Risk-Informed Changes to the Licensing
Basis - I
22.39
Elements of Reactor Design, Operations, and Safety Lecture 12 Fall 2006
George E. Apostolakis Massachusetts Institute of Technology
Department of Nuclear Science and Engineering
Licensing Basis Changes
These are modifications to a plants design, operation, and other activities that require NRC approval. Regulatory Guide 1.174 (General Guidance) was issued in 1998 and revised in 2002. In-Service Testing (RG 1.175) Graded Quality Assurance (RG 1.176) Technical Specifications (RG 1.177) In-Service Inspection (RG 1.178)
Department of Nuclear Science and Engineering
The Integrated Decision-Making Process (RG 1.174)
Comply with Regulations Maintain Defense-inDepth Philosophy Maintain Safety Margins
Integrated Decision Making Risk Decrease, Neutral, or Small Increase
Monitor Performance
3
Department of Nuclear Science and Engineering
Defense In Depth (RG 1.174)
A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence mitigation. Over-reliance on programmatic activities to compensate for weaknesses in plant design is avoided. System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties (e.g., no risk outliers). Defenses against common-cause failures are preserved, and the potential for the introduction of new common-cause failure mechanisms is assessed. Independence of barriers is not degraded. Defenses against human errors are preserved. The intent of the GDC in Appendix A to 10 CFR Part 50 is maintained.
Department of Nuclear Science and Engineering 4
CDF
Region I
10-5 Region II 10-6 Region III
Region I - No changes Region II - Small Changes - Track Cumulative Impacts Region III - Very Small Changes - More flexibility with respect to Baseline - Track Cumulative Impacts
10-5
10-4
CDF
Acceptance Guidelines for Core Damage Frequency
Department of Nuclear Science and Engineering 5
Uncertainties
Aleatory uncertainty is built into the structure of the PRA model itself. Epistemic uncertainties:
Parameter uncertainties are those associated with the values of the fundamental parameters of the PRA model, such as equipment failure rates, initiating event frequencies, and human error probabilities that are used in the quantification of the accident sequence frequencies. In many cases, understanding of certain processes or phenomena is incomplete, and there may be different opinions on how the models should be formulated. Examples: modeling human performance, common cause failures, and reactor coolant pump seal behavior upon loss of seal cooling. This gives rise to model uncertainty. Completeness is not in itself an uncertainty, but a reflection of scope limitations. The problem with completeness uncertainty is that, because it reflects an unanalyzed contribution, it is difficult (if not impossible) to estimate its magnitude. Examples: the analysis of some external events and the low power and shutdown modes of operation, and influences of organizational performance.
Department of Nuclear Science and Engineering 6
Comparison with Acceptance Guidelines
The acceptance guidelines were established with the Commissions Safety Goals and subsidiary objectives in mind, and these goals were intended to be compared with mean values. Therefore, the mean values of the distributions should be used. For the distributions generated in typical PRAs, the mean values typically corresponded to the region of the 70th to 80th percentiles, and coupled with a sensitivity analysis focused on the most important contributors to uncertainty, can be used for effective decision-making. Approach: Address parametric uncertainty and any explicit model uncertainties in the assessment of mean values; perform sensitivity studies to evaluate the impact of changes in key assumptions or the use of alternate models for the principal implicit model uncertainties; and use quantitative analyses or qualitative analyses as necessary to address incompleteness as appropriate to the decision and the acceptance guidelines.
Department of Nuclear Science and Engineering
Important Note
The analysis will be subject to increased technical review and management attention as indicated by the darkness of the shading of the figure. In the context of the integrated decision-making, the boundaries between regions should not be interpreted as being definitive; the numerical values associated with defining the regions in the figure are to be interpreted as indicative values only.
Regulatory Guide 1.174
Department of Nuclear Science and Engineering
Increased Management Attention
Consider:
The cumulative impact of previous changes and the trend in CDF (the licensees risk management approach); The cumulative impact of previous changes and the trend in LERF (the licensees risk management approach); The impact of the proposed change on operational complexity, burden on the operating staff, and overall safety practices; Plant-specific performance and other factors, including, for example, siting factors, inspection findings, performance indicators, and operational events; and Level 3 PRA information, if available; The benefit of the change in relation to its CDF/LERF increase; The practicality of accomplishing the change with a smaller CDF/LERF impact; and The practicality of reducing CDF/LERF, in circumstances where there is reason to believe that the baseline CDF/LERF are above the guideline values (i.e., 10-4 and 10-5 per reactor year).
Department of Nuclear Science and Engineering
South Texas Project Experience with Allowed
Outage Times
AOTs extended from 3 days to 14 days for emergency AC power and 7 days for Essential Cooling Water and Essential Chilled Water systems. Actual experience: Less than 5 days.
Department of Nuclear Science and Engineering
10
Example: 1-out-of-2 System
1 2 2 1 Q = T + + CCF T + 0 1 3 2
T CCF 0 1 standby failure rate Surveillance Test Interval Allowed Outage Time common-cause failure rate unconditional human error rate conditional human error rate
Department of Nuclear Science and Engineering 11
CDF and LERF can be calculated from the PRA.
Phased Approach to PRA Quality
In the 12/18/03 Staff Requirements Memorandum, the Commission approved the implementation of a phased approach to PRA quality. The phases are differentiated by the availability of standards. Phase 3 should be achieved by December 31, 2008. Guidance documents will be available to support all anticipated applications. Standard for PRA for Nuclear Power Plant Applications, ASME RA-S-2002. An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, RG 1.200, February 2004
Department of Nuclear Science and Engineering 12
ACRS Interpretations of DiD
Structuralist: DiD is embodied in the structure of regulations and in the design of the facilities built to comply with those regulations. What if this barrier or safety feature fails?
Rationalist: DiD is the aggregate of provisions made to compensate for uncertainty in our knowledge of accident initiation and progression.
Sorensen, J.N., Apostolakis, G. E., Kress, T.S., and Powers, D.A., On the Role of Defense in Depth in Risk-Informed Regulation, Proceedings of PSA 99, International Topical Meeting on Probabilistic Safety Assessment, pp. 408-413, Washington, DC, August 22 - 26, 1999, American Nuclear Society, La Grange Park, Illinois. Department of Nuclear Science and Engineering 13
The Concerns
Arbitrary appeals to the structuralist interpretation of defense-in-depth might diminish the benefits of riskinformed regulation. Strict implementation of risk-based regulation (the rationalist interpretation of defense-in-depth) without appropriate consideration of the structuralist defense-indepth could undermine the historical benefits.
Department of Nuclear Science and Engineering
14
We continue to be surprised
Recent events have shaken our confidence in our assumptions. The NRC and DBNPS failed to adequately review, assess, and followup on relevant operating experience. DBNPS failed to assure that plant safety issues would receive appropriate attention. The NRC failed to integrate known or available information into its assessments of DBNPSs safety performance.
[Davis Besse NPS Lessons-Learned Report, USNRC, September 30, 2002]
Department of Nuclear Science and Engineering 15
The ACRS Pragmatic Approach
Apply defense-in-depth (the structuralist approach) at a high level, e.g., the ROP cornerstones (e.g., IEs, Safety Functions). Implement the rationalist approach at lower levels, except when PSA models are incomplete. Revert to the structuralist approach in these cases.
Department of Nuclear Science and Engineering
16
Risk-Informed Framework
Traditional Deterministic
Approaches
Unquantified Probabilities
Risk-
Informed
Approach
Risk-Based
Approach
Quantified Probabilities
Combination of Design-Basis Accidents Scenario Based traditional and Structuralist Defense in Depth Realistic risk-based Can impose heavy regulatory burden Rationalist Defense in Depth approaches Incomplete Incomplete Quality is an issue
Department of Nuclear Science and Engineering 17
Benefits (NRC)
Risk-informing regulatory activities have enhanced and extended the traditional, deterministic, by:
Allowing consideration of a broader set of potential challenges to safety, Providing a logical means for prioritizing these
challenges based on risk significance, and
Allowing consideration of a broader set of resources to defend against these challenges
G. Holahan, RIODM Lecture, MIT, 2006 Department of Nuclear Science and Engineering 18
Remarks (NRC)
Risk-informed initiatives have enhanced every aspect of reactor regulations Steady progress is being made to continue the implementation of the Commission PRA policy and direction Enhanced public safety and a reduction of regulatory burden is resulting in redirection of resources to areas of greater benefit
G. Holahan, RIODM Lecture, MIT, 2006 Department of Nuclear Science and Engineering 19
Special Treatment Requirements
Requirements imposed on structures, systems, and components (SSCs) that go beyond industry-established requirements for commercial SSCs. Safety-related SSCs are subject to special treatment, including quality assurance, testing, inspection, condition monitoring, assessment, evaluation and resolution of deviations. Non-safety-related SSCs are not. The categorization of SSCs as safety-related and nonsafety-related does not have a rational basis. These requirements are very expensive. The impact of special treatment on SSC performance is not known.
Department of Nuclear Science and Engineering
20
Traditional SSC Categorization
Safety-Related
Non-Safety Related
Department of Nuclear Science and Engineering
21
SSC Categorization (10 CFR 50.69
RISC - 1 Safety-Related, Safety Significant FV>0.005 and RAW>2 Maintain Current Requirements RISC - 2 Non-Safety Related, Safety Significant FV>0.005 or RAW>2 Impose Current Requirements STP: 456 (0.7%) RISC - 4 Non-Safety Related, Low Safety Significant FV<0.005 and RAW<2 No Special Treatment STP: 47,876 (72.5%) STP: 13,755 (20.8%)
Department of Nuclear Science and Engineering 22
Importance Measures
STP: 3,971 (6.0%) RISC - 3 Safety-Related, Low Safety Significant FV<0.005 and RAW<2 Maintain Design Basis Requirements
Traditional
Reactor Oversight Process: Objectives
Make the oversight process more objective, predictable, consistent, and risk-informed. Reduce unnecessary regulatory burden. Integrate inspection, assessment, and enforcement processes. Utilize objective indicators of performance. Utilize inspections focused on key safety areas. Apply greater regulatory attention to facilities with performance problems while maintaining a base level of regulatory attention on plants that perform well. Respond to violations in a predictable and consistent manner that reflects the safety significance of the violations.
Department of Nuclear Science and Engineering
23
Regulatory Framework
NRCs Overall Safety Mission
Public Health and Safety as a Result of Civilian Nuclear Reactor Operation
Strategic Performance Areas
Reactor Safety
Radiation Safety
Safeguards
Cornerstones
Initiating Events
Mitigating Systems
Barrier Integrity
Emergency Preparedness
Occupational Radiation Safety
Public Radiation Safety
Physical Protection
Cross-cutting Issues
Human Performance
Safety Conscious Work Environment
Problem Identification and Resolution
Data Sources
Performance Indicators, NRC Inspections, Other Information Sources Department of Nuclear Science and Engineering 24
Plant Assessment Process
Licensee Action NRC Inspection
Regulatory Action
Assessment Report
Public Assessment Meeting
Action Matrix
Enforcement
Cornerstone Assessment
Cornerstones
(7 total)
Significance
Determination Process
Risk Informed Baseline Inspection
Complementary , Supplementary , Verification
Inspection
Reactive
Performance Indicator
25
Department of Nuclear Science and Engineering
Levels of Significance Associated with
Performance Indicators and Inspection Findings
Green - very low risk significance (for PIs: Within peer performance) White - low to moderate risk significance Yellow - substantive risk significance Red - high risk significance CDF > 1E-4
CDF < 1E-6
1E-6 < CDF < 1E-5
1E-5 < CDF < 1E-4
Department of Nuclear Science and Engineering
26
Licensee Response Column
Regulatory Response Column
Degraded Cornerstone Column
Multiple Repetitive Degraded Cornerstone Column Repetitive degraded cornerstone, multiple degraded cornerstones, multiple Yellow inputs, or 1 Red input1 ; cornerstone objectives met with longstanding issues or significant reduction in safety margin
Unacceptable Performance Column
All assessment inputs (performance Indicators (PI) and inspection findings) Green; cornerstone objectives fully met
One or two White inputs (in different cornerstones) in a strategic performance area; Cornerstone objectives fully met
One degraded cornerstone (2 White inputs or 1 Yellow input) or any 3 White inputs in a strategic performance area; cornerstone objectives met with minimal reduction in safety margin
Overall unacceptable performance; plants not permitted to operate within this band, unacceptable margin to safety
Results
Regulatory Conference
Routine Senior Resident Inspector (SRI) interaction
Branch Chief (BC) or Division Director (DD) meet with Licensee
DD or Regional Administrator (RA) meet with Licensee
EDO (or Commission) meet with Senior Licensee Management
Commission meeting with Senior Licensee Management
Response
Licensee Action
Licensee Corrective Action
Licensee corrective action with NRC oversight
Licensee self assessment with NRC oversight
Licensee performance improvement plan with NRC oversight Baseline and supplemental inspection 95003 10 CFR 2.204 DFI 10 CFR 50.54(f) letter CAL/Order RA review / sign assessment report (w/ inspection plan) Commission informed EDO (or Commission) discuss performance with Senior Licensee Management Order to modify, suspend, or revoke licensed activities
NRC Inspection
Risk-informed baseline inspection program
Baseline and supplemental inspection 95001 Document response to degrading area in assessment letter
Baseline and supplemental inspection 95002 Document response to degrading condition in assessment letter
Regulatory Actions
None
Communications
Assessment Report
BC or DD review / sign assessment report (w/ inspection plan)
DD review / sign assessment report (w/ inspection plan)
RA review / sign assessment report (w/ inspection plan)
Public Assessment Meeting
SRI or BC meet with Licensee
BC or DD meet with Licensee
RA discuss performance with Licensee
Commission meeting with Senior Licensee Management
Increasing Safety Significance
1 It is expected in a few limited situations that an inspection finding of this significance will be identified that is not indicative of overall licensee performance. The staff will consider treating these inspection findings as exceptions for the purpose of determining appropriate actions.
Department of Nuclear Science and Engineering
27
Performance Indicators (1)
Initiating Events Unplanned Scrams Scrams with Loss of Normal Heat Removal Unplanned Power Changes Mitigating Systems Safety System Unavailability Safety System Functional Failures Barriers Fuel Cladding (Reactor Coolant System) Reactor Coolant System (Leak Rate)
Department of Nuclear Science and Engineering 28
Performance Indicators (2)
Emergency Preparedness Drill/Exercise Performance Emergency Response Organization Drill Participation Alert and Notification System Reliability Occupational Radiation Safety Occupational Exposure Control Effectiveness Public Radiation Safety Radiological Effluent Occurrences Physical Protection Protected Areas Security Equipment Performance Index Personnel Screening Program Performance Fitness-for-Duty/Personnel Reliability Program Performance
Department of Nuclear Science and Engineering
29
Performance Indicators (3)
Emergency Preparedness Drill/Exercise Performance ERO Drill Participation Alert and Notification System Reliability Occupational Radiation Safety Occupational Exposure Control Effectiveness Public Radiation Safety RETS/ODCM Radiological Effluent Occurrence Physical Protection Protected Areas Security Equipment Performance Index Personnel Screening Program Performance Fitness-for-Duty/Personnel Reliability Program Performance
Department of Nuclear Science and Engineering
30
Examples of Thresholds for PIs
G/W
Reactor Safety Unplanned Scrams AFW Unavailability Public Radiation Safety Radiological Effluent Occurrences
W/Y
Y/R
3 0.02
6 0.06
25 0.12
7 or more 14 or more N/A events in 3 yrs events in 3 yrs (rolling average); (rolling average); 4 or more in 1 yr 8 or more in 1 yr
Department of Nuclear Science and Engineering
31
Objectives of the Significance Determination
Process
Characterize the significance of inspection findings using risk insights Provide a framework for communicating potential safety significant findings Provide a basis for assessment and/or enforcement actions
Department of Nuclear Science and Engineering
32
Significance Determination Process
Specific Finding Identified
Stated Concern is Screened for Potential Impact on Risk
Phase I Screening
Phase 2 Risk Characterization Determine Risk Associated with Most Limiting Scenario
Determine Likelihood of Scenario Initiating Event vs. Exposure Time
Identify the Remaining Mitigation Capability
Engage Licensee and NRC Risk Analysts to Refine Results
Department of Nuclear Science and Engineering
Phase 3 Risk Refinement 33 (as required)
