United States Nuclear Regulatory Commission

Office of Public Affairs

Washington, DC 20555

Phone 301-415-8200 Fax 301-415-2234

Internet:opa@nrc.gov

No. 97-064 FOR IMMEDIATE RELEASE

(April 22, 1997)

NOTE TO EDITORS:

The Nuclear Regulatory Commission has received three reports

from its Advisory Committee on Reactor Safeguards. The reports,

in the form of letters, provide comments on:

-- Proposed regulatory guidance related to the

implementation of 10 CFR 50.59 (changes, tests and

experiments).

-- Risk-based regulatory acceptance criteria for plantspecific application of safety goals.

-- Establishing a benchmark on risk during low-power and

shutdown operations.

Copies of the reports are available through the NRC's Office

of Public Affairs and the Public Document Room in Washington,

D.C.

#
ACRSR-1691

April 8, 1997

The Honorable Shirley Ann Jackson

Chairman

U.S. Nuclear Regulatory Commission

Washington, D.C. 20555-0001

Dear Chairman Jackson:

SUBJECT: PROPOSED REGULATORY GUIDANCE RELATED TO IMPLEMENTATION OF

10 CFR 50.59 (CHANGES, TESTS AND EXPERIMENTS)

During the 440th meeting of the Advisory Committee on Reactor

Safeguards, April 3-4, 1997, we met with representatives of the NRC

staff and the Nuclear Energy Institute (NEI) regarding SECY-97-035,

"Proposed Guidance Related to Implementation of 10 CFR 50.59

(Changes, Tests and Experiments)." We discussed the staff's

approach to clarifying guidance for implementing 10 CFR 50.59 and

proposed options for resolving policy issues.

Conclusions and Recommendations

We recommend that SECY-97-035, as now formulated, not be issued for

public comment. We recommend, instead, additional NRC and industry

interaction regarding this matter before the proposed guidance in

SECY-97-035 is issued for public comment.

Discussion

The industry and staff have over 30 years of experience in

implementing 10 CFR 50.59. Over this time, the staff has

identified concerns in only a small subset of situations evaluated

under 10 CFR 50.59. In SECY-97-035, the staff stated the following

with regard to the current process and industry implementation of

NSAC-125:

Although the staff has not endorsed NSAC-125, it has

concluded, as discussed in the April 15, 1996, memorandum

from James M. Taylor to Chairman Jackson, that NSAC-125

has given the nuclear power industry a reasonable

foundation to establish a process that will, in most

instances, produce effective evaluations related to

changes to plant design or procedures. Changes of
-3-

significance are highly likely to be identified by the

licensee through implementation of the NSAC-125 guidance.

Inspection results have confirmed that the quality of the

evaluations of changes has improved since licensees began

implementing the NSAC-125 guidance. However, the NSAC125 guidance is not a requirement for any licensee, and

each licensee develops its own program for performing the

required evaluations under 10 CFR 50.59.

The staff also found that difficulties arise in the licensee's dayto-day use of the 10 CFR 50.59 process when the staff and licensee

have a different understanding and different expectations for

implementation of the rule. The staff, therefore, is proposing

additional regulatory guidance in SECY-97-035 to reduce the

potential for deficiencies in implementing 10 CFR 50.59. Since the

staff appears to agree that when the NSAC-125 guidance has been

implemented properly it has generally resulted in satisfactory

safety evaluations, it would seem more effective to work with the

industry to build on NSAC-125. The goal would be for the staff to

endorse an appropriate version of NSAC-125 with exceptions, as

needed. It is our understanding that the industry has attempted to

improve on NSAC-125 through the development of draft guideline NEI

96-07, "Guidelines for 10 CFR 50.59 Safety Evaluations." These

improvements may well address many of the present concerns.

Sincerely,

/s/

R. L. Seale

Chairman

References:

1. SECY-97-035, Memorandum dated February 12, 1997, from H. L.

Thompson, Jr., Acting Executive Director for Operations, NRC,

for the Commissioners, Subject: Proposed Regulatory Guidance

Related to Implementation of 10 CFR 50.59 (Changes, Tests and

Experiments).

2. Memorandum dated April 15, 1996, from James M. Taylor,

Executive Director for Operations, NRC, to Shirley Ann

Jackson, Chairman, NRC, Subject: Action Plan for Improvements

to 10 CFR 50.59 Implementation and Oversight.

3. Electric Power Research Institute, Nuclear Safety Analysis

Center, NSAC-125, "Guidelines for 10 CFR 50.59 Safety

Evaluations," June 1989.

4. Nuclear Energy Institute, NEI 96-07, draft Revision A,

"Guidelines for 10 CFR 50.59 Safety Evaluations," July 1996.
-4-

ACRSR-1694

April 11, 1997

The Honorable Shirley Ann Jackson

Chairman

U.S. Nuclear Regulatory Commission

Washington, DC 20555-0001

Dear Chairman Jackson:

SUBJECT: RISK-BASED REGULATORY ACCEPTANCE CRITERIA FOR PLANTSPECIFIC APPLICATION OF SAFETY GOALS

In our December 6, 1996 meeting with the Commission, we committed

to provide an example of how risk-acceptance criteria could be

developed directly from the Safety Goals. Additionally, in a Staff

Requirements Memorandum dated January 14, 1997, the Commission

asked for our views on the relationship between the concept of

"adequate protection," as used in the NRC regulations, and the NRC

Safety Goals, from the standpoint of level of risk.

During the 440th meeting of the ACRS, April 3-4, 1997, we completed

our deliberations on plant-specific application of NRC Safety Goals

and the relationship between the concept of "adequate protection"

and the Safety Goals. In our November 18, 1996 report on this

subject, we stated that "the safety goals and subsidiary objectives

can and should be used to derive guidelines for plant-specific

applications." We noted that full-scope Level 3 probabilistic risk

assessments (PRAs) would be necessary to use the quantitative

health objectives (QHOs) directly to assess the acceptability of

plant-specific risk. We also stated that this assessment of risk

could be done in terms of the QHOs, along with the core damage

frequency (CDF), or in terms of the CDF and large, early release

frequency (LERF).

This report further discusses the need for plant-specific

application of risk-acceptance criteria and the appropriateness of

these criteria being derived from the Safety Goal QHO on early

fatalities. The additional comments to this report provide

examples of approaches that could be used to quantify lower tier

acceptance criteria (i.e., LERF, or CDF and conditional containment
failure probability) that will ensure that the early fatality QHO

is met at each site. Quantification of the LERF at each site is

needed to ensure the appropriateness of the choice of the LERF

acceptance criterion proposed in draft Regulatory Guide DG-1061 and

draft Standard Review Plan sections that support risk-informed,

performance-based regulation.

Need for Plant-Specific Application

The Safety Goal Policy Statement makes it clear that the QHOs and

the subsidiary goal on CDF were intended only to provide standards

for the NRC to judge the overall effectiveness of its regulatory

system. The Policy Statement specifically precludes enforcement of

the Safety Goals on a plant-specific basis.

In the development of draft Regulatory Guide DG-1061 and the

associated draft Standard Review Plan sections in support of riskinformed, performance-based regulation, the staff has found it

necessary to propose risk-acceptance guidelines that can be applied

on a plant-specific basis. These guidelines would be used, along

with other considerations and inputs, for making judgments on the

acceptability of requested changes to a licensee's current

licensing basis. Reviewing plant-specific license amendments by

using risk-acceptance guidelines is a positive action toward riskinformed, performance-based regulation.

We also note that, in the longer term, the Commission may want to

consider having a quantified acceptable risk level to replace the

current concept of "adequate protection." This risk level could

eventually serve as an objective risk-acceptance criterion for many

enforcement decisions.

Risk-Informed, Performance-Based Regulation

The Commission has directed the staff to increase the use of PRA in

the regulatory process. We have endorsed this because we believe

that a risk-informed, performance-based regulatory approach will

lead to increased coherence in the regulatory system, to enhanced

decision-making ability, and to technically defensible bases for

granting regulatory relief.

A risk-informed, performance-based regulatory system ought not be

implemented without the existence of top-level risk-acceptance

criteria. The obvious choices for these criteria are the NRC

Safety Goal QHOs. As it is the responsibility of the NRC to

license individual plants and ensure adequate protection, there

seems to be no alternative to plant-specific applications.

Relationship Between Adequate Protection and the Safety Goals

Currently, licensing acceptance criteria are embodied in the

concept of "adequate protection." With this concept, a plant that

is licensed and complies fully with the applicable rules and
-6-

regulations, is considered to meet the "adequate protection"

standard. "Adequate protection" embodies protection of public

health and safety against threats that can be quantified in terms

of risk as well as threats, such as sabotage and diversion of

special nuclear material, for which the risk cannot now be

quantified. In the discussion that follows, the nonquantifiable

aspects of adequate protection are set aside. Since there are many

ways in which plants can be designed and operated within the

confines of the regulations, the natural result is a spectrum of

risk levels across the population of operating plants. This

conclusion is consistent with the results of the recent Individual

Plant Examination Program. Since each licensed plant must, by

definition, provide adequate protection, the licensed plant that

poses the highest level of risk places a bound on the quantified

level of risk to be associated with "adequate protection."

Within the spectrum of risk, it is likely that there are plants

with risk levels above the Safety Goals and other plants with risk

levels below. If this is indeed the case, a single risk level that

bounds "adequate protection" would be a risk level greater than the

Safety Goal level. For those plants with risk levels below the

Safety Goals, the difference between the plant risk and the Safety

Goals can be viewed as margin. It is from some portion of this

margin that plant-specific regulatory relief could be granted. For

those plants with risk levels greater than the Safety Goals, the

challenge will be to eventually reduce their risk to below the

Safety Goal level within the confines of the backfit rule.

Regulatory Transparency

The unquantified "adequate protection" concept is not well

understood by the general public because the public is unfamiliar

with the regulatory process, the body of nuclear regulations, and

associated underlying technical bases. We believe that a long-term

objective of replacing the "adequate protection" concept with a

well articulated and quantified "acceptable level of risk" if

achievable, would enhance the public's understanding and acceptance

of the regulatory process and would lead to a more uniform level of

protection for all individuals living in the vicinity of nuclear

plants.

We note that the use of risk-acceptance criteria such as the QHOs

will add stability to the regulatory process. This is because the

Safety Goals are determined primarily from considerations of

societal risk, while the NRC rules and regulations, which are now

used to specify adequate protection, change with time as our

understanding of reactor safety issues evolves.

Safety Goals as Risk-Acceptance Criteria
-7-

It is our opinion that the QHOs are the appropriate choices for

risk-acceptance criteria for plant-specific applications. The

Safety Goals are the expression by NRC for "how safe is safe

enough." In our opinion, this is what risk-acceptance criteria

ought to be. As we stated in our August 15, 1996 report, the

subsidiary CDF goal should be elevated to the status of a

fundamental goal. Elevating the CDF subsidiary goal to the status

of a fundamental goal can be considered as a defense-in-depth

principle that provides balance between prevention and mitigation.

The early fatality QHO generally controls the risks from nuclear

plant operations. Our understanding of risk associated with lowpower and shutdown operations, or accidents initiated by external

events in which emergency response is impeded, is not yet

sufficient to draw definitive conclusions concerning the limiting

QHO in these situations.
-8-

Additional comments by ACRS Member T. S. Kress are presented below.

Sincerely,

/s/

R. L. Seale

Chairman

Additional Comments by ACRS Member T. S. Kress

While I agree completely with the Committee's report, I think it

could be augmented in two respects. First, it could make it

clearer that, with respect to plant-specific application of the

Safety Goals, we are making two related, somewhat radical proposals

ˇˇ the second more so than the first:

1) That lower tier risk-acceptance criteria (CDF and LERF), now

being proposed in Draft Regulatory Guide DG-1061 for use in

making decisions regarding requested changes to a licensee's

current licensing basis, be derived directly from the prompt

fatality QHO and be of such value as to bound all current

sites.

2) That, in the long run for enforcement purposes, the prompt

fatality QHO be considered as the quantification of a risk

level to replace "adequate protection."

Second, guidance on how lower tier criteria are to be derived from

the QHO is needed. Consequently, I am including two attachments to

these additional comments (one developed by me and a complementary

one developed by ACRS Senior Fellow Rick Sherry). These provide

examples of how to more rigorously derive the lower tier criteria.

It is suggested that the staff consider these for use if the first

proposal above is to be implemented.

Attachments:

1. Kress, T. S., "Risk-Based Regulatory Acceptance Criteria for

Plant-Specific Application of Safety Goals," March 1997

2. Sherry, R. R., "Methodology for Estimating Offsite Early

Fatality Risk in the Absence of a Level 3 PRA," March 1997

References:

1. Staff Requirements Memorandum dated January 14, 1997, from

John C. Hoyle, Secretary, NRC, to John T. Larkins, Executive

Director, ACRS, Subject: Meeting with ACRS, 9:30 A.M.,

Friday, December 6, 1996, Commissioners' Conference Room.
-9-

2. Report dated November 18, 1996, from T. S. Kress, Chairman,

ACRS, to Shirley Ann Jackson, Chairman, NRC, Subject: PlantSpecific Application of Safety Goals.

3. Report dated August 15, 1996, from T. S. Kress, Chairman,

ACRS, to Shirley Ann Jackson, Chairman, NRC, Subject: RiskInformed, Performance-Based Regulation and Related Matters.

4. U.S. Nuclear Regulatory Commission, NUREG-1560, Volume 1, Part

1, "Individual Plant Examination Program: Perspectives on

Reactor Safety and Plant Performance," Summary Report, Draft

Report for Comment, October 1996.

5. U.S. Nuclear Regulatory Commission Draft Regulatory Guide,

Draft DG-1061, "An Approach for Using Probabilistic Risk

Assessment in Risk-Informed Decisions on Plant-Specific

Changes to the Current Licensing Basis," dated February 28,

1997 (Predecisional).

6. U.S. Nuclear Regulatory Commission, Draft Standard Review Plan

Chapter 19, Revision L, "Use of Probabilistic Risk Assessment

in Plant-Specific,

Risk-Informed Decisionmaking: General Guidance," dated March

3, 1997 (Predecisional).
- 10 -

ACRSR-1696

April 18, 1997

The Honorable Shirley Ann Jackson

Chairman

U.S. Nuclear Regulatory Commission

Washington, D.C. 20555-0001

Dear Chairman Jackson:

SUBJECT: ESTABLISHING A BENCHMARK ON RISK DURING LOW-POWER AND

SHUTDOWN OPERATIONS

This report is to draw attention to the critical need for

developing an understanding of risk posed by low-power and shutdown

operations at nuclear power plants. This need is apparent as a

result of: (1) repeated events during these modes of power plant

operations, (2) changes being made in plant operations in response

to economic forces, and (3) the ongoing NRC initiative to develop

risk-informed, performance-based regulation. We believe it is

essential that the NRC staff undertake a quantitative examination

of risk during low-power and shutdown operations at representative

nuclear power plants. That is, the NRC staff needs to establish a

high-quality benchmark on risk during low-power and shutdown

operations comparable to that which it has derived for risk during

power operations from the NUREG-1150 study [Ref. 1] and other

sources. The benchmark for risk during low-power and shutdown

operations should address the following:

 a representative range of plant types,

 all phases of low-power and shutdown operations,

 accidents initiated by internal fires and other external

events,

 human performance, the unusual source term, radionuclide

dispersal, and on-site populations that will affect the

predictions of accident consequences, and

 uncertainties to a depth similar to that done for the risk

benchmark for power operations.
A substantial effort will be required to develop the technical

capabilities to conduct this benchmark risk analysis. Results of

the benchmark risk analysis may suggest the need for refinements to

the Commission's Safety Goals. In particular, the Commission may

find from the results that it wants to specify limits on the

tolerable durations of plant configurations that pose very high

risks.

Our recommendation for a detailed benchmark analysis is based on

the results of scoping risk studies done by the staff contractors

[Refs. 2,3], the continuing string of worrisome events at plants

during low-power and shutdown operations, and assessments of the

risk significance of plant events by the Office for Analysis and

Evaluation of Operational Data. The staff's contractors have done

limited analyses of risk during one phase of shutdown operations at

a pressurized water reactor with a subatmospheric containment [Ref.

2] and one phase of shutdown operations at a Mark III boiling water

reactor [Ref. 3]. Results of these studies show that even when the

risk for a short period of shutdown operations is normalized over

a full calendar year, the risk is a significant fraction of the

risk calculated for the same plant during power operations:

Boiling Water Reactor

Power Operations Shutdown Operations*

Mean Core Damage

Frequency

4.1x10

-6

2.1x10

-6

Mean Early Fatality

Risk

8.2x10

-9

1.4x10

-8

Mean Latent Cancer

Fatality Risk

9.5x10

-4

3.8x10

-3

* Plant Operating Mode 5 (cold shutdown) only.

Pressurized Water Reactor

Power Operations Shutdown Operations*

Mean Core Damage

Frequency

4.1x10

-5

4.2x10

-6

Mean Early Fatality

Risk

2.0x10

-6

4.9x10

-8

Mean Latent Cancer

Fatality Risk

5.2x10-3 1.6x10-2

* Mid-loop operation only.
- 12 -

These partial results, however, may not adequately reflect current

operating practices. The industry has instituted new guidelines

[Ref. 4] for low-power and shutdown operations that are intended to

reduce risk. Several licensees are using software such as the

Electric Power Research Institute’s ORAM (Outage Risk Assessment

and Management) to plan activities during low-power and shutdown

operations. These software tools are based on risk insights

derived from simplified probabilistic risk assessments. If the NRC

staff is to provide effective safety oversight of low-power and

shutdown operations, the staff will have to understand the

technical bases of the software tools and the approximations in

risk assessments that have been used to develop these tools. The

availability of benchmark risk assessments for low-power and

shutdown operations for representative plants akin to the benchmark

risk assessments for power operations appears to be essential for

the development of this understanding.

Despite the new guidelines and software tools developed by the

nuclear power industry for low-power and shutdown operations,

events that reveal safety vulnerabilities of the plants continue to

occur. Among the more recent of these events are:

 The Wolf Creek plant was in a "hot shutdown" condition when

activities involving the residual heat removal system created

a flow path that allowed approximately 9,200 gallons of

reactor coolant to transfer to the refueling water storage

tank. Had this draining not been promptly terminated, the

operability of the emergency core cooling system would have

been compromised. The Accident Sequence Precursor Analysis

indicated that this event had a high conditional core damage

probability [Ref. 5]. The scoping studies of shutdown risk,

however, suggested that a "hot shutdown" condition was of such

a low risk significance that it did not merit quantification.

 Loss of core cooling was threatened by the formation of a

nitrogen bubble in the reactor coolant system at the Haddam

Neck plant as a result of an improper valve lineup. Injection

of high-pressure nitrogen into the reactor vessel continued

for over three days while the plant was in a "cold shutdown"

condition. The water level in the reactor vessel was believed

to have been displaced three feet below the vessel flange

[Ref. 6].

 At the Cooper plant, about 10,000 gallons of water was

inadvertently lost from the refueling cavity because a

submerged valve was opened to the main steam line drains. It

took over an hour for operators to identify the source of the

loss of coolant inventory [Ref. 7].
- 13 -

Events during low-power and shutdown operations are consuming

significant staff resources. At our meeting on December 5, 1996,

we were told that more than 50 percent of recent events requiring

Augmented Inspection Teams have occurred when plants were in lowpower or shutdown conditions. Human errors during these conditions

appear to be especially probable. A number of incidents that have

occurred during low-power and shutdown conditions are reviewed in

the report NUREG/CR-6093 [Ref. 8]. This report concluded that

factors influencing operator actions are different from those

typically regarded as important during full-power operations and

states that: "Unlike full-power operations, large numbers of

multiple concurrent tasks are possible during LP&S (low-power and

shutdown) conditions. This has implications for both the PRA

(probabilistic risk assessment) modeling process and the HRA (human

reliability assessment) quantification process."

We are concerned that this situation will be exacerbated as the

industry moves to longer cycle times with less frequent

opportunities to exercise its low-power and shutdown operating

procedures. The situation may also be exacerbated by industry

efforts to shorten the duration of low-power and shutdown

operations by increasing the intensity of activities during these

periods. The industry will want to relieve burdens during outages

by doing some maintenance while the plant is operating. For the

staff to approve a trade-off between maintenance "on-line" and

maintenance during outages, it will have to consider risk. To do

this, the staff will have to gain an understanding of risk during

low-power and shutdown operations commensurate with its

understanding of risk during power operations.

The staff is now embarked on an effort to develop risk-acceptance

criteria for providing regulatory relief to licensees. Staff

judgments on these matters are based on a firm foundation

concerning event probabilities during power operations derived both

from the Individual Plant Examinations done by licensees and from

its own benchmarking risk studies reported in NUREG-1150. There is

no comparable basis for making judgments concerning the accident

probabilities and risk during low-power and shutdown operations.

At present, there is no defensible regulatory basis to determine

the extent to which results obtained for power operations ought to

be augmented to account for risk of low-power and shutdown

operations. A more complete understanding of risks during all

phases of nuclear plant operations is essential to ensure that

regulations address real, significant risks and do not impose ad

hoc measures to correct discovered deficiencies in the hope that

these measures will also address risk-significant issues.

We believe it is essential for the success of the Commission's

effort to adopt risk-informed, performance-based regulation that a

more complete understanding of the full spectrum of risk be
- 14 -

established on a defensible technical basis. This more complete

understanding is needed now as pivotal decisions are being made on

the implementation of risk-informed, performance-based regulation.

We do not believe that existing scoping analyses or further scoping

efforts will establish adequate benchmarks concerning risk during

low-power and shutdown operations. This is especially so in light

of evidence that time-dependent human performance is important.

Significant efforts may be needed to establish new risk assessment

methods and to understand phenomena associated with core damage

events and the dispersal of radioactivity during these phases of

plant operations. We are confident that areas of substantial

uncertainty will arise in the assessment of risk during low-power

and shutdown operations. Defensible quantification of these

uncertainties will require the same type of effort that was needed

to quantify uncertainties in risk during power operations.

It will take time to develop a usefully complete understanding of

risk during low-power and shutdown operations. We recommend that

a well-planned, deliberate effort with realistic time schedules and

extensive peer review be undertaken first to develop methods and

technologies that may be needed and then to benchmark risk during

low-power and shutdown operations.

Sincerely yours,

/s/

R. L. Seale

Chairman

References:

1. U.S. Nuclear Regulatory Commission, NUREG-1150, Vol. 1,

"Severe Accident Risks: An Assessment for Five U.S. Nuclear

Power Plants," December 1990.

2. U.S. Nuclear Regulatory Commission, NUREG/CR-6144, BNL-NUREG52399, Vol. 1, Brookhaven National Laboratory, "Evaluation of

Potential Severe Accidents During Low Power and Shutdown

Operations at Surry, Unit 1," Summary of Results, October

1995.

3. U.S. Nuclear Regulatory Commission, NUREG/CR-6143, SAND93-

2440, Vol.1, Sandia National Laboratories, "Evaluation of

Potential Severe Accidents During Low Power and Shutdown

Operations at Grand Gulf, Unit 1," Summary of Results, July

1995.

4. NUMARC 91-06, Nuclear Management and Resources Council, Inc.,

"Guidelines for Industry Actions to Assess Shutdown

Management," December 1991.

5. U.S. Nuclear Regulatory Commission, Information Notice 95-03,

Supplement 1, "Loss of Reactor Coolant Inventory and Potential
- 15 -

Loss of Emergency Mitigation Functions While in a Shutdown

Condition," dated March 25, 1996.

6. U.S. Nuclear Regulatory Commission, Information Notice 94-36,

Supplement 1, "Undetected Accumulation of Gas in Reactor

Coolant System," November 1996.

7. U.S. Nuclear Regulatory Commission, AEOD/S96-02, "Assessment

of Spent Fuel Pool Cooling," September 1996.

8. U.S. Nuclear Regulatory Commission, NUREG/CR-6093, "An

Analysis of Operational Experience During Low Power and

Shutdown and a Plan for Addressing Human Reliability

Assessment Issues," June 1994.