherregioneither,asaprudentapproachtosafetyassurancealwaysseekstoincorporatereason-ableadditionalcontrolswhereeveraproperqualitativeengineeringjudgmentoraquantitativeanalysissodictates.Fallingwithintheacceptableregioncoulddenythedesignersandothersfromthoroughengineeringthinkinginthesafetydesignprocess.IfitisassumedthatafuturedesignofanHTGRoranSMR meetstheFCcurve,thentheNRCwillbeonrecordforFig.1.Frequencyversusconsequencecurve(Fig.6.2)ofNUREG-1860.K.Jamali/ReliabilityEngineeringandSystemSafety95(2010)935-943 939 ARTICLEINPRESScertifyingthatthelevelofrisk-basedsafetyofthisdesignisacceptable,andincontrast,anydesignthatdoesnotmeetthislevelofsafety,evenforasingleaccidentscenariowithalltheattendantuncertainty,isunsafe.Thesameproblemisencounteredevenifthegoverningdocumentisfromtheindustry,whetherornotitisexplicitlyendorsedbytheNRC,suchasanASMEorANSstandardasin

[18].Howcouldtheregulatoracceptadesignwithoneormoreaccidentscenarios intheunacceptableregionwhenthegoverningindustrystandarditselfhaslabeleditassuch?SomecurrentLWRswilllikelynotmeetthisFCcurve.

AmisunderstandingoftheintentofthiscurveandtherolethatNUREGreportsplayatNRCcouldleadsometoincorrectconclusionsconcerningtheadequacyofsafetyofcurrentplants,becausetheNRCand/orthenuclearindustrythem-selves(as,e.g.,in

[15,18])havelabeledplantsthatdonotmeetthiscurveasunacceptable.TheFCcurveis,infact,introducingnewandmorerestrictiveacceptancecriteriathantheQHOsafetygoalsasevidentbyinspectionandasmentionedin

[15],incontradictiontotheACRSguidancementionedabove.Thecombinedeffectofusingriskmetricsasacceptancecriteriaandapplyingthemonthelevelofindividualaccidentscenarioscanleadtootherundesirableoutcomes.Futurereactordesignsofferinglowertotal(integrated)riskthancurrentoperatingreactorsmaybeerroneouslylabeledasunsafeandnotbepursued,orbeburdenedwithcostlyandunnecessarydesign modi"cations.

JAnexampleoftheabove(involvingapotentiallysafer futurereactordesign)isareactorcoolantlinebreakforahigh-temperaturegas-cooledreactor(HTGR).Inahypothe-ticalcase,itcanbeassumedthatanapplicantcalculatesthefrequencyandtheconsequencesofthescenarioinaway thatallowsthemtoshowthatitisacceptable.Anyoneinclinedtoquestionthevalidityofthecalculationscan:(a)pointtothedegreeofuncertaintyinthepipebreakfrequencybecauseofverylimitednumberofyearsofoperatingexperiencewiththesereactors;(b)pointtoconditionssuchashighoperatingtemperaturesasaddi-tionalreasonsformuchhigherfailurefrequencypotentialthanintheLWRexperience;and(c)challengetheassumedradionuclideairbornefractionsproducedbyuncertaintiesinsourceterms(e.g.,long-termdiffusionofradionuclidesthroughcoatedfuelparticles,resuspensioncausedbyvibrationeffects,highertemperatures,lowerplateout,etc.).Thesechallengescanleadtoaconclusionthatthescenariofallsintheunacceptableregioninstead.Simpleand/orpassivereactordesignswouldhavefewer numbersofaccidentscenariosthancomplexandactivedesignsatthesamelevelofaccidentscenariode"nition(e.g.,systemlevel)andwithinthesamePRAmodel.Thedifferenceinthenumberofaccidentscenarioscouldbeinmultiplesof10ratherthaninalgebraicfractions.Asahypotheticalexample,tworeactorsmayhavethesameriskpro"le,butthe"rsthas10sequenceswith30remat2E6/yr,andthesecondhasonesequencewithaconsequenceof 30remat2E5/yr.UndertheFCcurveconstruct,oneisdeemedacceptableandtheotherisnot,whichdoesnotmake senseinrealriskspace.

JThus,theuseofrisk-basedacceptancecriteriaonthelevelof individualaccidentscenarios(asopposedtointegralquan-tities)maybeviewedaspenalizingsimpleandpassivedesignsinfavorofactiveandcomplexdesigns,inviolationoftheCommissionPolicyStatementonAdvancedReactors[13].Again,becauseintegralmeasuresofriskarenotobtainedin thismodel,applicationsofthesescenario-levelandrisk-basedacceptancecriteriawillbevariableforeachdesign,speci"cPRAmodel,andreactorsite.Thevariabilitycanbesubstantialinsomecases.ItisimportantthattheNRCstaffbecognizantoftheaboveissuesincomplyingwiththeCommissiondirectionintestingtheconceptsembodiedinNUREG-1860inanactuallicensingapprovalprocessforafutureplant.Thestaffshouldensurethattheirreviewwillnotdeviatefromthelong-standingCommissionprecedentsinestablishingthemanyelementsofarisk-informedapproach.Whilethispaperhastouchedupononlyafewtopics,futurepaperscandiscusstheuseofPRA,includingtheintroduc-tionofaproposedtechnology-neutralgenericriskmeasurethatwillallowforcross-comparisonofthelevelofsafetyfordifferentplantdesignsindependentofsite-speci"ccharacteristics;ap-proachtodefense-in-depth;selectionoftheso-calledlicensing-basisevents;andselectionofsafetySSCsinarisk-informedandperformance-basedframework.ItshouldbeaddedthatalternativeandcomplementaryriskmetricstoQHOscanbeusefultoapotentialapplicantforadesigncerti"cationorcombinedlicense,forexampletoassistindeterminationofhavingreachedasuf"cientmixofpreventive andmitigativefeaturesinanewdesign(i.e.,safetydesigntrade-offdecisions)ortocomparerelativesafetyofdifferentdesigns.Thetechnology-neutralgenericriskmeasurementionedabovewillsatisfythelatterneedforfuturereactordesignsforwhichtheCDFandLRFmetricsmaynotbefullyapplicable.AnexampleofanalternativeFCcurvethatcanbeeffectivelyusedforsafetydesigntrade-offdecisionsisdiscussedinSection6.4.UseofriskmeasuresbyindustryTheimpactoftheaforementionedissuesmaynotbeasgreatinpracticewhentheFCcurveofNUREG-1860orasimilarconstructisusedonlybythedesignerasopposedtotheregulator.Thedesignercanusesuchconstructsorconceptsascomplementaryinformationinaniterativemannerthroughoutthedesignprocess.Aproblemthatmaybeencounteredinthatprocessisthataproperinterpretationofsomerisk-basedconceptsmaynotbeasintuitiveforthedesigner,especiallyforthosewhoarenotPRAexperts,asitmayappearat"rst.Inaddition,manualsofpractice, suchasstandardsorguidesthataredevelopedbytheindustrymaybeendorsedorreferencedbytheregulatorsandbeusedinwaysthatproducetheunintendedresults(e.g.,leadingtorejectionofsaferdesigns).Forthisreason,itissuggestedthattheuseofquantitativePRAresultsinthecontextofdesignorregulatoryrisk-acceptancecriteriabeavoidedbyall.Instead,Section6providesanalternativeconstructthatmaybeusedbytheindustrythatwillaccomplishtheintendedpurpose(designsafetytrade-offdecisions)withoutthenegativeconnotationsthatareassociatedwithNUREG-1860sversionofanFCcurve.5.Interpretationofthe25Remcriterionusedin10CFR100/50.34The25remcriterionusedin10CFR100and10CFR50.34isoftenusedasadefactodoseacceptancecriterionforDBAsbytheNRCstaff.Thisusageis,however,contradictorytoactual CommissionpolicyandguidanceasdescribedexplicitlyinNRCregulations,asdiscussedinthissection.SinceanuclearplantisdesignedtoadequatelyrespondtotheoccurrenceofDesignBasisEvents(DBEs

-includesAnticipatedOperationalOccurrencesandDesignBasisAccidents),theexpectationisthattheassociated offsiteconsequenceswillbesmall(e.g.,fractionsof25remTEDE).K.Jamali/ReliabilityEngineeringandSystemSafety95(2010)935-943 940 ARTICLEINPRESSThisexpectation,however,shouldbeviewedasasafetygoalorguidelineasopposedtoadoseacceptancecriterion,asdiscussedbelow.NRCPolicyStatementonSevereReactorAccidents

[28]states:Severenuclearaccidentsarethoseinwhichsubstantialdamageisdonetothereactorcore,whetherornotthereareseriousoffsiteconsequences.Basedonthisde"nition,thetypeofaccidentsdescribedin10CFR100and10CFR50.34involvingasubstantialamountofcoremeltdischargedintoanintactcontainmentisaSevereAccident,notaDBA.Elsewhereinthisdocument,severeaccidentsarede"nedasaclassofaccidentswhicharebeyondthesubstantialcoverageofdesignbasisevents.And"nally,itstatesthatanewdesignforanuclearpowerplantcanbeshowntobeacceptableforsevereaccidentconcernsifitmeetstheacceptabilityofsafetyusinganapproachthatstressesdetermi-nisticengineeringanalysisandjudgmentcomplementedbya PRA.Note7of10CFR50.34carefullyavoidsthelabelsofacceptableorunacceptabledosetothevalueof25remtotaleffectivedoseequivalent(TEDE).Rather,itstatesthat:

y thisdosevaluehasbeensetforthasareferencevalue,whichcanbe usedintheevaluationofplantdesignfeatureswithrespecttopostulatedreactoraccidents,inordertoassurethatsuchdesignsprovideassuranceoflowriskofpublicexposuretoradiation,intheeventofsuchaccidents.Withregardstotheoftencitedaccidentthatisthesourceofthe25remTEDEdose(10CFR100,or10CFR50.34)

[29]or[30],itisnotedthat:(a)itisnotanactualaccidentscenario,astheassumptionofsubstantialcoremeltoutsideofthereactorvesselandinside thecontainmentistheinitialconditionfortheanalysis,irrespectiveoftherequisitesequenceofevents(i.e.,thespeci"csoftheotheraspectsoftheplantdesign)thatmayorcouldhaveledtosuchconditions,(b)again,theCommissionsPolicyStatementonSevereAccidents

[28]considersaccidentsinvolvingsubstantialcoredamageasSevereAccidents,whetherornotthereareseriousoffsite consequences.ThismeansthatthecharacteristicsofthisaccidentshouldnottobecomparedwithDBAs,and(c)themagnitudeofthecalculateddoseitselfshouldnotbeviewedintermsofacceptabilityoralackthereof.Itisadosevaluethatisusedintheevaluationofcontainmentdesign(andsizeoftheExclusionandLowPopulationZones)toassurelowriskofpublicexposuretoradiationintheeventofaccidentsinvolvingcoremelt(10CFR50.34,Note7)inanintactcontainment.Theresultsoftheseanalysesandcalculationshavelittletodowiththerestoftheplantdesign,andthus,shouldnotbecorrelatedwiththesafetyand/oracceptabilityofthespeci"cdesign(withtheexceptionofthecontainmentsystems),(d)itshouldbenotedthatinparticular,typicalsevereaccidents(BeyondDBAs)incommercial-sizeLWRscouldexceedthis dosevaluebyordersofmagnitude,andthus:the25remTEDEshouldnotbeviewedasadose acceptancecriterionforanyaccidentscenario,DBAorBeyondDBA(suchassevereaccidents).Thisdistinctioniscriticalasitmayhavesubstantialimpactsonjudgingthesafetyoffuturedesigns.Forexample,inahypotheticalcase,itcanbeassumedthatanadvancedreactordesignhasariskpro"lethatisordersofmagnitudebelowcomparableLWRs(inreactorsize/energyoutput).ItcanbeassumedfurtherthattheadvancedreactordesignhasoneDBAthatiscalculatedtoresultina30remdoseatthesiteboundarywithoutaleak-tightcontainment.Woulditmakesensetorequirethedesigntoemployaleak-tightcontainmentsystembasedonthisscenarioalone?The decisiononwhetherthedesignhasachievedadequatesafety(withinthecontextofaccidentanalysisandPRA)shouldbederivedfromtheconsiderationofallrelevantinformationderivedfromthedeterministicandprobabilisticanalysisoftheaccident(s)andthedesignattributes,suchasmargins,assumptions,uncertainties,potentialcorrectiveormitigativefeaturesandfactors,andotherdesignoptionsthatcouldbeconsidered.Itshouldalsobenotedthatinjudgingthedegreeofseriousnessofcalculatedexposurelevels(thatcanbeverydifferentfromactualexposuresbecauseofuncertainties),suchasthe25remof10CFR100,itisusefultobemindfuloftheroutinelyacceptedexposurelevelsbythemembersofthepublic.Forexample,numerousmedicalproceduresexposethepatienttodosesofmorethan1rem,withatleastoneprocedurereachinganestimateddoseof5.7rem

[31].Inaddition,backgroundradiationdosesincertainpartsofthecountryandtheworldcanreach theremrangeandashighasaround26

[32]rem/yr(anotherstudyofthesamelocalityarrivedat70rem/yr

[33]).Ref.[32]foundnogreaterincidenceofcancerinthehighdosepopulationcomparedwiththoseinneighboringareasofnormalbackgroundradiation.Evenamaximumbackgroundradiationat1rem/yr,whichisobservedinmanypartsofthecountryandtheworld,canbearguedtobecomparabletoabout50remTEDEfora50-yearexposure.6.AnalternativefrequencyversusconsequencecurveThemotivationforuseofanFCcurveconceptis,inpart,toprovideanindicationofreachingadequatelevelsofpreventiveandmitigativemeasures(collectivelyreferredtoascontrolsinthispaper)forvariousaccidentscenarios.AnalternateandconceptualFCcurveforsatisfyingthispurposethatcanbeusedbytheapplicant/reactorvendorinthedesignstagewithoutthenegativeimplicationsthatwerementionedfortheFCcurveofNUREG-1860issuggestedinFig.2.Notethatthisschemewouldonlyformapartofanintegratedsafetydecisionmakingprocess foranewdesign,suchasthe"ve-elementprocessdescribedinRegulatoryGuide1.174.Thekeyfeatureofthiscurveisthatitisconsistentwiththeconceptofgeneratingriskinformationandinsightsinsupportof deterministicapproaches,notasameansforunderminingaholisticapproachtothenuclearplantsafetyassuranceprocess.ThisFCcurvecanbeviewedasadesignoroperationalsafetyoptimizationtoolforusebythereactordesignerorplant operator.Fig.2incorporatesseveralkeyconsiderations:(i)ThisFCcurveisalsousedwithsingleaccidentscenarios(orscenariogroups/eventfamilies).(ii)ThisisanFCcurveusedandconceptualizedbythedesignerorreactorvendorintheplantdesignstagetoestablishthe basisforthedecisionsregardingincorporationoftheinitialsetofcontrols,andeachadditionalcontroltobepotentiallyconsideredforagivenaccidentscenario.(iii)Theuseofrisk-basedacceptance-criteriaisavoided.Therearenoacceptableriskandunacceptableriskregions.Itis importanttoeliminatethisconceptofrisk-acceptabilityfromthedesignoptimizationprocess,eveninthemindofthedesigner.(iv)OneofthemainobjectivesforselectionofDBEandBeyondDBEsistoestablishtheadequacyofcontrols.Thetwodistinctregionsareassociatedspeci"callywithadecisiononK.Jamali/ReliabilityEngineeringandSystemSafety95(2010)935-943 941 ARTICLEINPRESSwhetheradditionalcontrolsshouldbeconsideredforthespeci"cscenario.(v)Thetworegionsareseparatedbyabandofperhapsanorderofmagnitudevariationwithdiffusedboundaries(suchasinRegulatoryGuide1.174)onfrequencyandconsequence,ratherthan"rmboundaries.Thisisbecauseanysingleparameterofscenariofrequencyorconsequence(themeanistypicallyusedforall)isitselfsubjecttouncertaintyandensuingchallenges,astherangesofvariabilityandtheunderlyingdistributionsaregenerallyassignedsubjectively.(vi)Theconsequencescalemayberelatedtoappropriatepublichealthmeasuresand/orcost-bene"tfortheinclusionoftheadditionalcontrolunderconsideration.(vii)Sincethiscurveisusedasadesignaidfortheapplicant,regulatorystaffwouldhavenopositionabouttheaccept-abilityorthelackthereofassociatedwithanypartofitsconstruct,includingtheanchorpoints.TheregulatormustusethetotalityofthesafetyinformationdeliveredbythedesignandtheproposedoperationalplanthatincludesthetraditionaldeterministicrequirementsalongwiththesupplementalPRAinformationinconcludingthatthepro-posedplantissafe.Notethattheboundaryregionofessentiallyconstantriskisonlyconceptual.Thedesignermaydecidethatincertainsub-regionsandbecauseofspeci"cconsiderations,suchaseventswithparticularlyhighorlowfrequenciesand/orconsequences,andinthoseareasgovernedbyexistingregulations,deviationsfromtheboundaryregionarewarranted.7.SummaryandconclusionsRisk-informedregulationisbuiltaroundtheconceptofusingtraditionaldeterministictechniquesofsafetyassurancesupplementedbyPRAinformationandinsights.Traditionaldeterministictechniquesincludeconceptssuchasincorporationofredundancyanddiversity,incorporationofsafetymargins,applicationofdefenseindepth,applicationofqualityassurance, etc.PRAresultsshouldplayalimitedandsupportiveroleinmakingdecisionsaboutadequacyofsafetyinarisk-informedregulatoryframework.However,recenttrendsinthedevelopmentofnewrisk-relatedapproaches,whethertheyareperformedbytheindustry,NRCstafforotherdomesticorinternationalbodies,aretowardsheavieremphasisinuseofquantitativePRAresults.Theserisk measuresaresometimescomparedtoriskthresholdvaluesthathaveattainedanactual,orevenadefacto,regulatorystatureofriskacceptancecriteriaincertaininstances.Suchapplicationsofriskmeasuresforanuclearreactordesignoraspeci"cplantarenotalwaysinkeepingwiththetenetsofrisk-informedregula-tions,whichcallforcomparing(integral)measuresofthecalculatedrisk(e.g.,PFsandLCFsortheirsuitablesurrogatessuchastheCDFortheLRF)againstQHOs(ortheirsurrogatetargets,e.g.,1E4/yrforCDF)onlyassafetygoals.Inaddition,usingnumericalPRAresults,particularlythosethatarenotintegralquantities,inarisk-acceptancecontext,evenbythenuclearindustry(asopposedtotheregulators)canhavenumerousundesirableconsequences.Examplesoftheseamongmanydiscussedinthetextinclude:thetendencytopenalizesimple,passivesafetysystemdesignsinfavorofcomplex,activedesigns;andfuturereactordesignsofferinglowerintegratedriskthanthoseofthecurrentandhighlysafeoperatingreactorsmaybeerroneouslylabeledasunsafeandnotbepursued,orbeburdenedwithcostlybutunnecessarydesignmodi"cations.Theseissuescanleadtoseriousunintendedconsequencesinlicensingoffuturereactorsorcreatingnewchallengesregardingthesafetyadequacyofexistingplants.Thepaperalsoofferedanalternativeuseforafrequencyversusconsequencecurveasadesignoroperationalsafetyoptimizationtoolforusebythereactordesignerorplantoperator.

DisclaimerTheworkrelatedtothedevelopmentofthispaperwasconductedattherequestoftheDirectoroftheAdvancedReactorProgramsattheOf"ceofNewReactors(nowretired)inthelastquarterof2008attheUSNRC,whiletheauthorwasonloanfromtheUSDepartmentofEnergy.Neithertheauthor,northeUnitedStatesGovernment,anyagencythereof,oranyoftheiremployeesmakesanywarranty,expressedorimplied,orassumesanylegalliabilityorresponsi-bilityfortheaccuracy,completeness,oranythirdpartysuseoftheresultsofsuchuseofanyinformation,product,orprocessdisclosed,orrepresentsthatitsusewouldnotinfringeprivatelyownedrights.Referencehereintoanyspeci"ccommercialproduct,process,orservicebytradename,trademark,manufac-turer,orotherwise,doesnotnecessarilyconstituteorimplyitsendorsement,recommendation,orfavoringbytheUnitedStatesGovernment,oranyagencythereof.Theviewsandopinionsoftheauthorexpressedhereindonotnecessarilystateorre"ectthoseoftheUnitedStatesgovernmentoranyagencythereof.AcknowledgmentsTheauthorwishestothankDr.DonDube(USNRC)whowasthe"rstexperttoreviewtheearlyversionsofthispaperandofferedhisbroadandin-depthknowledgeinsupportofitsdevelopment.Mr.AlanKuritzkyandDrs.MohsenKhatib-RahbarandDougTrueprovidedmanyusefulinsights.

References[1]ChapmanJ,HessSM.Risk-informed,technology-neutraldesignandlicensingframeworkfornewnuclearplants.In:ANSPSA2008topicalmeeting

-challengestoPSAduringthenuclearrenaissance,Knoxville,TN,September7-11,2008.[2]USNRC.FederalRegister,51FR30028.Safetygoalsfortheoperationsofnuclearpowerplants,August21,1986.Fig.2.Aconceptualaccidentsequence-levelfrequencyversusconsequencecurvethatcanbeusedbyapplicantduringdesignprocess.K.Jamali/ReliabilityEngineeringandSystemSafety95(2010)935-943 942 ARTICLEINPRESS[3]USNRC.FederalRegister,policystatementonuseofprobabilisticriskassessmentmethodsinnuclearregulatoryactivities,FinalPolicyStatement,August16,vol.60(158),1995.p.42622-9.[4]USNRC.GenericletterGL88020.Individualplantexaminationforsevereaccidentvulnerabilities,November23,1988.[5]USNRC.SECY-98-144.Whitepaperonrisk-informedandperformance-basedregulation,January22,1998.Staffrequirementsmemorandumapproved March1,1999.[6]USNRC.Regulatoryguide1.174.Anapproachforusingprobabilisticriskassessmentinrisk-informeddecisionsonplant-speci"cchangestothelicensingbasis,Revision1,November2002.[7]USNRC.NUREG-0800.USNuclearRegulatoryCommissionstandardreviewplan,Revision3,March2007[Chapter19].[8]USNRC.NUREG-1150.Severeaccidentrisks:anassessmentfor"veUSNuclearPowerPlants;October1990.[9]USNRC.SECY-89-102.Implementationofsafetygoalpolicy;March30,1989.[10]USNRC.ACRSLettertoNRCChairman,ACRScommentsonanimplementa-tionplanforthesafetygoalpolicy,May13,1987.[11]USNRC.SECY-00-0198.Statusreportonrisk-informedchangestothetechnicalrequirementsof10CFRpart50(option3)andrecommendationson risk-informedchangesto10CFRpart50.44(combustiblegascontrol);September14,2000.[12]USNRC.SECY-90-016.Evolutionarylightwaterreactor(LWR)certi"cationissuesandtheirrelationshipstocurrentregulatoryrequirements,June26,1990.[13]USNRC.FederalRegister,vol.73(199),NRC-2008-0237.Policystatementonregulationofadvancedreactors,October14,2008.p.60612-6.[14]USNRC.NUREG-1338.Draftpre-applicationsafetyevaluationreportforthemodularhigh-temperaturegas-cooledreactor,March1989.[15]USNRC.NUREG-1860.Feasibilitystudyforarisk-informedandperformance-basedregulatorystructureforfutureplantlicensing,December

2007.[16]GeneralAtomics.Top-levelregulatorycriteriaforthestandardMHTGR,DOE-HTGR-85002,September1989.[17]EuropeanCommission.EuropeansafetyapproachformodularHTR,Documentno.RAPHAEL-0903-D-ST4.2,Restricteddistribution,April15, 2005.[18]ANSI/ANS-53.1-200X.Nuclearsafetycriteriaandsafetydesignprocessformodularhelium-cooledreactorplants,Draft;June23,2008.[19]SafetyReportSeriesno.54,accidentanalysisfornuclearpowerplantswithmodularhightemperaturegascooledreactors,April,2008.[20]Hun-JooLee(Coauthor).KoreaInstituteofNuclearSafety.RegulatoryviewpointoninnovativeVHTRdevelopmentinKorea.In:4th internationaltopicalmeetingonhightemperaturereactortechnology,September28-October1,2008.[21]NEI-02-02.NuclearEnergyInstitute.Arisk-informed,performance-basedregulatoryframeworkforpowerreactors,May2002.[22]JeanJoubert(Coauthor).NationalNuclearRegulator,SouthAfrica.SouthAfricansafetyassessmentframe-workforthepebblebedmodularreactor.In:

4thinternationaltopicalmeetingonhightemperaturereactortechnology,September28-October1,2008.[23]PBMR(Pty)Ltd.Probabilisticriskassessment(PRA)approachforthepebblebedmodularreactor,Revision1,June12,2006.[24]USNRC.SECY-07-0101.Staffrecommendationsregardingarisk-informedandperformance-basedrevisionto10CFRpart50(RIN3150-AH81);

June14,2007.StaffrequirementsmemorandumapprovedSeptember10, 2007.[25]USNRC.SECY-09-0056.Staffapproachregardingarisk-informedandperformance-basedrevisiontopart50oftitle10oftheCodeofFederalRegulationsandDevelopingaPolicystatementonDefense-in-Depthfor FutureReactors,April7,2009.[26]USNRC.ACRSR-2267.Developmentofatechnology-neutralregulatoryframework,September26,2007.[27]Memorandum.E.V.ImbrotoJ.E.Dyer.ForeigntraveltripreportfortheInternationalAtomicEnergyAgencyConsultancymeetingtodevelopanIAEA safetyguideonclassi"cationofstructures,systems,andcomponentsfromApril24throughApril29,2006;May5,2006.[28]USNRC.FederalRegister,50FR32138.Policystatementonseverereactoraccidentsregardingfuturedesignsandexistingplants,August8, 1985.[29]CodeofFederalRegulations,Parts1-50;January1,2008[Chapter10].

[30]CodeofFederalRegulations,Parts51-199;January1,2008[Chapter10].

[31]StabinM.G.Dosesfrommedicalradiationsources.HealthPhysicsSociety.

/http://www.hps.org/hpspublications/articles/dosesfrommedicalradiation.

html S;UpdatedMay26,2009.[32]KaramPA.ThehighbackgroundradiationareainRamsar,Iran:Geology,norm,biology,LNT,andpossibleregulatoryfun.In:WM02Conference, Tucson,AZ,February24-28,2002.[33]JaworowskiZ.Ionizingradiationandradioactivityinthe20thcentury.In:Internationalconferenceonradiationanditsroleindiagnosisandtreatment,Tehran,Iran,October18-20,2000.K.Jamali/ReliabilityEngineeringandSystemSafety95(2010)935-943 943