ML021830643

Attachment 1, Draft Regulatory Guide, Determining the Technical Adequacy of PRA Results for Risk-Informed Activities

ML021830643
Person / Time
Issue date:	07/01/2002
From:	Mary Drouin NRC/RES/DRAA/PRAB
To:	Cunningham M NRC/RES/DRAA/PRAB
References
-nr
Download: ML021830643 (30)

Text

Attachment 1 DRAFT REGULATORY GUIDE DETERMINING THE TECHNICAL ADEQUACY OF PRA RESULTS FOR RISK-INFORMED ACTIVITIES DRAFT JULY 1, 2002

Draft Regulatory Guide xx DETERMINING THE TECHNICAL ADEQUACY OF PRA RESULTS FOR RISK-INFORMED ACTIVITIES TABLE OF CONTENTS SectionPage 1.Purpose and Scope 1.1Introduction 1.2Background 1.3Purpose of this Regulatory Guide 1.4Scope of this Regulatory Guide 1.5Relationship to Other Guidance Documents 2.Demonstrating Support for Results of PRA Analysis 2.1Definition of Application 2.2Scope of Risk Contributors Addressed by the PRA Model 2.3Demonstration of Technical Adequacy of the PRA Results Used 2.3.1Assessment that the PRA Model Elements are Technically Correct 2.3.2Assessment of Engineering Analyses, Assumptions and Approximations 2.4Documentation 3.Scope, Level of Detail and Technical Adequacy of the PRA 3.1Scope of PRA 3.2Level of Detail of a PRA 3.2.1Level 1 Elements 3.2.2Level 2 Elements 3.2.3Internal Floods Elements 3.2.4Internal Fire Elements 3.2.5External Hazards Elements 3.2.6Documentation 3.3Technical Adequacy of a PRA 3.4Characteristics and Attributes of a Peer Review 3.5Principles and Objectives for a PRA Standard 4.Regulatory Position on Consensus PRA Standards and Industry PRA Programs 5.References Tuesday, Jul 9, 2 (1:42p) -ii- Revision 0

Draft Regulatory Guide xx DETERMINING THE TECHNICAL ADEQUACY OF PRA RESULTS FOR RISK-INFORMED ACTIVITIES 1.Purpose and Scope 1.1 Introduction Over the past 25 years a significant number of probabilistic risk assessments (PRAs) have been performed by the U. S. Nuclear Regulatory Commission (NRC) and the nuclear industry. The scope, depth, and technical content of the PRAs have varied depending on their purposes and uses. Results from PRAs have increasingly been used in the regulatory process, starting with generic safety issue prioritization and progressing to regulatory analysis in support of rulemaking and backfits and currently risk-informed regulation. This last activity opens up the possibility of using PRA information for decision making in many ways not previously done.

The NRC issued a Policy Statement (1) on the use of PRA in 1995, encouraging its use in all regulatory matters. The Policy Statement states that ..the use of PRA technology should be increased to the extent supported by the state-of-the-art in PRA methods and data and in a manner that complements the NRCs deterministic approach. Since that time, many uses have been implemented or undertaken, including the initiation of work to modify the reactor regulations and inspection program. As a result PRA is becoming a mainstream regulatory tool and, as such, is providing valuable input into the decision-making process regarding the design, operation and maintenance of plants. Consequently, confidence in the information derived from a PRA is an important issue: the accuracy of the technical content must be of sufficient rigor to justify the specific results and insights from the PRA that are used to support the decision under consideration. And finally, the documentation of the process used, including the supporting data and references for methodology guidance must be sufficiently accurate and complete as appropriate for the particular application.

This regulatory guide addresses the use of available standards and industry programs to determine that the quality of a PRA analysis and its documentation is sufficient to provide an appropriate level of confidence in the results used in regulatory decision-making for light water reactors.

1.2 Background In their March 1999 report (Nuclear Regulation: Strategy Needed to Regulate Safety Using Information on Risk, GAO/RCED-99-95) (2), the General Accounting Office (GAO) identified a number of issues that it believed required resolution for NRC to successfully implement a risk-informed regulatory approach. Among these, GAO indicated that more was needed to develop standards on the scope and detail of risk assessments needed for utilities to determine that changes to their plants design will not negatively affect safety.

PRA standards have been under development by the American Society of Mechanical Engineers (ASME) and American Nuclear Society (ANS). On April 5, 2002, ASME issued a standard for a full-power, internal events (excluding fire) Level 1 and a limited Level 2 PRA(3). In the future, ANS plans to issue standards for external events risk and low power shutdown.

Reactor owners groups have been developing and applying a PRA peer review program for several years. In a letter dated April 24, 2000, the Nuclear Energy Institute (NEI) submitted NEI-00-02 (Probabilistic Risk Assessment Peer Review Process Guidance, Rev. A3) (4) to the NRC Tuesday, Jul 9, 2 (1:42p) Revision 0

Draft Regulatory Guide xx for review in the context of the staffs work to risk-inform the scope of special treatment requirements contained in 10 CFR Part 50 (discussed in SECY-99-256) (5).

Concerns regarding PRA quality and the standards development effort were discussed in the March 31, 2000, Commission briefing on the Risk-Informed Regulation Implementation Plan (6).

The Commission, in their April 18, 2000, Staff Requirements Memorandum (SRM) (7) on that briefing, indicated that the staff should provide its recommendations to the Commission for addressing the issue of PRA quality until the ASME and ANS standards have been completed, including the potential role of an industry PRA certification process. In response to the Commissions SRM dated April 18, 2000, the staff issued SECY-00-162, Addressing PRA Quality in Risk-Informed Activities (8), which described an approach for addressing PRA quality including identification of the scope and minimal functional attributes necessary to ensure that the PRA information is adequate for its intended application in decision making. The Commission, in their October 27, 2000, SRM (9), indicated that the ...the timely resolution of PRA quality requirements is necessary to support existing and developing risk-informed regulation...

SECY-02-0070, Publication of Revisions 1 to Regulatory Guide 1.174 and SRP Chapter 19 and Notice of A Staff Plan for Endorsing Consensus Probabilistic Risk Assessment Standards and Industry Peer Review Programs (10), was issued in March, 2002. This SECY informed the Commission of the staffs plans to publish Revisions 1 to Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment In Risk-Informed Decisions On Plant-Specific Changes To The Licensing Basis (11), and Standard Review Plan (SRP) Chapter 19, Use of Probabilistic Risk Assessment in Plant-Specific , Risk-Informed Decisionmaking: General Guidance (12). The SECY also provided information on the staffs plan for endorsement of the then pending ASME and ANS consensus standards and peer review programs on PRA. The endorsement was to be provided in a new regulatory guide (this document) and a new SRP Chapter.

1.3 Purpose of this Regulatory Guide To: (1) provide guidance to licensees on how to demonstrate with appropriate documentation that the results used in the decision-making process are supported by the underlying PRA analysis, provide guidance on determining the technical adequacy of the PRA results (via e.g., consensus PRA standards), and (3) provide the NRC position on consensus PRA standards and industry PRA program documents.

1.4 Scope of this Regulatory Guide This regulatory guide describes an acceptable approach for assessing the technical adequacy of PRA information used in decision-making processes.

In addition, this regulatory guide indicates an acceptable level of documentation that will enable the staff to reach a finding that a sufficiently complete and scrutable analysis has been performed, and that the results used in the decision-making process are supported by the underlying PRA analysis.

1.5 Relationship to Other Guidance Documents This regulatory guide is a supporting document to other NRC regulatory guides that address risk-informed applications. These guides include Regulatory Guide 1.174(11) and SRP Chapter 19 (12) that provide general guidance on applications addressing changes to the licensing basis, and guidance for specific applications such as for inservice testing (13), inservice inspection (14), quality Tuesday, Jul 9, 2 (1:42p) Revision 0

Draft Regulatory Guide xx assurance (15), and technical specifications (16), and the corresponding SRP chapters for the application-specific guides (with the exception of quality assurance for which there is no SRP chapter).

Figure 1 below shows the relationship of this new regulatory guide and risk-informed activities, application specific guidance, consensus PRA standards, and industry programs (e.g., NEI-00-02).

Tuesday, Jul 9, 2 (1:42p) Revision 0

Draft Regulatory Guide xx

2. Demonstrating Support for Results of PRA Analysis This section of the Regulatory Guide addresses the first purpose identified in Section 1.3, namely, to provide guidance to licensees on how to demonstrate with appropriate documentation that the results used in the decision-making process are supported by the underlying PRA analysis.

2.1 Definition of Application The requirements placed on a risk analysis are dependent on the application for which its results and derived insights are intended, and the role those results and insights play in the decision-making process. Therefore, when risk information is used in a risk-informed process, it is crucial that the information is characterized correctly for the decision makers, so that they can determine how much credence can be given to the risk information, and the appropriate weight that it can be given in making the decision. Thus it is necessary for the risk analysts to provide the decision makers with an assessment both of the degree of applicability and of the scope and level of detail of the analysis, and include an assessment of the robustness of the conclusions drawn taking into account uncertainties, in the context of the decision being made. The risk information used will vary with the application, and will depend on guidelines to be used to judge the adequacy of the application. An application must, therefore, begin with a clear definition of the proposed regulatory activity, and a definition of the acceptance guidelines or criteria, including the rules for comparing the risk information with those guidelines or criteria. When following an application specific Regulatory Guide, the acceptance criteria will typically be specified. In addition, when an application is performed in accordance with Regulatory Guide 1.174, acceptance guidelines are presented in terms of changes to the core damage frequency (CDF) and large early release frequency (LERF) from all initiating events in all modes of operation. Figures 3 and 4 of RG 1.174 present these acceptance guidelines, and section 2.2.5.5 presents guidance on how the comparison with the guidelines is to be made, including how uncertainties are to be addressed.

When an application is not addressed by an existing regulatory guide however, it will be necessary to define an appropriate set of these criteria. The acceptance guidelines should determine the scope of the risk assessment necessary.

For a PRA to be capable of supporting an application, it should be capable of providing the risk input that can be used in the context of the acceptance criteria. To achieve this, those aspects of the plant affected by the proposed change, for example, specific SSCs or certain required operator actions, must be identified, and the potential impact of the application on those aspects characterized. This has been referred to as establishing the cause-effect relationship resulting from the application. Then, it must be possible to map the aspects that are subject to the application onto elements of the PRA model, and the impact of the change related to changes in the PRA event probabilities. The way in which the mapping is performed will have an impact on the usefulness of the results. For example the mapping may be direct and explicit, or it may be indirect and implicit. Typically the more explicit the mapping, the more relevant the PRA input is to the decision. Similarly, the way in which the impact of the change on the probabilities, e.g.

whether the approach is a conservative, bounding approach or an approach based on an engineering analysis, will have an impact on the relevance of the results.

In summary, the assessment of the confidence in the conclusions drawn from the PRA analysis must begin with a clear definition of the application in terms of the following:

Tuesday, Jul 9, 2 (1:42p) Revision 0

Draft Regulatory Guide xx

• SSCs, operator actions and plant operational characteristics affected by the application

• a description of the cause-effect relationships between the change and the above SSCs, operator actions and plant operational characteristics

• the mapping of the cause-effect relationships onto PRA model elements

• definition of the acceptance criteria or guidelines:

S an identification of the PRA results that will be used to compare against the acceptance criteria or guidelines, and how the comparison is to be made S scope of risk contributors needed to support the decision This information defines the context within which the demonstration that the results are supportable by the PRA is to be performed. An additional consideration, however, is the fact that the PRA may be of limited scope with respect to the acceptance guidelines. This is an issue that must be addressed by the decision-makers. Similarly, it may be the case that not all the SSCs impacted by the application are modeled explicitly. This again is an issue that must be dealt with by the decision-makers. It is not the intent of this Regulatory Guide to address these issues, nor is it intended to address the issue of the modeling of the cause-effect relationship. These issues are addressed in application-specific regulatory guides (12-16) and Standard Review Plan chapters.

2.2 Scope of Risk Contributors Addressed by the PRA Model Based on the definition of the application, the scope of risk contributors (internal and external initiating events, modes of plant operation) that would ideally be required of the PRA can be identified. For example, if the application is designed around using the acceptance guidelines of RG 1.174, the evaluations of CDF, CDF, LERF and LERF should be performed with a full scope PRA including external initiating events and all modes of operation. However, since most PRAs do not address this full scope, the decision-makers must make allowances for these omissions.

Examples of approaches to making allowances include: the introduction of compensatory measures; restriction of the implementation of the proposed change to those aspects of the plant covered by the risk model; use of bounding arguments to cover the risk contributions not addressed by the model. This Regulatory Guide does not address this aspect of decision-making, but is focused specifically on the quality of the PRA information used.

The PRA Standards and Industry PRA Programs that have been, or are in the process of being, developed address a specific scope. For example, the ASME PRA Standard addresses internal events at full power for a limited level 2 PRA analysis. Similarly NEI-00-02 is a peer review process for the same scope. Neither addresses external initiating events, or the low power and shutdown modes of operation. The different PRA Standards or industry PRA Programs are addressed separately in Appendixes to this Regulatory Guide. In using this Regulatory Guide, the applicant shall identify which of these Appendixes are applicable to his PRA analysis.

2.3 Demonstration of Technical Adequacy of the PRA Results Used In order to demonstrate that the PRA input to a decision is supportable, it is necessary to address all the elements of the PRA that are called upon to provide the PRA results required by the acceptance criteria. These include not only those elements onto which the cause-effect relationships are mapped, but also all those elements that appear in the accident sequences in which the first group of elements appear. For some applications, this may be a limited set, but for others, e.g., risk-informing the scope of special treatment requirements, all elements of the PRA model are relevant. As preparation for using this Regulatory Guide, the applicant shall have determined which PRA elements are to be addressed.

There are two aspects to demonstrating the adequacy of the PRA results. First, is the assurance Tuesday, Jul 9, 2 (1:42p) Revision 0

Draft Regulatory Guide xx that the elements of the PRA used in the application have been performed in a technically correct manner. This implies the following: a) the PRA model, or those parts of the model required to support the application, represents the as-built and as-operated plant, which, in turn, implies that the PRA is up-to-date and reflects the current design and operating practices; b) the PRA model has been developed in a manner consistent with industry practice and that it correctly reflect the dependencies of systems and components on one another, and on operator actions, and c) the probabilities used are appropriate for the boundary conditions of the events to which they correspond.

The current state-of-the-art in PRA technology is that there are elements for which there are no consensus methods of analysis. Furthermore, PRAs are models, and in that sense the developers of those models rely on certain approximations to make the models tractable, and on certain assumptions to address uncertainties as to how to model certain issues. This is recognized in the application specific regulatory guides such as RG 1.174, which give guidance on how to address the uncertainties. The second aspect, therefore, is associated with the assessment that the engineering analyses, assumptions and approximations used in developing the PRA model are appropriate, and demonstrating the robustness of the conclusions with respect to the uncertainties in the analysis. This demonstration typically will involve uncertainty analyses or sensitivity analyses.

2.3.1 Assessment that the PRA Model Elements are Technically Correct When using risk insights based on a PRA model the applicant shall ensure that the PRA model, or at least that part of it needed to provide the results, is technically correct as discussed above.

The model shall be demonstrated to be up to date in that it represents the current plant design and configuration, and represents current operating practices. This can be achieved through a PRA maintenance plan which includes a commitment to update the model periodically to reflect significant changes.

The various consensus PRA standards and industry PRA programs that provide guidance on the performance of, or reviews of, PRAs are addressed individually in the Appendixes to this document.

These Appendixes document the Staffs regulatory position on each of these standards or programs. The Staffs regulatory position on each of these documents is in terms of either no objection, no objection with clarification, or no objection subject to a qualification. The meaning of each of these classifications is given in Table 2-1.

Table 2-1 Classifications Regarding NRC Positions on the ASME PRA Standard

• No objection.

• No objection with clarification: Certain requirements, as written, are either unclear or ambiguous and therefore, the staff has provided their understanding of these requirements.

• No objection subject to the following qualification: The staff has a technical concern with the requirement and has provided a qualification to resolve the concern.

When the concerns are taken into account, the document in question can be interpreted to be adequate for the purpose for which it was intended. If the elements of the PRA can be shown to have met the requirements of the appropriate document, with attention paid to the clarifications or objections, it can be assumed that the analysis is technically correct, and will not require review by NRC Staff, other than an audit. Where deviations from the documents exist, the applicant shall Tuesday, Jul 9, 2 (1:42p) Revision 0

Draft Regulatory Guide xx either, demonstrate that his approach is equivalent, or that the influence on the results used in the application are insignificant.

2.3.2 Assessment of Engineering Analyses, Assumptions and Approximations Since the Standards and Industry PRA Programs are not (or are not expected to be) prescriptive, there is some freedom on how to model certain elements of the PRA, so that different analysts may make different assumptions, and still meet the requirements of the Standard or have been accepted by the peer review. The choice of a specific assumption or a particular approximation may, however, influence the results of the PRA. The NRC Staff needs to be cognizant of which features of the analysis have the potential to alter the conclusions. In documenting the conclusions, the applicant shall justify the choice of their applicable assumptions and approximations by demonstrating that their conclusions are robust compared with other reasonable choices. Part of this documentation should include the peer reviewers comments and assessment of the applicants approach. This assumptions are an important approach to dealing with model uncertainty, and those that can influence the conclusions will be a focus of review by NRC Staff.

The way in which the impact of the change in individual SSCs is modeled is influenced by the degree of detail of the PRA model. However, the level of detail in the PRA model is not prescribed by the Standard documents or the peer review process. Thus, from a statement that the PRA has satisfied the Standard, for example, it is not possible for the Staff reviewer to have a clear picture of how well the impact of the application is modeled. The area is again expected to be an area of Staff review that will be addressed in application-specific regulatory guides and Standard Review Plan chapters.

Each of the documents addressed in the Appendixes either requires, or represents, a peer review.

The peer review shall address the assumptions and make judgements as to their appropriateness.

Those that can impact the results for the particular application shall be identified and documented.

2.4 Documentation The licensee shall provide documentation to demonstrate the robustness of the PRA results within the context defined by:

• the impact of the application on the plant design, configuration, or operational practices

• the acceptance guidelines and method of comparison

• the scope of the risk assessment in terms of initiating events and operating modes modeled

• the elements of the PRA required to provide the results needed for item b) above The licensee shall provide documentation to show how it has determined that its PRA is of sufficient quality to support the application. An acceptable way of achieving this is to document that the elements of the PRA required to produce the results used in the decision are performed consistently with the Standard or peer review process as endorsed in the Appendixes to this RG, or provide a discussion of the impact of not meeting the Standard or the criteria of the peer review process on the results Further, the licensee should identify the assumptions, approximations and engineering analyses that have a significant impact on the results used, and provide an assessment of the robustness Tuesday, Jul 9, 2 (1:42p) Revision 0

Draft Regulatory Guide xx of the conclusions based on these results. In addition, the more significant sources of uncertainty should be identified, and any assumptions designed to address those uncertainties identified as possible candidates for sensitivity studies to provide additional characterization of the results for the decision-making panel.

The licensee shall also provide a discussion of the resolution of the peer review comments that are applicable to those PRA elements required for the application.

The Standards or peer review process documents recognize different categories or grades that are related to level of detail, degree of conservatism, and degree of plant-specificity. The licensee shall provide documentation that identifies the use of PRA elements that conform to the less detailed categories, and the limitations this imposes.

3. Scope, Level of Detail and Technical Adequacy of the PRA The scope, level of detail and technical adequacy of the PRA is to be commensurate with the application for which it is intended and the role the PRA results play in the integrated decision process.

Since this Regulatory Guide xx is intended to support a variety of applications, the guidance regarding scope, level of detail and technical adequacy is for a full-scope Level 1 and Level 2 PRA.

The guidance is based on the guidance contained in SECY-00-0162.

3.1 Scope of PRA The metrics used for risk characterization in risk-informed applications are CDF and LERF (as a surrogate for early fatalities). Issues related to the reliability of barriers, in particular containment integrity and consequence mitigation, are addressed through consideration of defense-in-depth.

To provide the risk perspective for use in decision-making, a Level 1 PRA is required. A limited Level 2 PRA is needed to address LERF and may be helpful in addressing issues related to long-term containment integrity.

The risk characterization (CDF and LERF) needs to account for all plant operating states and initiating events.

Plant operating states (POSs) are used to subdivide the plant operating cycle into unique states such that the plant response can be assumed to be the same for all subsequent accident initiating events. Operational characteristics (such as reactor power level; in-vessel temperature, pressure, and coolant level; equipment operability; and changes in decay heat load or plant conditions that allow new success criteria) are examined to identify those important to defining plant operational states. The important characteristics are used to define the states and the fraction of time spent in each state is estimated using plant specific information. The risk perspective is based on the total risk connected with the operation of the reactor which includes not only full power operation, but low power and shutdown conditions. Therefore, to gain the maximum benefit from a PRA, the model addresses all modes of operation.

Initiating events are the events that have the ability to challenge the condition of the plant. These events include failure of equipment from either internal plant causes such as hardware faults, operator actions, floods or fires, or external plant causes such as earthquakes or high winds.

The risk perspective is based on the total risk connected with the operation of the reactor which includes events from both internal and external sources. Therefore, to gain the maximum benefit Tuesday, Jul 9, 2 (1:42p) Revision 0

Draft Regulatory Guide xx from a PRA, the model should address both internal and external initiating events.

3.2 Level of Detail of a PRA Table 1 provides the level of detail (i.e., list of general technical elements) required to provide the results for a PRA. A PRA that is missing one or more of these elements would not be considered a complete PRA.

Table 1 Technical Elements of a PRA Scope of Technical Element Analysis Level 1

• Initiating event analysis

• Parameter estimation analysis

• Success criteria analysis

• Human reliability analysis

• Accident sequence analysis

• Quantification

• Systems analysis

• Interpretation of results

• Internal flood analysis

• Internal fire analysis

• External Hazards Analysis Level 2

• Plant damage state analysis

• Quantification

• Accident progression analysis

• Interpretation of results 3.2.1 Level 1 Elements Initiating event analysis identifies and characterizes those random internal events that both challenge normal plant operation during power or shutdown conditions and require successful mitigation by plant equipment and personnel to prevent core damage from occurring. Events that have occurred at the plant and those that have a reasonable probability of occurring are identified and characterized. An understanding of the nature of the events is performed such that a grouping of the events into event classes, with the classes defined by similarity of system and plant responses (based on the success criteria), may be performed to manage the large number of potential events that can challenge the plant.

Success criteria analysis determines the minimum requirements for each function (and ultimately the systems used to perform the functions) needed to prevent core damage (or to mitigate a release) given an initiating event occurs. The requirements defining the success criteria are based on acceptable engineering analyses that represent the design and operation of the plant under consideration. The criteria needed for a function to be successful is dependent on the initiator and the conditions created by the initiator. The code(s) used to perform the analyses for developing the success criteria are validated and verified for both technical integrity and suitability to assess plant conditions for the reactor pressure, temperature and flow range of interest, and accurately analyze the phenomena of interest. Calculations are performed by personnel qualified to perform the types of analyses of interest and are well trained in the use of the code(s).

Accident sequence development analysis models, chronologically, the different possible progression of events (i.e., accident sequences) that can occur from the start of the initiating event to either successful mitigation or to core damage. The accident sequences account for those systems and operator actions that are used (and available) to mitigate the initiator based on the defined success criteria and plant operating procedures (e.g., plant emergency and abnormal operating procedures and as practiced in simulator exercises). The availability of a system includes consideration of the functional, phenomenological and operational dependencies and Tuesday, Jul 9, 2 (1:42p) Revision 0

Draft Regulatory Guide xx interfaces between the different systems and operator actions during the course of the accident progression.

Systems analysis identifies the different combinations of failures that can preclude the ability of the system to perform its function as defined by the success criteria. The model representing the various failure combinations includes, from an as-built and as-operated perspective, the system hardware and instrumentation (and their associated failure modes) and the human failure events that would prevent the system from performing its defined function. The basic events representing equipment and human failures are developed in sufficient detail in the model to account for dependencies between the different systems, and to distinguish the specific equipment or human event (and its failure mechanism) that has a major impact on the systems ability to perform its function.

Parameter estimation analysis quantifies the frequencies of the identified initiating events and quantifies the equipment failure probabilities and equipment unavailabilities of the modeled systems. The estimation process includes a mechanism for addressing uncertainties, has the ability to combine different sources of data in a coherent manner, and represents the actual operating history and experience of the plant and applicable generic experience as applicable.

Human reliability analysis identifies and provides probabilities for the human failure events that can negatively impact normal or emergency plant operations. The human failure events associated with normal plant operation include those events that leave the system (as defined by the success criteria) in an unrevealed, unavailable state. The human failure events associated with emergency plant operation include those events that, if not performed, do not allow the needed system to function. Quantification of the probabilities of these human failure events is based on plant and accident specific conditions, where applicable, including any dependencies among actions and conditions.

Quantification provides an estimation of the CDF given the design, operation and maintenance of the plant. This CDF is based on the summation of the estimated CDF from each initiator class.

If truncation of accident sequences and cutsets is applied, truncation limits are set so that the overall model results are not impacted significantly and that important accident sequences are not eliminated. Therefore, the truncation limit can vary for each accident sequence. Consequently, the truncation value is selected so that the accident sequence CDF before and after truncation only differs by less than one significant figure.

Interpretation of results entails examining and understanding the results of the PRA and identifying the important contributors sorted by initiating events, accident sequences, equipment failures and human errors. Methods such as importance measure calculations (e.g., Fussel-Vessely, risk achievement, risk reduction, and Birnbaum) are used to identify the contributions of various events to the model estimation of core damage frequency for both individual sequences and the model as a total. Sources of uncertainty are identified and their impact on the results analyzed. The sensitivity of the model results to model boundary conditions and other key assumptions is evaluated using sensitivity analyses to look at key assumptions both individually or in logical combinations. The combinations analyzed are chosen to fully account for interactions among the variables.

3.2.2 Level 2 Elements Plant damage state analysis groups similar core damage scenarios together to allow a practical assessment of the severe accident progression and containment response resulting from the full spectrum of core damage accidents identified in the Level 1 analysis. The plant damage state Tuesday, Jul 9, 2 (1:42p) Revision 0

Draft Regulatory Guide xx analysis defines the attributes of the core damage scenarios that represent important boundary conditions to the assessment of severe accidents progression and containment response that ultimately affect the resulting source term. The attributes address the dependencies between the containment systems modeled in the Level 2 analysis with the core damage accident sequence models to fully account for mutual dependencies. Core damage scenarios with similar attributes are grouped together to allow for efficient evaluation of the Level 2 response.

Severe accident progression analysis models the different series of events that challenge containment integrity for the core damage scenarios represented in the plant damage states. The accident progressions account for interactions among severe accident phenomena and system and human responses to identify credible containment failure modes including failure to isolate the containment. The timing of major accident events and the subsequent loadings produced on the containment are evaluated against the capacity of the containment to withstand the potential challenges. The containment performance during the severe accident is characterized by the timing (e.g., early versus late), size (e.g., catastrophic versus bypass), and location of any containment failures. The code(s ) used to perform the analysis are validated and verified for both technical integrity and suitability. Calculations are performed by personnel qualified to perform the types of analyses of interest and well trained in the use of the code(s).

Source term analysis characterizes the radiological release to the environment resulting from each severe accident sequence leading to containment failure or bypass. The characterization includes the time, elevation, and energy of the release and the amount, form, and size of the radioactive material that is released to the environment. The source term analysis is sufficient to determine whether a large early release or a large late release occurs. A large early release is one involving significant, unmitigated releases from containment in a time frame prior to effective evacuation of the close-in population such that there is a potential for early health effects. Such accidents generally include unscrubbed releases associated with early containment failure at or shortly after vessel breach, containment bypass events, and loss of containment isolation. With large late release, significant, unmitigated release from containment occurs in a time frame that allows effective evacuation of the close-in population such that early fatalities are unlikely.

Quantification integrates the accident progression models and source term evaluation to provide estimates of the frequency of radionuclide releases that could be expected following the identified core damage accidents. This quantitative evaluation reflects the different magnitudes and timing of radionuclide releases and specifically allows for identification of the LERF and the probability of a large late release.

Interpretation of results entails examining results from importance measure calculations (e.g.,

Fussel-Vesely, risk achievement, risk reduction, and Birnbaum) to identify the contributions of various events to the model estimation of LERF and large late release probability for both individual sequences and the model as a total. Sources of uncertainty are identified and their impact o the results analyzed. The sensitivity of the model results to model boundary conditions and other key assumptions is evaluated using sensitivity analyses to look at key assumptions both individually or in logical combinations. The combinations analyzed are chosen to fully account for interactions among the variables.

3.2.3 Internal Floods Elements Flood identification analysis identifies those plant areas where flooding could pose significant risk. Flooding areas are defined on the basis of physical barriers, mitigation features, and propagation pathways. For each flooding area, flood sources due to equipment (e.g., piping, valves, pumps) and other sources internal to the plant (e.g., tanks) are identified along with the affected SSCs. Flooding mechanisms are examined which include failure modes of components, human induced mechanisms, and other water releasing events. Flooding types (e.g., leak, rupture, Tuesday, Jul 9, 2 (1:42p) Revision 0

Draft Regulatory Guide xx spray) and flood sizes are determined. Plant walkdowns are performed to verify the accuracy of the information.

Flood evaluation analysis identifies the potential flooding scenarios for each flood source by identifying flood propagation paths of water from the flood source to its accumulation point (e.g.,

pipe and cable penetrations, doors, stairwells, failure of doors or walls). Plant design features or operator actions that have the ability to terminate the flood are identified. Credit given for flood isolation is justified. The susceptibility of each SSC in a flood area to flood-induced mechanisms is examined (e.g., submerge, spray, pipe whip, and jet impingement). Flood scenarios are developed by examining the potential for propagation and giving credit for flood mitigation. Flood scenarios can be eliminated on the basis of screening criteria. The screening criteria used are well defined and justified.

Quantification analysis provides an estimation of the CDF of the plant due to internal floods. The frequency of flooding induced initiating events that represent the design, operation and experience of the plant are quantified. The Level 1 models are modified and the internal flood accident sequences quantified: (1) modify accident sequence models to address flooding phenomena, (2) perform necessary calculations to determine success criteria for flooding mitigation, (3) perform parameter estimation analysis to include flooding as a failure mode, (4) perform human reliability analysis to account for PSFs due to flooding, and (5) quantify internal flood accident sequence CDF. Modification of the Level 1 models are performed consistent with the characteristics for Level 1 elements for transients and LOCAs. In addition, sources of uncertainty are identified and their impact o the results analyzed. The sensitivity of the model results to model boundary conditions and other key assumptions is evaluated using sensitivity analyses to look at key assumptions both individually or in logical combinations. The combinations analyzed are chosen to fully account for interactions among the variables.

3.2.4 Internal Fire Elements Screening analysis identifies fire areas where fires could pose a significant risk. Fire areas which are not risk significant can be "screened out" from further consideration in the PRA analysis. Both qualitative and quantitative screening criteria can be used. The former address whether an unsuppressed fire in the area poses a nuclear safety challenge; the latter are compared against a bounding assessment of the fire-induced core damage frequency for the area. The potential for fires involving multiple areas should be addressed. Assumptions used in the screening analysis should be verified through appropriate plant walkdowns. Key screening analysis assumptions and results, e.g., the area-specific conditional core damage probabilities (assuming fire-induced loss of all equipment in the area), should be documented.

Fire initiation analysis determines the frequency and physical characteristics of the detailed (within-area) fire scenarios analyzed for the unscreened fire areas. The analysis needs to identify a range of scenarios which will be used to represent all possible scenarios in the area. The possibility of seismically-induced fires should be considered. The scenario frequencies should reflect plant-specific experience, and should be quantified in a manner that is consistent with their use in the subsequent fire damage analysis (discussed below). The physical characterization of each scenario should also be in terms that will support the fire damage analysis (especially with respect to fire modeling).

Fire damage analysis determines the conditional probability that sets of potentially risk-significant components (including cables) will be damaged in a particular mode, given a specified fire scenario. The analysis needs to address components whose failure will cause an initiating event, affect the plants ability to mitigate an initiating event, or affect potentially risk significant equipment Tuesday, Jul 9, 2 (1:42p) Revision 0

Draft Regulatory Guide xx (e.g., through suppression system actuation). Damage from heat, smoke, and exposure to suppressants should be considered. If fire models are used to predict fire-induced damage, compartment-specific features (e.g., ventilation, geometry) and target-specific features (e.g., cable location relative to the fire) should be addressed. The fire suppression analysis should account for the scenario-specific time required to detect, respond to, and extinguish the fire. The models and data used to analyze fire growth, fire suppression, and fire-induced component damage should be consistent with experience from actual nuclear power plant fire experience as well as experiments.

Plant response analysis involves the modification of appropriate plant transient and LOCA PRA models to determine the conditional core damage probability, given damage to the set(s) of components defined in the fire damage analysis. All potentially significant fire-induced initiating events, including such "special" events as loss of plant support systems, and interactions between multiple nuclear units during a fire event, should be addressed. The analysis should address the availability of non-fire affected equipment (including control) and any required manual actions. For fire scenarios involving control room abandonment, the analysis should address the circuit interactions raised in NUREG/CR-5088, including the possibility of fire-induced damage prior to transfer to the alternate shutdown panel(s). The human reliability analysis of operator actions should address fire effects on operators (e.g., heat, smoke, loss of lighting, effect on instrumentation) and fire-specific operational issues (e.g., fire response operating procedures, training on these procedures, potential complications in coordinating activities). In addition, sources of uncertainty are identified and their impact o the results analyzed. The sensitivity of the model results to model boundary conditions and other key assumptions is evaluated using sensitivity analyses to look at key assumptions both individually or in logical combinations. The combinations analyzed are chosen to fully account for interactions among the variables.

3.2.5 External Hazards Elements Screening and bounding analysis identifies external events other than earthquake (such as river-induced flooding) that may challenge plant operations and require successful mitigation by plant equipment and personnel to prevent core damage from occurring. The term "screening out" is used here for the process whereby an external event is excluded from further consideration in the PRA analysis. There are two fundamental screening criteria embedded in the requirements here, as follows: An event can be screened out either (i) if it meets the design criteria, or (ii) if it can be shown using an analysis that the mean value of the design-basis hazard used in the plant design is less than 10-5/year, and that the conditional core-damage probability is less than 10-1, given the occurrence of the design-basis hazard. An external event that cannot be screened out using either of these criteria is subjected to the detailed-analysis.

Hazard Analysis characterizes non-screened external events and seismic events, generally, as frequencies of occurrence of different sizes of events (e.g., earthquakes with various peak ground accelerations, hurricanes with various maximum wind speeds) at the site. The external events are site specific and the hazard characterization addresses both aleatory and epistemic uncertainties.

Fragility Analysis characterizes conditional probability of failure of important structures, components, and systems whose failure may lead to unacceptable damage to the plant (e.g., core damage) given occurrence of an external event. For important SSCs, the fragility analysis is realistic and plant-specific. The fragility analysis is based on extensive plant-walkdowns reflecting as-built, as-operated conditions.

Level 1 Model Modification assures that the system models include all important external-event caused initiating events that can lead to core damage or large early release. The system model Tuesday, Jul 9, 2 (1:42p) Revision 0

Draft Regulatory Guide xx includes external-event induced SSC failures, non-external-event induced failures (random failures), and human errors. The system analysis is well coordinated with the fragility analysis and is based on plant walkdowns. The results of the external event hazard analysis, fragility analysis, and system models are assembled to estimate frequencies of core damage and large early release. Uncertainties in each step are propagated through the process and displayed in the final results. The quantification process is capable of conducting necessary sensitivity analysis and to identify dominant sequences and contributors.

3.2.6 Documentation Traceability and defensibility provides the necessary information such that the results can easily be reproduced and justified. The sources of information used in the PRA are both referenced and retrievable. The methodology used to perform each aspect of the work is described either through documenting the actual process or through reference to existing methodology documents.

Assumptions1 made in performing the analyses are identified and documented along with their justification to the extent that the context of the assumption is understood. The results (e.g.,

products and outcomes) from the various analyses are documented.

3.3 Technical Adequacy of a PRA The PRA should realistically reflect the actual design, construction, operational practices and operational experience of the plant and its owner.

Tables 2 and 3 provides a summary of the PRA technical characteristics and attributes that provide the guidelines in determining the technical adequacy of the PRA.

Table 2 Summary of Technical Characteristics and Attributes of a PRA Element Technical Characteristics and Attributes PRA Full Power, Low Power and Shutdown Level 1 PRA (internal events -- transients and loss of coolant accidents (LOCAs))

Initiating Event

• sufficiently detailed identification and characterization of initiators Analysis

• grouping of individual events according to plant response and mitigating requirements

• proper screening of any individual or grouped initiating events Success Criteria

• based on best-estimate engineering analyses applicable to the Analysis actual plant design and operation

• codes developed, validated, and verified in sufficient detail

- analyze the phenomena of interest

- be applicable in the pressure, temperature, and flow range of interest 1

Assumptions include those decisions and judgments that were made in the course of the analysis.

Tuesday, Jul 9, 2 (1:42p) Revision 0

Draft Regulatory Guide xx Table 2 Summary of Technical Characteristics and Attributes of a PRA Element Technical Characteristics and Attributes Accident Sequence

• defined in terms of hardware, operator action, and timing Development requirements and desired end states (e.g., CD or PDSs)

Analysis

• includes necessary and sufficient equipment (safety and non-safety) reasonably expected to be used to mitigate initiators

• includes functional, phenomenological, and operational dependencies and interfaces Systems Analysis models developed in sufficient detail to:

• reflect the as built, as operated plant including how it has performed during the plant history

• reflect the required success criteria for the systems to mitigate each identified accident sequence

• capture impact of dependencies, including support systems and harsh environmental impacts

• include both active and passive components and failure modes that impact the function of the system

• include common cause failures, human errors, unavailability due to test and maintenance, etc.

Parameter

• estimation of parameters associated with initiating event, basic Estimation Analysis event probability models, recovery actions, and unavailability events that account for plant-specific and generic data

• consistent with component boundaries

• estimation includes a characterization of the uncertainty Human Reliability

• identification and definition of the human failure events that would Analysis result in initiating events or pre- and post-accident human failure events that would impact the mitigation of initiating events

• quantification of the associated human error probabilities taking into account scenario (where applicable) and plant-specific factors and including appropriate dependencies both pre- and post-accident Quantification

• estimation of the CDF for modeled sequences that are not screened due to truncation, given as a mean value

• estimation of the accident sequence CDFs for each initiating event group

• truncation values set relative to the total plant CDF such that the frequency in not significantly impacted Interpretation of

• identification of the key contributors to CDF: initiating events, Results accident sequences, equipment failures and human errors

• identification of sources of uncertainty and their impact on the results

• understanding of the impact of the key assumptions* on the CDF and the identification of the accident sequence and their contributors Level 2 PRA Plant Damage State

• identification of the attributes of the core damage scenarios that Analysis influence severe accident progression, containment performance, and any subsequent radionuclide releases

• grouping of core damage scenarios with similar attributes into plant damage states

• carryover of relevant information from Level 1 to Level 2 Tuesday, Jul 9, 2 (1:42p) Revision 0

Draft Regulatory Guide xx Table 2 Summary of Technical Characteristics and Attributes of a PRA Element Technical Characteristics and Attributes Severe Accident

• use of verified, validated codes by qualified trained users with an Progression Analysis understanding of the code limitations and the means for addressing the limitations

• assessment of the credible severe accident phenomena via a structured process

• assessment of containment system performance including linkage with failure modes on non-containment systems

• establishment of the capacity of the containment to withstand severe accident environments

• assessment of accident progression timing, including timing of loss of containment failure integrity Quantification

• estimation of the frequency of different containment failure modes and resulting radionuclide source terms Source Term

• assessment of radionuclide releases including appreciation of Analysis timing, location, amount and form of release

• grouping of radionuclide releases into smaller subset of representative source terms with emphasis on large early release (LER) and on large late release (LLR)

Interpretation of

• identification of the contributors to containment failure and resulting Results source terms

• identification of sources of uncertainty and their impact on the results

• understanding of the impact of the key assumptions* on Level 2 results Documentation Traceability and

• The documentation is sufficient to facilitate independent peer defensibility reviews

• The documentation describes all of the important interim and final results, insights, and important sources of uncertainties

• Walkdown process and results are fully described

• Assumptions include those decisions and judgments that were made in the course of the analysis.

In addressing the above elements, because of the nature and impact of internal flood and fire and external hazards, their attributes need to be discussed separately. This is because flood, fire and external hazards analyses have the ability to cause initiating events but also have the capability to impact the availability of mitigating systems. Therefore, regarding the PRA model, the impact of flood, fire and external hazards needs to be considered in each of the above technical elements.

Table 3 provides a summary of the attributes of an internal flood, fire and external hazards analysis.

Table 3 Summary of Technical Characteristics and Attributes of an Internal Flood and Fire Analysis and External Hazards Analysis Areas of Analysis Technical Characteristics and Attributes**

Internal Flood Analysis Tuesday, Jul 9, 2 (1:42p) Revision 0

Draft Regulatory Guide xx Table 3 Summary of Technical Characteristics and Attributes of an Internal Flood and Fire Analysis and External Hazards Analysis Areas of Analysis Technical Characteristics and Attributes**

Flood Identification

• sufficiently detailed identification and characterization of:

Analysis - flood areas and SSCs located within each area

- flood sources and flood mechanisms

- the type of water release and capacity

- the structures functioning as drains and sumps

• verification of the information through plant walkdowns Flood Evaluation

• identification and evaluation of Analysis - flood propagation paths

- flood mitigating plant design features and operator actions

- the susceptibility of SSCs in each flood area to the different types of floods

• elimination of flood scenarios uses well defined and justified screening criteria Quantification

• identification of flooding induced initiating events on the basis of a structured and systematic process

• estimation of flooding initiating event frequencies

• estimation of CDF for chosen flood sequences

• modification of the Level 1 models to account for flooding effects including uncertainties Internal Fire Analysis Fire Area

• all potentially risk-significant fire areas are identified and Identification and addressed Screening Analysis

• all required mitigating components and their cables in each fire area are identified

• screening criteria are defined and justified

• necessary walkdowns are performed to confirm the screening decisions

• screening process and results are documented

• unscreened events areas are subjected to appropriate level of evaluations (including detailed fire PRA evaluations as described below) as needed Fire Initiation

• all potentially significant fire scenarios in each unscreened area Analysis are addressed

• fire scenario frequencies reflect plant-specific features

• fire scenario physical characteristics are defined

• bases are provided for screening fire initiators Fire Growth and

• damage to all potentially significant components is addressed; Damage Analysis considers all potential component failure modes

• all potentially significant damage mechanisms are identified and addressed; damage criteria are specified

• analysis addresses scenario-specific factors affecting fire growth, suppression, and component damage

• models and data are consistent with experience from actual fire experience as well as experiments

• includes evaluation of propagation of fire and fire effects (e.g.,

smoke) between fire compartments Tuesday, Jul 9, 2 (1:42p) Revision 0

Draft Regulatory Guide xx Table 3 Summary of Technical Characteristics and Attributes of an Internal Flood and Fire Analysis and External Hazards Analysis Areas of Analysis Technical Characteristics and Attributes**

Plant Response

• all potentially significant fire-induced initiating events are Analysis addressed so that their bases are included in the model

• includes fire scenario impacts on core damage mitigation and containment systems including fire-induced failures

• analysis reflects plant-specific safe shutdown strategy

• potential circuit interactions which can interfere with safe shutdown are addressed

• human reliability analysis addresses effect of fire scenario-specific conditions on operator performance Quantification

• estimation of fire CDF for chosen fire scenarios

• identification of sources of uncertainty and their impact on the results

• understanding of the impact of the key assumptions* on the CDF

• all fire risk-significant sequences are traceable and reproducible External Hazards Analysis Screening and

• credible external events (natural and man-made) that may affect Bounding Analysis the site are addressed

• screening and bounding criteria are defined and results are documented

• necessary walkdowns are performed

• non-screened events are subjected to appropriate level of evaluations Hazard Analysis

• the hazard analysis is site and plant-specific

• the hazard analysis addresses uncertainties Fragility Analysis

• fragility estimates are plant-specific for important SSCs

• walkdowns are conducted to identify plant-unique conditions, failure modes, and as-built conditions.

Level 1 Model

• important external event caused initiating events that can lead to Modification core damage and large early release are included

• external event related unique failures and failure modes are incorporated

• equipment failures from other causes and human errors are included. When necessary, human error data is modified to reflect unique circumstances related to the external event under consideration

• unique aspects of common causes, correlations, and dependencies are included

• the systems model reflects as-built, as-operated plant conditions

• the integration/quantification accounts for the uncertainties in each of the inputs (i.e., hazard, fragility, system modeling) and final quantitative results such as CDF and LERF

• the integration/quantification accounts for all dependencies and correlations that affect the results

• Assumptions include those decisions and judgments that were made in the course of the analysis.

• • Documentation also applies to flood, fire and external hazards.

3.4 Characteristics and Attributes of a Peer Review Tuesday, Jul 9, 2 (1:42p) Revision 0

Draft Regulatory Guide xx One approach a licensee could use to ensure technical adequacy is to perform a peer review of the PRA. A peer review process can be used to identify the strengths and weaknesses in the PRA and their importance to the confidence in the PRA results. An acceptable peer review needs to be performed by qualified personnel, needs to be performed according to an established process that compares the PRA against the characteristics and attributes, and needs to document the results, and identify both strengths and weaknesses of the PRA.

The team qualifications determine the credibility and adequacy of the peer reviewers. In order that the peer reviewers not give any perception of a technical conflict of interest, they should not have performed any actual work on the PRA. The members of the peer review team have technical expertise in the PRA elements they review including experience in the specific methods that are utilized to perform the PRA elements. This technical expertise includes experience in performing (not just reviewing) the work in the element assigned for review. In addition, knowledge of the key features specific to the plant design and operation is essential. Finally, each member of the peer review team is knowledgeable of the peer review process including the desired characteristics and attributes used to assess the adequacy of the PRA.

The peer review process includes a documented procedure to direct the team in evaluating the adequacy of a PRA. The review process compares the PRA against the desired PRA characteristics and attributes that are listed in this appendix and elaborated on in a PRA standard.

In addition to reviewing the methods utilized in the PRA, the peer review also determines if the application of those methods was done correctly. The PRA models are compared against the plant design and procedures to validate that they reflect the as-built and as-operated plant. Key assumptions are reviewed to determine if they are appropriate and if they have a significant impact on the PRA results. The PRA results are checked for fidelity with the model structure and also for consistency with the results from PRAs for similar plants. Finally, the peer review process examines the procedures or guidelines in place for updating the PRA to reflect changes in plant design, operation, or experience.

Documentation provides the necessary information such that the peer review process and the findings are both traceable and defensible. A description of the qualifications of the peer review team members and the peer review process are documented. The results of the peer review for each technical element and the PRA update process are described including those areas where the PRA do not meet or exceed the desired characteristics and attributes used in the review process. This includes an assessment of the importance of any identified deficiencies on the PRA results and potential uses and how these deficiencies were addressed and resolved.

Table 4 provides a summary of the characteristics and attributes of a peer review.

Table 4 Summary of the Characteristics and Attributes of a Peer Review Element Characteristics and Attributes Team Qualifications

• independent with no conflicts of interest

• expertise in all the technical elements of a PRA including integration

• knowledge of the plant design and operation

• knowledge of the peer review process Tuesday, Jul 9, 2 (1:42p) Revision 0

Draft Regulatory Guide xx Table 4 Summary of the Characteristics and Attributes of a Peer Review Element Characteristics and Attributes Peer Review

• documented process Process

• utilize a set of desired PRA characteristics and attributes

• review PRA methods

• review application of methods

• review key assumptions

• determine if PRA represents as-built and as-operated plant

• review results of each PRA technical element for reasonableness

• review PRA maintenance and update process Documentation

• describe the peer review team qualifications

• describe the peer review process

• document where PRA does not meet desired characteristics and attributes

• assess and document significance of deficiencies Tuesday, Jul 9, 2 (1:42p) Revision 0

Draft Regulatory Guide xx 3.5 Principles and Objectives for a PRA Standard A PRA standard can also provide the guidance to a licensee for the technical adequacy of a PRA.

If this approach is used, the standard needs to be consistent with the attributes and characteristics provided in the previous subsections and should be based on a set of principles and objectives.

Table 5 below provides a set which were established by ASME with consensus from industry and the NRC.

Table 5 Principles and Objectives of a Standard

1. The PRA Standard needs to provide well-defined criteria against which to judge the strengths and weaknesses of the PRA so that decision-makers can determine the degree of reliance that can be placed on the PRA results of interest.

2. The Standard needs to be based on current good practices as reflected in publicly available documents. The needs for the documentation to be publicly available follows from the fact that the Standard may be used to support safety decisions.

3. To facilitate the use of the Standard for a wide range of applications, categories can be defined to aid in determining the applicability of the PRA for various types of applications.

4. The Standard needs to be thorough and complete in defining what is technically required and should, where appropriate, identify one or more acceptable methods.

5. The Standard needs to require a peer review process that identifies and assesses where the technical requirements of the Standard are not met. The Standard needs to assure that the peer review process:

• determines whether methods identified in the Standard have been used appropriately;

• determines that, when acceptable methods are not specified in the Standard, or when alternative methods are used in lieu of those identified in the Standard, the methods used are adequate to meet the requirements of the Standard;

• assesses the significance on the results and insights gained from the PRA of not meeting the technical requirements in the Standard;

• highlights assumptions that way significantly impact the results and provides an assessment of the reasonableness of the assumptions;

• is flexible and accommodates alternate peer review approaches; and

• includes a peer review team that is comprised of members who are knowledgeable in the technical elements of a PRA, are familiar with the plant design and operation, and are independent with no conflicts of interest.

6. The Standard needs to address the maintenance and update of the PRA to incorporate changes that can substantially impact the risk profile, so that the PRA adequately represents the current as-built and as-operated plant.

7. The Standard needs to be viewed as a living document. Consequently, it should not impede research but needs to be structured such that when improvements in our state of knowledge occur, the Standard can easily be updated.

Tuesday, Jul 9, 2 (1:42p) Revision 0

Draft Regulatory Guide xx

4. Regulatory Position on Consensus PRA Standards and Industry PRA Programs A licensee can demonstrate technical adequacy of the PRA by meeting the attributes and characteristics provided in Section 3. This demonstration can be met by either utilizing a PRA standard or by performing a peer review in conformance with this standard. ASME has issued a (3) a Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications , the scope being a PRA for Level 1 and limited Level 2 (LERF) for full-power operation and internal events (excluding internal fires.). Industry has develop a peer review program, Probabilistic Risk (4)

Assessment Peer Review Process Guidance , the scope being a PRA for Level 1 and limited Level 2 (LERF) for full-power operation and internal events (excluding internal floods and fires).

The staff regulatory position on these documents are provided in Appendix A and B, respectively, to this regulatory guide. Additional appendices will be added in future updates to this regulatory guide to address the remaining PRA scope.

5. References

1. USNRC, Use of Probabilistic Risk Assessment Methods in Nuclear Activities: Final Policy Statement, Federal Register, Vol. 60, p. 42622 (60 FR 42622), August 16, 1995.

2. GAO, Nuclear Regulation: Strategy Needed to Regulate Safety Using Information on Risk, GAO/RCED-99-95, March 1999.

3. ASME, Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications, ASME RA-S-2002.

4. NEI, Probabilistic Risk Assessment (PRA) Peer Review Process Guidance, NEI-00-02, Rev.

A3, March 20, 2000.

5. USNRC, SECY-99-256,

6. USNRC, Quarterly Status Update for the Probabilistic Risk Assessment Implementation Plan, SECY-

7. USNRC, Staff Requirements Memorandum (SRM) regarding SECY- , PRA Implementation Plan, April 18, 2000.

8. USNRC, Addressing PRA Quality In Risk-Informed Activities, SECY-00-162, July 28, 2000.

9. USNRC, SRM, regarding SECY-162, Addressing PRA Quality In Risk-Informed Activities, October 27, 2000.

10. USNRC, Publication of Revisions 1 to Regulatory Guide 1.174 and SRP Chapter 19 and Notice of a Staff Plan for Endorsing Consensus Probabilistic Risk Assessment Standards and Industry Peer Review Programs, SECY-02-0070,

11. USNRC, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions On Plant-Specific Changes to the Licensing Basis, Regulatory Guide 1.174, July 1998.

Tuesday, Jul 9, 2 (1:42p) Revision 0

Draft Regulatory Guide xx

12. USNRC, Use of Probabilistic Risk Assessment in Plant-Specific, Risk-Informed Decisionmaking: General Guidance, Chapter 19 of the Standard Review Plan, July 1998.

13. USNRC, An Approach for Plant-Specific, Risk-Informed Decisionmaking: Inservice Testing, Regulatory Guide 1.175,

14. USNRC, An Approach for Plant-Specific, Risk-Informed Decisionmaking: Inservice Inspection of Piping, Regulatory Guide 1.178,

15. USNRC, An Approach for Plant-Specific, Risk-Informed Decisionmaking: Graded Quality Assurance, Regulatory Guide 1.176,

16. USNRC, An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications, Regulatory Guide 1.177, Tuesday, Jul 9, 2 (1:42p) Revision 0