United States Nuclear Regulatory Commission

Office of Public Affairs

Washington, DC 20555

Phone 301-415-8200 Fax 301-415-2234

Internet:opa@nrc.gov

No. 96-85 FOR IMMEDIATE RELEASE

(Monday, June 17, 1996)

NOTE TO EDITORS:

The Nuclear Regulatory Commission has received the attached

report from its Advisory Committee on Reactor Safeguards (ACRS).

The report, in the form of a letter, provides comments on the

potential use of individual plant examinations for external

events in determining where the current number of nuclear plants

in operation fall in relation to radiological risk and the NRC's

safety goals.

In addition, the NRC's executive director for operations

received four ACRS reports. They provide comments on:

--A proposed rule on operations at nuclear power plants

during shutdowns;

--Regulatory guidance documents related to digital

instrumentation and control systems;

--The adequacy of the NRC's multiple system responses

program in resolving safety issues; and

--Implementation of NRC's regulatory review group

recommendations.

#

Attachments:

As stated
June 6, 1996

The Honorable Shirley Ann Jackson

Chairman

U.S. Nuclear Regulatory Commission

Washington, D.C. 20555-0001

Dear Chairman Jackson:

SUBJECT: POTENTIAL USE OF IPE/IPEEE RESULTS TO COMPARE THE RISK

OF THE CURRENT POPULATION OF PLANTS WITH THE SAFETY

GOALS

This report is in response to a Staff Requirements Memorandum

dated September 20, 1994, in which the Commission requested

further guidance and insight on determining where the current

population of operating plants, both individually and

collectively, fall in relation to the safety goals. Our intent

in developing a response was to examine the Individual Plant

Examinations (IPEs)/Individual Plant Examinations of External

Events (IPEEEs) results to see if they can be extended so as to

compare the risk of the current population of plants with the

safety goals.

During the 431st meeting of the Advisory Committee on Reactor

Safeguards, May 23-25, 1996, we completed our discussions on this

subject. During the 418th, February 1995, and 419th, March 1995

meetings, we heard presentations by an ACRS Senior Fellow on an

approach for estimating the risk associated with some of the

missing or incomplete elements of the IPEs. During our 431st

meeting, we reviewed a study by the Brookhaven National

Laboratory (BNL) (performed as part of the IPE Insights Program)

that investigated the use of some of the IPEs to compare the

plant risk to the safety goals. We also had the benefit of the

documents referenced.

The prompt fatality and latent health effects quantitative safety

goals are posed in risk terms. Consequently, to establish the

status of the population of plants with respect to these goals, a

full-scope Level 3 probabilistic risk assessment (PRA) of

acceptable quality for every plant would seem to be required.

Such PRAs would need to include all internal and external events

(including low-power and shutdown operations) and would also need

to take into consideration the individual site characteristics.

In almost all cases, the IPEs and IPEEEs are not and were not

intended to be full-scope PRAs. For example, a large number of

IPEEEs used the Fire Induced Vulnerability Evaluation (FIVE)
Methodology to search for potential fire vulnerabilities and the

Seismic Margins Methodology to search for seismic

vulnerabilities, neither of which gives a direct expression of

risk. Furthermore, shutdown risk was not a part of the

IPEs/IPEEEs. While most licensees performed some type of Level 2

containment analysis, the vast majority did not perform a Level 3

offsite consequences analysis.

The BNL study represents a good attempt to estimate the effects

of some of the missing elements in the IPEs/IPEEEs. This study

did not attempt to evaluate the risk resulting from seismic and

fire events, nor did it attempt to evaluate risk in the shutdown

mode.

Information is available that arguably would make it possible to

bound the effects on risk of elements missing from the

IPEs/IPEEEs and to develop an approximate comparison with the

safety goals. Such a bound would be of questionable value and

would have very large uncertainties. We do not recommend that

this be done.

The evidence from the BNL study, NUREG-1150, other PRAs, and

scoping studies of shutdown risk indicates that, on average, the

population of plants meets the safety goals. A definitive

determination of this, however, will only be possible when

acceptable, full-scope Level 3 PRAs are available for all the

plants. We believe that the required effort to develop such

comprehensive PRAs cannot be justified for the sole purpose of

comparison with the safety goals. Such PRAs, however, will be

needed in the long run to move toward a coherent risk-informed

regulatory system.

Sincerely,

/S/

T. S. Kress

Chairman, ACRS

REFERENCES:

1. Memorandum dated September 20, 1994, from John C. Hoyle,

Acting Secretary, NRC, to John T. Larkins, Executive

Director, ACRS, Subject: Staff Requirements - Periodic

Meeting with ACRS, Thursday, September 8, 1994

2. Richard Sherry, ACRS Senior Fellow, "A Simplified Approach

to Estimation of Seismic Core Damage Frequencies from a

Seismic Margins Methods Analysis"

3. U. S. Nuclear Regulatory Commission, NUREG-1150, "Severe

Accident Risks: An Assessment for Five U.S. Nuclear Power

Plants," Office of Nuclear Regulatory Research, December

1990
4. U. S. Nuclear Regulatory Commission, NUREG-XXXX, "Individual

Plant Examination Program: Perspectives on Reactor Safety

and Plant Performance," Draft for Comment dated April 1996

5. U.S. Nuclear Regulatory Commission, NUREG/CR-6144,

"Evaluation of Potential Severe Accidents During Low Power

and Shutdown Operations at Surry, Unit 1," Brookhaven

National Laboratory, July 1994

6. U. S. Nuclear Regulatory Commission, NUREG/CR-6143,

"Evaluation of Potential Severe Accidents During Low Power

and Shutdown Operations at Grand Gulf, Unit 1," Sandia

National Laboratories, March 1995
June 14, 1996

Mr. James M. Taylor

Executive Director for Operations

U.S. Nuclear Regulatory Commission

Washington, D.C. 20555-0001

Dear Mr. Taylor:

SUBJECT: PROPOSED RULE ON SHUTDOWN OPERATIONS

During the 431st meeting of the Advisory Committee on Reactor

Safeguards, May 23-25, 1996, we held discussions with

representatives of the NRC staff and the Nuclear Energy Institute

(NEI), concerning the subject proposed rule and the probabilistic

risk assessment (PRA) studies that were performed for the Surry

and the Grand Gulf Nuclear Power plants. Our Subcommittee on

Plant Operations met with the staff, NEI, and a utility

representative on May 21, 1996, to discuss these matters. We

also had the benefit of the documents referenced. We previously

commented on the staff effort to resolve the shutdown operations

issue in our letters dated August 13, 1991, April 9, 1992,

September 15, 1992, and May 13, 1994.

According to the staff, the proposed rule will contain

performance-based elements. Since the supporting regulatory

analysis and regulatory guide are still being developed, we

discussed only the proposed rule during our meeting. The staff

has held several public meetings with NEI to obtain industry

input on the formulation of this rule.

We made a number of comments on the risk basis for the rule. The

staff agreed to consider our comments as it finalizes the draft

rule, which it plans to publish for public comment in September

1996. We plan to provide comments on the proposed final rule

after the staff has reconciled the public comments.

The concern for risk associated with shutdown operations has

arisen from incidents that have occurred. Our quantitative

understanding of the risk posed by plants in low-power or

shutdown modes of operation is limited. Risk assessments for

shutdown operations were performed for Surry (a three-loop PWR

with loop isolation valves and a sub-atmospheric pressure

containment) and Grand Gulf (a BWR-6 with a Mark III

containment). Neither of these plants is a particularly good

surrogate for the entire population of PWRs and BWRs.
The studies of shutdown risk consisted of two phases. The first

phase was a deliberately conservative scoping analysis. The

second phase focused on a single, high-risk plant operational

state among the many that exist during shutdown operation. Such

an approach could lead to an incorrect assessment of risk (a

historical analogue is the selection of the large-break, loss-ofcoolant accident as a bounding event) or to the adoption of

operating practices that might increase risk.

The available evidence does suggest that shutdown operations can

make important contributions to the overall risk to the public

posed by nuclear power plants. On the eve of our entry into an

era of risk-informed rulemaking, there are no complete, reliable

assessments of risk during shutdown operations even for a few

representative plants. Certainly, there is nothing commensurate

with the NUREG-1150 study of risk during full-power operation.

The staff effort toward an interim solution by promulgating this

proposed rule is based on engineering judgment and will probably

lessen risk. A risk-informed understanding will require a

quantitative evaluation of risk during low-power and shutdown

operations. We therefore recommend that priority attention be

given to performing Level 3 PRAs for shutdown operations at the

NUREG-1150 plants with consideration of spent fuel pool risk and

uncertainty assessments.

Sincerely,

/s/

T. S. Kress

Chairman, ACRS

References:

1. Memorandum dated April 5, 1996, from Robert C. Jones, Office

of Nuclear Reactor Regulation, to John T. Larkins, ACRS,

Subject: Development of §50.67, "Shutdown Operation of

Nuclear Power Plants"

2. U. S. Nuclear Regulatory Commission, Prepared by Brookhaven

National Laboratory, NUREG/CR-6144, "Evaluation of Potential

Severe Accidents During Low Power and Shutdown Operations at

Surry, Unit 1," Summary of Results, October 1995

3. U. S. Nuclear Regulatory Commission, Prepared by Sandia

National Laboratories, NUREG/CR-6143, "Evaluation of

Potential Severe Accidents During Low Power and Shutdown

Operations at Grand Gulf, Unit 1," Summary of Results, July

1995

4. Nuclear Management and Resources Council, Inc., NUMARC 91-

06, "Guidelines for Industry Actions to Assess Shutdown

Management," December 1991
June 6, 1996

Mr. James M. Taylor

Executive Director for Operations

U.S. Nuclear Regulatory Commission

Washington, D.C. 20555-0001

Dear Mr. Taylor:

SUBJECT: REGULATORY GUIDANCE DOCUMENTS RELATED TO DIGITAL

INSTRUMENTATION AND CONTROL SYSTEMS

During the 429th and 431st meetings of the Advisory Committee on

Reactor Safeguards, March 7-9 and May 23-25, 1996, we reviewed

portions of the proposed Standard Review Plan (SRP), Branch

Technical Positions (BTPs), and Regulatory Guides related to

digital instrumentation and control (I&C) systems. We held

discussions with representatives of the NRC staff and its

contractor, the Lawrence Livermore National Laboratory (LLNL).

In addition, our Subcommittee on I&C Systems and Computers met

with the NRC staff and LLNL to discuss these documents on March 6

and May 22, 1996. We also had the benefit of the documents

referenced.

The staff requested ACRS to review the SRP Chapter 7 update in

the early stages of development to accommodate the schedule set

forth in the Digital I&C Task Action Plan. The staff expects to

complete development of the SRP Chapter 7 update and associated

guidance in September 1996, integrate the recommendations from

the National Academy of Sciences/National Research Council

(NAS/NRC) Phase 2 study report in October 1996, publish the Draft

SRP Chapter 7 and associated guidance for public comment in

December 1996, and issue the final SRP and related guidance in

May 1997.

The staff is revising the SRP, adding two new sections,

developing new BTPs, and preparing six regulatory guides that

endorse eight industry standards. The staff presented a safety

evaluation report (SER) on an Electric Power Research Institute

(EPRI) topical report for electromagnetic/radiofrequency

interference (EMI/RFI) design requirements and testing. A

planned BTP on commercial off-the-shelf (COTS) software may be

replaced by an SER on a topical report being developed by an EPRI

working group. We concur with the staff conclusions in the SER

associated with the EPRI topical report on EMI/RFI and encourage

the staff to complete an SER for the EPRI topical report on COTS.

Considering the fact that the staff is using generally accepted

U.S. software engineering practices, it appears that the staff
approach is appropriate to update the SRP and associated guidance

to codify the current regulatory framework for digital I&C. We

raised several issues (e.g., the linkage between SRP Chapter 7

and other SRP chapters, and graded approaches based on importance

to safety) that were subsequently clarified by the staff. The

staff agreed to document these clarifications.

We have raised other issues that include the level of detail

provided in the regulatory guides and the balance in the guidance

between the review of the design process and the assessment of

the product. We plan to report on these and other digital I&C

issues at a later date.

We plan to review the staff's remaining SRP sections, the BTPs,

and the SER on the EPRI topical report on COTS when they become

available.

Sincerely,

/S/

T. S. Kress

Chairman, ACRS

References:

1. U. S. Nuclear Regulatory Commission, Standard Review Plan,

Section 7.0, "Instrumentation and Controls Overview of

Review Process," Draft Version 3.0, February 12, 1996

2. U. S. Nuclear Regulatory Commission, Standard Review Plan,

Section 7.1, "Instrumentation and Controls Introduction,"

Draft Version 7.0, February 14, 1996

3. U. S. Nuclear Regulatory Commission, Standard Review Plan,

Section 7.2, "Reactor Trip System," Draft Version 6.0, April

17, 1996

4. U. S. Nuclear Regulatory Commission, Standard Review Plan,

Section 7.9, "Data Communications," Draft Version 4.1, April

18, 1996

5. U. S. Nuclear Regulatory Commission, (Proposed) Branch

Technical Position HICB-14: "Guidance on Software Reviews

for Digital Computer-Based Instrumentation and Control

Safety Systems," Version 9.0, February 14, 1996

6. U. S. Nuclear Regulatory Commission, (Proposed) Branch

Technical Position HICB-16: "Guidance on the Level of Detail

Required for Design Certification Applications Under 10 CFR

Part 52," Version 7.0, April 12, 1996
7. U. S. Nuclear Regulatory Commission, Draft Regulatory

Guides, transmitted by memorandum dated February 9, 1996,

from M. Wayne Hodges, Director, Office of Nuclear Regulatory

Research, NRC, to John T. Larkins, ACRS:

ˇ U. S. Nuclear Regulatory Commission, Draft Regulatory

Guide DG-XXXX, Version 2.7.2, "Verification,

Validation, Reviews, and Audits for Digital Computer

Software Used in Safety Systems of Nuclear Power

Plants"

ˇ U. S. Nuclear Regulatory Commission, Draft Regulatory

Guide DG-XXXX, Version 2.0.7, "Configuration Management

Plans for Digital Computer Software Used in Safety

Systems of Nuclear Power Plants"

8. U. S. Nuclear Regulatory Commission, Draft Regulatory

Guides, transmitted by memorandum dated April 26, 1996, from

M. Wayne Hodges, Director, Office of Nuclear Regulatory

Research, NRC, to John T. Larkins, ACRS:

ˇ Draft Regulatory Guide DG-XXXX, Version 2.0, "Software

Unit Testing for Digital Computer Software Used in

Safety Systems of Nuclear Power Plants"

ˇ Draft Regulatory Guide DG-XXXX, Version 2.0,

"Developing Software Life Cycle Processes for Digital

Computer Software Used in Safety Systems of Nuclear

Power Plants"

ˇ Draft Regulatory Guide DG-XXXX, Version 2.0, "Software

Requirements Specifications for Digital Computer

Software Used in Safety Systems of Nuclear Power

Plants"

ˇ Draft Regulatory Guide DG-XXXX, Version 2.0, "Software

Test Documentation for Digital Computer Software Used

in Safety Systems of Nuclear Power Plants"

9. Memorandum dated January 30, 1996, from F. Miraglia, Office

of Nuclear Reactor Regulation, NRC, to E. Jordan, Committee

to Review Generic Requirements, NRC, Subject: Request for

Endorsement of the Safety Evaluation Report on Electric

Power Research Institute Topical Report, TR-102323,

"Guidelines for Electromagnetic Interference Testing in

Power Plants"
June 3, 1996

Mr. James M. Taylor

Executive Director for Operations

U.S. Nuclear Regulatory Commission

Washington, D.C. 20555-0001

Dear Mr. Taylor:

SUBJECT: RESOLUTION OF THE MULTIPLE SYSTEM RESPONSES

PROGRAM ISSUES

During the 431st meeting of the Advisory Committee on Reactor

Safeguards, May 23-25, 1996, we completed our review of the

adequacy of the resolution of the Multiple System Responses

Program (MSRP) issues. During the 427th meeting, December 7-8,

1995, we heard presentations by and held discussions with

representatives of the NRC staff and an ACRS Senior Fellow

regarding this matter. We also had the benefit of the documents

referenced.

In the process of reviewing a number of Unresolved Safety Issues

(USIs) during the mid-1980s, the ACRS expressed concern that

treating each safety issue in isolation might not identify

significant system interactions. The ACRS also raised a number

of questions concerning system interactions that were not

addressed in the proposed resolution of certain USIs.

Subsequently, the staff established the MSRP in 1986 to address

ACRS concerns and other related issues.

The MSRP identified 21 potential generic issues. In August 1995,

the NRC staff issued a final report which concluded that none of

the MSRP issues posed new or separate safety concerns and that

these issues were being addressed under the scope of the existing

Generic Safety Issue (GSI) process, or in the programs of

Individual Plant Examinations (IPEs) and Individual Plant

Examination of External Events (IPEEEs).

The MSRP issues have been treated to a degree in the IPE/IPEEE

programs and in the GSI process. A review of a number of

IPE/IPEEE submittals, however, failed to identify satisfactory

resolution for some issues (e.g., the treatment of interactions

between nonsafety and safety systems, seismically induced

interactions, and hydrogen line ruptures). We also note that the

issues of nonsafety/safety systems interactions appear to be

better treated in the IPEEE submittals that were based on

probabilistic risk assessments than in those that were based on

Seismic Margins Methodology and Fire-Induced Vulnerability

Evaluation Methodology.
Incorporation of some MSRP issues into the IPE/IPEEE process may

have been expedient, but the staff failed to put into place a

mechanism to ensure that licensees had evaluated and resolved

these issues in an adequate manner. Additional staff review to

determine the adequacy of the resolution of these issues is,

therefore, warranted.

As stated in our report to the Commission, dated August 16, 1988,

we continue to emphasize that "systems interactions, some of

which may be adverse to safety, will continue to be revealed by

operating experience in existing plants. These should be

evaluated by the staff as they occur, and the lessons learned

incorporated into the requirements and practices of the agency."

Sincerely,

/s/

T. S. Kress

Chairman, ACRS

References:

1. U. S. Nuclear Regulatory Commission, NUREG/CR-5420,

"Multiple System Responses Program  Identification of

Concerns Related to a Number of Specific Regulatory Issues,"

Prepared by Oak Ridge National Laboratory, October 1989

2. Multiple System Responses Program  Final Report,

transmitted by memorandum dated August 2, 1995 from L. C.

Shao, Office of Nuclear Regulatory Research, to David L.

Morrison, Office of Nuclear Regulatory Research

3. Memorandum dated January 12, 1996, from August W.

Cronenberg, ACRS Senior Fellow, to ACRS Members and Staff,

Subject: Observations from Review of Multiple System

Responses Program (MSRP) Reports and Memoranda

4. U. S. Nuclear Regulatory Commission, NUREG-0933, "A

Prioritization of Generic Safety Issues," July 1991

5. Report dated August 16, 1988, from W. Kerr, ACRS Chairman,

to Lando W. Zech, Jr., NRC Chairman, Subject: Proposed

Resolution of USI A-17, "Systems Interactions in Nuclear

Power Plants"
June 5, 1996

Mr. James M. Taylor

Executive Director for Operations

U.S. Nuclear Regulatory Commission

Washington, D.C. 20555-0001

Dear Mr. Taylor:

SUBJECT: IMPLEMENTATION OF THE REGULATORY REVIEW GROUP

RECOMMENDATIONS

During the 431st meeting of the Advisory Committee on Reactor

Safeguards, May 23-25, 1996, we reviewed the status of the

implementation of the Regulatory Review Group recommendations.

During our review, we had the benefit of discussions with representatives of the NRC staff and the referenced document.

The Regulatory Review Group was established by you on January 4,

1993, to conduct a comprehensive and disciplined review of power

reactor regulations and related NRC procedures, programs, and

practices. In August 1993, the Regulatory Review Group issued

its final report containing recommendations to reduce the regulatory burden on licensees and to strengthen NRC administrative

practices. The staff submitted its plan for implementing these

recommendations in January 1994 and issued subsequent semiannual

status reports.

We believe that the effort by the Regulatory Review Group has

been successful. The Regulatory Review Group recommendations

have been implemented or assigned to appropriate NRC offices for

implementation. We would like to compliment the staff on its

success.

Sincerely,

/s/

T. S. Kress

Chairman, ACRS

Reference:

SECY-96-024, dated February 2, 1996, from James M. Taylor,

Executive Director for Operations, NRC, for the Commissioners,

Subject: Semiannual Status Report on the Implementation of

Regulatory Review Group Recommendations

#