June 2007

USNRC STANDARD REVIEW PLAN

This Standard Review Plan, NUREG-0800, has been prepared to establish criteria that the U.S. Nuclear Regulatory Commission 

staff responsible for the review of applications to construct and operate nuclear power plants intends to use in evaluating whether

an applicant/licensee meets the NRC's regulations. The Standard Review Plan is not a substitute for the NRC's regulations, and

compliance with it is not required. However, an applicant is required to identify differences between the design features, analytical techniques, and procedural measures proposed for its facility and the SRP acceptance criteria and evaluate how the proposed

alternatives to the SRP acceptance criteria provide an acceptable method of complying with the NRC regulations.

The standard review plan sections are numbered in accordance with corresponding sections in Regulatory Guide 1.70, "Standard

Format and Content of Safety Analysis Reports for Nuclear Power Plants (LWR Edition)." Not all sections of Regulatory Guide 1.70

have a corresponding review plan section. The SRP sections applicable to a combined license application for a new light-water

reactor (LWR) are based on Regulatory Guide 1.206, "Combined License Applications for Nuclear Power Plants (LWR Edition)."

These documents are made available to the public as part of the NRC's policy to inform the nuclear industry and the general public

of regulatory procedures and policies. Individual sections of NUREG-0800 will be revised periodically, as appropriate, to accommodate comments and to reflect new information and experience. Comments may be submitted electronically by email to

NRR_SRP@nrc.gov.

Requests for single copies of SRP sections (which may be reproduced) should be made to the U.S. Nuclear Regulatory

Commission, Washington, DC 20555, Attention: Reproduction and Distribution Services Section, or by fax to (301) 415-2289; or by email to DISTRIBUTION@nrc.gov. Electronic copies of this section are available through the NRC's public Web site at

http://www.nrc.gov/reading-rm/doc-collections/nuregs/staff/sr0800/, or in the NRC's Agencywide Documents Access and Management System (ADAMS), at http://www.nrc.gov/reading-rm/adams.html, under Accession # ML071700658.

NUREG-0800

 U.S. NUCLEAR REGULATORY COMMISSION

STANDARD REVIEW PLAN

19.2 REVIEW OF RISK INFORMATION USED TO SUPPORT PERMANENT PLANTSPECIFIC CHANGES TO THE LICENSING BASIS: GENERAL GUIDANCE

REVIEW RESPONSIBILITIES

Primary - The organization responsible for the review of the applicant’s probabilistic risk

assessment (PRA).

Secondary - The organization(s) responsible for the review of the applicant’s traditional

engineering analyses, systems, processes, and programs (e.g., Inservice

Inspection (ISI), Quality Assurance (QA), Technical Specifications (TS), Reactor

Systems, Balance of Plant Systems, Electrical Systems) affected by the

proposed plant-specific change.

I. AREAS OF REVIEW

Introduction

This section of the Standard Review Plan (SRP) identifies the roles and responsibilities of

organizations in the U.S. Nuclear Regulatory Commission (NRC) that participate in

risk-informed reviews of licensees’ proposals for changes to the licensing basis (LB) of nuclear

power plants. In this context, changes are modifications to a plant’s design, operations, or

other activities that require NRC approval. These modifications could include items such as

exemption requests under 10 CFR 50.11 and license amendments under 10 CFR 50.90. This

SRP section identifies the types of information that may be used in fulfilling an organization’s
19.2-2 June 2007

responsibilities and provides general guidance on how the information from a PRA can be

combined with other pertinent information in the process of making a regulatory decision. This

section was originally published as SRP Chapter 19.

The guidance in this document is a logical extension of current NRC policy on the use of PRA in

regulatory activities. This policy is documented in the Commission’s PRA policy statement and

implementation plan (60 FR 42622, SECY-95-280, and SECY-94-219). In developing this SRP

section, the staff considered the NRC’s guidance on the use of PRA in risk-informed regulatory

applications as documented in Regulatory Guide 1.174 as well as the relevant industry

guidance documented by the Electric Power Research Institute (EPRI) in its "Probabilistic

Safety Assessment (PSA) Applications Guide." In addition, this section references other SRP

sections that provide additional guidance for reviewing specific applications of PRA in regulated

activities.

The appendices to this SRP section provide more specific guidance. Included are Appendix A,

“Guidance for a Focused-Scope Application-Specific PRA Review”; Appendix B, “Integrated

Decisionmaking”; Appendix C, “Categorization of Plant Elements with Respect to Safety

Significance”; and Appendix D, “Use of Risk Information in Review of Non-Risk-Informed

License Amendment Requests.”

In the process of risk-informed decisionmaking, the NRC will rely on the approach discussed in

this SRP section. Above all, the design, construction, and operational practices of each plant

are expected to be consistent with its licensing basis (LB). In addition, the risk evaluations

performed to justify regulatory changes are expected to realistically reflect these plant-specific

design, construction, and operational practices. The PRA analyses should be as realistic as

practicable and, when interpreting the results of those analyses, the reviewers should account

for the impact of the most significant uncertainties. The results of these risk analyses will then

form part of the input to the decisionmaking process that evaluates the margin in plant

capability (in both performance and redundancy/diversity). Specifically, the decisionmaking

process will use the results of the risk analyses in a manner that complements traditional

engineering approaches, supports the defense-in-depth philosophy, and preserves safety

margins. Thus, risk analysis will inform, but it will not determine regulatory decisions.

The NRC's PRA Implementation Plan as proposed in Reference 3, now replaced by the RiskInformed Regulation Implementation Plan (SECY-00-0213), identifies a wide scope of

regulatory activities for which PRA provides valuable insights. This scope includes activities

that require NRC review and approval, as well as other activities that are considered internal to

the NRC and affect licensees and applicants in a less direct manner (e.g., generic issue

prioritization). This SRP section solely concerns licensing amendment requests submitted for

NRC review and approval for which PRA can play an effective role in the decisionmaking

process. General review guidance for applicable activities is presented in this SRP section. In

addition, application-specific SRP sections are available to provide additional guidance for

several activities including the following examples:

• Changes to allowed outage times (AOTs) and surveillance test intervals (STIs) in

plant-specific technical specifications (SRP section 16.1)

• Changes in the scope and frequency of tests on pumps and valves in a licensee's

inservice test (IST) program (SRP section 3.9.7)
19.2-3 June 2007

• Changes in the scope and frequency of inspections in a licensee's inservice inspection

(ISI) program (SRP section 3.9.8)

Regulatory Guide 1.174 defines an acceptable approach for use in analyzing and evaluating

proposed LB changes. This approach supports the staff's desire to base its decisions on the

results of traditional engineering evaluations, supported by insights (derived through the use of

PRA methods) on the risk significance of the proposed changes. The decisionmaking process

leading to the proposed change is expected to follow an integrated approach (considering

traditional engineering and risk information) and may build upon qualitative factors as well as

quantitative analyses and information.

As discussed later in this SRP section, the scope of the staff review of a risk-informed

application will depend on the specifics of the application. However, this scope should include

reviewing the four elements suggested in Regulatory Guide 1.174, Section 2. The areas of

review for each of these elements are summarized as follows:

• Element 1 - Define the Proposed Change: The objective of this element is to lay the

groundwork for evaluating the safety impacts of the proposed change. Therefore, one

area of review would be an evaluation of the proposed change in light of the LB (i.e.,

evaluation of the structures, systems, and components (SSCs), as well as the plant

procedures and activities that are affected by the proposed change and how these

SSCs, procedures, or activities relate to the LB). In addition, an evaluation of the

method of analysis and a study of available insights from traditional and probabilistic

engineering studies that are relevant to the proposed change would be necessary to

determine if the change can be supported.

• Element 2 - Conduct Engineering Evaluations: The licensees' decisionmaking process

should factor in the appropriate traditional and probabilistic engineering insights.

Reviewers should evaluate the proposed change to ensure that the defense-in-depth

philosophy and sufficient safety margins are maintained, and that the calculated change

in plant risk is within the guidelines specified in Regulatory Guide 1.174. Reviewers

should also verify that insights from the engineering evaluations used to justify a change

have been used to improve operational and engineering decisions where appropriate,

and not simply to eliminate requirements the licensee sees as undesirable.

• Element 3 - Develop Implementation and Monitoring Strategies: Results from

implementation and monitoring strategies can provide an early indication of

unanticipated degradation of performance of those plant elements affected by the

proposed change. These strategies are therefore important in applications where

uncertainty in evaluation models and/or data used to justify the change can change the

conclusions of the analysis. As such, the review scope should include provisions to

ensure that the licensee has proposed an implementation and monitoring process that is

adequate to (in part) account for uncertainties regarding plant performance under the

proposed change.

• Element 4 - Document Evaluations and Submit Request: Reviewers should ensure that

the submittal includes sufficient information to support conclusions regarding the 

acceptability of the proposed change, and that the archival documentation of the

evaluation process and findings is maintained and available for staff audit and review.
19.2-4 June 2007

Reviewers should also ensure that the licensee has requested the appropriate

regulatory action (for example, a license amendment, an exemption, or a change to

technical specifications). Where appropriate, reviewers should ensure that the submittal

has documented any licensee-proposed enhancements to regulatory requirements (e.g.,

high risk significant SSCs not currently subject to regulatory control may be subject to

requirements commensurate with their risk significance). Finally, reviewers should

ensure that LB changes are appropriately included in an updated safety analysis report,

as necessary.

Application-Specific Reviews: This SRP section is intended to provide guidance for reviewing

applications in risk-informed regulation where numerical values of risk indices play a relatively

large role in the decisionmaking process and where a broad set of scenarios and plant

operating modes may be affected. Where it is determined that an application could justify a

review that is less than the full scope described in this document, reviewers should choose the

relevant and applicable parts of this SRP section for guidance. The necessary sophistication of

the review of the PRA, its supporting analyses, and its results depend on the contribution the

risk assessment provides to the integrated decisionmaking. Application-specific SRP sections

(where available) provide additional guidance in this area.

II. ACCEPTANCE CRITERIA

This SRP section provides guidance for use in conducting staff reviews of PRA findings and

risk insights in support of licensees' requests for changes to the LB of nuclear power plants

(e.g., requests for license amendments under 10 CFR 50.90 and exemptions under

10 CFR 50.11). Regulatory Guide 1.174 sets forth guidance for licensees to use in

implementing acceptable methods for conducting PRA and traditional engineering analyses to

support such changes.

To evaluate licensee-initiated LB changes that are consistent with currently approved staff

positions (e.g., regulatory guides, standard review plans, or branch technical positions), the

staff normally uses traditional engineering analyses. Licensees generally would not be expected

to submit risk information in support of such proposed changes. However, circumstances may

arise in which new information reveals an unforeseen hazard or a substantially greater potential

for a known hazard to occur, even when all regulatory requirements are met. In such

situations, the NRC has the statutory authority to require licensee action above and beyond

existing regulations to maintain the level of protection necessary to avoid undue risk to public

health and safety. The use of risk information in the review of such license amendment

requests is addressed in Appendix D of this SRP section.

To evaluate licensee-initiated LB changes that go beyond current staff positions, the reviewers

may use traditional engineering analyses as well as the risk-informed approach set forth in this

SRP section. In such instances, licensees may be requested to submit supplemental risk

information or traditional engineering information if such information is not already included as

part of the original submittals. If risk information on the proposed LB changes is not provided,

the reviewers will determine if the application can be approved on the basis of the information

provided using traditional methods and will either approve or reject the application based upon

this information. For those licensee-initiated LB changes that a licensee chooses (or is

requested by the staff) to support with risk information, this SRP section describes the scope

and content of the staff’s review by considering engineering issues and applying risk insights.
19.2-5 June 2007

Licensees submitting risk information to support changes to their LB (whether on their own

initiative or at the request of the staff) should address each of the principles of risk-informed

regulation discussed in Regulatory Guide 1.174. The reviewers should then determine if the

licensees’ selected approaches and methods (whether quantitative or qualitative, and traditional

or probabilistic), data, and criteria for considering risk are appropriate for the decision to be

made.

For each risk-informed application, reviewers should ensure that the proposed changes meet

the following principles. (Subsections of this SRP section dealing with review guidance for each

principle are identified in brackets.)

1. The proposed change meets the current regulations unless it is explicitly related to a

requested exemption, i.e., a "specific exemption" under 10 CFR 50.12. [Subsection

III.2.1].

2. The proposed change is consistent with the defense-in-depth philosophy.

[Subsection III.2.1]

3. The proposed change maintains sufficient safety margins. [Subsection III.2.1]

4. When proposed changes result in an increase in core damage frequency or risk, the

increases should be small and consistent with the intent of the Commission’s Safety

Goal Policy Statement (60 FR 42622). [Subsections III.2.2 and III.2.3]

5. The impact of the proposed change should be monitored using performance

measurement strategies. [Subsection III.3]

In demonstrating adherence to the above principles, reviewers should ensure that licensees

address the following issues as part of their submittals:

• All safety impacts of the proposed change are evaluated in an integrated manner as part

of an overall risk management approach in which the licensee is using risk analysis to

improve operational and engineering decisions broadly by identifying and taking

advantage of opportunities to reduce risk, and not just to eliminate requirements the

licensee sees as desirable. For those cases when risk increases are proposed, the

benefits should be described and should be commensurate with the proposed risk

increases. The approach used to identify changes in requirements was used to identify

areas where requirements should be increased as well as where they could be reduced.

[Subsection III.2.3]

• The scope, level of detail, and quality of the engineering analyses (including traditional

and probabilistic analyses) conducted to justify the proposed LB change are appropriate

for the nature and scope of the change and are based on the as-built, as-operated, and

maintained plant, including reflecting operating experience at the plant.

[Subsection III.2.2]

• The plant-specific PRA supporting the licensee’s proposals has been subjected to

quality controls such as an independent peer review or certification. [Subsection III.2.2]
19.2-6 June 2007

• Appropriate consideration of uncertainty is given in analyses and interpretation of

findings, including using a program of monitoring, feedback, and corrective action to

address significant uncertainties. [Subsections III.2.2 and III.3]

• The use of core damage frequency (CDF) and large early release frequency (LERF) as

bases for probabilistic risk assessment guidelines is an acceptable approach to

addressing Principle 4. Use of the Commission's Safety Goal quantitative health

objectives (QHOs) in lieu of LERF is acceptable in principle and licensees may propose

their use. However, in practice, implementing such an approach would require an

extension to a Level 3 PRA, in which case the methods and assumptions used in the

Level 3 analysis, and associated uncertainties, would require additional attention.

[Subsection III.2.2]

• Increases in estimated CDF and LERF resulting from proposed LB changes will be

limited to small increments. The cumulative effect of such changes should be tracked

and considered in the decision process. [Subsection III.2.2]

• The acceptability of the proposed changes should be evaluated by the licensee in an

integrated fashion that ensures that all principles are met. [Subsection III.2.3]

• Data, methods, and assessment criteria used to support regulatory decisionmaking

must be well documented and available for public review. [Subsection III.4]

III. REVIEW PROCEDURES

For risk-informed applications, reviewers should ensure that licensees’ submittals meet the

principles specified in Subsection II of this SRP section and address the expectations for

risk-informed decisionmaking (also specified in Subsection II). This section provides guidance

to assist reviewers in making this determination. For consistency, Subsections III.1 through

III.4 of this SRP section present this guidance in terms of the four elements of the approach

described in Regulatory Guide 1.174, Section 2.

III.1 Element 1: Define the Proposed Change

In this element, reviewers should verify that the submittal provides enough information to meet

the staff’s expectation that all potential safety impacts have been identified and evaluated. In

addition, reviewers should be satisfied that, where appropriate, the licensee has identified

design and operational aspects of the plant related to the change request that should be

enhanced consistent with an improved understanding of their safety significance based on the

methodology used to support the proposed relaxation in regulation. These enhancements

should be appropriately reflected in changes to the plant’s LB (e.g., technical specification,

license conditions, and Final Safety Analysis Report (FSAR).

Reviewers must also assess the proposed changes as they relate to the plant’s LB, which

specifies how the licensee satisfies certain basic regulatory requirements such as diversity,

redundancy, defense-in-depth, and the General Design Criteria. This assessment should

include reviewing the engineering (or other pertinent) analysis and data that identify the safety

margins and plant design and/or activities conducted to preserve those margins. If exemptions

from regulations or other forms of relief are needed to implement the licensee’s proposed
19.2-7 June 2007

change, reviewers should ensure that the appropriate requests accompany the licensee’s

submittal.

Reviewers should also verify that the licensee has identified and appropriately used available

information reflecting traditional engineering concepts and principles. The non-PRA sources of

information that should be examined to support the evaluation of safety significance include the

safety insights developed in licensing documents such as the FSAR, as well as the bases for

the plant’s Technical Specifications, which may include AOTs, limiting conditions for operation

(LCOs), and surveillance requirements (SRs).

Where available, plant-specific data and operational information should be factored into the

definition of the proposed change. Reviewers should consider the way in which the issues at

hand are reflected in operational data. Useful insights from plant-specific operating experience

can also be obtained from inspections that follow incidents at the facility, including incident

investigation and augmented team inspections conducted by the NRC, incident assessments

documented in significant operating event reports prepared by the Institute of Nuclear Power

Operations (INPO), licensee follow-up investigations, and routine inspections by NRC resident

inspectors. Inspection results can provide valuable qualitative insights in such areas as human

performance, management controls, adequacy of procedures, and root causes of events, which

are often difficult to treat with precision in a PRA.

Finally, as part of the initial review of the licensing amendment, reviewers should determine if

the submittal adequately characterizes the impact of the proposed change (specifically, if the

submittal identifies all SSCs or other plant elements affected by the proposed change) and if

the analyses performed and submitted by the licensees have the scope and depth to

adequately characterize the impact of the change.

Licensees may submit proposals that include several individual LB changes that have been

evaluated and will be implemented in an integrated fashion. For example, individual changes

may be grouped together for convenience (ease of implementation and/or review), or changes

may be combined as risk tradeoffs (balancing risk increases with risk decreases). Changes

grouped in this way should normally be related, for example by affecting the same single

system or activity, the same safety function, or the same accident sequence group, or by being

of the same type (e.g., changes in AOT). However, this does not preclude unrelated changes

from being accepted. When combined change requests are submitted, the reviewers should

conduct a detailed assessment of the relationship between the individual changes and how they

have been modeled in the risk assessment. Reviewers should evaluate the acceptability of the

individual changes and the overall impact of the combined changes with respect to the

principles and expectations discussed in Subsection II of this SRP section. Subsection III.2.3

discusses the review of combined change requests in more detail.

III.2 Element 2: Conduct Engineering Evaluations

In order to make findings regarding the acceptability of a proposed license amendment, the

reviewers should use an integrated assessment of traditional engineering evaluations and

probabilistic information. Regulatory Guide 1.174, Section 2.2 describes the specific

evaluations that the licensee is expected to perform. The scope and quality of the engineering

analyses conducted to justify a proposed change should be appropriate for the nature and
19.2-8 June 2007

scope of that change. Regulatory Guide 1.174, Section 3 describes the various types of

traditional engineering and probabilistic information that should be included in submittals.

The results of this element should be reviewed to determine if the submittal satisfies the

following principles for risk-informed decisionmaking: the proposed change meets current

regulations (unless the change is explicitly related to a requested exemption or rule change);

the defense-in-depth philosophy is maintained; sufficient safety margins are maintained; and

proposed increases in core damage frequency and/or risk (if any) are small and are consistent

with the intent of the Commission’s Safety Goal Policy Statement (51 FR 28044).

III.2.1 Evaluation of Defense-in-Depth Attributes and Safety Margins

Reviewers should assess the licensee’s engineering evaluations to confirm that the principles

identified in Subsection II of this SRP section are not compromised. These evaluations should

include not only the traditional design basis accident (DBA) analyses, but also evaluations of

the defense-in-depth attributes of the plant, safety margins, and risk assessments performed to

obtain risk insights and to quantify the impact of the proposed change.

III.2.1.1 Defense in Depth

Defense in depth is defined as a philosophy that ensures that successive measures are

incorporated into the design and operating practices for nuclear plants to compensate for

potential failures in protection and safety measures. In risk-informed regulation, the intent is to

ensure that the defense-in-depth philosophy is maintained, not to prevent changes in the way

defense in depth is achieved. The defense-in-depth philosophy has been and continues to be

an effective way to account for uncertainties in equipment and human performance. In some

cases, risk analysis can help quantify the range of uncertainty; however, there will likely remain

areas of large uncertainty or areas not covered by the risk analysis. Where a comprehensive

risk analysis can be performed, it can help determine the approximate extent of defense in

depth (e.g., balance among core damage prevention, containment failure, and consequence

mitigation) to ensure protection of public health and safety. However, because PRAs do not

reflect all aspects of defense-in-depth, appropriate traditional defense-in-depth considerations

should also be used to account for uncertainties.

III.2.1.1.1 Preservation of Multiple Barriers for Radioactivity Release

Defense in depth can be evaluated on the basis of considerations involving the barriers that

prevent or mitigate radioactivity release. Release of radioactive materials from the reactor to

the environment is prevented by a succession of passive barriers, including the fuel cladding,

reactor coolant pressure boundary, and containment structure. These barriers, together with an

imposed exclusion area and emergency preparedness, are the essential elements for accident

consequence mitigation. Given these multiple barriers, safety is ensured through the

application of deterministic safety criteria for the performance of each barrier and through the

design and operation of systems to support the functional performance of each barrier.

In maintaining consistency with the defense-in-depth philosophy, the proposed license

amendment should not result in any substantial change in the effectiveness of the barriers.

Consequently, reviewers should consider the following objectives to ensure that the proposed

change maintains appropriate safety within the defense-in-depth philosophy:
19.2-9 June 2007

• The change does not result in a significant increase in the existing challenges to the

integrity of the barriers.

• The proposal does not significantly change the failure probability of any individual

barrier.

• The proposal does not introduce new or additional failure dependencies among barriers

that significantly increase the likelihood of failure compared to the existing conditions.

• The overall redundancy and diversity among the barriers is sufficient to ensure

compatibility with the risk acceptance guidelines.

In evaluating whether a proposed change request fulfills the objectives listed above, the

reviewers should establish that the proposed change will meet the following guidelines:

• A reasonable balance is preserved among prevention of core damage, prevention of

containment failure, and mitigation of consequences.

• The proposal avoids over-reliance on programmatic activities to compensate for

weaknesses in plant design.

• The proposed change preserves system redundancy, independence, and diversity

commensurate with the expected frequency of challenges, consequences of failure of

the system, and associated uncertainties.

• The proposal preserves defenses against potential common cause failures and

assesses the potential introduction of new common cause failure mechanisms.

• The proposed change does not degrade the independence of barriers.

• The proposed change preserves defenses against human errors.

• The proposal fulfills the intent of the General Design Criteria of 10 CFR Part 50,

Appendix A.

Reviewers can assess fulfillment of the above guidelines by using qualitative or traditional

engineering arguments or by using PRA results contained in the accident sequences or cutsets.

III.2.1.1.2 Role of PRA in Review of Defense in Depth

In addition to the usual quantitative risk indices, PRAs provide important qualitative results,

namely, the contributors to accident sequences. For PRAs that use the fault tree linking

approach, these contributors are described by the accident sequence minimal cutsets. Each

accident sequence minimal cutset is a combination of passive and active SSC failures and

human errors that would cause core damage or a release of radioactivity. The cutsets

therefore directly show one particular aspect of defense in depth, in that they reveal how many

failures must occur in order for core damage or radiological release to occur. Thus, the minimal

cutsets show the effective redundancy and diversity of the plant design. For analysis

approaches that use event trees with boundary conditions, the results take the form of accident
19.2-10 June 2007

sequence descriptions and typically include elements representing unavailabilities of systems

(or trains of systems) rather than components. However, in most cases, cutsets providing a

component level decomposition of the system (or train) unavailabilities are provided, and an

equivalence to the minimal cutset description can be established if necessary.

In most cases, events that appear in each minimal cutset are targeted by programmatic

activities to ensure the reliability of the associated SSC. Specific activities that are important to

maintain the reliability of a component include IST, ISI, periodic surveillance required by

Technical Specifications, quality assurance, and maintenance. Therefore, when a review of the

minimal cutsets reveals areas where redundancy or diversity are already marginal, it would

arguably be inappropriate to reduce the level of activities aimed at ensuring SSC performance.

(The exception would arise if the licensee can show that the activities have little or no effect on

SSC performance, or if it can be shown that uncertainties in the performance of the elements in

this cutset are well understood and quantified. It is also possible that the licensee could

propose compensating or alternative activities to provide assurance of SSC performance.) The

objective of this review is to avoid completely relaxing the defense-in-depth posture at points at

which the plant design has the least overall functional independence, redundancy, and/or

diversity. On the other hand, in areas where a plant has substantial redundancy and diversity,

defense-in-depth arguments used to justify relaxations should be given appropriate weight.

As part of the defense-in-depth evaluation, reviewers should consider the effects of multiple

component failures and common cause failures that could result from the proposed change. 

For example, if the licensee proposes to reduce the requirements for all events in a cutset,

reviewers should ensure that the effect of the change is properly modeled and that the change

does not have an adverse effect on defense in depth.

Finally, in assessing the accident sequence cutsets, reviewers should devote attention to

potential over-reliance on programmatic activities or operator actions that compensate for

weaknesses in the plant design. For example, proposed maintenance and surveillance

activities should complement and not replace proper plant design.

III.2.1.2 Safety Margins

In the determination of the design performance characteristics of a system, safety margin

represents an allowance for uncertainty in SSC performance. Current safety analysis practices

incorporate consideration of margin in most areas. As examples, many engineering standards,

licensing analyses, and technical specifications take margin into account.

Incorporating margin can result in over-designing of components, incorporation of extra

systems or system trains, or in conservative operating requirements for systems and

components. Therefore, some licensee applications will seek to reduce this margin in some

areas. Such reductions should appropriately reflect the current understanding of existing

uncertainties and the potential impact of the proposed change. Therefore, in evaluating a

proposed change request, reviewers should establish that the proposal fulfills the following

guidelines:

• The proposal meets established engineering codes and standards or NRC-approved

alternatives, or deviations are justified.
19.2-11 June 2007

• The proposal meets the safety analysis acceptance criteria in the LB, or proposed

revisions provide sufficient margin to account for uncertainty in the analysis and data.

Clearly, these guidelines are closely related to the guidance provided in Subsection III.2.1.3 of

this SRP section regarding the need to maintain the LB. The thrust of the guidance in this

subsection is to sensitize reviewers to the implications of relaxing the margin when evaluating

the acceptability of changes to the LB.

The level of justification required for changes in margin should depend on how much

uncertainty is associated with the performance parameter in question, the availability of

alternatives to compensate for adverse performance, and the consequences of functional

failure of the affected elements. Therefore, the results derived from risk evaluations and the

associated analysis of uncertainties (especially in the analysis areas and models affected by the

application) will provide useful information to help in the reviewers’ decisionmaking. As an

example, in evaluating available safety margins, reviewers should consider the risk profile of the

plant. If a proposed LB change creates or exacerbates a situation where risk is dominated by a

few elements (SSCs or human actions) or a few accident sequences, the reviewers should

carefully evaluate the modeling of these elements or sequences including the modeling of

uncertainties. Reviewers should consider the results from the analysis of uncertainty when

determining the acceptability of the reduction in margin from the proposed change.

In demonstrating available safety margins, licensees will in some cases support their proposal

by citing new data from plant tests or research projects, or they will conduct analyses using

models that are predicated on new data. The following examples illustrate situations in which

data and analyses can be used effectively to support the LB change request.

• It is shown that a phenomenon of concern cannot occur or is less likely to occur than

originally thought.

• It is shown that the amount of safety margin in the design is significantly greater than

that which was assumed when the requirement or position was imposed.

• It is shown that time available for operator actions is greater than originally assumed.

The reviewers' primary objective is to verify the relevance and acceptability of the new

information with respect to the requested LB change. Data that directly apply to the original

technical concern should be considered in the decision process. Depending on the

circumstances, the cognizant review branch may have additional specific guidance available for

use in reviewing the quality and acceptability of the data. However, the data or analyses must

be clearly applicable to the plant and specific circumstances in which they are being applied.

III.2.1.3 Current Regulations

Reviewers should ensure that the proposed change satisfies current regulations (including the

General Design Criteria), unless the licensee explicitly includes a proposed exemption (i.e., a

"specific exemption" as allowed by 10 CFR 50.12).

The LB also applies until the staff approves modifications to the existing basis. It is expected

that some applications will seek to modify the LB in risk-informed submittals. Applications that
19.2-12 June 2007

seek to make qualitative changes to the LB (such as moving components out of the scope of a

required program) should be reviewed in greater detail with respect to defense in depth and

safety margins when compared to applications that seek to make parametric changes (such as

incremental changes to surveillance interval).

III.2.2 Risk Assessment

For effective implementation of risk-informed regulatory approaches, reviewers should ensure

that the licensee has demonstrated that the plant’s design and actual operating conditions and

practices are properly reflected in the risk insights derived using the plant-specific PRA model.

Otherwise, the risk assessment may provide inaccurate or misleading information that will

require careful scrutiny before use in any regulatory decisionmaking process.

Development of a plant-specific, risk-informed program also requires the availability of

information to identify the SSCs and human actions that contribute most significantly to the

plant’s estimated risk. In addition, it is necessary to be able to capture the impact of the

proposed change on the elements of the PRA. Subsection III.2.2.1 of this SRP section 

discusses the characterization of the proposed change in terms of PRA model elements. The

results of this determination of the cause-effect relationships between the proposed application

and the PRA models will help define the scope and level of detail required for the PRA to

support the application. Subsections III.2.2.2 and III.2.2.3 of this SRP section discuss these

topics.

Many applications, such as those involving changes in component test intervals, allow explicit

PRA modeling of the impact of the proposed change and quantification of the expected change

in risk using plausible models of the impact on SSC unavailability to the extent that the affected

components are included in the plant’s PRA. For other risk-informed applications, however, it

may not be feasible to explicitly model the cause-and-effect relationship because the resulting

actual impact on component unavailability is not clearly understood. For such applications, the

use of risk categorization techniques provides a useful way to identify groups of SSCs that are

less risk-important to risk and, as such, are possible candidates for a graded approach to

regulatory requirements. Using such a categorization approach, however, it is still necessary to

understand the potential or bounding impact of the proposed change and to assess the risk

impact through appropriate sensitivity studies. In either the detailed quantification approach or

the risk categorization approach, risk results should be derived from analyses of appropriate

quality. Subsection III.2.2.4 and Appendix A to this SRP section present guidelines to help

reviewers evaluate PRA quality as a function of the application. Finally, Appendix C to this SRP

section discusses review issues related to the determination of risk contribution and component

categorization.

III.2.2.1 Characterization of Change in Terms of PRA Model Elements

Where quantitative PRA results are used as part of a risk-informed evaluation of a proposed

change, the licensee should define the change in terms that are compatible with the risk

analysis, i.e., the risk analysis should be able to effectively evaluate the effects of the change.

The approach to risk characterization should establish a cause-effect relationship to identify

portions of the PRA affected by the issue being evaluated. This includes (1) identifying the

specific PRA contributors for the particular application, (2) assessing the portions of the model

that should be modified for the application, and (3) identifying supplemental analyses that could
19.2-13 June 2007

be used to support the application. This approach will help reviewers determine the scope and

level of detail of analysis required for the remaining steps in the change process.

Table III-1 of this SRP section summarizes the general guidance for use in identifying elements

of the PRA model that may be affected by an application. This guidance, presented as a list of

questions, will assist reviewers in establishing a cause-effect relationship between the

application and the PRA model. The answers to these questions should be used to identify the

extent to which the proposed change affects the design, operation, and maintenance of plant

SSCs.

Reviewers should also verify that the effects of the proposed changes on plant elements

(SSCs, operator actions, etc.) are adequately characterized in the elements of the PRA model

or by appropriate changes to the logic model structure. For full-scale applications of the PRA,

for example, this should be reflected in a quantification of the impact on the PRA results. For

applications like component categorization, however, sensitivity studies on the effects of the

change may be sufficient. Similarly, for other applications, it may be adequate to define the

qualitative relationship of the impact on the PRA elements, or it may simply be necessary to

identify which elements are impacted.

The review procedure for this element is therefore intended to verify that the submittal

appropriately accounts for the effects of the changes on SSC reliability and unavailability or on

operator actions. Where applicable, reviewers should also evaluate the modeling and

quantification of the effects of the change to ensure that the models are appropriate and that

the results can be supported by plant and/or industry data.

III.2.2.2 Scope of Analysis

The necessary scope of a PRA supporting risk-informed requests will depend on the specific

application. Although the assessment of risk implications (in light of the acceptance guidelines

defined in Regulatory Guide 1.174) requires that all plant operating modes and initiating events

be addressed, it is not necessary in risk-informed regulation that licensees submit PRAs that

treat all plant operating modes and all initiating events. Instead, when full-scope PRAs are not

available, reviewers should ensure that the submitted findings are supportable on the basis of

traditional engineering analyses or other plant operational information that addresses modes an

initiators not analyzed in the base PRA.

For plant modes and initiators not analyzed in the PRA (such as shutdown, seismic events, fire,

floods and severe weather), the licensee should consider the effects of the change and provide

the rationale for why additional PRA analyses are not necessary. This rationale could be

addressed by assessing the level of redundancy and diversity provided by the plant systems,

system trains, human actions, etc., for responding to these unanalyzed initiating events. The

licensee should also show that the proposed change does not introduce unanalyzed

vulnerabilities and that redundancy and diversity will still exist in the plant response capability

after the changes are implemented. This issue is addressed acceptably if the proposal fulfills

any one of the following criteria:

• The licensee addresses all modes and all initiator types using PRA.
19.2-14 June 2007

• The licensee demonstrates that the application does not unacceptably degrade plant

capability and does not introduce risk vulnerabilities or remove elements of the plant

response capability from programmatic activities aimed at ensuring satisfactory safety

performance for plant modes and initiator types not included in the PRA.

• If the proposed change impacts unanalyzed plant modes or initiator types, the licensee

demonstrates that a bounding analysis of the change in plant risk from the application

(e.g., by qualitative arguments, or by use of sensitivity studies) meets guidelines that are

equivalent to the acceptance guidelines specified in Regulatory Guide 1.174, Section

2.2.4.

III.2.2.3 Level of Detail

The level of detail in a PRA required to support an application should be such that the proposed

changes to the plant can be adequately characterized in the PRA model elements, as

discussed in Subsection III.2.2.1 of this SRP section. In addition, the PRA should be detailed

enough to account for important system and operator dependencies (functional, operational,

and procedural), especially for those components affected by the application. A review of the

licensee's failure modes and effects analysis and a review of plant operating and emergency

procedures will be useful for this purpose.

The usefulness of PRA results in risk-informed regulation is dependent on the level of

resolution of the modeled SSCs. A component-level resolution provides insights at the

component level. However, if a PRA is performed at a system or train level, the insights of the

PRA will be limited to that level unless it can be demonstrated that component-level insights can

be bounded by, or deduced from, system- or train-level effects. The direct application of PRA

results will therefore be limited to those SSCs that are explicitly modeled as part of the PRA

basic events. Insights for SSCs that are implicitly modeled (e.g., screened out, assumed not

important) are only to be used after additional consideration of the effects of the proposed

change on PRA assumptions, screening analyses, and boundary conditions.

Specifically, the following relationships exist between the level of detail in the modeling of each

SSC and the conclusions that can be drawn from the PRA:

• If the SSCs are modeled at the basic event level, i.e., each SSC is represented by a

basic event (or sometimes, more than one if different failure modes are modeled), risk

insights from the PRA can be applied directly to the modeled component as long as the

effects of the change are appropriately considered.

• If the SSCs are included within the boundaries of other components (e.g., the governor

and throttle valves being included in the pump boundary), or if they are included in

"black boxes" or modules within the PRA model, or if they are modeled as part of the

calculation of human error probabilities (HEPs) in recovery actions, risk insights from the

PRA can be applied if the effects of the application can be mapped onto the events

(e.g., modules, HEPs) in question. In these cases it should be noted that the mapping

is relatively simple if the event is under the same "OR gate" with the other module or

HEP events. However, if the logic involves "AND gates," the mapping is more

complicated.
19.2-15 June 2007

• If the SSCs are omitted from the model because of inherent reliability, or if they are not

modeled at all, risk insights for these components should be obtained through an

integrated decisionmaking process (such as an Expert Panel) that revisits the

assumptions or screening criteria used to support the initial omission.

III.2.2.4 Quality of a PRA for Use in Risk-Informed Regulation

The baseline risk profile is used to model the plant's licensing basis and operating practices that

are important to safe operation. As such, the profile may provide insights into areas in which

existing requirements can be relaxed without unacceptable safety consequences. It is therefore

essential that the PRA adequately represent the risk profile. To complement this requirement, it

is necessary to identify those elements of the plant that are responsible for reducing the risk to

acceptable levels and to adequately address those elements in the licensee's programmatic

activities. Therefore, the following criteria should be satisfied in risk-informed regulation.

• A reasonable assurance exists with regard to the adequacy of the PRA. That is, the

PRA model properly reflects the actual design, construction, operating practices, and

operating experience of the plant and its owner. This should include plant changes

arising from the licensee's voluntary actions, regulatory requirements, or previous

changes made to the LB. 

• The results and conclusions are "robust" and, where appropriate, the licensee has

conducted an analysis of uncertainties and sensitivities to show this robustness.

• Key performance elements are appropriately classified, and performance is backed up

by licensee actions. PRA results are dependent on plant activities. They reflect not only

inherent device characteristics, but also numerous programmatic activities, such as IST,

ISI, quality assurance, or maintenance. Use of a PRA to justify relaxation of a

requirement should therefore imply a commitment to the important programmatic

activities that are needed to maintain performance at the PRA-credited levels that

served as the basis for the proposed relaxation.

III.2.2.4.1 Review of the PRA Quality Required for an Application

The submittal must demonstrate that the licensee’s technical analysis is of an appropriate

quality. The required PRA quality should be commensurate with the application for which it is

applied and the role the PRA results play in the integrated decisionmaking process. The more

emphasis that is placed on the risk insights and PRA results in the decisionmaking process, the

more requirements have to be placed on the PRA in terms of how well the licensee assesses

the risk and/or the change in risk. Emphasis on the PRA review may be reduced if a proposed

change to the LB decreases the risk or is risk neutral, or if proposed risk increases are

calculated to be very small, or if the decision could be based largely on traditional engineering

arguments, or if the licensee proposes compensating measures and/or qualitative factors (such

as unquantified benefits) such that it can be convincingly argued that the change improves

safety or the risk increase is very small.

One way for a licensee to demonstrate reasonable assurance of PRA technical adequacy in

their base PRA model is by implementing RG 1.200 for those aspects of the PRA for which the

NRC has endorsed PRA standards. When licensees use RG 1.200 in support of an
19.2-16 June 2007

application, it should obviate the need for an in-depth review of the base PRA by NRC

reviewers for those PRA aspects addressed, allowing the staff to focus their review on the

application-specific impacts, key assumptions, and areas identified by peer reviewers and 

self-assessments as being of concern that are relevant to the application. Aspects of the

licensee’s PRA for which there are not endorsed PRA standards may require more in-depth

staff review, commensurate with their potential impacts on the PRA results. Guidance for the

staff review of the technical adequacy of the licensee’s base PRA is provided in SRP Section

19.1, with implementation guidance provided in Regulatory Issue Summary (RIS) 2007-06,

“Regulatory Guide 1.200 Implementation.” 

In assessing the acceptability of a PRA for an application, reviewers should evaluate the

licensee's process to ensure quality. In addition, reviewers should reach specific findings

regarding the quality of the PRA for each application. At a minimum, reviewers should reach

these findings on the basis of a "focused-scope" evaluation that concentrates on

application-specific attributes of the PRA and on the assumptions and elements of the PRA

model that drive the results and conclusions. Appendix A to this SRP section provides more

detailed guidance regarding several issues that are important to the application-specific reviews

of probabilistic evaluations performed as part of risk-informed regulation.

The robustness of the results can be determined by developing an understanding of the

contributors and the sources of uncertainty that impact the results. For the proposed risk

change, reviewers should identify the elements that increase risk and those that decrease risk,

and then identify the contributors to both the risk increase and decrease. A review of the basic

events, assumptions, and uncertainties involved in the increase and decrease in risk will help

reviewers understand the elements that are important in determining the risk change, and thus

ensure that the conclusions are robust with respect to the results obtained.

In addition to the focused-scope review, reviewers should consider the following factors in

determining the need for a more detailed and larger scope staff review of the PRA:

• The PRA results play a relatively significant role in the decisionmaking process, coupled

with the finding that the proposed change in risk and/or the baseline risk is close to the

decision guidelines as defined in Section 2.2.4 of Regulatory Guide 1.174.

• Staff audits of the licensee's process for conducting a PRA have identified practices that

could detrimentally affect the quality of the technical analysis.

• Results of the licensee's analysis submitted in support of a licensing action are in some

way counter-intuitive or inconsistent with results for similar plants on similar issues.

• The licensee's analysis is part of a pilot application of PRA in a regulatory activity.

• The PRA includes new methods that are unfamiliar to the staff.

The staff review should take into account the process used in a peer review (including the

review guidelines or standards to which the PRA is compared, the review scope and elements,

the qualification and makeup of the review team, etc.). Results from previous staff reviews of

the PRA (e.g., from previous applications) could also provide a good starting point. In cases

where the PRA is based on the individual plant examination (IPE) or the IPE of externally
19.2-17 June 2007

initiated events (IPEEE) models, reviewers should also be familiar with the request for

additional information (RAI) issued by the staff in connection with those examinations, as well

as the licensee’s responses to those RAIs, and the staff evaluation reports regarding the

licensee’s IPE and IPEEE submittals.

Reviewers could reach a finding that previous industry reviews, with or without licensee self

assessments, or staff reviews are sufficient to show that the PRA is of adequate quality in one

or more of the review areas for the present application. In such cases, the scope of the review

should be adjusted accordingly. However, reviewers should be aware of potential

application-specific differences and of the currency of the previous review findings with respect

to the current plant design and operating procedures. 

It should be noted that the NRC has not developed its own formal standards. However, the

NRC continues to support ongoing initiatives to develop such standards and endorses

standards that are suitable for regulatory decisionmaking in Regulatory Guide 1.200. 

III.2.2.4.2 Quality Assurance Requirements Related to the PRA

To the extent that a licensee elects to use PRA as an element to enhance or modify its

implementation of activities affecting the safety-related functions of SSCs, appropriate quality

requirements will also apply to the PRA. In this context, therefore, a licensee would be

expected to control PRA activity in a manner commensurate with its impact on the facility’s

design and licensing basis. Regulatory Guide 1.174, Section 2.5 describes the quality elements

that apply to the licensee’s PRA activities. Reviewers should verify that the quality of analyses

and performance programs that affect safety-related equipment and activities will meet the

quality guidelines described in Regulatory Guide 1.174.

III.2.2.5 Evaluation of Risk Impact

In evaluating the risk impact from an application, reviewers should consider the proposed

change in risk with regard to the acceptance guidelines, the cumulative and synergistic effects

of the application on the overall plant risk profile, and the licensee’s risk management

philosophy. Each of these items is discussed in the following subsections.

III.2.2.5.1 Acceptance Guidelines for Risk Impact from the Application

For many risk-informed applications, the licensee is expected to perform a quantitative estimate

of the total impact of a proposed action to demonstrate that Principle 4 (see Subsection II of

this SRP section) has been satisfied. Regulatory Guide 1.174, Section 2.2.4 discusses the

acceptance guidelines for changes to the plant’s risk. To summarize, regions are established in

the two planes generated by a measure of the baseline risk metrics (CDF and LERF) along the

x-axis, and the change in those metrics (CDF and LERF) along the y-axis (Figures III-1 and

III-2), and acceptance guidelines are established for each region as discussed below. These

guidelines are intended for comparison with a full-scope assessment (including internal events,

external events, and events that take place under full power, low power and shutdown

conditions). However, reviewers should recognize that many PRAs are not full-scope

assessments and the use of less than full-scope PRA information may be acceptable as

discussed later.
19.2-18 June 2007

There are two acceptance guidelines, one for CDF and one for LERF, and both should be used.

The guidelines for CDF are as follows:

• If the application can clearly be shown to decrease CDF, the change is considered to

satisfy the relevant principle of risk-informed regulation with respect to CDF. (Because

Figure III-1 is drawn on a log scale, it does not explicitly indicate this region.)

• When the calculated increase in CDF is very small (less than 1 x 10-6 per reactor year),

the change should be considered regardless of whether there is an assessment of total

CDF (Region III). While there is no requirement for the licensee to quantitatively assess

the total CDF, information should be provided to show that there is no indication that the

total CDF could considerably exceed 1 x 10-4 per reactor year. Such an indication could

result, for example if the contribution to CDF calculated from a limited-scope analysis

(such as that from the IPE or the IPEEE) significantly exceeds 1 x 10-4 per reactor year,

if the licensee has identified a potential vulnerability from a margins-type analysis, or if

plant operating experience has indicated a potential safety concern.

• When the calculated increase in CDF is in the range of 1 x 10-6 to 1 x 10-5 per reactor

year, applications should be considered only if the licensee can reasonably show that

the total CDF is less than 1 x 10-4 per reactor year (Region II).

• Applications that increase CDF by more than 1 x 10-5 per reactor year (Region I) should

not normally be considered.

The CDF-related guidelines listed above are to be applied together with the guidelines for

LERF. That is, both sets of guidelines should be satisfied. Specifically, the guidelines for LERF

are as follows:

• If the application can clearly be shown to decrease LERF, the change is considered to

satisfy the relevant principle of risk-informed regulation with respect to LERF. (Because

Figure III-2 is drawn on a log scale, it does not explicitly indicate this region.)

• When the calculated increase in LERF is very small (less than 1 x 10-7 per reactor year),

the change should be considered regardless of whether there is an assessment of total

LERF (Region III). While there is no requirement for the licensee to quantitatively

assess the total LERF, information should be provided to show that there is no indication

that the total LERF could considerably exceed 1 x 10-5 per reactor year. Such an

indication could result, for example, if the contribution to LERF calculated from a limited

scope analysis (such as that from the IPE or the IPEEE) significantly exceeds 1 x 10-5

per reactor year, if the licensee has identified a potential vulnerability from a

margins-type analysis, or if plant operating experience has indicated a potential safety

concern.

• When the calculated increase in LERF is in the range of 1 x 10-7 to 1 x 10-6 per reactor

year, applications should be considered only if the licensee can reasonably show that

the total LERF is less than 1 x 10-5 per reactor year (Region II).

• Applications that increase LERF by more than 1 x 10-6 per reactor year (Region I) should

not normally be considered.
19.2-19 June 2007

These guidelines are intended to provide assurance that proposed increases in CDF and LERF

are small and are consistent with the intent of the Commission's Safety Goal Policy Statement

(51 FR 28044).

The guidelines discussed above are applicable for full-power, low-power, and shutdown

operations. However, during certain shutdown operations when the containment function is not

maintained, the LERF guidelines as defined above are not practical. In such cases, the

licensee may use more stringent baseline CDF guidelines (e.g., 10-5 per reactor year) to

maintain an equivalent risk profile or may propose an alternative guideline to LERF that meets

the intent of Principle 4.

As indicated by the shading in Figures III-1 and III-2, the change request should be subjected to

technical and management reviews that become more intensive as the calculated results

approach the region boundaries. The technical review related to the risk evaluation should

address the scope, quality, and robustness of the analysis, including consideration of

uncertainties. The scope, level of detail, and quality of analysis is further discussed in

Subsections III.2.2.2, III.2.2.3, and III.2.2.4 of this SRP section. The robustness of the results

can be determined by developing an understanding of the contributors, the sources of

uncertainty that impact the results, and their impact on whether the acceptance guidelines are

met.

The necessary sophistication of this evaluation depends on both the role the risk assessment

plays in the decision and the magnitude of the potential risk impact. For actions justified

primarily by traditional engineering considerations and for which minimal risk impact is

anticipated, a bounding estimate may be sufficient. For actions justified primarily by PRA

considerations for which a substantial impact is possible or is to be offset with compensatory

measures, an in-depth and comprehensive PRA analysis is generally needed.

III.2.2.5.2 Comparison of Results with Acceptance Guidelines

In the context of integrated decisionmaking, the acceptance guidelines should not be

interpreted as being overly prescriptive. They are intended to provide an indication, in

numerical terms, of what is considered acceptable. As such, the numerical values associated

with defining the regions in Figures III-1 and III-2 are approximate values used to indicate the

changes that are generally acceptable. Furthermore, the state of knowledge (or epistemic)

uncertainties associated with PRA calculations preclude a definitive decision (based purely on

the numerical results) with respect to which region a given application belongs. The intent in

making the comparison of the PRA results with the acceptance guidelines is to demonstrate

with reasonable assurance that the proposal fulfills Principle 4 (discussed in Subsection II of

this SRP section). The assessment of whether this has been demonstrated must be made on

the basis of an understanding of the contributors to the PRA results and on the impacts of the

uncertainties (both those that are explicitly accounted for in the results and those that are not).

This is a somewhat subjective process; therefore, in order to complete the assessment,

reviewers must carefully document the reasoning behind the decisions.

As discussed in Regulatory Guide 1.174, PRA values can be affected by particular modeling

assumptions that are a response to the uncertainty regarding how to correctly model the plant

response following an initiating event. Thus, it is important that uncertainties in the PRA results
19.2-20 June 2007

be taken into account in assessing the risk impact and in the risk-informed decisionmaking

process to demonstrate the robustness of the results. The scope of the required uncertainty

analysis is a function of the role that the quantification results play in the decision and on the

significance of the calculated change.

The general approach to accounting for uncertainty is discussed in Regulatory Guide 1.174,

Section 2.2.5. In that discussion, uncertainties are categorized as parameter, model, and

completeness uncertainties. In assessing analysis of uncertainties, reviewers should consider

the types and sources of uncertainties identified by the licensee, and how those uncertainties

have been addressed with reference to the decision guidelines. Specifically, review guidance is

as follows.

• Parameter Uncertainty: Reviewers should determine whether the licensee has

accounted for parameter uncertainties in an appropriate manner so that the estimated

values for CDF, LERF, CDF, and LERF can be regarded as equivalent to mean values.

However, this does not imply that a detailed propagation of uncertainties is always

necessary; in many cases, it is possible to show that a point estimate is an acceptable

approximation of the mean value using qualitative arguments about the risk contributors.

For example, if a formal propagation has not been performed, it is necessary for the

licensee to demonstrate that the result is not affected by the so-called state of

knowledge correlation (specifically, that there are no significant contributing cutsets or

scenarios that involve multiple events for which the probabilities are determined using

the same parameter, particularly if the parameter value is very uncertain).

It is not uncommon for licensees to use point estimate values without defining probability

distributions on the values. In such instances, it is not possible to characterize the point

estimate as a mean value. However, for the more significant parameters, some

characterization of uncertainty is essential to demonstrate that the point estimate is not

an optimistic value.

• Model Uncertainty: Reviewers should determine whether the results are strongly

impacted by the specific models or assumptions adopted for the assessment of

important elements of the PRA and whether the sensitivity analyses that have been

performed (if any) are sufficient to address the most significant uncertainties with

respect to these elements.

In some cases, particularly for small changes in risk or for relatively minor changes,

there may be relatively few issues related to model uncertainties. In other cases, where

the baseline risk values are to be estimated, the modeling issues should include all

those that have a significant impact on the evaluation of the baseline risk values. Model

uncertainties arise when there are several alternative approaches to the analysis of

certain elements of the PRA model. They are typically addressed by adopting a specific

model or making a specific assumption. In such cases, the licensee should document

why the particular model or assumption used is appropriate both for the base case risk

evaluation and for the analysis of the impact of the change. In certain cases, it may be

necessary to perform sensitivity analyses using alternative reasonable models or

assumptions to demonstrate the robustness of the conclusions. In deciding what are

reasonable alternatives, reviewers should consider whether the alternatives have some

precedent and whether they have a reasonable engineering basis.
19.2-21 June 2007

Reviewers should pay particular attention when the characterization of a model

uncertainty is such that the results fall into a bimodal or multi-modal distribution and one

or more of the modes exceed the acceptance guidelines. The results should then be

reviewed on the basis of an evaluation of the significance of the hypotheses associated

with the modes that exceed the guidelines.

• Completeness Uncertainty: Reviewers should determine whether the licensee has

adequately addressed the limitations in the PRA scope and other completeness issues,

either by limiting the scope of the application or by demonstrating that the impact of the

unanalyzed portion of the risk on both the base case risk and on the change in risk is

bounded or can be neglected. Subsection III.2.2.2 of this SRP section discusses this

further.

III.2.2.5.3 Cumulative and Synergistic Effects from all Applications

In evaluating the licensee's submittal, reviewers should consider the effects of the proposed

changes in light of previously submitted changes implemented by the licensee. Optimally, the

PRA used for the current application should already model the effects of past applications.

However, qualitative and synergistic effects are sometimes difficult to model in the PRA.

Therefore, a review of changes in risk (both quantifiable and non-quantifiable) from previously

submitted changes to the plant's design and operation would provide a means to account for

the cumulative and synergistic effects of these changes.

For all previous changes, reviewers should consider the following factors:

• The calculated change in risk for each application (CDF and LERF) and the plant

elements (SSCs, procedures, etc.) affected by each change,

• Qualitative arguments used to justify the change (if any) and the plant elements affected

by those arguments,

• Compensatory measures or other commitments used to help justify the change (if any)

and the plant elements affected,

• A summary of the results from the monitoring programs (where applicable) and a

discussion on how these results have been factored into the PRA or into the current

application,

• The plant risk profile to ensure that the accumulation of changes has not created

dominant risk contributors.

If the licensee's submittal includes past changes made to the plant (but not submitted to the

NRC) that reduced the plant risk, especially changes related to the current application,

reviewers should consider such changes in the integrated decisionmaking process. Benefits

from the implementation of the Maintenance Rule can also be credited for the applicable SSCs. 

Beyond cumulative effects, synergistic effects are also possible, and some of these might not

emerge from a quantification of the PRA. For example, if conventional importance ranking

approaches are employed to determine the importance of SSCs, it would be possible that
19.2-22 June 2007

multiple requirements could be relaxed on certain "low" significant components under multiple

applications. If the QA (potentially affecting the failure rate) and the test interval (potentially

affecting fault exposure time) were to be relaxed for the same component, the component

unavailability could increase more than expected (since failure rate and fault exposure time

combine multiplicatively in the calculation of unavailability). If the effects of QA on failure rate

could be quantified convincingly, this would be addressed explicitly, but this cannot presently be

ensured. As a result, potential exists that different applications might lead to unintended and

unquantified synergistic effects on the unavailability of a given component.

Synergistic effects on a given element can be addressed by showing that the basic event model

adequately reflects the effects of programmatic activities, and that the calculated unavailability,

propagated through the PRA, is consistent with the needed performance with regard to the risk

indices and the defense-in-depth concept. However, it is more straightforward simply not to

allow for the relaxation of multiple programmatic requirements on a given component unless

demonstrable justification is provided that the risk contribution from the component is negligible

for conditions covered by the set of requirements. For example, if IST is relaxed on a given

component, it would be preferable not to relax QA as well unless good arguments are given for

allowing both.

III.2.2.5.4 Risk Management

One of the goals of the review should be to ensure that in the course of the licensee's

engineering evaluations, principles of risk management are appropriately applied in the process

of evaluating changes to current regulatory requirements. For the purposes of this SRP

section, "risk management" refers to an approach to decisionmaking about safety that seeks to

allocate available resources and worker dose in such a way as to minimize the risk to public

health and safety from plant operations. The reviewers should recognize that there is a point of

diminishing returns in risk reduction and that some residual risk will be associated with plant

operation. Nonetheless, reviewers should expect that licensees will make an effort to identify

reasonable and cost-effective measures to control this residual risk as part of the risk-informed

regulatory process. Therefore, as a staff expectation, the process of risk management in

risk-informed decisionmaking should not be biased toward eliminating requirements to the

exclusion of enhancements that would convey a worthwhile safety benefit. Licensees are

expected to apply risk insights in an unbiased way, and licensees who do not satisfy subsidiary

safety objectives (as defined in Regulatory Guide 1.174) are expected to seek safety

enhancements in conjunction with risk-informed applications.

Therefore, when risk increases are proposed, reviewers should consider plant performance and

past changes to the LB to ensure that there is no pattern for a systematic increase in risk.

Insights on the licensee’s operational practices, management controls, risk management

programs, plant configuration control programs, or performance monitoring programs from

previous applications can be obtained from the NRC project managers, the NRC regional

offices, or documentation of NRC inspection activities.

III.2.3 Integrated Decisionmaking Process

The acceptability of the proposed changes should be reviewed and determined in an integrated

fashion. Reviewers should verify that the licensee has used the results of the traditional

engineering analyses and the risk assessment to ensure that the submittal fulfills the principles
19.2-23 June 2007

listed in Subsection II of this SRP section. Since the roles played by the traditional analyses

and the risk analyses in the decisionmaking process determine the scope, quality, and

robustness required of those analyses, examination of the appropriate inputs and assumptions

in the analyses may be necessary for reviewers to conclude with reasonable assurance that the

proposal fulfills the stated principles.

When appropriate, the integrated decisionmaking process should include implementation and

monitoring strategies that are used to provide confidence that the results of the underlying

engineering analyses remain valid. In addition, licensees can take compensatory measures

that reduce risk to offset incompleteness or uncertainties in the analysis. Compensatory

measures can also be used to offset a quantifiable increase in risk with nonquantifiable but

expected improvements in safety.

In addition, the reviewer should ensure that the scope of the proposed changes is

commensurate with, and fully supported by, the results of the analyses. That is, the scope of

the change should be dependent on the degree of completeness of, level of detail of, and

confidence in, the analyses. As an example, if the application concerned changing the

treatment of SSCs according to their safety significance, a more detailed PRA model would

allow a more detailed categorization into high or low significance than would a less detailed

PRA model. Consequently, it would be expected that more SSCs could be characterized as low

safety significant in the former case than the latter. It should be noted that both PRAs in this

example may be stated to have sufficient quality for supporting the results as they were used in

the decision. In this sense, quality can be thought of as a measure of the confidence in the

results.

To ensure that the important assumptions used in the engineering analysis to justify the LB

change remain valid, the integrated decisionmaking process should ensure that the licensee

maintains an appropriate set of programmatic activities (e.g., IST, QA, ISI, maintenance,

monitoring) for important elements of the plant response capability. In addition, performance of

compensating SSCs should be ensured (through programmatic activities) when these SSCs are

used to help justify the relaxation of requirements for other SSCs.

The process used by licensees to integrate traditional and probabilistic engineering evaluations

for risk-informed decisionmaking is expected to be well-defined, systematic, and scrutable.

Appendix B to this SRP section presents review guidance and staff expectations for the

licensee’s integrated decisionmaking process.

In evaluating the acceptability of a proposed change, reviewers should also address the

following factors:

• The cumulative impact of previous changes and the trend in CDF and LERF (the

licensee's risk management approach),

• The impact of the proposed change on operational complexity, burden on the operating

staff, and overall safety practices,

• Plant-specific performance and other factors, including, for example, siting factors,

inspection findings, performance indicators, operational events, and Level 3 PRA

information if available,
19.2-24 June 2007

• The benefit of the change in relation to its CDF/LERF increase and whether it is

practical to accomplish the change with a smaller CDF/LERF impact,

• Practical actions that could reduce CDF/LERF when there is reason to believe that the

baseline CDF/LERF are above the guideline values (i.e., 10-4 and 10-5 per reactor year).

III.2.3.1 Review of Combined Change Requests

In assessing combined change requests, reviewers should evaluate the acceptability of each of

the individual changes with respect to the defense-in-depth and safety margin guidelines

discussed in Subsection III.2.1 of this SRP section. In addition, reviewers should evaluate the

overall risk impact of the combined changes using the guidelines discussed in Subsection III.2.2

of this SRP section.

In evaluating the overall (i.e., combined) risk impact, reviewers should take into account the

relationship between the individual changes. For example, in combined change requests for

which individual changes that increase risk are compensated for by other changes that

decrease risk, reviewers should evaluate and understand the major contributors to both the risk

increase and risk decrease, including the analysis assumptions and uncertainties from each

contributor that might affect the decision process. Combining risk impacts from the individual

contributors is prudent when the contributors are closely related in terms of analysis

assumptions and uncertainty. Contributors could also be related if they impact on the same

plant functions, for example. Conversely, for contributors that are not closely related, risk

impacts from each change should be evaluated on an individual basis.

Finally, combined changes should not trade many small risk decreases for a large risk increase

(i.e., create a new significant contributor to risk). It is expected that implementation of

combined change requests will improve, or at least maintain, the overall plant risk profile. A

desirable risk profile is one in which no contributors are overly dominant. Therefore, proposed

changes should not create or exacerbate a risk imbalance either in terms of dominant plant

elements (SSCs or operator actions) or accident sequences.

III.3 Element 3: Develop Implementation and Monitoring Strategies

Implementation and monitoring strategies are important in most risk-informed processes since

they can provide an early indication of unanticipated degradation of SSCs or other plant

performance factors under the proposed changes. In addition, these strategies may be needed

to ensure that the plant will effectively maintain the performance of SSCs that are relied upon to

justify the proposed change to the LB. Regulatory Guide 1.174, Section 2.3 provides guidance

for the suggested process related to this issue.

The primary goal of the monitoring program should be to ensure that no adverse degradation

occurs because of the changes to the LB. These programs should therefore address the

possibility that the aggregate impact of changes that affect a large class of SSCs could lead to

an unacceptable increase in the number of failures attributable to unanticipated degradation,

including possible increases in common cause failure mechanisms.
19.2-25 June 2007

Reviewers should evaluate the implementation and monitoring strategies on the basis of

findings obtained from the traditional engineering and probabilistic evaluations. When broad

implementation is proposed over a short period of time, reviewers should verify that this is

consistent with the traditional engineering evaluations, defense-in-depth considerations

(including common cause failure), and risk-evaluation models and assumptions. When there is

a need to gain additional performance insights given a change in requirements, reviewers

should verify that the licensee has proposed a phased approach to implementation. If this

phased approach involves plan implementation for different SSC groups at different times,

reviewers should also assess the basis for the licensee’s grouping criteria, keeping in mind the

potential common cause failures.

Monitoring should be applied to SSCs in a manner commensurate with their importance to

safety as determined by the engineering evaluation that supports the LB change. This

monitoring should be contingent on the reliability/availability allocated to SSCs in the risk model

(or on performance of operators, where appropriate) used to support the proposed change in

regulation. As such, reviewers should ensure that the chosen performance criteria are

consistent with the level of performance allocated in the risk analysis.

When monitoring that is already being performed as part of the Maintenance Rule

implementation or as part of other plant programs is also proposed for the current application,

reviewers should ensure that the monitoring proposed is sufficient for the SSCs affected by the

risk-informed application and that the performance criteria chosen are appropriate for the

application in question.

As part of the evaluation of the licensee’s monitoring program, reviewers should assess the

proposed provisions for cause determination, trending of degradation and failures, and

corrective actions. The program should be structured such that feedback of information and

corrective actions is accomplished in a timely manner and degradation in SSC performance is

detected and corrected before plant safety can be compromised. In cases when monitoring

detects degradation, there should be provisions for a trending and corrective action program, or

for the SSCs to be refurbished, replaced, or tested/inspected more often (or a combination of

these initiatives). The preferred initiative should be selected on the basis of determination

regarding the cause of the degradation (whether it is generic, age-related, etc.). Reviewers

should evaluate whether the information gathered during monitoring activities is extensive

enough to provide a timely indication of component degradation. Since many components are

inherently quite reliable, the limited tests on a limited number of similar components may not

provide adequate data, especially for newer plants where aging effects may not be detected

until the proposed program is fully in place (and the advantages of a phased implementation

are lost). One approach to ameliorate this concern would be to include performance data for

similar SSCs at other plants with a range of operating times to expand the applicable database

over a range of component ages. Such a program would be expected to improve the chance of

early detection of SSC reliability degradation.

Reviewers should evaluate the impact on plant risk and SSC functionality, reliability, and

availability given the licensee’s proposed implementation and monitoring plan. The benefits

from the implementation and monitoring programs should be balanced against any negative

impact on risk.
19.2-26 June 2007

Finally, reviewers should consider the criteria to be applied in deciding what actions are to be

taken in cases when performance falls below that predicted by the supporting evaluations.

Corrective action procedures should be in place before implementation of the proposed

program.

III.4 Element 4: Conduct Staff Evaluation of Submittal

In order for the staff to reach a conclusion regarding the acceptability of the proposed LB

change on the basis of the review guidance presented in earlier subsections of this SRP

section, the licensee must submit or make available sufficient engineering and licensing

information. In addition, the licensee should request appropriate regulatory action. Requests

for proposed changes to the plant’s LB typically take the form of requests for license

amendments (including changes to or removal of license conditions), technical specification

changes, changes to or withdrawal of orders, and changes to programs pursuant to

10 CFR 50.54 (e.g., QA program changes under 10 CFR 50.54(a)). Reviewers should

determine whether (i) the form of the change request is appropriate for the proposed LB

change, (ii) the licensee submitted the information required by the relevant regulations in

support of the request, and (iii) the request is in accordance with relevant procedural

requirements. For example, license amendments should meet the requirements of

10 CFR 50.90, 50.91, and 50.92, as well as the procedural requirements in 10 CFR 50.4. 

When the licensee submits risk information in support of the LB change request, that

information should meet the guidance in Regulatory Guide 1.174, Section 3.

Licensees have a choice of whether to submit results or insights from risk analyses in support

of their LB change request. When the licensee’s proposed change is consistent with the

currently approved staff positions, reviewers generally should reach their determination solely

on the basis of traditional engineering analysis without recourse to risk information. (Reviewers

may, however, consider any risk information submitted by the licensee.) When the licensee’s

proposed change goes beyond currently approved staff positions or appears to constitute a

special circumstance as described in Appendix D, reviewers should consider both information

derived through traditional engineering analysis and information derived from risk insights. If the

licensee does not submit risk information in support of a LB change which goes beyond

currently approved staff positions, reviewers may request that the licensee provide this

information. If the licensee chooses not to provide the risk information, reviewers will evaluate

the proposed application using traditional engineering analysis and determine whether the

licensee has provided sufficient information to support the requested change. If the licensee

does not choose to address risk for a situation believed to create a special circumstance as

described in Appendix D, reviewers should not issue the requested amendment until they have

assessed the risk implications sufficiently to determine that there is reasonable assurance that

the public health and safety will be adequately protected if the amendment request is approved.

In risk-informed change proposals, licensees are expected to identify SSCs with high risk

significance that are not currently subject to regulatory requirements, or are subject to a level of

regulation that is not commensurate with their risk significance, or are voluntary actions that are

key to decisionmaking. In addition, licensees are expected to propose LB changes that will

subject such SSCs or voluntary actions to the appropriate level of attention, consistent with their

significance. Application-specific regulatory guides set forth specific information on the staff’s

expectations on this issue. Reviewers should ensure that this application-specific guidance is

followed. If there is no guidance, reviewers should determine whether any commitments for
19.2-27 June 2007

enhanced requirements/controls are appropriate for such SSCs or voluntary actions, and

ensure that those commitments are reflected in the licensing basis.

III.4.1 Update of the Safety Analysis Report

Reviewers should ensure that the proposed changes, when approved by the staff, will be

appropriately included in future updates to the licensee’s safety analysis report. In addition, the

licensee should identify important assumptions (including SSC functional capabilities and

performance attributes) that play a key role in supporting the acceptability of the LB change.

Since the continued satisfaction of these assumptions is necessary to maintain the validity of

the safety evaluation, reviewers should verify that such assumptions are reflected by licensee

commitments that are incorporated into the safety analysis report. Reviewers should also verify

that the licensee has submitted revised FSAR pages as necessary. This revision should

include all the programmatic activities, performance monitoring aspects, and SSC functional

performance and availability attributes which form the basis of the request. This material

should also identify the SSCs for which performance should be verified (including

non-safety-related SSCs for which performance and reliability provide part of the basis for the

LB change).

III.4.2 Considerations Related to the National Environmental Policy Act

In accordance with 10 CFR Part 51, reviewers should address environmental protection

regulations, such as those from the National Environmental Policy Act (NEPA). Reviewers

should use NRR Office Letter 906 and 10 CFR 51.25 to determine how the NEPA requirements

are to be addressed. If it is determined necessary, an environmental assessment (EA) should

be prepared to assess whether an environmental impact statement (EIS) is required or whether

the reviewers can reach a finding of no significant impact (FONSI). It is expected that, if all of

the guidance and acceptance criteria provided in Regulatory Guide 1.174 are satisfied, the

reviewers should normally be able to reach such a finding for the proposed change.
19.2-28 June 2007

Table III-1 (page 1 of 5)

Questions To Assist in Establishing the Cause-Effect Relationship

Note: Information from Section 3.3 of the EPRI “PSA Applications Guide” (EPRI-TR-105396)

provided substantial input to this table.

LEVEL 1 (INTERNAL EVENTS PRA)

Initiating Events

• Does the application introduce new initiating events?

• Does the application address changes that lead to a modification of the initiating event

groups?

• Does the application necessitate reassessment of the frequencies of the initiating event

groups?

• Does the application increase the likelihood of a system failure that was bounded by an

initiating event group to the extent that it needs to be explicitly considered?

Success Criteria

• Does the application necessitate modification of the success criteria?

• Does the modification of success criteria necessitate changes in other criteria, such as

system interdependencies?

Event Trees

• Does the application address an issue that can be associated with a particular branch or

branches on the event trees, and if so, is the branching structure adequate?

• Does the application necessitate the introduction of new branches or top events to

represent concerns not addressed in the event trees?

• Does the application necessitate consideration of reordering branch points (i.e., does

the application affect the sequence-dependent failure analysis)?

System Reliability Models

• Does the application impact system design in such a way as to alter system reliability

models?

• Does the application impact the support functions of the system in such a way as to alter

the dependencies in the model?

• Does the application impact the system performance and, if so, is that impact obscured

by conservative modeling techniques?
19.2-29 June 2007

Table III-1 (page 2 of 5)

Questions to Assist in Establishing the Cause-Effect Relationship

Parameter Database

• Can the application be clearly associated with one or more of the basic event definitions,

or does it necessitate new basic events?

• Does the application necessitate a specialized probability model (e.g., time-dependent

model)?

• Does the application necessitate modifications to specific parameter values?

• Does the application introduce new component failure modes?

• Does the application affect the component mission times?

• Does the application necessitate that the plant-specific (historical) data be taken into

account, and can this be easily achieved by an update of the previous parameters?

• Does the application involve a change that may impact parameter values, and do the

present estimates reflect the current status of the plant with respect to what is to be

changed?

Dependent Failure Analysis

• Does the application introduce or suggest new common cause failure contributions?

• Does the application introduce new asymmetries that might create subgroups within the

common cause failure component groups?

• Is the application likely to affect the probabilities of common cause failure?

Human Reliability Analysis

• Does the application involve a procedure change?

• Does the application involve a new human action?

• Does the application change the available time for human actions?

• Does the application affect the human action dependency analysis?

• Does the application eliminate or modify an existing human action?

• Does the application introduce or modify dependencies between plant instrumentation

and human actions?

• Is the application concerned with events that have been screened from the model, either

in whole or in part?

• Does the application impact a particular performance shaping factor (PSF), or a group

of PSFs, and are they explicitly addressed in the estimation approach (e.g., if the issue

is to address training, is training one of the PSFs used in the human reliability analysis)?

• Does success in the application hinge on incorporating the impact of changes in PSFs

and, if so, do the current estimates reflect the current status of these PSFs?

• Is it possible that the particular group of human error events that is affected by the

change being analyzed has been truncated?

• Does the change address new recovery actions?
19.2-30 June 2007

Table III-1 (page 3 of 5)

Questions to Assist in Establishing the Cause-Effect Relationship

Internal Flooding

• Does the application affect the screening analysis (e.g., does the application result in

the location of redundant trains or components into the same flood zone)?

• Does the application introduce new flooding sources or increase existing potential flood

inventories?

• Does the application affect the status/availability of flood mitigation devices?

• Does the application affect flood propagation pathways?

• Does the application affect critical flood heights?

• Does the application affect timing considerations used in the flooding analysis (e.g.,

flood flow rates or flood egress rates)?

Quantification

• Does the application change any of the basic event probabilities?

• Does the application change relative magnitudes of probabilities?

• Does the application only make probabilities smaller?

• Is the new result needed in a short-time scale?

• Does the application necessitate a change in the truncation limits for the model?

• Does the application affect the "delete terms" used during the quantification process?

(That is, does the application introduce new combinations of maintenance actions or

operating modes that are deleted during the base case quantification process using the

delete function?)

• Does the application affect equipment credited for recovery actions, including credit for

inter-system or inter-unit crossties?

Analysis of Results

• Does the application necessitate an assessment of uncertainty, and is it to be qualitative

or quantitative?

• Are there uncertainties in the application that could be clarified by the application of

sensitivity studies?

• Does the application strategy necessitate an importance analysis to rank contributions?

• Does the application necessitate the performance of an importance, uncertainty, or

sensitivity analysis of the base case PRA?
19.2-31 June 2007

Table III-1 (page 4 of 5)

Questions to Assist in Establishing the Cause-Effect Relationship

Plant Damage State Classification

• Does the application impact the choice of parameters used to define plant damage

states?

• Do the key plant damage states (KPDSs) utilized adequately represent the results of the

Level 1 analysis by including the plant damage states that have a significant frequency

of occurrence?

• Have those plant damage states that have been eliminated in this process been

assigned to KPDSs of higher consequence (e.g., likelihood of large early release)?

LEVEL 2 (CONTAINMENT ANALYSIS)

• Have new containment failure modes identified by the application been addressed in the

PRA? Are potential changes accounted for?

• Are any dependencies among containment failure modes being changed?

• Does the application involve mechanisms that could lead to containment bypass?

• Does the application involve mechanisms that could cause failure of containment

isolation?

• Does the application directly affect the occurrence of any severe accident phenomena?

• Does the application necessitate use of risk measures other than large early release?

• Does the application change equipment qualification to the point where it affects timing

of equipment failure relative to containment failure?

• Does the application affect core debris path to the sump or suppression pool or to the

other portions of the containment?

• Do the selected source term categories adequately represent the revised containment

event tree (CET) endpoints? Are CET endpoint frequencies changed enough to affect

the selection of the dominant/representative sequences in the source term binning

process?

• Does the application affect the timing of release of radionuclides into the environment

relative to the initiation of core melt and relative to the time for vessel rupture?

LEVEL 3 (CONSEQUENCE ANALYSIS)

• Does the application necessitate detailed evacuee doses?

• Are individual doses at specific locations needed for this application?

• Is evacuation or sheltering being considered as a mitigation measure?

• Are long-term doses a consideration in this application?
19.2-32 June 2007

Table III-1 (page 5 of 5)

Questions to Assist in Establishing the Cause-Effect Relationship

EXTERNAL EVENTS PRA

• Does the application introduce external hazards not previously evaluated?

• Does the application increase the intensity of existing hazards significantly?

• Are design changes modifying the structural response of the plant being considered?

• Does the change impact the availability and performance of necessary mitigation

systems for an external hazard?

• Does the application significantly modify the inputs to the plant model conditioned on the

external event?

• Are changes being requested for systems designed to mitigate against specific external

events?

• Does the application involve availability and performance of containment systems under

the external hazard?

LOW POWER and SHUTDOWN PRA

• Does the application introduce new initiating events or change the frequencies of

existing events?

• Does the application affect the scheduling of outage activities?

• Does the application affect the ability of the operator to respond to shutdown events?

• Does the application affect the reliability or availability of equipment used for shutdown

conditions?

• Does the application affect the availability of equipment or instrumentation used for

contingency plans?

• Does the application affect the ability for the operator to close containment?
19.2-33 June 2007

Note: The analysis will be subject to increased technical review and management attention as

indicated by the darkness of the shading of the figure. In the context of the integrated

decisionmaking, the boundaries between the regions should not be interpreted as being

definitive; the numerical values associated with defining the regions in the figure are to be

interpreted as indicative values only. 

Figure III-1 Acceptance Guidelines for Core Damage Frequency (CDF)
19.2-34 June 2007

Note: The analysis will be subject to increased technical review and management attention as

indicated by the darkness of the shading of the figure. In the context of the integrated

decisionmaking, the boundaries between the regions should not be interpreted as being

definitive; the numerical values associated with defining the regions in the figure are to be

interpreted as indicative values only. 

Figure III-2 Acceptance Guidelines for Large Early Release Frequency (LERF)
19.2-35 June 2007

IV. EVALUATION FINDINGS

The results of the reviewers’ evaluation should reflect a consistent and scrutable integration of

the probabili stic considerations and traditional engineering considerations provided by the

licensee or applicant and developed independently by the reviewers. To reach a finding of

acceptability, reviewers will generally need to show that in light of a small or nonexistent

increase in risk and a reduced level of conservatism, defense in depth and sufficient safety

margins are maintained. Findings of acceptability should be supported with logical bases built

from an evaluation of the considerations given in Subsection III of this SRP section. Reviewers

should confirm that sufficient information is provided in accordance with the requirements of this

SRP section and that the evaluation supports the following conclusions; these confirmations are

to be included in the staff’s safety evaluation.

IV.1 General

• The proposed change meets the current regulations unless it is explicitly related to a

requested exemption, i.e., a "specific exemption" under 10 CFR 50.12.

• The proposed change is consistent with the defense-in-depth philosophy.

• The proposed change maintains sufficient safety margins.

• When proposed changes result in an increase in CDF or risk, the increases are small

and are consistent with the intent of the Commission's Safety Goal Policy Statement (51

FR 28044).

• The impact of the proposed change is monitored using performance-based strategies.

• All safety impacts of the proposed change are evaluated in an integrated manner as part

of an overall risk management approach in which the licensee is using risk analysis to

improve operational and engineering decisions broadly by identifying and taking

advantage of opportunities to reduce risk, not just to eliminate requirements the licensee

sees as undesirable. For those cases when risk increases are proposed, the benefits

have been described and these benefits are commensurate with the proposed risk

increases. The approach used to identify reduced requirements was also used to

identify whether there are areas where requirements should be increased.

• The scope and quality of the engineering analyses (including traditional and probabilistic

analyses) conducted to justify the proposed LB change are appropriate for the nature

and scope of the change and are derived on the basis of the as-built, as-operated, and

as-maintained plant, including operating experience at the plant.

• The plant-specific PRA supporting the licensee’s proposals has been subjected to

quality controls such as an independent peer review or certification.

• Appropriate consideration of uncertainty has been given to results of the analyses and

interpretation of findings, including the use of a program of monitoring, feedback, and

corrective action to address significant uncertainties, where applicable.
19.2-36 June 2007

• CDF and LERF are used as bases for probabilistic risk assessment guidelines for

addressing Principle 4. If the Commission's Safety Goal QHOs have been used in lieu

of LERF, the implementation of such an approach included justification of the methods

and assumptions used in the analysis and treatment of uncertainties.

• Increases in estimated CDF and LERF resulting from proposed LB changes are limited

to small increments, and the cumulative effects of such changes are tracked and

considered in the decision process.

• The acceptability of the proposed changes has been evaluated by the licensee in an

integrated fashion that ensures that all principles are met.

• Data, methods, and assessment criteria used to support regulatory decisionmaking are

clearly documented and available for public review.

IV.2 Definition of the Proposed Change

• Adequate traditional engineering and probabilistic evaluations are available to support

the proposed LB change. Plant-specific and relevant industry data and operational

experience also support the proposed change.

• Cause-effect relationships have been identified to adequately link the application with

the evaluation models, and the proposed models can effectively evaluate or realistically

bound the effects of the proposed change.

• Information from engineering analyses, operational experience, and plant-specific

performance history have been factored into the decisionmaking process.

IV.3 Evaluations of Defense-In-Depth Attributes and Safety Margins

• Defense in depth is preserved (for example, system redundancy, diversity, and

independence are maintained commensurate with the expected frequency and

consequence of challenges to the system; defenses against potential common cause

failures are maintained and the introduction of new common cause failure mechanisms

is assessed; and defenses against human errors are maintained).

• Sufficient safety margins are maintained (for example, NRC-approved codes and

standards are met or deviations justified; and safety analysis acceptance criteria in the

LB are met, or proposed revisions provide sufficient margin to account for analysis and

data uncertainty).

• Current regulations have been met, or the proposed exemption is acceptable.

IV.4 Scope of Risk Analysis

• The licensee's risk analysis satisfactorily addresses all mode/initiator combinations or

• The licensee's risk analysis does not analyze all mode/initiator type combinations.

However, in each instance, the licensee has demonstrated that
19.2-37 June 2007

< suitably redundant and diverse plant response capability is maintained for

significant initiators in these modes and

< sufficient elements of the plant response capability are subject to programmatic

activities to ensure suitable performance.

IV.5 Level of Detail of Risk Analysis

• The PRA is detailed enough to account for important system and operator

dependencies.

• Risk insights are consistent with the level of detail modeled in the PRA.

IV.6 Quality of the PRA

• There is reasonable assurance that the PRA is of sufficient quality to support the

conclusions as they impact the decision, as shown by the licensee's process to ensure

quality, including an independent peer review, and by a focused-scope

application-specific review by the staff.

• Results are robust in terms of uncertainties and sensitivities to the key modeling

parameters.

• Key performance elements for the application have been appropriately classified and

performance is backed up by licensee actions.

IV.7 Evaluation of Risk Impact

• If the risk-informed application assesses whether it meets Principle 4 by evaluating the

change to risk quantitatively, then the following applies:

< The application either decreases plant risk, or if an application increases risk, the

increase is within the guidelines defined in Regulatory Guide 1.174. The

cumulative and synergistic effects on risk from the present and previous

applications have been addressed. Licensee risk-management practices are

being followed to minimize the risk from plant operations.

< An appropriate consideration of uncertainties is provided in support of the

proposed application. The licensee showed that even taking into account the

uncertainties in the analysis, the evaluation of the change in risk was robust in

that there can be confidence in the conclusions drawn with respect to the nature

of the change compared with the acceptance guidelines. This argument was

supported either by explicit propagation or by a qualitative and/or sensitivity

analysis showing that no event contributing to the change in risk is subject to

significant uncertainty.

• If the risk-informed application is based on a qualitative assessment of the change to

risk, the application is shown to result in a decrease in plant risk, or is risk neutral, or
19.2-38 June 2007

CDF and LERF increases are shown to be acceptable on the basis of bounding

evaluations or sensitivity studies.

IV.8 Integrated Decisionmaking Process

• Results from traditional engineering analyses and risk analyses have been used to

ensure that the principles for risk-informed decisionmaking have been met.

• Potential analysis limitations, uncertainties, and conflicts are resolved by use of

conservative results, or by use of appropriate implementation and monitoring strategies,

or by use of appropriate compensatory measures.

• The integrated decisionmaking process is well-defined, systematic, repeatable, and

scrutable.

• The scope of implementation of the change is appropriate for, and commensurate with,

the level of confidence in the results of the analysis.

IV.9 Implementation and Monitoring Strategies

• The implementation process is commensurate with the uncertainty associated with the

results of the traditional and probabilistic engineering evaluations.

• A monitoring program that could adequately track the performance of equipment

covered by the proposed licensing changes was established. It was demonstrated that

the procedures and evaluation methods will provide reasonable assurance that

performance degradation will be detected and that the corrective action plan will ensure

that appropriate actions can be taken before SSC functionality and plant safety is

compromised. Data from similar plants will be used if needed.

• In addition to the tracking of performance of SSCs affected by the application, the

performance monitoring process also includes tracking the performance of SSCs that

support the underlying basis for the decisionmaking.

IV.10 Licensee Submittal

• The submittal includes sufficient information to support conclusions regarding the

acceptability of the proposed change.

• The appropriate regulatory action was requested. In addition, pertinent information on

the LB change will be included in the safety analysis report, technical specifications, or

license conditions, as necessary.

• The licensee has appropriately committed to the important programmatic and

performance assumptions in the PRA and engineering analyses that served as the basis

of the LB change. These include compensatory actions used to justify the change and

any new regulatory requirements for high risk significant SSCs not otherwise subject to

existing requirements, commensurate with their risk significance. These commitments
19.2-39 June 2007

are reflected in revisions to the safety analysis report or technical specifications, or both,

or the staff has imposed appropriate licensee conditions.

V. IMPLEMENTATION

The preceding material is intended to provide guidance to applicants and licensees regarding

the NRC staff's plans for using this SRP section for reviews of applications involving

risk-informed changes to the plant's design, operations, and other activities that require NRC

approval. Except when the applicant or licensee proposes an acceptable alternative method for

demonstrating that a proposed LB change is acceptable, the method described herein will be

used by the staff in its evaluation of such changes.

The provisions of this SRP section apply to reviews of applications submitted six months or

more after the date of issuance of this SRP section, unless superseded by a later revision.

VI. REFERENCES

1. 10 CFR 2.102, “Administrative Review of Application.”

2. 10 CFR 2.108, “Denial of Application for Failure to Supply Information.”

3. 10 CFR Part 50, “Domestic Licensing of Production and Utilization Facilities.”

4. 10 CFR Part 50, Appendix A, “General Design Criteria for Nuclear Power Plants.”

5. 10 CFR 50.4, “Written Communications.”

6. 10 CFR 50.11, “Exceptions and Exemptions from Licensing Requirements.”

7. 10 CFR 50.12, “Specific Exemptions.”

8. 10 CFR 50.54, “Conditions of Licenses.”

9. 10 CFR 50.54(a), “Conditions of Licenses.”

10. 10 CFR 50.90, “Application for Amendment of License or Construction Permit.”

11. 10 CFR 50.91, “Notice for Public Comment; State Consultation.”

12. 10 CFR 50.92, “Issuance of Amendment.”

13. 10 CFR Part 51, “Environmental Protection Regulations for Domestic Licensing and

Related Regulatory Functions.”

14. 10 CFR 51.25. “Determination to Prepare Environmental impact Statement or

Environmental Assessment; Eligibility for Categorical Exclusion.”

15. 10 CFR Part 52, “Early Site Permits; Standard Design Certifications; and Combined

Licenses for Nuclear Power Plants.”

16. 10 CFR Part 100, “Reactor Site Criteria.”
19.2-40 June 2007

17. The Atomic Energy Act of 1954. Pub. L. 83 - 703, 68 Stat. 919 (1954).

18. Electric Power Research Institute. “PSA Applications Guide.” EPRI-TR-105396. EPRI:

Palo Alto, CA. August 1995.

19. Maine Yankee Atomic Power Company (Maine Yankee Nuclear Power Plant, Unit 2). 

ALAB-161, 6 AEC 1003. US Atomic Energy Commission: Washington, DC. 1973.

20. Regulatory Guide 1.70, “Standard Format and Content of Safety Analysis Reports for

Nuclear Power Plants (LWR Edition).”

21. Regulatory Guide 1.174, Revision 1, “An Approach for Using Probabilistic Risk

Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing

Basis.” July 2002.

22. Regulatory Guide 1.200, Revision 1, “An Approach for Determining the Technical

Adequacy of Probabilistic Risk Assessment Results for Risk-informed Activities.” 

January, 2007.

23. Regulatory Guide 1.206, “Combined License Applictions for Nuclear Power Plants (LWR

Edition).”

24. U.S. Nuclear Regulatory Commission, Washington, DC. “Safety Goals for the

Operations of Nuclear Power Plants Policy Statement.” Federal Register: Volume 51,

No. 149. pp 28044-28049. August 4, 1986.

25. U.S. Nuclear Regulatory Commission, Washington, DC. “Use of Probabilistic Risk

Assessment Methods in Nuclear Regulatory Activities; Final Policy Statement.” Federal

Register: Volume 60, No.158. pp 42622-42629. August 16, 1995.

26. U.S. Nuclear Regulatory Commission, Office of Nuclear Reactor Regulation. 

“Procedural Guidance for Preparing Environmental Assessments and Considering

Environmental Issues.” NRR Office Letter 906, Revision 1. NRC: Washington, DC. 

September, 1996.

27. U.S. Nuclear Regulatory Commission, Washington, DC. SECY-94-219. “Proposed

Agency-Wide Implementation Plan for Probabilistic Risk Assessment,” NRC:

Washington, DC. August 19, 1994.

28. U.S. Nuclear Regulatory Commission, Washington, DC. SECY-95-280. “Framework for

Applying Probabilistic Risk Analysis in Reactor Regulation,” NRC: Washington, DC.

November 27, 1995.

29. U.S. Nuclear Regulatory Commission, Washington, DC. SECY-00-0213. 

“Risk-Informed Regulation Implementation Plan,” NRC: Washington, DC. 

October 26, 2000. Updated as SECY-01-0218. December 5, 2001. 

PAPERWORK REDUCTION ACT STATEMENT

The information collections contained in the Standard Review Plan are covered by the requirements of 10 CFR Part 50 and

10 CFR Part 52, and were approved by the Office of Management and Budget, approval number 3150-0011 and 3150-0151. 

PUBLIC PROTECTION NOTIFICATION
19.2-41 June 2007

The NRC may not conduct or sponsor, and a person is not required to respond to, a request for information or an information

collection requirement unless the requesting document displays a currently valid OMB control number. 

 

APPENDIX A

Guidance for a Focused-Scope Application-Specific PRA Review

As stated in SRP 19.2, Subsection III.2.2.4 and in Regulatory Guide 1.174, Section 2.2.3 PRAs

that are used in risk-informed submittals to determine risk significance or risk impact should be

shown to be of adequate quality. In risk-informed regulation (RIR), licensee submittals are

expected to utilize an integrated process that combines risk insights from a PRA, together

withinsights from traditional engineering analyses, supported by performance monitoring and

feedback. The quality of the PRA required to support this process is commensurate with the

roles the risk insights play in the final decisionmaking.

The staff evaluation of a licensee’s risk-informed application submittal is expected to include a

review of the licensee’s process for PRA quality assurance. Where necessary, this should be

supplemented by a general review of the event and fault tree models, data on SSC failures and

common cause failures, mission success criteria, initiating event analysis, human reliability

analysis, and sequence quantification including the analysis of uncertainties. These reviews

should be sufficiently detailed to give the staff confidence that the PRA appropriately reflects

the plant’s design and actual operating conditions and practices. Results from previous staff

reviews (e.g., from prior applications or from IPE/IPEEE reviews) and from industry reviews

(e.g., from independent peer reviews, certification processes, or cross comparisons) should be

used, as appropriate.

In addition to the general overall review described above, reviewers are expected to perform a

focused-scope review of the risk analysis on an application-specific basis. This appendix

provides review guidance for the likely elements of a PRA that may affect or be affected by

proposed changes to the LB. Reviewers should choose the relevant parts of this appendix,

guided by the application-specific SRP sections (where available) and by the cause-effect

relationship described in Subsection III.2.2.1 of this SRP section.

For additional background on the PRA review, the reader is referred to the bibliography

provided in Section A.11 of this appendix.

A.1 Initiating Event Analysis

a. Areas of Review

Whether or not a PRA includes a particular initiating event depends on the scope of the PRA,

the frequency of the given event, the plant systems or other features available to mitigate the

event, and the consequences of the event if unmitigated. Proposed plant changes could affect

the frequency of initiating events, the probability of mitigating event initiators, and in some

cases, event consequences. In addition, plant changes could potentially introduce new

initiating events or increase the importance of events that were previously screened out.

b. Review Guidance and Procedures

For risk-informed applications, reviewers should determine whether the licensee followed a

systematic approach to determine whether initiating events and anticipated plant response are

affected by the proposed changes. Reviewers should also determine whether the licensee’s

process includes provisions to evaluate whether the proposed changes can (i) increase the
19.2-42 June 2007

frequency of an initiator already included in the PRA, (ii) increase the frequency of initiators that

were initially screened out in the PRA, (iii) introduce new initiating events, or (iv) affect the

grouping of initiating events. These considerations are discussed in more detail in the following

paragraphs.

Applications that change the frequency of an initiator or the ability of the plant to respond to

event initiators are relatively easy to model in the risk analysis if the initiators are already

included in the base analysis. In such cases, the licensee should have evaluated the impact of

the changes directly from the risk model.

In cases where initiators are not included in the original risk analysis based on screening

analyses, the licensee should have determined whether initiating events previously screened

out because of low frequency might now be above the screening threshold as a result of a

proposed application. Plant changes could increase the frequency of initiating events that were

relatively infrequent to begin with, or these changes could affect structures, systems, and

components (SSCs) or operator actions that were credited with the satisfactory mitigation of

initiating events. If initiating events increased in frequency as a result of an application to the

point where it became important (i.e., could no longer be screened out), reviewers should verify

that the licensee has modified the scope of the analysis to reflect this change.

Low frequency of an event, by itself, is not usually sufficient as a criterion for screening

purposes. The consequences of non-mitigation of the events also play a big part in this

process. For example, interfacing system loss-of-coolant accidents (ISLOCAs) are often

assessed as low-frequency events. However, because of their impact on public health and

safety, these ISLOCAs can be important. Therefore, for potentially high-consequence events,

even if the event frequency is below a screening criterion, the features that lead to the

frequency being low (for example, surveillance test practices, startup procedures) should be

taken into account in reviews of PRA applications.

The licensee should also have evaluated proposed plant changes to determine whether the

changes could result in initiators that were not previously analyzed in the PRA. For example,

changes might enhance the potential for spurious operation of components that might, in turn,

cause initiating events, or changes might increase the likelihood for operator errors of

commission that could result in plant trips. If the licensee identified mechanisms for producing

new initiators, reviewers should ensure that the licensee added those initiators to the risk

analysis so that their impacts can be analyzed.

In PRAs, initiating events are usually grouped according to the systems required to respond to

the transient. This implies that success criteria for plant systems and operator responses are

similar for all events in a group. In addition, events may be screened out when it can be shown

that they are bounded in probability and consequence by other similar events. In evaluating

risk-informed applications that affect initiating events, reviewers should ensure that grouping

criteria used in the base analysis have not been invalidated by the proposed plant changes or,

when this is not true, the licensee has made appropriate changes to the event groupings.

Finally, the reader should note that many PRAs model initiating events as single basic events or

"black boxes." In RIR, it is preferred that the licensee model initiating events (especially those

that result from the loss of support systems) using a fault tree (or equivalent) approach so that

system dependencies are fully understood and accounted for. If this is not the case, reviewers

should be aware of the combination of SSC failures or other events that could lead to the

"failure" of the black box. This would lead to a better understanding of the risk contributors and

is especially important in risk categorization applications.
19.2-43 June 2007

c. Evaluation Findings

Reviewers should verify that the information provided and review activities conducted support

the following conclusions:

• The licensee has adequately considered the effects of proposed changes on the

frequencies of initiating events analyzed and those previously screened out.

• The licensee has demonstrated that the changes do not result in new initiating events

or, if new initiators have been identified, these have been added to and analyzed in the

risk model.

• The licensee has accounted for the proposed changes in the grouping of initiating

events.

• The decisionmaking process considered the dependencies between the initiating events

and the plant's mitigation systems.

A.2 Accident Sequence Analysis (Event Trees)

a. Areas of Review

Although the evaluation of risk change from most applications will usually not necessitate

changes to the event tree structure or logic, reviewers should be aware that there will be some

changes, particularly those involving changes to plant procedures, that might cause a

restructuring of the event sequence logic.

In addition, the application may isolate part of the PRA that is dependent on specific initiating

events. Thus, these initiating events and their associated event trees would have a

proportionately greater impact on the evaluation of the change in risk. In this case, these event

trees could be candidates for a higher level of scrutiny. For example, if the changes involved

the addition or subtraction of a diesel generator, the review would focus on the station blackout

event tree and its associated structure and logic. Similarly, if changes involve modification to

procedures to cross-tie electrical buses, the review might focus on the loss of offsite power

event trees.

b. Review Guidance and Procedures

Event tree sequence models are used to model the responses of plant systems and operations

personnel to initiating events. When the LB change request requires the review of event trees,

it is important that reviewers become familiar with their structure and with the assumptions

embedded in them. In particular, it is important to identify assumptions or approximations that

might impact the application. Such assumptions and approximations are not always explicitly

documented. The guidance provided below discusses approaches that reviewers can adopt to

assess the appropriateness of the modeling of the LB change in the event trees.

Reviewers should familiarize themselves with the structure of the event trees and the

associated assumptions that are used in the construction of the event trees. Specific issues to

consider should include the conditions created by the initiator and the chronological

requirements for systems operation and/or operator responses for the different event tree

branches. Reviewers should be satisfied that, if simplifications or assumptions were made in
19.2-44 June 2007

the structure and logic of the event trees, these would remain justifiable in light of the LB

change.

Reviewers should also study the functional and physical dependencies for each phase of the

sequence and, at the same time, the interaction between operators and systems as the

sequence unfolds. The timing of the events and time dependencies should also be understood.

A review of the general structure and philosophy underlying the pertinent plant emergency and

abnormal operating procedures will provide valuable insight on the validity of the event tree

structure and logic.

Specifically, reviewers should ensure that the following factors are addressed in the evaluation

of the LB change:

• The event trees reflect changes (if any) to the initiating event groupings.

• The models and analyses are consistent with the as-built and as-operated plant, i.e., the

functions necessary for safe shutdown are included, relevant systems are credited for

each function, and plant emergency operating procedures (EOPs) and abnormal

operating procedures (AOPs) are correctly represented. In addition, when the proposed

change affects any of these elements, the change is properly modeled.

• Changes to the plant's design or operations could affect the dependencies (functional,

phenomenological, and operational) among the top events in event trees. Section A.4 of

this appendix presents additional detail concerning the review of the dependent failure

analysis.

• Time-phased evaluation is normally included for sequences with significant

time-dependent failure modes (e.g., batteries for station blackout sequences) and

significant recoveries (e.g., AC recovery for station blackout (SBO) sequences). The

impact of the change on event timing that could affect the structure or logic of the event

trees should be understood.

• It is expected that the success criteria used in the event trees will not be affected by

many of the changes to the plant's design and operations. In cases where changes

could affect the success criteria for front-line or support systems, reviewers should verify

that these criteria (hardware requirements, number of trains required, etc.) remain

consistent with the required performance criteria (flow, response time, etc.) related to

functional requirements. However, even in cases where the change does not affect the

success criteria, reviewers should be aware that the success criteria used in the base

PRA analysis could affect the conclusions made in the evaluation of the risk change. For

example, a component in a three-train system might not be risk-significant if mission

success was contingent on the successful operation of one out of the three trains, but

this component could become more risk-significant if the success criterion was

two-out-of-three or three-out-of-three trains. Section A.5 of this appendix discusses the

review of the success criteria used in accident sequence modeling.

c. Evaluation Findings

Reviewers should verify that information provided and review activities conducted support the

following conclusions:
19.2-45 June 2007

• The licensee has adequately considered the effects of proposed changes on the

structure and logic of the event trees.

• The licensee has addressed the effects of the application on sequence dependent

failure analysis, sequence timing, and success criteria.

A.3 System Modeling Analysis (Fault Trees)

a. Areas of Review

Fault trees are used to depict the logical interrelationships of credible plant events (component

hardware failures, human errors, or other pertinent events) that can lead to particular failure

modes of plant systems in the context of their environment and operation. In RIR, the majority

of proposed changes would only be expected to impact the parameters that are used to

quantify the event probabilities modeled in the fault trees. In such cases, the change will not

affect the fault tree logic models themselves. However, in cases where the change relates to a

system design change, or where the licensee is proposing temporary changes that require

reconfiguration of the system into ones that are not currently modeled, the revised fault trees

should be one focus of the review.

Other considerations of which reviewers should be aware in the area of system analysis are

whether the application can impact support functions in such a way as to alter the

dependencies in the model, and whether the application can impact system performance to an

extent that would require changes to the fault tree logic or modeling assumptions.

b. Review Guidance and Procedures

When the review of one or more of the system logic models becomes necessary, this review

should include a study of the appropriate system notebooks from the base PRA to understand

the modeling characteristics that may be affected by the change. It should also include an

evaluation of the licensee’s process for modeling the system change as well as a spot-check of

the revised system models and results. Reviewers should verify that, in modeling the change,

the licensee appropriately modified the system logic models to reflect changes in the plant’s

configuration, including changes to the system design, system performance characteristics,

system alignments, operational procedures, and operational philosophies. In particular,

reviewers should address the following considerations:

• The analysis of the change should account for the effects of the change on the definition

of system success. That is, if the proposed application affects component

configurations, expected operability conditions, failure modes and their effects, and

alternative success and potential failure paths, these should be taken into account. In

addition, the licensee should show that the justification used in the original analysis to

exclude components, component failure modes, or flow diversion paths, etc., remain

valid in light of the proposed change. The analysis should also identify and account for

changes that could affect environmental conditions that could cause system failure (e.g.,

room temperature, containment pressure).

• The analysis should account for interfaces with other systems and dependence on

support functions; this is particularly important if dependencies on motive power, control

power, component cooling, room cooling, or any interlocks have been altered by an

application. Other dependencies that licensees should consider include the dependency

on automatic system initiation and the conditions that must exist for automatic start,
19.2-46 June 2007

essential manual actions to initiate or control the system, and the resources required to

fulfill mission success (e.g., water sources, air, fuel oil). When applicable, licensees

should factor these dependencies into the analysis of the change.

• When proposed changes deal with proceduralized test and maintenance actions or

applicable technical specification conditions, the modeling of test and maintenance

unavailabilities and the modeling of restoration errors for the affected

systems/components should be reviewed. Changes to the frequency of each test or

maintenance activity, its approximate duration, the components repositioned for the

action, the verification activities after test and maintenance, and the availability of the

system during the test procedure should have been factored into the change analysis.

• Operational history (i.e., plant-specific operational experience) should be considered in

the review of the system models and especially in the review of how the proposed

change will affect system operation. Considerations like recurring check valve problems

(e.g., back-leakages), water hammer events, or flow blockages by sludge or debris

should also be considered in the analysis.

• The potential for common cause failures, including those potentially resulting from the

change, should have been evaluated and modeled where appropriate. Review guidance

for the evaluation of common cause failures is provided in Section A.7 of this appendix.

• The function of the modeled system should remain consistent with that required in the

event tree models. Success criteria and event sequence conditions should be correctly

modeled and consistent with the definition in the event trees.

When fault tree solutions in the form of function cutsets are available, an efficient way to review

for the logic in system models is to study the cutsets produced by the solution of the linked fault

trees (i.e., the fault tree formed by linking the support system fault trees to the system fault

tree). In performing this visual inspection, reviewers should compare the results with

expectations based on their understanding of functional and support system dependencies. The

effects of events such as operator actions or common cause failures can also be easily verified

by an inspection of the function cutsets. When expected combinations of failures are not

present, reviewers should check to see if these failures have been modeled, or if they have

been truncated during model solution, or if the fault tree logic is incorrect (e.g., an AND gate in

place of an OR gate). In short, a review of cutsets can be one way to focus further reviews on

other parts of the system modeling analysis.

c. Evaluation Findings

Reviewers should verify that information provided and review activities conducted support the

following conclusion:

The evaluation adequately reflects changes in the plant hardware or procedures,

including changes to the system design or alignments, system performance

characteristics, support system dependencies, and operational procedures or

operational philosophies. Where applicable, these changes are appropriately included in

the PRA system models.

A.4 Dependent Failure Analysis

a. Areas of Review
19.2-47 June 2007

Accident progression models and system models should correctly account for dependencies

between systems and operator actions needed for accident mitigation. Proposed changes to

the plant's design or operations could affect these dependencies; therefore, the evaluation of

the risk change should also consider system-operator dependencies. However, since the

modeling of these dependencies requires detailed knowledge of the plant systems and

procedures, it will not be practical (nor is it intended) for reviewers to verify that all

dependencies have been included in the change evaluation. Instead, reviewers should verify

that the evaluation used a comprehensive and systematic process to look for these

dependencies. Reviewers should rely on their experience with similar change analyses (when

applicable) or with PRAs of similar plants, but should be aware that dependencies are in many

cases plant-specific and will depend on plant-specific system capabilities and interactions,

procedural guidance, and timing of potential accident sequences.

b. Review Guidance and Procedures

Review guidance in this section consists of a discussion of the dependencies that could be

important and that could be affected by changes to the plant’s design or operations. Although

most changes will not alter the original PRA dependent failure analysis, some design or

procedure changes could introduce new dependencies or affect existing ones. Therefore,

reviewers should be cognizant with regard to the following types of dependencies that could

exist and could affect the results of the change analysis:

Functional Dependencies: These dependencies occur because the function of one system or

component depends on that of another system or component. Functional dependencies include

interactions that can occur when the change in the function of a system or component causes a

physical change in the environment that results in the failure of another system or component.

Functional dependencies include the following examples:

• Shared component dependencies (e.g., systems or system trains that depend on a

common intake or discharge valve),

• Actuation requirement dependencies (e.g., systems that depend on common actuation

signals, common actuation circuitry, or common support systems like AC or DC power

or instrument air for initiation or actuation) and conditions needed for actuation (e.g., low

RPV water level),

• Isolation requirement dependencies (e.g., conditions that could cause more than one

system to isolate, trip, or fail), including environmental conditions (temperature,

pressure, and/or humidity), temperature and pressure of fluids being processed, water

level status, and radiation levels,

• Power requirement dependencies (e.g., systems that depend on the same power

sources for motive power),

• Cooling requirement dependencies (e.g., systems that depend on the same room

cooling subsystem, or the same lube oil cooling subsystem, or systems that depend on

the same service water or component cooling water train for cooling),

• Indication requirement dependencies (e.g., systems that depend on the same pressure,

temperature, or level instrumentation for operation),
19.2-48 June 2007

• Phenomenological effect dependencies (e.g., conditions generated during an accident

sequence that influence the operability of more than one system), including generation

of harsh environments that result in protective trips of systems, loss of pump net positive

suction head (NPSH) when containment heat removal is lost, clogging of pump strainers

from debris generated during a LOCA, failure of components outside the containment

following containment failure attributable to harsh environment inside the containment,

closure of safety relief valves in BWRs on high containment pressure, and coolant pipe

breaks or equipment failures following (or resulting from) containment failure,

• Operational dependencies (e.g., unavailability of the suppression pool cooling mode for

a train of the residual heat removal system when the system is in the low pressure

coolant injection mode).

Reviewers should look for evidence that the licensee properly considered the above types of

dependencies in the evaluation of the change. In most cases, these dependencies should be

explicitly included in the fault tree or event tree logic models; however, in some cases, a

qualitative evaluation process may be sufficient.

Human Interaction Dependencies: These dependencies could become important contributors to

risk if operator error can result in multiple component failures. Past PRAs show that the

following plant conditions could lead to human interaction dependencies that can become

important:

• Tests or maintenance that require multiple components to be reconfigured,

• Multiple calibrations performed by the same personnel,

• Post-accident manual initiation (or backup initiation) of components that require the

operator to interact with multiple components.

Reviewers should verify that the licensee's evaluation of risk from proposed changes to plant

procedures or changes to operator training included a process to identify these (or similar)

activities, and that the licensee evaluated the activities that could be risk contributors.

Component Hardware Failure Dependencies: These dependencies, usually referred to as

common cause failures (CCFs), cover the failures of usually identical components that may be

caused by design, manufacturing, installation, calibration, or operational deficiencies. CCFs are

treated quantitatively by common cause failure probabilities or other dependence quantification

approaches. Section A.7 of this appendix presents review guidance related to CCFs.

Spatial Dependencies: Multiple failures could be caused by events that fail all equipment in a

defined space or area. These spatially dependent failures include those caused by internal

flooding, fires, seismic events, missiles (e.g., turbine missiles), or any of the other external

event initiators. In cases where these events could affect the results of the change evaluation,

and where these events are not modeled in the PRA, the dependencies resulting from the

unmodeled initiators should be evaluated qualitatively as part of the integrated decisionmaking

process. Subsection III.2.2 of this SRP section discusses the required scope of the PRA in

more detail. In addition, the change request should include the licensee's consideration of the

common influences on component operation such as adverse environment (including excessive

temperature, humidity, radiation), inadequate space, inadvertent or spurious sprinkler operation,

or routine equipment travel near major components. Reviewers should verify that the change
19.2-49 June 2007

request has used a systematic process to identify potential spatial challenges that could result

in multiple failures of SSCs.

c. Evaluation Findings

Reviewers should verify that information provided and review activities conducted support the

following conclusion:

Dependencies between system and operator interactions have been properly accounted

for in the evaluation of the proposed change. Where appropriate, these dependencies

have been included in the accident progression models (event trees) and the system

analysis models (fault trees).

A.5 Determination of Success Criteria

a. Areas of Review

Guidance in the PRA policy statement and in Regulatory Guide 1.174 stipulates that realistic

analysis should be used in PRA implementation. The following discussion is intended to sort out

what is meant by "realistic" analysis of success criteria by reference to SAR analysis. In order to

fulfill its intended purpose, SAR analysis is ordinarily based on a set of assumptions containing

significant embedded conservatisms. SAR analysis also reflects a postulated single active

failure, in addition to whatever event initiated the sequence. When an SAR analysis shows a

successful outcome, there is good reason to believe that (apart from beyond-single-failure

scenarios) the system will meet or exceed performance requirements for the initiating event

considered.

Applying the SAR mission success criterion in a PRA would be conservative, in the sense that

the probability of failure to meet this performance standard would be greater than probability of

failure to meet a more realistic performance standard. However, re-analyzing event sequences

with conventional SAR tools would be too burdensome to apply to the large number of

scenarios that are defined in the course of a PRA. In addition, the rather specialized computer

codes used in SAR analysis may not be appropriate in beyond-single-failure scenarios.

Traditionally, development of mission success analyses in PRAs has ranged from the use of

faster running models that might not have the same level of quality assurance as the

conventional SAR tools to the extrapolation of results from analyses performed on similar

plants.

In order to satisfy the Commission’s guideline, then, reviewers should find that the licensee has

not distorted the PRA insights by using a systematically conservative bias in mission success

criteria and that mission success criteria used to justify changes to the plant’s design or

operations have a sound technical basis.

b. Review Guidance and Procedures

When it is determined that the results and conclusions of a risk-informed application are

especially sensitive to the choice of mission success criteria, or if the modeling is particularly

controversial, reviewers should evaluate the relevant success criteria and the basis for each.

If the basis is analytical, it may be appropriate to evaluate the code and the input data used.

When it is determined that the computer codes used have not received adequate licensee or

other industry review, closer examination of the models should also be considered.
19.2-50 June 2007

The models, codes, and inputs used to determine mission success criteria should meet QA

standards that are consistent with generally accepted methods. Standards should include

configuration control of the analysis inputs and results. The standards do not have to be the

same as the standards applicable to SAR analysis, but they should be explicit (i.e., engineering

calculations and codes should be verified and quality assured) and they should be formalized

as part of the licensee’s QA program.

In cases where the basis for the success criteria is lacking, reviewers should either request

additional licensee justification or seek independent analysis. Licensee justification could

include the use of alternative plausible models to justify the conclusions (thus addressing the

model uncertainty) or the redesign of the change such that the change is not affected by the

choice of success criteria.

Some mission success criteria can validly be extrapolated between similar plants when a firm

basis for the criteria is created at the first plant and when the licensee shows that plant-specific

features do not invalidate the comparison.

On an application-specific basis, reviewers should determine whether the definition of the

system success criteria will be affected by the application-specific elements or by the elements

in the same minimal cutset or accident scenario as the application-specific element. Reviewers

should ensure that the success criteria are not so optimistic that they underestimate the

required number of components (i.e., overestimate the size of the minimal cutset).

c. Evaluation Findings

In cases where conclusions are sensitive to the mission success criteria, the reviewers should

verify that information provided and review activities conducted support findings equivalent to

the following:

A technical basis has been established for the mission success criteria used in the

analysis. Analytical elements of the technical basis have received an appropriate level of

configuration control and quality assurance. Where comparison with analogous criteria

from other plants is possible, this comparison has been justified.

A.6 Use of Appropriate Data

a. Areas of Review

In risk-informed applications, it is important that the licensee use appropriate SSC failure data.

While plant-specific data is preferred, for plants with little operating history the only choice might

be the use of generic data. Furthermore, when the impact of the change is being modeled as a

modification of parameter values, sufficient plant-specific data may not exist to support the

modification. The data-related issues are summarized as follows: (a) if the impact of the

application is to be modeled as a change in parameter values associated with basic events

representing modes of unavailability of certain SSCs, these changes should be reasonable and

should be supported by technical arguments including plant-specific and generic operational

information (when available) and (b) the impact of the change should neither be exaggerated

nor obscured by the parameter values used for those SSCs unaffected by the change.

b. Review Guidance and Procedures
19.2-51 June 2007

It is to be expected that, for a PRA that has undergone a technical review, parameter values will

have been judged to be appropriate, whether they have been evaluated using generic or

plant-specific data. However, since the review was focused on the PRA as a base case model,

a different perspective on the appropriateness of parameter values may be required for specific

applications. Therefore, in evaluating PRA applications, reviewers should focus on those

parameter values that have the potential to change the conclusions of the analysis. For

example, parameters associated with SSCs that appear in the same cutsets or scenarios as the

affected SSCs have the potential to distort the conclusions by decreasing the assessed

importance of the change if their values are too low, or by increasing it if their values are too

high. Similarly, parameters that contribute to the cutsets or scenarios that do not contain

affected SSCs can decrease the importance of the change by being too high or increase it by

being too low.

The failure rates and probabilities used, especially those that directly affect the proposed

application, should appropriately consider both plant-specific and generic data. The staff

expects that these values will be consistent with generally accepted values from PRAs of similar

plants, or the licensee should justify significant deviations on the basis of plant-specific factors.

"Significant" in this context can be defined as no greater than a factor of 3 for the mean values

of the failure rate or failure probability. The focus of the review should be on those parameter

values that have a significant impact on the results as discussed above and that deviate

significantly from the generally accepted norm.

If the reviewer decides that a more detailed review of the parameter values is appropriate, the

following guidance applies. For plant-specific data, reviewers should determine how the

licensee used plant records to estimate the number of events or failures, the number of

demands, and the operating or standby hours. Reviewers should verify the consistency

between the definitions of failure modes and component boundaries used in the risk analysis

and the corresponding definitions used in the plant records. When reviewing generic data, it is

important to verify that the plant component is typical of the generic industry component. In

cases where generic failure rates are used in combination with plant-specific data like test

intervals, reviewers should verify that the generic data are applicable for the range of plant data

used.

When evaluating the impact of the change, it is important for reviewers to recognize the

assumptions that have gone into developing the PRA model. For example, two models are

commonly used for events representing the unavailability of a standby component on demand:

the standby failure rate model and the constant probability of failure on demand model. The

constant probability of failure on demand parameter may be estimated on the basis of an

assumed number of demands, implying an average test interval. Use of such a model to

investigate the impact of extending test intervals can result in large differences between the

unavailabilities of components for which the test intervals differ significantly. Reviewers should

be sensitive to this effect, and should ascertain that licensees use appropriate models and

parameters for such evaluations.

As another example, in considering plant-specific failure data, poorly performing individual

components may have been grouped with other components, allowing their poor performance

to be averaged over all components of that type. Poor performance may arise because of

inherent characteristics of one member of what would otherwise be considered a uniform

population, or may arise because components are operating in a more demanding environment.

If these components are grouped together with others for which the operating conditions are

more favorable, the failure rates used for the poor performers could be artificially lowered. If

requirements are relaxed on the basis of the group failure rate, reduced programmatic attention
19.2-52 June 2007

to these poor performers could lead to a greater-than-expected probability of experiencing an

inservice failure of one of these components. Reviewers should be aware of such effects, and

should ensure that the components are grouped appropriately.

When the impact of the change is modeled as a change in the parameter values associated

with specific basic events representing modes of unavailability of SSCs, reviewers should focus

on whether the change in parameter values is appropriate and reasonable. The licensee is

expected to document the rationale behind the change in parameter values, and that rationale

should be carefully reviewed.

If generic values are used for the base case parameter values that are candidates for change,

reviewers should verify that the conditions under which the generic data apply do not

correspond to those which would be more appropriate for a plant with the change incorporated.

This should only be a real concern if the plant being changed is somewhat atypical with respect

to the issue being addressed by the change. This would not be a concern if plant-specific data

were used.

Finally, to validate the data used to justify changes in risk-informed applications, it is important

for licensees to monitor the performance of components affected by the application. This

monitoring should be performed as the proposed application is phased in. For very reliable

SSCs, it may be necessary for the licensee to review available operating experience at other

plants for applicability to the licensee’s plant to expand the operating experience database.

Reviewers should ascertain that the monitoring program is capable of demonstrating that the

performance of the components or systems is in accordance with what has been assumed.

c. Evaluation Findings

Reviewers should verify that information provided and review activities conducted support the

following conclusions:

• The failure rates and probabilities used, especially those that directly affect the

proposed application, appropriately consider both plant-specific and generic data that

are consistent with generally accepted values from PRAs of similar plants, and

deviations (if any) have been justified on the basis of plant-specific factors.

• The licensee has systematically considered the possibility that individual components

could be performing more poorly than the average associated with their class, and has

avoided relaxation for those components to the point where the unavailability of the poor

performers would be appreciably worse than that assumed in the risk analysis.

• The changes to the parameter values impacted by the application are both justified and

reasonable.

• Data used to support changes to the plant's design or operations are supported by an

appropriate performance monitoring program.

A.7 Modeling of Common Cause Failures

a. Areas of Review

Common cause failures (CCFs) represent the failures of components that are caused by

common influences such as design, manufacturing, installation, calibration, or operational
19.2-53 June 2007

deficiencies. Since CCFs can fail more than one component at the same time and can occur

with greater probability than would be predicted by the product of the individual component

failure probabilities, they can significantly contribute to plant risk.

Risk-informed applications that cover SSCs as a group have the potential to affect the CCF

probabilities of SSCs within the given group. For the affected components, CCF probabilities

could be low or might not even be included in the baseline PRA models based on the

operational and engineering evidence driven by current requirements. With proposed changes,

there should be assurance that the CCF contribution will not become more significant. In

addition, the assessment of the impact of the change can be affected by the CCF probabilities

for other components, and can either be exaggerated or obscured depending on the CCF

probabilities.

b. Review Guidance and Procedures

Reviewers should verify that the PRA addressed potentially significant CCFs and that, where

applicable, the CCF modeling has incorporated the effects of the proposed changes. The staff

evaluation should include a review of the process used to select common cause component

groups. Specific review guidelines related to risk-informed applications and the assessment of

the change are as follows:

• Reviewers should verify that industry and especially plant-specific experience involving

the failure of two or more components (especially for the application-specific

components) from the same cause was analyzed and incorporated into the risk model

where appropriate.

• For relevant applications, reviewers should check that licensees have appropriately

modeled the CCF of groups of equipment that were proposed for the change. In cases

where the effects of the application on CCF cannot be easily evaluated or quantified,

reviewers should establish that performance monitoring is capable of detecting CCF

before multiple failures are likely to occur subsequent to an actual system challenge. In

addition, to reduce fault exposure times for potential common cause failures, phased or

incremental implementation should be considered as part of the effort to protect against

CCF.

• Reviewers should ensure that the impact of the change is not inappropriately made

insignificant by the choice of CCF probabilities for SSCs unaffected by the change. This

can occur in two ways. First, the cutsets or scenarios containing events that represent

failures of SSCs affected by the change may include CCF contributions from other

SSCs that are too small. Second, the contribution of cutsets or scenarios that do not

contain affected SSCs may be artificially increased by having CCF contributions that are

too large so that the impact of the change is obscured. These cases will impact

applications involving risk categorization by lowering the relative contribution (and

importances) of the affected SSCs. An understanding of these effects can be obtained

from sensitivity analyses performed by removing the pertinent CCFs or by using more

realistic values for the CCFs.

• A common modeling approximation is to include CCF contributions only from that

combination of SSCs that fails the function of the system. For example, if system

success is defined as success of one out of four components, usually only a single term

representing a CCF of all four components is included. If the success criterion were two

out of four, the corresponding CCF term would represent failure of any three or all four
19.2-54 June 2007

SSCs in the group. While probabilistically this usually corresponds to the dominant

contributions, care has to be taken when the application relies on assessing the impact

on risk of having one train unavailable. In this case, the effective success criterion of

the remaining part of the system changes, so that in the case of the one-out-of-four

system, a CCF of three SSCs becomes a possible contributor. The impact of not

modeling the lower-order CCF contributors should be investigated. Note that this can

impact applications for which the justification of the change relies on risk categorization,

as well as those that require an evaluation of changes to risk.

c. Evaluation Findings

Reviewers should verify that information provided and review activities conducted support the

following conclusions:

• Common cause failure has been suitably addressed, and the licensee has

systematically identified component groups sharing attributes that correlate with CCF

potential and that affect the application.

• Where applicable, the licensee's performance monitoring program addresses a phased

implementation approach to reduce the potential for increased incidence of CCFs

attributable to the proposed change.

A.8 Modeling of Human Performance

a. Areas of Review

The results of a PRA, and therefore the input it provides to risk-informed decisionmaking, can

be very strongly influenced by the modeling of human performance. Plant safety depends

significantly on human performance, so it is essential that the PRA treat it carefully. However,

the modeling of human performance, typically referred to as human reliability analysis (HRA), is

a relatively difficult area; significant variations in approach continue to be encountered, and

these can yield significantly different estimates of human error probabilities (HEPs) for what

appears to be similar human failure events. The particular values used for HEPs can

significantly influence results of the assessment of the impact of a proposed change.

In addition to the quantification issue, there are questions related to what kind of human actions

can appropriately be credited in the context of a particular regulatory finding. As an example,

suppose that PRA results appear to support relaxation of requirements for a component based

on the argument that even if the component fails, its failure can be recovered with high

probability by operator actions outside the control room. The issues of concern here are

whether the modeling of the operator action and the evaluation of the failure probability is

appropriate, and whether this kind of credit is the sort of compensating measure that is

intended by staff guidance to support justification of a relaxation. One further issue involves the

impact of human performance that is not explicitly modeled, but is implicit in certain parameter

values. An example is the influence of human performance on initiating event frequency. The

causes of initiating events are typically not addressed; their impact is included in the frequency

in an implicit way.

b. Review Guidance and Procedures
19.2-55 June 2007

Reviewers should understand the potentially significant human performance issues that might

be affected by the application and how these are reflected in the PRA. This understanding

requires a review of the approach used to estimate human error probabilities.

The HRA can impact the assessment of the change in several ways. First, the change may

directly affect the human failure events (HFEs). Second, the HFEs may represent responses to

failures of the SSCs impacted by the change. Finally, HFEs unrelated to the change can

obscure or exaggerate the impact of the change (depending on their values) by inappropriately

increasing or decreasing the value of the accident sequences unaffected by the change.

When the change directly impacts the HFEs (e.g., as a result of a procedure change or a

change in operating practice), reviewers should ensure that the licensee appropriately modeled

the impact; that is, reviewers should ensure that the licensee addressed the following

considerations:

• Whether new human actions are introduced or whether existing actions are modified or

eliminated,

• Whether the change affects factors assumed to impact the likelihood of failure (usually

called performance shaping factors or PSFs), including the quality of the procedures;

the cues available to the operators; the quality of the information (instrumentation)

available to the operators; the quality of the human-machine interface; the location of

the interface(s); the complexity of the task; the conditions or context within which the

operators are responding, including previous failures, previous actions, etc.; the time

available to perform the task; the quality of the training (type and frequency) on the

specific event; the crew interactions and their potential for recovery from errors; and the

stress on the operators,

• Whether the human action dependency analysis is affected,

• Whether the application introduces or modifies dependencies between plant

instrumentation and human actions,

• Whether the screening analysis is affected.

When HFEs represent responses to failures of the SSCs impacted by the change, reviewers

may want to focus their resources on these HFEs in the following ways:

• Identify any human actions that compensate for events affected by the proposed

application, and ensure that the licensee did not claim inappropriate credit for these

events. For human actions that are used to compensate for a basic event probability

increasing as a result of proposed changes, licensee actions to ensure operator

performance at the level credited in the risk analysis should also be a part of the change

request.

• Ensure that appropriate justification is provided when the licensee takes credit for

post-accident recovery of failed components (repair or other non-proceduralized manual

actions, such as manually forcing stuck valves to open). Reviewers should also

ascertain whether the identified recovery action is obvious, feasible (given the time and

physical constraints), and supportable by plant programs such as training.
19.2-56 June 2007

• Ensure that the licensee assessed whether the conditions under which the human

actions are to be performed have changed significantly so that the HEP should be

modified.

Reviewers should also be aware that the impact of the change can be obscured if the accident

sequences that do not contain affected SSCs are artificially increased in value by HEPs that are

too large. These cases will impact applications involving risk categorization by lowering the

relative contribution of the affected SSCs. An understanding of these effects can be obtained

from sensitivity analyses performed by removing the pertinent HEPs or by using more realistic

values for the HEPs.

Another consideration associated with the potential masking of important SSCs is that the

SSCs might not be included in the model used to perform the evaluation of risk. This can

happen in several ways:

• Cutsets or scenarios containing the SSCs may be truncated because HEPs in the same

cutset or scenario are too low. Such truncation should only be a concern if the logic

model was not re-solved to determine the change in risk (for example, in applications

that depend on SSC risk ranking using a pre-solved equation). The preferred resolution

to this would be a request for re-solution with the appropriate changes made to all

affected SSCs. Section A.9 of this appendix discusses this in more detail.

• SSCs may not be included in the logic model structure because HEPs are so high that

they are assumed to dominate the unavailability of a function, and therefore the

associated hardware is not modeled. However, the hardware could still be a contributor

to the calculation of risk importance. For example, the hardware (as a group) will have

the same risk importance (in terms of Risk Achievement Worth) as the associated HFE.

This suggests that the licensees should identify the important operator actions for

applications in RIR, as well as the equipment required to perform the specific function

associated with the action. The equipment should then be dispositioned in accordance

with its importance in achieving that function.

• For some complex groups of operator actions (e.g., the response to an anticipated

transient without scram (ATWS) in a BWR, or the choice to go to recirculation rather

than residual heat removal (RHR) in response to a small LOCA in a PWR), the PRA

analysts may have chosen to adopt a bounding approach to the accident scenarios that

precludes having to address subsequent actions. This could mean that the equipment

associated with those actions might be overlooked in the change process.

c. Evaluation Findings

Reviewers should verify that information provided and review activities conducted support the

following conclusions:

• The modeling of human performance is appropriate.

• Post-accident recovery of failed components is modeled in a defensible way. Recovery

probabilities are realistically quantified. The formulation of the model shows

decisionmakers the degree to which the apparently low risk significance of certain items

is dependent on credit for recovery of failed components (restoration of component

function, as opposed to actuation of a compensating system).
19.2-57 June 2007

• When human actions are proposed as compensatory measures as part of a proposed

change, licensee actions to ensure operator performance at the level credited in the risk

analysis (e.g., by training, procedures, etc.) are also a part of the change request.

A.9 Sequence Quantification

a. Areas of Review

The staff would not generally anticipate the need to perform a detailed review of the

quantification of the change in risk; however, some details of the quantification process should

be confirmed. Specifically, reviewers should be confident that the licensee's evaluation process

is sufficient to account for the potential effects of the proposed change on modeling

simplifications and assumptions made during the quantification of risk. In addition, the

reviewers should ensure that the chosen sequence truncation limits are appropriate so that

important sequences are not discarded and final results are not sensitive to the chosen

truncation limit.

b. Review Guidance and Procedures

Reviewers should verify that model simplifications and assumptions made during the

quantification process are properly accounted for in evaluating of the change in risk, as

illustrated by the following examples:

• Reviewers should ensure that the licensee accounted for model asymmetries during the

application of the PRA models. Asymmetries could result from modeling assumptions

(e.g., assuming one train to be the operating train, and the second train to be the

standby train), from differences in support system alignment, or from actual differences

in system design or operating procedures. The licensees should have accounted for

these asymmetries when evaluating changes to the affected systems.

• Reviewers should ensure that, if cutset/sequence deletion is performed during

quantification, these are correctly addressed in the assessment of risk change. In some

quantification processes, cutsets that contain combinations of maintenance actions that

are disallowed by the Technical Specifications are deleted from the accident sequence

equations after the merging of functional cutset equations. This is done to avoid undue

conservatism. If the PRA application deals with Technical Specification allowed outage

issues, reviewers should confirm that any impacts on such deletions have been correctly

addressed.

• Reviewers should ensure that, if operator recovery actions are incorporated after the

initial quantification, these actions are still valid in light of the proposed change. Section

A.8 of this appendix discusses this in more detail.

• Circular logic in fault trees will cause the quantification process to abort. This is a

problem for systems such as the emergency service water system, which provides

cooling to the emergency diesel generators, but requires power from those diesel

generators when offsite power is lost. Another example is the mutual dependency

between the DC and AC power systems. In situations such as these (i.e., when the

physical situation has embedded circular dependencies), analysts have to break this

circularity to allow for model solution. For changes on systems that are affected by

circular logic, reviewers should investigate the manner in which the circularity was
19.2-58 June 2007

broken (usually in the sequencing of functions in the event tree) and should verify that

the dependency is still being accounted for in the evaluation of the risk change.

Sequence Truncation

Licensees may calculate the change in risk from the application by requantifying the base PRA

model so that the potential effects of originally truncated events can be accounted for should

they become important as a result of an application. If the licensee did not requantify the

model, or if the application depended on the risk ranking of SSCs from a pre-solved equation,

reviewers should use the guidelines provided below.

Reviewers should be assured (either by documentation provided in the licensee’s submittal or

by an independent staff analysis) that cutset or scenario truncation did not introduce errors into

the application results or the logic of the PRA that affects the application. The staff review

could also involve performing (or reviewing) sensitivity studies where the truncation limit is

lowered for the dominant sequences and event initiators, as well as studying the resultant

cutsets or scenarios to see if there are any hidden dependencies or unusual/unexpected event

combinations (especially if these involve components affected by the proposed application).

Reviewers could also include comparing a list of the events affected by the application that is in

the final truncated cutset equations to the list of application-specific basic events used in the

fault tree and event tree models. This yields a list of events that did not make it pass the

truncation process. Documentation should be available to enable reviewers to determine the

reason truncated events are not important to risk.

Finally, in PRA models where common cause failures and human dependencies are

incorporated at the sequence level after a truncated set of minimal cutsets has been obtained,

reviewers should verify that the truncation criteria used in the PRA do not lead to cutsets

involving application-specific components being truncated that could be important if common

cause failures or human dependencies are considered.

c. Evaluation Findings

Reviewers should verify that the information provided and review activities conducted support

the following conclusions:

• The change is appropriately modeled and is properly quantified.

• The licensee has satisfactorily established that conclusions are not adversely affected

by truncation either because (i) the change in risk from the application was calculated by

the requantification of the base model, or (ii) if model requantification was not

performed, or if the application depended on the risk ranking of SSCs from a pre-solved

cutset equation, the following apply:

< The truncation criterion is sufficiently low to ensure stable results, that is, the

magnitude of the CDF or release frequency will not change as a result of lower

truncation limits, and the grouping of SSCs into risk categories will not be

affected.

< The components affected by the application are, for the most part, not truncated

out of the model. In cases where they are, a qualitative assessment can

demonstrate the reasons why they are unimportant to risk.
19.2-59 June 2007

A.10 Modeling of Containment Response and Changes in Large Early Release Frequency

a. Areas of Review

The purpose of this section is to provide guidance for use in reviewing the licensee’s evaluation

of changes in LERF stemming from proposed changes to the plant’s design or operations.

In general, only a subset of CDF sequences will be affected by a change. Whether or not this

subset contributes significantly to LERF depends on several plant-specific characteristics. This

section focuses on the characteristics that strongly affect LERF and identifies review

approaches based on these characteristics. It also provides guidance to help reviewers identify

the major items related to functional plant capability that directly affect the potential for large

early release, to direct reviewers in establishing whether the proposed changes can affect this

capability, and to determine whether the licensee has appropriately addressed these items in

estimating changes in LERF.

b. Review Guidance and Procedures

There are several ways in which a change to the plant’s design or operation can significantly

alter LERF, including those that:

• Change the frequency of containment bypass sequences (e.g., steam generator tube

ruptures and interfacing system LOCAs).

• Change the frequency of core damage sequences that pose severe challenges to

containment (e.g., sequences resulting in elevated reactor coolant system (RCS)

pressure during core damage and at vessel failure).

• Change the performance of systems involved in containment safety functions (e.g.,

containment isolation, containment heat removal, containment sprays, hydrogen

control).

• Change the performance of systems or operator actions that affect accident

management strategies (e.g., depressurization, venting).

• Change the frequency of core damage sequences occurring at shutdown with

containment functionality reduced.

The guidance provided below focuses, for each plant type, on particular examples of these

general categories.

Based on previous PRAs, NUREG/CR-6595 developed some insights on the factors that most

strongly affect the estimated likelihood of a large early release. Although plant-specific details

may become significant in some cases, it was found that plants of each major containment type

tend to be similar in the types of sequences that could lead to a large early release, reflecting

strengths and weaknesses of that containment structure and particular features of the core

damage sequences that characterize that plant type. Based on these insights,

NUREG/CR-6595 presents a screening approach to evaluate the frequencies of dominant

containment failure modes and bypass events. The purpose of this approach is to provide

estimates of LERF, given certain characteristics of core damage sequences as input.
19.2-60 June 2007

The review approach presented in this section builds upon the underlying insights from

NUREG/CR-6595. For each major containment type, particular considerations are suggested

for attention in the review process. However, it is not intended to suggest that these

considerations exhaust the technical issues that affect the potential for large early release. For

example, where plant-specific PRA Level 2 analyses exist, these could provide further insights

into LERF considerations for that plant.

For each major containment type, the factors that most strongly affect the potential for large

early release (given that a core damage sequence is underway) are as follows:

PWR Large Dry: Containment bypass

Containment isolation

RCS depressurization

Emergency core cooling (ECC) restoration before vessel failure

PWR Ice Condenser: Containment isolation

Containment bypass

Hydrogen igniters

RCS depressurization

ECC restoration before vessel failure

BWR Mark I and II: Containment isolation

Containment bypass

Venting

Containment heat removal: decay heat

Containment heat removal: ATWS

RCS depressurization

ECC restoration before vessel failure

BWR Mark III: All Mark I and Mark II issues

Igniters

It should be noted that, at some BWRs, many sequences that result in vessel breach have a

significant probability of also failing the containment. Also, the reader should note that a loss of

containment heat removal may significantly contribute to CDF.

In reviewing the calculation of change in LERF for a given plant type, reviewers should consider

the following factors:

Containment Bypass:

• Whether the proposed change affects systems that are credited in the prevention of, or

in response to, an initiating event involving a steam generator tube rupture (SGTR) or

an ISLOCA.

• Whether the proposed change affects the frequency or severity of transients that could

result in induced steam generator tube ruptures (ISGTR) (i.e., tube rupture in the course

of an accident, caused by elevated temperatures and/or elevated pressure differentials).

If the proposed change does not directly affect steam generator tube integrity, and the

steam generators in the plant are not experiencing significant degradation, only a

qualitative analysis may be needed to ensure that the risk of ISGTR is not significantly

increased by the proposed change. However, if the plant has suffered a steam
19.2-61 June 2007

generator tube rupture, or has been shut down because of excessive steam generator

tube leakage, or has detected tubes that do not meet applicable ASME Code

requirements for structural integrity, or has repaired a significant amount of tubes as a

result of free span degradation, the application should provide a more thorough analysis

of the effects of the proposal on the risk associated with ISGTR.

Containment Isolation:

• Whether the proposed change affects systems that perform or support the isolation

function.

• Whether the proposed change affects systems that prevent or mitigate core damage

sequences initiated during periods of reduced containment functionality (e.g.,

shutdown).

• Whether the proposed change affects the ability to restore containment function during

such periods (e.g., AC power, plant procedures).

Igniters:

• Whether the proposed change affects the igniters or any applicable support systems.

ECC Restoration Before Vessel Failure:

• If credit was taken in the estimate of LERF for recovery of cooling before vessel failure,

whether the proposed change affects performance of any system thus credited

(including support systems).

• Whether the proposed change affects other accident management strategies credited in

the PRA (e.g., external vessel flooding).

RCS Pressure at Vessel Failure:

• Whether the proposed change affects the capability to depressurize the RCS.

Venting:

• Whether the proposed change affects the capability to vent the containment.

 Containment Heat Removal:

• Whether the proposed change affects systems credited in containment heat removal

(including front-line and support systems).

• Whether the proposed change affects the frequency or severity of ATWS sequences.

For each of the above considerations that apply, reviewers should ascertain that the licensee

adequately evaluated the effects and took them into account in calculating the change in LERF.
19.2-62 June 2007

c. Evaluation Findings

Reviewers should verify that information provided and review activities conducted support the

following conclusions:

The calculation for the change in LERF resulting from a proposed change has

systematically taken into account the dominant causes of containment failure. In

particular, the calculation has considered bypass sequences; sequences posing

relatively severe challenges to containment or sequences occurring during periods of

reduced containment functionality (shutdown); performance of systems involved in

containment safety functions, including containment heat removal, sprays, isolation, and

restoration of containment functionality (shutdown); and performance of systems

involved in accident management strategies.

A.11 Bibliography

This section provides a list of documents that the staff reviewers could use as reference or

background material during the review process. This bibliography is divided into general

categories in the areas of desirable PRA attributes, review of the PRA, uncertainty and

sensitivity analyses, and use of the PRA in risk ranking. In addition, a bibliography is provided

for each of the review categories discussed in Sections A.1 through A.10 of this appendix.

General - Desirable PRA Attributes

Electric Power Research Institute. "PSA Applications Guide." EPRI TR-105396. EPRI: Palo

Alto, CA. August 1995.

Electric Power Research Institute. "Development of a Quality Pedigree Process and

Application to the Duane Arnold Energy Center Probabilistic Safety Assessment." EPRI

TR-106575. EPRI: Palo Alto, CA. August 1996 (proprietary document - contact EPRI for

availability).

International Atomic Energy Agency. "Procedures for Conducting Probabilistic Safety

Assessments of Nuclear Power Plants (Level 1)." IAEA Safety Series No. 50-P-4. IAEA:

Vienna, Austria. 1992.

U.S. Nuclear Regulatory Commission. NUREG-1150. "Severe Accident Risks: An Assessment

for Five U.S. Nuclear Power Plants." NRC: Washington, DC. January 1991.

U.S. Nuclear Regulatory Commission. NUREG-1489. "A Review of NRC Staff Uses of

Probabilistic Risk Assessment." NRC: Washington, DC. March 1994.

U.S. Nuclear Regulatory Commission. NUREG-1560. "Individual Plant Examination Program:

Perspectives on Reactor Safety and Plant Performance." NRC: Washington, DC. December

1997.

U.S. Nuclear Regulatory Commission. NUREG-1602 (Draft for Comment). "The Use of PRA in

Risk-Informed Applications." NRC: Washington, DC. April 1997.

U.S. Nuclear Regulatory Commission. NUREG/CR-2300. "PRA Procedures Guide." NRC:

Washington, DC. January 1983.
19.2-63 June 2007

U.S. Nuclear Regulatory Commission. NUREG/CR-2815. "Probabilistic Safety Analysis

Procedures Guide." NRC: Washington, DC. Revision 1, August 1985.

U.S. Nuclear Regulatory Commission. SECY-94-003. "Plan for Implementing Regulatory

Review Group Recommendations." NRC: Washington, DC. January 1994.

General - Review of the PRA

Boiling Water Reactor Owners’ Group. "Report to the Industry on PSA Peer Review

Certification Process: Pilot Plant Results." BWROG: Atlanta, GA. January 1997.

Electric Power Research Institute. "Individual Plant Examination Review Guide." EPRI

TR-100369. EPRI: Palo Alto, CA. February 1992.

International Atomic Energy Agency. "IPERS Guidelines for the International Peer Review

Service." IAEA-TECDOC-832 Second Edition. IAEA: Vienna, Austria. October 1995.

U.S. Nuclear Regulatory Commission. NUREG-1335. "Individual Plant Examination: Submittal

Guidance." NRC: Washington, DC. August 1989.

U.S. Nuclear Regulatory Commission. NUREG-1407. "Procedural and Submittal Guidance for

the Individual Plant Examination of External Events (IPEEE) for Severe Accident

Vulnerabilities." NRC: Washington, DC. May 1991.

U.S. Nuclear Regulatory Commission. NUREG/CR-3485. "PRA Review Manual." NRC:

Washington, DC. 1985.

U.S. Nuclear Regulatory Commission. Regulatory Guide 1.174, “An Approach for Using

Probabilistic Risk Assessment in Risk informed Decisions on Plant-Specific Changes to the

Licensing Basis.” NRC: Washington, DC. July 2002.

General - PRA Uncertainties and Sensitivity Studies

Apostolakis, G.A. "Probability and Risk Assessment: The Subjectivist Viewpoint and Some

Suggestions." Nuclear Safety. Volume 19, No. 3, pages 305-315, 1978.

Apostolakis, G.A. and Kaplan, S. "Pitfalls in Risk Calculations." Reliability Engineering. 

Volume 2, pages 135-145, 1981.

Kaplan, S., and Garrick, B.J. "On the Quantitative Definition of Risk." Risk Analysis. Volume 1,

pages 11-28, March 1981.

Parry, G.W., and Winter, P.W. "Characterization and Evaluation of Uncertainty in Probabilistic

Risk Analysis." Nuclear Safety. Volume 22, No. 1, pages 28-42, 1981.

Proceedings of Workshop I in Advanced Topics in Risk and Reliability Analysis. “Model

Uncertainty: Its Characterization and Quantification.” University of Maryland, Center for

Reliability Engineering, Annapolis, Maryland, October 20-22, 1993. University of Maryland

Press: College Park, MD. 1996.

“Treatment of Aleatory and Epistemic Uncertainty.” Reliability Engineering and System Safety. 

Volume 54, Nos. 2 and 3: November/December 1996.
19.2-64 June 2007

U.S. Nuclear Regulatory Commission. NUREG-1489, Appendix C.6. "A Review of NRC Staff

Uses of Probabilistic Risk Assessment." NRC: Washington, DC. March 1994.

U.S. Nuclear Regulatory Commission. NUREG/CR-2350. "Sensitivity Analysis Techniques:

Self Teaching Curriculum." NRC: Washington, DC. June 1982.

U.S. Nuclear Regulatory Commission. NUREG/CR-4836. "Approaches to Uncertainty Analysis

in Probabilistic Risk Assessment." NRC: Washington, DC. January 1988.

General - Use of PRA for Risk Ranking

U.S. Nuclear Regulatory Commission. NUREG/CR-3385. "Measures of Risk Importance and

Their Applications." NRC: Washington, DC. July 1983.

Vesely, W.E. "The Use of Risk Importances for Risk-Based Applications and Risk-Based

Regulation." Proceedings of PSA ’96. Park City, Utah, September 1996.

Initiating Events

Electric Power Research Institute. "ATWS--A Reappraisal, Part 3, Frequency of Anticipated

Transients." EPRI NP-2330. EPRI: Palo Alto, CA. 1982.

Nuclear Safety Analysis Center. "Loss of Offsite Power at U.S. Nuclear Power Plants Through

1991." NSAC-182. March 1992.

U.S. Nuclear Regulatory Commission. NUREG-1032. "Evaluation of Station Blackout

Accidents at Nuclear Power Plants." NRC: Washington, DC. June 1988.

U.S. Nuclear Regulatory Commission. NUREG/CR-3862. "Development of Transient Initiating

Event Frequencies for Use in Probabilistic Risk Assessments." NRC: Washington, DC. May

1985.

U.S. Nuclear Regulatory Commission. NUREG/CR-5032. "Modeling Time to Recovery and

Initiating Event Frequency for Loss of Offsite Power Incidents at Nuclear Power Plants." NRC:

Washington, DC. January 1988.

U.S. Nuclear Regulatory Commission. NUREG/CR-5928. "ISLOCA Research Program Final

Report." NRC: Washington, DC. July 1993.

Accident Sequence Analysis (Event Trees)

U.S. Nuclear Regulatory Commission. NUREG/CR-2300, Section 3.4. "PRA Procedures

Guide." NRC: Washington, DC. January 1983.

System Modeling Analysis (Fault Trees)

U.S. Nuclear Regulatory Commission. NUREG-0492. "Fault Tree Handbook." NRC:

Washington, DC. January 1981.

U.S. Nuclear Regulatory Commission. NUREG/CR-2300, Section 3.5. "PRA Procedures

Guide." NRC: Washington, DC. January 1983.
19.2-65 June 2007

Dependent Failure Analysis

U.S. Nuclear Regulatory Commission. NUREG/CR-2300, Section 3.7. "PRA Procedures

Guide." NRC: Washington, DC. January 1983.

Determination of Success Criteria

Brookhaven National Laboratory. "MAAP 3.0B Code Evaluation Final Report." FIN L-1499. 

US DOE BNL: Upton, NY. October 1992.

Electric Power Research Institute. "MAAP Thermal-Hydraulic Quantification Studies." EPRI

TR-100741. EPRI: Palo Alto, CA. June 1992.

Electric Power Research Institute. "MAAP BWR Application Guidelines." EPRI TR-100742. 

EPRI: Palo Alto, CA. June 1992.

Electric Power Research Institute. "MAAP PWR Application Guidelines for Westinghouse and

Combustion Engineering Plants." EPRI TR-100741. EPRI: Palo Alto, CA. June 1992.

Fauske & Associates, Inc. "MAAP 3.0B Users Manual." FAI: Burr Ridge, IL. March 1990.

U.S. Nuclear Regulatory Commission. NUREG/CR-5535. "RELAP5/MOD3 Code Manual." 

Volumes 1-5. NRC: Washington, DC. June 1990.

U.S. Nuclear Regulatory Commission. NUREG/CR-5673. "TRAC-PF1/MOD2 Code Manual." 

Volumes 1-4. NRC: Washington, DC. 1994.

Westinghouse Owners Group. "Reactor Coolant Pump Seal Performance Following Loss of All

AC Power." WCAP-10541. Westinghouse Electric Corporation: Monroeville, PA. Revision 1

(Proprietary).

Use of Appropriate Data

Electric Power Research Institute. "Nuclear Plant Reliability: Data Collection and Usage

Guides." EPRI TR-100381. EPRI: Palo Alto, CA. April 1992.

Idaho National Engineering Laboratory. "Emergency Diesel Generator Power System

Reliability 1987-1993." INEL-95/0035. INEL: Idaho Falls, ID. February 1996.

Institute of Electrical and Electronics Engineers. "Guide to the Selection and Presentation of

Electrical, Electronic and Sensing Component Reliability Data for Nuclear Power Generating

Stations." IEEE-STD-500. IEEE: New York, NY. Revision 1, 1984.

International Atomic Energy Agency. "Component Reliability Data for Use in Probabilistic

Safety Assessment." IAEA-TECDOC-478. IAEA: Vienna, Austria. October 1988.

International Atomic Energy Agency. "Evaluation of Reliability Data Sources." 

IAEA-TECDOC-504. IAEA: Vienna, Austria. April 1989.

International Atomic Energy Agency. "Survey of Ranges of Component Reliability Data for Use

in Probabilistic Safety Assessment." IAEA-TECDOC-508. IAEA: Vienna, Austria. June 1989.
19.2-66 June 2007

T-Book. "Reliability Data of Components in Nordic Nuclear Power Plants." ATV Office:

Vattenfall AB, Sweden. Third Edition. 1992.

U.S. Nuclear Regulatory Commission. NUREG/CR-1025. "Data Summaries of Licensee Event

Reports on Pumps at U.S. Commercial Nuclear Power Plants." NRC: Washington, DC. 

Revision 1, 1982.

U.S. Nuclear Regulatory Commission. NUREG/CR-1363. "Data Summaries of Licensee Event

Reports of Valves of U.S. Commercial Nuclear Power Plants." NRC: Washington, DC. 1982.

U.S. Nuclear Regulatory Commission. NUREG/CR-1740. "Data Summaries of Licensee Event

Reports of Selected Instrumentation and Control Components at U.S. Commercial Nuclear

Power Plants, January 1, 1976 to December 31 1981." NRC: Washington, DC. 1984.

U.S. Nuclear Regulatory Commission. NUREG/CR-3867. "Data Summaries of Licensee Event

Reports of Inverters at U.S. Commercial Nuclear Power Plants, January 1, 1976 to December

31 1982." NRC: Washington, DC. 1984.

U.S. Nuclear Regulatory Commission. NUREG/CR-4126 (Draft). "Data Summaries of

Licensee Event Reports of Protective Relays and Circuit Breakers at U.S. Commercial Nuclear

Power Plants, January 1 1976 to December 31 1983." NRC: Washington, DC. 1985.

Modeling of Common Cause Failures

Idaho National Engineering Laboratory. "Common Cause Failure Data Collection and Analysis

System." INEL-94/0064 (Draft). INEL: Idaho Falls, ID. December 1995.

International Atomic Energy Agency. "Guidelines for Conducting Common Cause Failure

Analysis in Probabilistic Risk Assessment." IAEA-TEC-DOC 648. IAEA: Vienna, Austria. 

1992.

U.S. Nuclear Regulatory Commission. NUREG/CR-4780. "Procedures for Treating Common

Cause Failures in Safety and Reliability Studies." Volumes 1 and 2. NRC: Washington, DC. 

January 1988.

Modeling of Human Performance

Chien, S.H., et. al. "Quantification of Human Error Rates Using SLIM-Based Approach." IEEE

Fourth Conference on Human Factors and Power Plants. IEEE: New York, NY. 1992.

Electric Power Research Institute. "Systematic Human Action Reliability Procedure." EPRI

NP-3583. EPRI: Palo Alto, CA. June 1984.

Electric Power Research Institute. "Operator Reliability Experiments Using Power Plant

Simulators." EPRI NP-6937 Volumes 1-3. EPRI: Palo Alto, CA. July 1990 (proprietary

document - contact EPRI for availability).

Electric Power Research Institute. "Human Cognitive Reliability Model for PRA Analysis." 

EPRI RP-2170-3 (Draft). EPRI: Palo Alto, CA. December 1984.
19.2-67 June 2007

Electric Power Research Institute. "An Approach to the Analysis of Operator Actions in

Probabilistic Risk Assessment." EPRI TR-100259. EPRI: Palo Alto, CA. June 1992

(proprietary document - contact EPRI for availability).

Electric Power Research Institute. "SHARP1 - A Review of Systematic Human Action Reliability

Procedure." EPRI TR-101711. EPRI: Palo Alto, CA. December 1992 (proprietary document -

contact EPRI for availability).

U.S. Nuclear Regulatory Commission. NUREG/CR-1278. "Handbook of Human Reliability

Analysis with Emphasis on Nuclear Power Plant Applications." NRC: Washington, DC. August

1983.

U.S. Nuclear Regulatory Commission. NUREG/CR-2254. "A Procedure for Conducting a

Human Reliability Analysis for Nuclear Power Plants." NRC: Washington, DC. 1983.

U.S. Nuclear Regulatory Commission. NUREG/CR-2986. "The Use of Performance Shaping

Factors and Quantified Expert Judgement in the Evaluation of Human Reliability: An Initial

Appraisal." NRC: Washington, DC. 1983.

U.S. Nuclear Regulatory Commission. NUREG/CR-3518. "SLIM/MAUD: An Approach to

Assessing Human Error Probabilities Using Structured Expert Judgement." Volumes 1 and 2.

NRC: Washington, DC. 1984.

U.S. Nuclear Regulatory Commission. NUREG/CR-4772. "Accident Sequence Evaluation

Program - Human Reliability Analysis Procedure." NRC: Washington, DC. February 1987.

Sequence Quantification

Institute of Electrical and Electronics Engineers. "IEEE Standard for Software Verification and

Validation Plans." IEEE Standard 1012-1986. IEEE: New York, NY. 1986.

U.S. Nuclear Regulatory Commission. NUREG/CR-2300, Chapter 6. "PRA Procedures

Guide." NRC: Washington, DC. January 1983.

U.S. Nuclear Regulatory Commission. NUREG/BR-0167. "Software Quality Assurance

Program and Guidelines." NRC: Washington, DC. February 1993.

Modeling of Containment Response and Changes in Large Early Release Frequency

U.S. Nuclear Regulatory Commission. NUREG-1570 (Draft for Comment). "Risk Assessment

of Severe Accident-Induced Steam Generator Tube Rupture." NRC: Washington, DC. May

1997.

U.S. Nuclear Regulatory Commission. NUREG/CR-4551. "Evaluation of Severe Accident

Risks: Surry Unit 1." Volume 3, Revision 1, Part 1. NRC: Washington, DC. October 1990.

U.S. Nuclear Regulatory Commission. NUREG/CR-4551. "Evaluation of Severe Accident

Risks: Peach Bottom Unit 2." Volume 4, Revision 1, Part 1. NRC: Washington, DC. 

December 1990.
19.2-68 June 2007

U.S. Nuclear Regulatory Commission. NUREG/CR-4551. "Evaluation of Severe Accident

Risks: Sequoyah Unit 1." Volume 5, Revision 1, Parts 1 and 2. NRC: Washington, DC. 

December 1990.

U.S. Nuclear Regulatory Commission. NUREG/CR-4551. "Evaluation of Severe Accident

Risks: Grand Gulf Unit 1." Volume 6, Revision 1, Parts 1 and 2. NRC: Washington, DC. 

December 1990.

U.S. Nuclear Regulatory Commission. NUREG/CR-5305. "Integrated Risk Assessment for the

LaSalle Unit 2 Nuclear Power Plant: Phenomenology and Risk Uncertainty Evaluation Program

(PRUEP)." NRC: Washington, DC. December 1990.

U.S. Nuclear Regulatory Commission. NUREG/CR-4551. "Evaluation of Severe Accident

Risks: Zion Unit 1." Volume 7, Revision 1. NRC: Washington, DC. March 1993.

U.S. Nuclear Regulatory Commission. NUREG/CR-6595. "An Approach for Estimating the

Frequencies of Various Containment Failure Modes and Bypass Events." NRC: Washington,

DC. Revision 1, October 2004.
19.2-69 June 2007

APPENDIX B

Integrated Decisionmaking

Risk-informed applications are expected to require a process to integrate traditional engineering

and probabilistic considerations to form the basis for acceptance. In order for this

decisionmaking process to be effective in rendering accurate representations of plant safety

and risk, the staff anticipates that licensees will have documented guidance to ensure

consistent and defensible results. Such guidance would also allow staff reviewers to

reconstruct the logic and events involved in the integration process.

This appendix discusses issues that the staff reviewers should address during reviews of the

licensees’ integrated decisionmaking process (sometimes referred to as the “expert panel”

process).

a. Areas of Review

Reviewers are expected to evaluate proposed changes to the LB by taking into account both

traditional and probabilistic engineering considerations. For each change, reviewers should

evaluate the licensee’s justification for the change and the process by which the results were

obtained. In many pilot risk-informed applications, licensees have justified changes to the LB

through the use of integrated decisionmaking panels (or expert panels) especially in cases

where there are broad applications of PRA and traditional engineering results over a large

number of plant elements (SSCs, operator actions, etc.). A review of the licensee’s integrated

decisionmaking process would ensure a better understanding of the reasons, assumptions,

approaches, and information used to justify these changes.

b. Review Guidance and Procedures

Since the licensee’s integrated decisionmaking process is responsible for justifying the

acceptability of the proposed changes to the LB, the staff anticipates that licensees will

document the process in a relatively formal fashion. The staff may not routinely audit all of the

licensee’s findings or recommendations, but the documentation should exist to support such a

review, and should be maintained for the life of the plant or until such time at which the

recommendations are invalidated by later changes.

Staff Expectations of the Integrated Decisionmaking Process

Reviewers should ensure that the licensee’s decisionmaking process contains the following

attributes:

• The process should be well-defined, systematic, repeatable, and scrutable. This

process should be technically defensible and should be sufficiently detailed to allow an

independent party to reproduce the major results.

• Deliberations should be application-specific. The objectives proposed for the integrated

decisionmaking process for a particular application (particularly, how the results are to

be utilized) should be well defined and relevant to the given application.

• Membership in the decisionmaking team should include experienced individuals with

demonstrated skills and knowledge in relevant engineering disciplines (depending on

the application), plant procedures and operations, plant systems (including operational
19.2-70 June 2007

history), system response and dependencies, operator training and response, details of

the plant-specific PRA, and regulatory guidance.

• The decisionmaking team should have been advised of the specifics of all proposed

changes and the relevant background information associated with the licensing action.

In addition, since the judgement will depend, in part, on the results of a risk analysis, it is

important that all team members be provided with an interpretation of the results of the

risk model and the potential limitations of that model.

• The licensee's integrated decisionmaking process should take into account the

principles and expectations described in Subsection II of this SRPsection.

• In formulating the findings, the licensee should account for both probabilistic and

traditional engineering considerations. This should include information from the risk

analysis, traditional engineering evaluations and insights, quantitative sensitivity studies,

operational experience and historical plant performance, engineering judgment, and

current regulatory requirements. Potential limitations of the risk model should be

identified and resolved. In addition, the licensee should individually consider and

evaluate all SSCs that are affected by the proposed application but are not modeled in

the PRA, on the basis of guidelines similar to those provided later in this appendix or in

Section C.2 of Appendix C to this SRP section. Finally, the licensee's conclusions

should be sufficiently robust with regard to different plausible assumptions and

analyses.

• When findings or conclusions depend, in part, on the use of compensatory measures,

the licensee should justify why the compensatory measures are an appropriate

substitute for a proposed relaxation in current requirements. The compensatory

measures should also become part of the plant's licensing basis.

Technical Information Basis for Applications Involving Risk Quantification or Risk Categorization

The information base supplied to the integrated decisionmaking panel should be capable of

supporting the findings that should be made in the context of the specific risk-informed

application. For example, in risk quantification and risk categorization applications, the

following guidelines should be applicable.

• At least the Level 1 portion of the internal events PRA should be formulated in such a

way as to support quantification of a change in risk (CDF and LERF) and importance

measures, and should provide qualitative information (e.g., minimal cutsets) adequate to

support defense-in-depth findings.

• There should be an inventory of plant response capability for probabilistically significant

operating modes and initiating event categories (internal, external, flood, fire, seismic,

etc.). Given a full-scope Level 2 PRA, this requirement could be satisfied by an

inventory of event tree success paths, with an indication of the mission success criteria,

systems, and SSCs involved in each path. Lacking a full-scope Level 2 PRA, surrogate

information should be developed for unanalyzed areas, along the lines described in

Subsection III.2.2.2 of this SRP section. This requirement is necessary in order to show

the safety functions performed by SSCs (or other plant elements) affected by the

application.
19.2-71 June 2007

• Causal models (determination of cause-and-effect relationships) should be developed to

support an evaluation (qualitative or quantitative) of the change in risk as a function of

the application. This is necessary in order to relate the application to actual risk indices.

Documentation of inputs to the decisionmaking panel should be part of the process.

Reviewers should verify the scope and depth of the information base, especially

information supplied regarding modes and/or classes of initiators unanalyzed in the

PRA.

Treatment of SSCs Not Modeled in the PRA

PRAs do not model all SSCs involved in performance of safety functions for various reasons.

However, this should not imply that unmodeled SSCs are not important in terms of contributions

to plant risk. For example, SSCs are omitted in some cases because the analysts take credit

for programmatic activities that ensure a low failure frequency for that item or a short fault

exposure time in the event that it does fail. In such cases, even though the PRA results will not

reflect the SSC at all, it would be inappropriate to conclude that the programmatic activity is

unimportant.

Consequently, one task of the integrated decisionmaking panel is to extrapolate from the PRA

and other information sources to draw conclusions about SSCs that are not modeled in the

PRA. This does not mean that the panel is to impute to the PRA high-level results that were not

generated in the analysis; however, it does mean that if a success path is modeled in the PRA,

the panel is justified in reasoning that unmodeled SSCs in that path are relied upon. If items

were screened from the PRA, the panel should be aware of the screening process in order to

avoid violating the basis for the screening.

For SSCs not modeled in the PRA, reviewers should verify that the decisionmaking panel has

performed the following tasks:

• Review the PRA assumption base for instances in which initiators were screened out on

the basis of credit for SSCs affected by the application.

• Review plant operating history for initiating events that might have been prevented by

the proposed application.

• Review plant operating history for failures of mitigating system trains attributable to

events that might have been prevented by the proposed application.

• Review accident sequence modeling for instances in which early termination of the

analysis obscured challenges to affected SSCs that would normally come into play later

than the termination point.

Possible dispositions of the above tasks include the following results:

• The item will not affect initiating event frequency or mitigating system performance

under reasonably foreseeable circumstances, and the proposed change is warranted.

• Although unmodeled, the item already receives and will continue to receive

programmatic attention commensurate with its significance. In cases where reduced

commitments are proposed, adequate justification is provided for this reduction.
19.2-72 June 2007

• The item does not currently receive sufficient programmatic attention and may be

subject to tighter controls.

Reviewers should verify that the safety significance of SSCs not modeled in the PRA (but

affected by the proposed application) are appropriately characterized and justified.

Addressing Limitations of the Risk Analysis

One objective of the integrated decisionmaking process is to overcome certain limitations of the

PRA. However, this does not include substituting the analyst's judgment for essential PRA

results. One reason for developing PRA models is that the complexity of many facilities makes

judgment difficult in many contexts.

Generally, if the PRA highlights a plant vulnerability, this should be taken seriously and should

not be discounted on the basis of judgment. If the analyst can show that the PRA

representation of a vulnerability is invalid, then the PRA should be modified, and the licensee

should work with the results of the revised PRA.

To address the issue of credit for unmodeled systems that would change a PRA result, the

preferred method is to alter the PRA to take the credit. Reviewers should be aware that cases

may potentially arise in which credit for an unmodeled system would be seriously complicated

by issues of shared support systems, environmental conditions, or other factors such as spatial

interaction issues or operator interaction dependencies.

To address the issue of making decisions about SSCs that might influence plant response in

unmodeled modes or to unmodeled initiators, the acceptable approach is to proceed on the

basis of a structured representation of plant response that shows at least qualitatively the

initiating events that may pertain, the systems available to respond to each, the functional

dependencies of these systems, and the backups available in the event of failure of any

particular SSC. While it is possible to accept program reductions for SSCs that are explicitly

shown to play no role in unanalyzed modes, it is more difficult to accept reductions for

components that do play a role in unanalyzed (e.g., shutdown) modes. For such instances,

conservative methods will be considered prudent.

To address instances in which a PRA model exists but is considered misleading, caution is

indicated. An example would be to down-classify SSCs from a PRA result (i.e., state that a high

risk contributor is actually a low contributor), on the basis of panel judgment. It is not

acceptable to place on the record both a PRA and a finding that clearly contradicts it. Although

the panel is not expected to take the PRA as absolute truth, the test should be whether the

record establishes a clear basis for a finding. A technical argument that begins with the

misleading PRA result and furnishes supplementary information sufficient to justify a relatively

minor change to a PRA result, or a qualified interpretation of a PRA result, is satisfactory. A

cursory technical argument leading to a conclusion that qualitatively contradicts a major PRA

result is an unsatisfactory record.

c. Evaluation Findings

Reviewers should verify that information provided and review activities conducted support the

following conclusions:

• The integrated decisionmaking process is appropriate. Appropriate information was

available, suitable issues were raised, the disposition of these issues was systematic
19.2-73 June 2007

and defensible, and the documentation of the findings is traceable and reviewable in

principle, so that the basis for conclusions and recommendations is available for scrutiny

and review.

• The evaluation of risk significance represents appropriate consideration of probabilistic

information, traditional engineering evaluations, sensitivity studies, operational

experience, engineering judgment, and current regulatory requirements.

• The technical information basis was adequate for the scope of the application. In

particular, the analysis of success and failure scenarios was adequate to identify the

roles played by the SSCs affected by the application, the quantification of the frequency

of these scenarios was adequate to establish the safety significance of the SSCs, and

the causal models were adequate to establish the effects of the proposed changes in

the program.

• The safety significance of components affected by the proposed application but not

modeled in the PRA was evaluated in a systematic manner. This included a search of

components that might contribute to initiating event occurrence, mitigating system

components that were not modeled in the PRA because their failure was not expected to

dominate system failure in the baseline configuration, and components in systems that

do not play a direct role in accident mitigation but do interface with accident mitigating

systems.

• The process applied by the licensee to overcome limitations of PRA was appropriate.

Where decisions were made that do not follow straightforwardly from the PRA, a

technical basis was provided that shows how the PRA information and the

supplementary information validly combine to support the finding. No findings contradict

the PRA in a fundamental way.
19.2-74 June 2007

APPENDIX C

Categorization of Plant Elements with Respect to Safety Significance

For several proposed applications in risk-informed regulation, one of the principal activities is

the categorization of SSCs and human actions with respect to their safety-significance. This

appendix discusses how to review approaches that may be used in this categorization process.

The first review consideration is the definition of safety-significance as it applies to SSCs and

human actions for a specific application. A related, but not identical concept, is that of risk

significance. For example, an individual SSC can be identified as being risk-significant if it can

be demonstrated that its failure or unavailability contributes significantly to the measures of risk

(e.g., CDF and LERF). Safety significance, on the other hand, can be thought of as being

related to the role the SSC or human action plays in preventing the occurrence of the undesired

end state. Thus, the SSCs and human actions considered when constructing the PRA model

have the potential to be safety significant, since they play a role in preventing core damage or

large early release. These SSCs and human actions may include those that do not necessarily

appear in the final quantified model because they have initially been screened, are assumed to

be inherently reliable, or have been truncated from the solution of the model. In addition, there

may be SSCs or human actions not modeled in the PRA that have the potential to be safety

significant because they play a role in preventing core damage or large early release.

In reviewing the categorization, it is important to recognize its underlying purpose.

Categorization is generally intended to sort the SSCs or human actions into two general groups:

those for which some change is proposed, and those for which no change is proposed. It is the

potential impact of the application on the particular SSCs and human actions and on the

measures of risk which ultimately determines which SSCs and human actions should be

regarded as safety-significant. Since different applications impact different SSCs and human

actions, it is reasonable to expect that the categorization could be different for different

applications. Thus, the question being addressed by the application is, for which groups of

SSCs and human actions can the change be made such that there will be no more than an

insignificant increase in the risk to the health and safety of the public. This impact on overall

risk should be related back to the criteria for acceptable changes in the risk measures identified

in Regulatory Guide 1.174. It is those groups for which changes can be made that satisfy these

criteria that can be regarded as low safety-significant in the context of the specific application.

Thus, the most appropriate way to address the categorization is through a requantification of

the risk measures. However, the feasibility of performing such risk quantification has been

questioned for those applications for which a method for evaluating the impact of the change on

SSC unavailability is not obviously available.

In such instances, an acceptable alternative to requantification of risk is to categorize SSCs and

human actions using an integrated decisionmaking process (such as the use of an Expert

Panel), with PRA importance measures as input. This appendix discusses the issues that

reviewers should address for this approach. Section C.1 of this appendix discusses the

technical issues associated with the use of PRA importance measures, and Section C.2 of this

appendix discusses the use of the importance measures by the decisionmaking panel.

C.1 Use of Importance Measures

a. Areas of Review
19.2-75 June 2007

In the implementation of the Maintenance Rule and in many industry guides for the

risk-informed applications, the measures most commonly identified for use in the relative risk

ranking of SSCs and human actions include the Fussell-Vesely Importance, Risk Reduction

Worth, and Risk Achievement Worth. However, in using these importance measures for

risk-informed applications, several issues should be addressed. Most of these issues relate to

technical problems that can be resolved through the use of sensitivity studies or appropriate

quantification techniques, as discussed in detail later in this section. In addition, there are two

issues that reviewers should ensure have been adequately addressed, namely (i) that risk

rankings apply only to individual contributions and not to combinations or sets of contributors,

and (ii) that risk rankings are not necessarily related to the risk changes that result from those

contributor changes. When correctly applied and interpreted, component-level importance

measures can provide valuable input to the integrated decisionmaking process.

b. Review Guidance and Procedures

Risk ranking results from a PRA can be affected by many factors, the most important being the

model assumptions and techniques (e.g., for modeling of human reliability or common cause

failures), the data used, and the success criteria chosen. Reviewers should therefore evaluate

the licensee’s PRA as part of the overall review process. Appendix A to this SRP section 

presents guidance for this review.

In addition to using a PRA of appropriate quality for the application, the licensee should

demonstrate the robustness of risk ranking results for conditions and parameters that might not

be addressed in the base PRA. Therefore, when importance measures are used to group

components or human actions as low safety-significant contributors, the information to be

provided to the integrated decisionmaking process should include sensitivity studies and/or

other evaluations to demonstrate the sensitivity of the ranking results to the important PRA

modeling techniques, assumptions, and data. In assessing this information, reviewers should

consider the following issues:

Different Risk Metrics: Reviewers should ensure that the licensee’s ranking process adequately

considered risk in terms of both CDF and LERF.

Completeness of Risk Model: Reviewers should ensure that, when determining safety

significance contributions using an internal events PRA, the licensee also considered external

events, as well as shutdown and low-power initiators, either by PRA modeling or by the

integrated decisionmaking process (as detailed in Section C.2 of this appendix and Appendix B

to this SRP section).

Sensitivity Analysis for Component Data Uncertainties: The licensee should have addressed

the sensitivity of component categorizations to uncertainties in the parameter values. 

Reviewers should be satisfied that SSC categorization is not affected by data uncertainties.

Sensitivity Analysis for Common Cause Failures: CCFs are modeled in PRAs to account for

dependent failures of redundant components within a system. As discussed in Appendix A to

this SRP section, CCF probabilities can impact PRA results by enhancing or obscuring the

importance of components. This should be addressed by the review. A component may be

ranked as a high risk contributor mainly because of its contribution to CCFs, or a component

may be ranked as a low risk contributor mainly because it has negligible or no contribution to

CCFs. I n RIR, removing or relaxing requirements may increase the CCF contribution, thereby

changing the risk impact of an SSC.
19.2-76 June 2007

Consideration of Multiple Failure Modes: PRA basic events represent specific failure events

and failure modes of SSCs. Reviewers should verify that the licensee performed the

categorization by taking into account the combined effects of all associated basic PRA events

(such as failure to start and failure to run), including indirect contributions through associated

CCF event probabilities.

Sensitivity Analysis for Recovery Actions: PRAs typically model recovery actions especially for

dominant accident sequences. Quantification of recovery actions typically depends on the time

available to diagnose the situation and perform the action, as well as the adequacy of the

licensee’s training, procedures, and operator knowledge. Estimating the success probability for

the recovery actions involves a certain degree of subjectivity. The concerns in this case stem

from situations where very high success probabilities are assigned to a sequence, resulting in

related components being ranked as low risk contributors. Furthermore, it is not desirable for

the categorization of SSCs to be impacted by recovery actions that sometimes are only

modeled for the dominant scenarios. Sensitivity analyses can be used to show how the SSC

categorization would change if recovery actions were removed. Reviewers should ensure that

the categorization has not been unduly impacted by the modeling of recovery actions.

Truncation Limit: Reviewers should verify that the licensee set the sequence truncation limits

low enough so that the truncated set of minimal cutsets or scenarios contains the significant

contributors and their logical combinations for the application in question. Depending on the

level of PRA detail (module level, component level, or piece-part level), this may translate into a

truncation limit from 10-12 to 10-8 per reactor year.

Multiple Component Considerations: As previously discussed, importance measures are

typically evaluated on the basis of individual SSCs or human actions. One potential concern

that arises from this practice is that single-event importance measures have the potential to

dismiss all elements of a system or group, despite the system or group having a high

importance when taken as a whole. (Conversely, there may be grounds for screening out

groups of SSCs, owing to the unimportance of the systems of which they are elements.) Two

potential approaches are used to address the multiple component issue. The first is to define

suitable measures of system or group importance. The second is to choose appropriate criteria

for categorization based on component-level importance measures. In both cases, it will be

necessary for the licensee to demonstrate that the cumulative impact of the change has been

adequately addressed.

While there are no widely accepted definitions of system or group importance measures, it is

likely that some licensees will develop new system or group measures. If any are proposed,

reviewers should ensure that the measures logically capture the impact of changes to the

group. As an example of the issues that arise, consider the following. For front-line systems,

one possibility would be to define a Fussell-Vesely type measure of system importance as the

sum of the frequencies of sequences involving failure of that system, divided by the sum of all

sequence frequencies. Such a measure would need to be carefully interpreted if the numerator

included contributions from failures of that system as a result of support systems. Similarly, a

Birnbaum-like measure could be defined by quantifying sequences involving the system,

conditional on its failure, and summing up those quantities. This would provide a measure of

how often the system is critical. However, the support systems again make the situation more

complex. To take a two-division plant as an example, front-line failures can occur as a result of

failure of support division A in conjunction with failure of front-line division B. Working with a

figure of merit determined by the "total failure of support system" would miss contributions of

this type. 
19.2-77 June 2007

In the absence of appropriately defined group level importance measures, reliance should be

made on the integrated decisionmaking process to make the appropriate determination (see

Section C.2 of this appendix).

Relationship of Importance Measures to Risk Changes: Importance measures do not directly

relate to changes in risk associated with implementation of a set of changes proposed in an

application. Instead, the risk impact is indirectly reflected in the choice of the value of the

measure used to determine whether an SSC should be classified as being of high or low safety

significance. This is a concern whether importances are evaluated at the component or group

level. Therefore, the criteria for categorization into low and high significance should be related

to the acceptance guidelines for changes in CDF and LERF. This implies that the criteria

should be a function of the base case CDF and LERF, rather than being fixed for all plants.

Thus, reviewers should determine how the choice of criteria relates to, and conforms with, the

acceptance guidelines described in Regulatory Guide 1.174. If component level criteria are

used, they should be established taking into account the fact that the allowable risk increase

associated with the change should be determined on the basis of simultaneous changes to all

members of the category.

c. Evaluation Findings

Reviewers should verify that information provided and review activities conducted support the

following conclusions:

• The information provided to the integrated decisionmaking process with regard to

determining the risk importance of contributors for a specific application is robust in

terms of model inputs and assumptions, including issues like the use of both CDF and

LERF, completeness of the risk model, and sensitivity of the results to data

uncertainties, common cause failure modeling, modeling of human reliability, and

truncation limits used.

• The categorization addresses the effect of the change on groups of components in a

way that is compatible with the risk acceptance guidelines.

C.2 Role of Integrated Decisionmaking in Component Categorization

a. Areas of Review

While probabilistic importance analysis can provide valuable information regarding

categorization of SSCs or human actions, it should be supported and supplemented by an

evaluation based on traditional engineering considerations. This will require using the

qualitative insights obtained from the PRA, and considering the maintenance of the

defense-in-depth philosophy and sufficient safety margins. One important element of this

integrated decisionmaking can be the use of an "expert panel." This section provides

guidelines for reviewing the licensee's integrated decisionmaking process in the area of

importance categorization, and it supplements the general guidance in Appendix B to this SRP

section.

b. Review Guidance and Procedures

Identification of Functions, Systems, and Components Important to Safety: The PRA can

provide significant qualitative insights that emerge simply from considering whether and how

systems are invoked in particular scenarios. If a front-line system is credited in success paths,
19.2-78 June 2007

it is "important" in some sense, and at least some of its SSCs must also be important in some

sense, even if a given single-event importance measure does not reflect this. However, the real

importance of a system is a function of whether alternative, diverse systems that could fulfill the

same function. Systems that are the only means of providing the function would be considered

more important than those for which there are viable alternatives. A system that supports an

important front-line system could also be considered important. This does not mean that all

such systems cannot be candidates for relaxing current requirements; however, it does mean

that components in system trains credited in the PRA should be explicitly considered during the

integrated decisionmaking process.

Either by evaluating the licensee's documentation or by conducting an independent verification,

reviewers should complete the following steps:

• Identify all systems that are relied upon in plant response to an initiating event, whether

explicitly modeled in the PRA or not (e.g., room cooling systems, and instrumentation

and control systems associated with indications rather than control may not be

modeled), and identify the function(s) they perform or support.

• Determine whether failure of components screened out on the basis that they are

elements of "unimportant" systems could affect a system that is relied upon in the

plant's response to an initiating event.

Reviewers should then verify that at least some elements of each of the important systems

identified above are considered "safety significant." If this is not the case, reviewers should

ascertain what performance is allocated to these items in the PRA, and whether the

programmatic activities allocated to these elements are commensurate with the given

performance level. If a system is identified as being important, but none of its elements is,

reviewers should carefully evaluate the licensee’s justification.

As an example, consider the case of a system that contains many redundant flowpaths. Single

event importance analysis will tend to dismiss the flowpaths one at a time, effectively dismissing

the group as a whole. The focus of the above guidance is that the redundant flowpaths

(considered as a subsystem, and recognizing the function they perform), are important and

deserve some attention, even though conventional importance measures would not highlight

them. However, in the case of redundant systems, the solution need not always be to assign

every redundant path to the high-risk contributor category. In this example, especially if the

paths are essentially similar, it is arguably necessary to consider CCF. Thus, a program that

addresses CCF potential by monitoring component performance may provide the necessary

protection against loss of the function, while still allowing a decrease in some level of

commitment on the individual members of the group.

Verification of Low Safety Significance: In evaluating the qualitative risk-informed

categorization, reviewers should consider the integrated decisionmaking process and criteria

used by the licensee. In reviews of the licensee’s determination of low safety significance for

SSCs or operator actions, reviewers should verify that the licensee appropriately applied risk

importance measures and accounted for the results of sensitivity studies. Reviewers should

also verify that the licensee considered and compensated for factors such as potential

inadequate scope and level of detail of the PRA (see Subsections III.2.2.2 and III.2.2.3 of this

SRP section). Finally, reviewers should verify that, in categorizing an SSC or operator action as

low safety significance, the licensee considered the defense-in-depth philosophy and available

safety margins. Subsection III.2.1 of this SRP section presents review guidance on these

topics.
19.2-79 June 2007

For SSCs not modeled in the PRA, reviewers should verify that the licensee’s process

determined that the following conditions apply for each SSC that has been proposed as a

candidate for relaxation or removal of current requirements:

• The SSC does not perform a safety function, or does not perform a support function to a

safety function, or does not complement a safety function.

• The SSC does not support operator actions credited in PRAs for either procedural or

recovery actions.

• The failure of the SSC will not result in the eventual occurrence of a PRA initiating

event.

• The SSC is not a part of a system that acts as a barrier to fission product release during

severe accidents.

• The failure of the SSC will not result in unintentional releases of radioactive material

even in the absence of severe accident conditions.

If any of the above conditions apply, or if SSC performance is difficult to quantify, the licensee

should have used a qualitative evaluation process to determine the impact of relaxing

requirements on equipment reliability and performance. This evaluation should include

identifying those failure modes for which the failure rate may increase, and those for which

detection could become more difficult. Reviewers should then verify that the licensee provided

one or more of the following (or similar) justifications:

• A qualitative discussion on how the change is consistent with the defense-in-depth

philosophy and how the change maintains sufficient safety margins,

• A qualitative discussion and historical evidence why these failure modes may be unlikely

to occur,

• A qualitative engineering discussion on how such failure modes could be detected in a

timely fashion,

• A discussion on what other requirements may be useful to control such failure rate

increases,

• A qualitative engineering discussion on why relaxing the requirements may have

minimal impact on the failure rate increase.

c. Evaluation Findings

Reviewers should verify that information provided and review activities conducted support the

following conclusions:

• The categorization of the SSCs or human actions has adequately captured their

significance to safety, and this categorization has been performed in such a way that the

potential impact of the proposed application results in, at most, a small increase in the

risk to the health and safety of the public. The input to the integrated decisionmaking

process derived from importance measures has been utilized, taking into account the

known limitations of importance calculations, and the results have been supplemented

by appropriate qualitative considerations.
19.2-80 June 2007

• The integrated decisionmaking process explicitly recognized systems invoked in plant

response to initiating events and ensured that components within these systems are

considered for programmatic attention in areas (IST, ISI, etc.) appropriate to their

performance characteristics and the level of performance needed from them.
19.2-81 June 2007

APPENDIX D

Use of Risk Information in Review of Non-risk-informed License Amendment Requests

Areas of Review

When a license amendment request complies with the regulations and other license

requirements, there is a presumption by the Commission of adequate protection of public health

and safety (Maine Yankee, ALAB-161, 6 AEC 1003 (1973)). However, circumstances may

arise in which new information reveals an unforeseen hazard or a substantially greater potential

for a known hazard to occur, such as identification of an issue that substantially increases risk.

In such situations, the NRC has the statutory authority to require licensee action above and

beyond existing regulations to maintain the level of protection necessary to avoid undue risk to

public health and safety. Section 182.a of the Atomic Energy Act of 1954, as amended, and as

implemented by 10 CFR 2.102 gives the NRC the authority to require the submittal of

information in connection with a license amendment request if NRC has reason to question

adequate protection of public health and safety. The licensee may decline to submit such

information, but it would risk having the amendment request denied if NRC cannot find that the

requested amendment provides adequate protection of public health and safety.

Under unusual circumstances that could introduce significant and unanticipated risks, the NRC

staff reviewers would assume the burden of demonstrating that the presumption of adequate

protection is not supported by the bases for the existing staff positions despite the fact that

currently specified regulatory requirements are met. Instances in which license amendment

requests meet all regulatory requirements yet raise significant risk concerns are rare. The

process used for identifying those situations in which risk implications are appropriate to

consider and for deciding if undue risk exists is depicted in Figure 1. This process can be used

in the review of both licensee-initiated, risk-informed license amendment requests, as well as

license amendment requests in which the licensee chooses to not submit risk information (i.e.,

non-risk-informed requests).

License amendment requests will be screened for potential risk implications as part of the

license amendment review process. Office-level license amendment review procedures provide

guidance on which license amendment requests should be examined at the level of the

integrated risk model because of the potential for significant impacts on plant risk. In

accordance with the guidance, the risk implications of a non-risk-informed submittal would be

discussed with a risk analyst if the submittal:

• Significantly changes the allowed outage time (e.g., outside the range previously

approved at similar plants), the probability of the initiating event, the probability of

successful mitigative action, the functional recovery time, or the operator action

requirement;

• Significantly changes functional requirements or redundancy;

• Significantly changes operations that affect the likelihood of undiscovered failures;

• Significantly affects the basis for successful safety function; or

• Could create “special circumstances” under which compliance with existing regulations

may not produce the intended or expected level of safety and plant operation may pose

an undue risk to public health and safety.
19.2-82 June 2007

Non-risk-informed license amendment requests judged to have the potential to significantly

affect risk would be referred for a more detailed risk evaluation as part of the license

amendment review.

Review Guidance and Procedures

For license amendment requests referred for a risk review, the reviewers should assess the

requested changes, and the need for and the effectiveness of any compensatory measures that

might be warranted because of risk considerations, by evaluating the changes relative to the

safety principles and integrated decisionmaking process defined in Regulatory Guide 1.174.

The risk acceptance guidelines (Sections 2.2.4 and 2.2.5 of Regulatory Guide 1.174) describe

acceptable levels of risk increase as a function of total core damage frequency (CDF) and large

early release frequency (LERF) and the manner in which the acceptance guidelines should be

applied in the review and decisionmaking process. Reviewers should note that the guidelines

serve as a point of reference for gauging risk impact but are not legally binding requirements.

For non-risk-informed license amendment requests, the preliminary assessment would be

qualitative, with a decision based on engineering judgment, since quantitative risk information

would not generally be presented in submittals that are not risk informed. If “special

circumstances” are believed to exist, the reviewers will explore in more detail the underlying

engineering issues contributing to the risk concern, as well as the potential risk significance of

the license amendment request. The staff should inform and engage the licensee as early as

possible in the evaluation process when it believes that a special circumstance may exist and is

considering the need for risk information.

“Special circumstances” represent conditions or situations that would raise questions about

whether there is adequate protection and that could rebut the normal presumption of adequate

protection from compliance with existing requirements. In such situations, undue risk may exist

even when all regulatory requirements are satisfied. In general, a special circumstance may

exist if (1) the situation was not identified or specifically addressed in the development of the

current set of regulations and could be important enough to warrant a new regulation (e.g., a

risk-informed regulation) if such situations were encountered on a widespread basis and (2) the

reviewer has knowledge that the risk impact is not reflected by the licensing basis analysis and

has reason to believe that the risk increase would warrant denial or attaching conditions to the

staff’s approval if the request were evaluated as a risk-informed application. If one criterion is

met, the second would generally be met as well. However, in view of the judgment involved in

these determinations, cases in which one of the criteria is not clearly met should still be

elevated for management consideration as discussed below.

“Special circumstances” may include but not be limited to license amendment requests that, if

approved, could:

• Substantially increase the likelihood or consequences of accidents that are risk

significant but are beyond the design and licensing basis of the plant, for example,

proposed changes to steam generator (SG) allowable leak rates that meet

10 CFR Part 100 limits based on the design basis source term but result in a large early

release given a severe accident source term; or use of new materials for SG repairs that

provide acceptable performance under normal and designbasis accident conditions but

a reduced capability to maintain SG tube integrity in hightemperature, severe accident

scenarios.
19.2-83 June 2007

• Degrade multiple levels of defense, or cornerstones in the reactor oversight process,

through plant operations or situations not explicitly considered in the development of the

regulations, for example, advanced applications of digital instrumentation and controls in

which the licensee does not address or comply with regulatory guidance concerning

evaluation of defense in depth and diversity in digital instrumentation and control

systems.

• Significantly reduce the availability or reliability of structures, systems, or components

that are risk significant but are not required by regulations, for example, amendment

requests that as an unintended consequence compromise the effectiveness of the Mark

I hardened wetwell vent system in protecting against containment overpressure failures

in accidents beyond the design basis, or the diversity of the turbine-driven auxiliary

feedwater pumps provided in response to NUREG-0737, Section II.E.1.1.

• Involve changes for which the synergistic or cumulative effects could significantly impact

risk, for example, power uprate requests that would increase operating power well

beyond the levels approved in previous uprates and would introduce or substantially

increase the frequency of risk-significant core damage sequences.

If, upon further consideration, it is believed that approval of the request would compromise the

safety principles described in Regulatory Guide 1.174 and substantially increase risk relative to

the risk acceptance guidelines contained in the regulatory guide, the reviewers should inform

NRC management of the risk concerns and the need to further evaluate the risk associated with

the request. In such instances, the reviewers, with management concurrence, should ask the

licensee to address the safety principles and the numerical guidelines for acceptable risk

increases contained in Regulatory Guide 1.174 in its submittal. The reviewers may alternatively

ask the licensee to submit the information needed in order for the NRC staff to make an

independent risk assessment.

The appropriate level of management involvement would depend on the nature and significance

of the issue. In general, the decision regarding whether a license amendment request creates a

special circumstance should, at a minimum, be supported by the division directors responsible

for probabilistic safety assessment, the technical issue and the regulatory requirements in

question, and licensing project management, as well as the Office of the General Counsel.

Review by the Risk-Informed Licensing Panel (RILP) should be considered for this purpose.

The need to elevate the issue to a higher management level or to inform the Commission

should be specifically addressed by the RILP if a special circumstance is determined to exist.

The RILP should ensure that the burden imposed on the licensee in responding to risk

questions raised by the NRC is justified in view of the potential safety significance of the issue

to be addressed in the requested information.

If a licensee does not choose to address risk, the reviewers should not issue the requested

amendment until they have sufficiently assessed the risk implications to determine that there is

reasonable assurance that the public health and safety will be adequately protected if the

amendment request is approved. A licensee’s decision not to submit requested information

could impede the staff’s review and could also prevent the reviewers from reaching a finding

that there is reasonable assurance of adequate protection. A licensee’s failure to submit

requested information could also be a basis for rejection pursuant to 10 CFR 2.108.
19.2-84 June 2007

Evaluation Findings

The numerical guidance for CDF and LERF and the safety principles provided in Regulatory

Guide 1.174 are intended to provide a basis for finding that there is reasonable assurance of

adequate protection. Therefore, situations that exceed these values or violate the other

principles would constitute a trigger point at which questions are raised as to whether the

proposed change provides reasonable assurance of adequate protection. A more in-depth

assessment of the special circumstances, the safety principles, and the issues identified for

management attention in Section 2.2.6 of Regulatory Guide 1.174 should then be made in

order to reach a conclusion regarding the level of safety associated with the requested change.

In making this assessment, the reviewers should be mindful to clearly differentiate the concept

of adequate protection from the numerical risk acceptance guidelines. The guidelines in

themselves do not constitute a definition of adequate protection but provide an appropriate set

of criteria to be used in the process for evaluating adequate protection. As discussed in

Regulatory Guide 1.174, the uncertainty in the analyses must be considered in any finding that

adequate protection is achieved.

The final acceptability of the proposed change should be based on a consideration of current

regulatory requirements, as well as on adherence to the safety principles, and not solely on the

basis of a comparison of quantitative probabilistic risk assessment results with numerical

acceptance guidelines. The decision to reject a non-risk-informed license amendment request

on the basis of risk should be supported by the RILP and would be expected to be elevated to

officelevel management for a final decision. The authority provided by the Atomic Energy Act

and current regulations requires rejection of a license amendment request if the NRC is unable

to find that adequate protection is provided.
19.2-85 June 2007

Figure 1 - Process and Logic for Considering Risk in License Amendment Reviews

Request raises issues that could

rebut presumption of adequate

protection – “special circumstance”

believed to exist (see Note)

Management agreement

regarding special circumstances

and obtaining risk information

RG 1.174 safety principles

are not met (quantitative and

qualitative assessments)

Cannot find reasonable assurance

of adequate protection when risk

and all other factors are considered

Questions raised regarding adequate protection;

perform in-depth reassessment of all factors

? Inform/engage licensee regarding risk concern

? Inform management of risk concern

“Special circumstance” exists; request and

evaluate risk information

Application

acceptable

Application

acceptable

Application

acceptable

Application

acceptable

N

N

N

N

Y

Y

Y

Reject application on the basis of inadequate protection

Y

Non-risk-informed submittal that

meets deterministic requirements

Note: “Special circumstances” may exist if

1. The situation was not identified or addressed in development

of regulations, and could be important enough to warrant a new

regulation if encountered on a widespread basis.

2. The reviewer has knowledge that the risk impact is not

reflected by the licensing basis analysis, and has reason to

believe that the risk increase would warrant denial if the request

were evaluated as a risk-informed application.

Request raises issues that could

rebut presumption of adequate

protection – “special circumstance”

believed to exist (see Note)

Management agreement

regarding special circumstances

and obtaining risk information

RG 1.174 safety principles

are not met (quantitative and

qualitative assessments)

Cannot find reasonable assurance

of adequate protection when risk

and all other factors are considered

Questions raised regarding adequate protection;

perform in-depth reassessment of all factors

? Inform/engage licensee regarding risk concern

? Inform management of risk concern

“Special circumstance” exists; request and

evaluate risk information

Application

acceptable

Application

acceptable

Application

acceptable

Application

acceptable

N

N

N

N

Y

Y

Y

Reject application on the basis of inadequate protection

Y

Non-risk-informed submittal that

meets deterministic requirements

Note: “Special circumstances” may exist if

1. The situation was not identified or addressed in development

of regulations, and could be important enough to warrant a new

regulation if encountered on a widespread basis.

2. The reviewer has knowledge that the risk impact is not

reflected by the licensing basis analysis, and has reason to

believe that the risk increase would warrant denial if the request

were evaluated as a risk-informed application.
19.2-86 June 2007

SRP Section 19.2

Description of Changes

This SRP section affirms the technical accuracy and adequacy of the guidance previously

provided in Revision 1, dated November 2002 of this SRP. See ADAMS accession number

ML023250195. 

SRP Section 19.2 was previously issued as SRP Chapter 19.0. A new SRP Section 19.0 is

being developed to address the review of risk information submitted to support application for

design certifications and combined operating licenses. This version of SRP Section 19.2 was

created to retain the previous guidance in SRP Chapter 19.0 and make minor editorial changes.

In addition, this SRP section was administratively updated in accordance with NRR Office

Instruction, LIC-200, Revision 1, “Standard Review Plan (SRP) Process.” The revision also

adds standard paragraphs to extend application of the updated SRP section to prospective

submittals by applicants pursuant to 10 CFR Part 52, as appropriate. 

Review Responsibilities - Reflects changes in review branches resulting from reorganization

and branch consolidation. Changes are reflected throughout the SRP. 

1. Moved footnote into the text to improve clarity.

2. Updated Review Responsibilities to reflect NRO guidance.

I. AREAS OF REVIEW

None

II. ACCEPTANCE CRITERIA

None

III. REVIEW PROCEDURES

1. Deleted previous footnote and added a reference to SRP Section 19.1 in the text to

reflect’s the staff’s current position on the use of industry peers reviews.

 2. Deleted previous footnote and added a reference to RG 1.200 in the text to reflect the

fact that RG 1.200 is the current vehicle used by the staff to endorse industry PRA

standards.

3. Changed the previous footnote of Table III-1 into a note immediately following the title to

improve clarity.

4. Added item to Table III-1, "Questions to Assist in Establishing the Cause-Effect

Relationship" for Low Power and Shutdown PRA, "Does the application affect the ability

for the operator to close containment?" To be consistent with the risk insights identified

in SECY 97-168.

5. Changed the previous footnote of Figure III-1 into a note to improve clarity.

6. Changed the previous footnote of Figure III-2 into a note to improve clarity.
19.2-87 June 2007

IV. EVALUATION FINDINGS

Revised to indicate that reviewers should verify the information provided by the applicant

and conduct review activities in order to support the conclusion(s) reached, rather than

simply providing example language for stating the conclusion(s) without also indicating

the need to provide the technical basis(es) behind the conclusion(s).

V. IMPLEMENTATION

 None

VI. REFERENCES

1. Deleted the previous footnotes that told reviewers how to obtain copies of the cited

references. All of the current references can now be obtained from either the public

website or ADAMS.

 2. Added and restructured reference list.