Attachment

Integrated Safety Analysis:

Why It Is Appropriate for Fuel Recycling Facilities

Executive Summary

This paper addresses why the use of an Integrated Safety Analysis ("ISA") is appropriate

for fuel recycling facilities' which would be licensed under new regulations currently

being considered by NRC. The use of the ISA for fuel facilities under Part 70 is

described and compared to the use of a Probabilistic Risk Assessment ("PRA") for

reactor facilities. A basis is provided for concluding that future recycling facilities -

which will possess characteristics similar to today's fuel cycle facilities and distinct from

reactors - can best be assessed using established qualitative or semi-quantitative ISA

techniques to achieve and demonstrate safety in an effective and efficient manner.

An ISA, as defined in 10 CFR § 70.4 and recommended by industry for recycling

facilities2, is a systematic analysis to identify facility and external hazards and their

potential for initiating accident sequences, the potential accident sequences, their

likelihood and consequences, and the items relied on for safety ("IROFS"). At existing

fuel cycle facilities, the ISA is part of the safety program required by 10 CFR § 70.62 to

demonstrate that the performance requirements of 10 CFR § 70.61 are met. The ISA

provides the framework and establishes the needed safety basis to assure the safe

handling of nuclear material. This framework includes measures for carrying out the

safety program including appropriate monitoring.

Under the Part 70 approach an ISA provides a flexible methodology that can be tailored

to the uniqueness of each facility to identify undesirable events or accidents with high or

intermediate consequences and to develop the needed safety measures to prevent or

preclude these events. Use of an ISA achieves the required safety for fuel facilities and is

the best, most cost effective option for ensuring safety at recycling facilities.

A PRA is intended to provide a complete, quantitative risk representation of a facility and

illustrate the contribution to risk of the supporting features of the facility. In contrast, an

ISA does not determine the overall quantitative risks associated with a facility. An ISA

identifies undesirable events or accidents with high or intermediate consequences and

develops the needed safety measures to prevent or preclude these events. There is a

likelihood associated with the event that can be defined qualitatively, semi-quantitatively,

or quantitatively. The PRA considers the components of the facility and their

contribution to risk or an undesirable outcome. The ISA identifies the potential hazards

and events and then assigns IROFS to prevent that event or mitigate the consequences

should that event occur.

' Fuel recycling facility means a facility for recycling and its associated activities such as, but not limited to, spent fuel

storage, vitrification, plutonium and/or minor actinides processing and fuel fabrication, waste storage and processing,

and storage of new fuel to the extent such associated activities are included in the application and or license for the fuel

recycling facility. A fuel recycling facility is a production facility. 2 Industry's proposed recycling facility regulatory framework contained in a "Part 7X" which was provided as

Appendix A of the NEI December 19, 2008 "White Paper" submitted to the NRC (ML083590129).
A PRA relies on extensive data bases that include information on equipment reliability,

test data for equipment performance under adverse conditions, as well as an

understanding of plant operations and conditions and their relative importance to the risk

at the facility. This data has been established over time at numerous reactor sites. While

no reactor may be identical in every fashion, they all have similar systems.

Fuel cycles facilities rarely have similar systems and equipment. Because of the

uniqueness of the facilities and the proprietary natures of their systems, the fuel cycle

industry has not created shared databases of reliability information as has the nuclear

power reactor industry. For fuel cycle facilities, this information would need to be

developed over time at a significant cost using scarce specialized human resources to

enable PRAs.

In contrast to reactors, fuel facility processes are typically much less inter-dependent.

The differences in inter-dependency at a fuel cycle facility make the need for Boolean

analysis 3 approaches, which are employed in PRAs but not ISAs, less important than at a

reactor. Also, fuel facilities do not require large amounts of cooling water to be available

to prevent or mitigate accidents. Although large amounts of radioactive fission products

are stored and processed on site, these fission products are not in the presence of large

energy sources or chemicals that could affect the integrity of the fission product barriers.

The requirements for safety systems at fuel facilities are much less complex than at

reactors where these systems are required to prevent core damage.

An ISA is essentially a design methodology to assure appropriate safety controls are in

place to meet performance objectives. It is not, like PRA, a tool to determine the overall

risk of a facility. ISAs are useful to determine the needed safety requirements for a

facility, but in contrast to a PRA, the ISA process is not intended for determining the

relative increase in the off-site risk of a facility following a degraded condition.

A high-level simplified PRA for a recycling facility could be used to provide risk insights

in the context of demonstrating the margin within safety goals for accident scenarios

from fission product releases with potential for high consequences. Such an analysis

would support the conservative assumptions applied in the ISA. Such insights could be

used to inform regulatory decisions and, in this manner, aid the inspection process and

the allocation of inspection resources. Alternately, the inspection process can be risk

informed by focusing resources on IROFS needed to prevent or mitigate high and

intermediate consequence events based on the ISA process. I

In summary, an ISA is an appropriate, cost effective methodology for achieving and

maintaining safety at fuel recycling facilities in a risk-informed, performance-based way.

4 This approach has been adopted in industry's prior proposal for recycling regulations

3 A Boolean analysis allows events or scenarios to be described as an algebraic combinatorial system which treats

variables as propositions and computer logic elements utilizing such operations as AND, OR, NOT, THEN, and

EXCEPT.

4 Part 7X, Appendix A of the NEI December 19, 2008 "White Paper" submitted to the NRC (ML083590129)

2
I. Introduction

Fuel recycling facilities are proposed to be licensed under a new set of regulations

currently being considered by NRC. Industry has constructed a proposal for how such

regulations should be constructed in a proposed 10 CFR Part 7x. 5 Part 7x is derived in

large part from the requirements of 10 CFR Part 70 "Domestic Licensing of Special

Nuclear Material," which are applicable to fuel cycle facilities regulated by the U. S.

Nuclear Regulatory Commission (NRC).

On May 12, 2010, in response to a briefing on the Fuel Cycle Oversight Process

revisions, the Commission issued an SRM directing the NRC Staff to provide the

Commission with "a concise paper comparing [ISAs] for fuel cycle facilities and

Probabilistic Risk Assessments (PRAs) for reactors, including a critical evaluation of

how ISAs differ from PRAs." 6 This paper has been developed to represent the industry's

perspective on that inquiry as it relates to recycling facilities. In so doing, this paper

focuses on the development of the ISA process under Part 70, its application to NRC's

future recycling regulations Part 7x, the differences between PRAs and ISAs, and the

benefits and challenges of application of ISAs and PRAs to recycling facilities.

II. History of ISA

Application of integrated safety analysis ("ISA") methods to Nuclear Regulatory

Commission ("NRC" or "Commission") regulations originated as a result of Commission

concern over safety regulations governing certain fuel cycle facilities. In 1992, the NRC

reviewed its safety regulations for licensees who possess large quantities of Special

Nuclear Material ("SNM"). This review was prompted by a near criticality incident at a

low enriched fuel fabrication facility that occurred in May 1991. Similarly, the NRC was

prompted to consider its safety regulations pertaining to facilities involving significant

chemical processes, as the result of a fatal chemical accident in January 1986.

As a result of its 1992 review, the NRC decided to revise the regulatory base for licenses

to possess a critical mass of SNM, and concluded that an ISA should be required "to

increase confidence in the margin of safety at a facility possessing this type and amount

of material." 7 Accordingly, the NRC held public meetings in May and November 1995.

In September 1996, the Nuclear Energy Institute ("NEI") submitted a Petition for

Rulemaking regarding Part 70 regulations, which the NRC published in the Federal

Register in November 1996.8 In its petition, NEI argued that a major revision to Part 70

was not required, but advocated "a focused and performance-based addition to the

5

id.

6 SRM- 10-0429, Staff Requirements - Briefing on the Fuel Cycle Oversight Process Revisions (May 12, 2010).

7 Proposed Rule; Domestic Licensing of Special Nuclear Material; Possession of a Critical Mass of Special Nuclear

Material, 64 Fed. Reg. 41,338, 41,339 (July 30, 1999) ("SNM Proposed Rule").

8 Nuclear Energy Institute; Receipt of a Petition for Rulemaking, 61 Fed. Reg. 60,057 (Nov. 26, 1996) ("Receipt of

NEI Rulemaking Petition").

3
existing regulation to address the NRC's concern about possible hazards at 10 CFR Part

70 licensed facilities." 9 Specifically, NEI proposed the use of an ISA.' 0

The NRC did not immediately accept NEI's petition. ' 1 After some revision to NEI's

proposal, the NRC published the proposed rule on July 30, 1999.12 As summarized by

the Commission:

The proposed amendments [to Part 70] would identify

appropriate consequence criteria and the level of protection

needed to prevent or mitigate accidents that exceed these

criteria; require affected licensees to perform an [ISA] to

identify potential accidents at the facility and the items

relied on for safety necessary to prevent these potential

accidents and/or mitigate their consequences; require the

implementation of measures to ensure that the items relied

on for safety are available and reliable to perform their

function when needed; require the inclusion of the safety

bases, including a summary of the ISA, with the license

application; and allow for licensees to make certain

changes to their safety program and facilities without prior

NRC approval. 13

On September 18, 2000, after addressing comments on the proposed rule, the NRC

published the final rule for the amendment to Part 70 requiring that licensees and

applicants under Part 70 perform an ISA. 14 This requirement was a part of a new Subpart

H, "Additional Requirements for Certain Licensees Authorized to Possess a Critical Mass

of Special Nuclear Material." In the years that followed, ISA has consistently been used

for fuel cycle facilities under Part 70.

9 Id. at 60,058

10 As an aside, this was not the first time that the ISA methods had been applied in the NRC arena. Earlier, the NRC

referenced the American Institute of Chemical Engineer's ("AIChE") Guidelines for Hazard Evaluation Procedures,

with Worked Examples (2nd ed. Apr. 1992), to inform such hazard analyses under other NRC requirements. See

Receipt ofNEI Rulemaking Petition, 61 Fed. Reg. at 60,058.

1 On June 30, 1997, the NRC Staff proposed a resolution to the petition in SECY-97-137, including adding a

requirement to Part 70 that licensees perform a formal ISA as the basis for the safety program, and requiring inclusion

of the safety bases (i.e., the identification of the potential accidents, IROFS, and measures necessary to ensure the

IROFS) in the license application. See SNM Proposed Rule, 64 Fed. Reg. at 41,339. On August 22, 1997, the

Commission approved the Staffs proposal and directed the Staff to submit a draft proposed rule by July 31, 1998. See

SECY-97-137, Revised, Proposed Resolution to Petition for Rulemaking Filed by the Nuclear Energy Institute (Aug.

22, 1997). Accordingly, on July 30, 1998, the Staff submitted a proposed rule in SECY-98-185 requiring that the

safety basis for a facility, including the ISA results, be included in the license, and directed that a qualitative backfit

mechanism should be considered for implementation. In SRM-98-185, issued on December 1, 1998, the Commission

directed the Staff to not publish the proposed rule, but obtain stakeholder input and revise the proposed rule considering

8 stated elements. Among these 8 elements was consideration of what information was fundamental for inclusion in

the Part 70 license, and clarification of the basis for use of chemical safety and chemical consequence criteria. The

NRC held public meetings from December 1998 through March 1999. 12 SNM Proposed Rule, 64 Fed. Reg. at 41,338-57

13 id.

14 Final Rule; Domestic Licensing of Special Nuclear Material; Possession of a Critical Mass of Special Nuclear

Material, 65 Fed. Reg. 56,211 (Sept. 18, 2000) ("SNM Final Rule").

4
III. The ISA Process

The ISA process required by Part 70 and identified for recycling facilities by industry in

Part 7x is a systematic, risk-informed and performance-based analysis that includes the

following steps: (1) identification of the plant and external hazards and their potential for

initiating accident sequences; (2) identification of the potential for accident sequences,

their likelihood, and the consequences; and (3) identification of the structures, systems,

and components ("SSCs") and personnel activities relied on to prevent or mitigate

potential accidents. The ISA provides the framework and establishes the needed safety

basis to assure that the handling of nuclear material is within the programmatic

requirements, that the safety program is appropriate for the risk, and that the measures for

carrying out the safety program are appropriately monitored.

ISA is "performance based" because it establishes certain thresholds for these accident

consequences, which licensees or applicants must meet. 15 If the ISA analysis identifies

potential accidents that could exceed those thresholds, the licensee or applicant must take

certain actions to reduce the likelihood of the accident, or mitigate the consequences of

the accident.16 Thus, ISA is also risk informed. Specifically, a licensee or applicant must

take steps to ensure that a high consequence event is highly unlikely, or reduce the

consequence to the threshold provided in § 70.61 (b). For an intermediate consequence

event, the licensee or applicant must take steps to ensure that the event is unlikely, or

reduce its consequences to a level below the threshold provided in § 70.6 1(c). For

possible criticality accidents, the licensee must take steps to ensure that under normal and

credible abnormal conditions, all nuclear processes are subcritical. These three

thresholds are called "performance requirements."

The controls used and relied upon to ensure compliance with each of the three

performance requirements must be identified as items relied on for safety ("IROFS"),

described as the third prong above. Licensees must also use "management measures" to

ensure that each IROFS is available and reliable to perform its safety function(s) when

needed. 1

7 The management measures, as defined in 10 CFR § 70.4, include the Quality

Assurance program, the maintenance program, the configuration management program,

and the supporting training, audit, and procedural controls. The applicant's safety

program including the ISA and the determination of likelihoods is reviewed by the NRC

as part of the NRC's evaluation of the application. As explained in the 1999 proposed

rule for the revision to Part 70, the Commission believes that "the combination of the set

of '[IROFS]' and the 'management measures' applied to each item will determine the

extent of the licensee's programmatic and design requirements, consistent with the

facility risk, and will ensure that at any given time, the facility risk is maintained safe and

protected from accidents (viz., satisfies the performance requirements)." 18

15 10 C.F.R. § 70.61 16 id.

17 10 C.F.R. § 70.62(d).

18 SNM Proposed Rule, 64 Fed. Reg. at 41,341.

5
ISA differs from PRA in part because ISA methodology need not be quantitative. In its

rulemaking, the NRC made clear that a licensee and the NRC could make technical

determinations without actually having to quantify the probability of events, as one

would with a PRA. 1 9

Consequently, the regulatory approach under the current Part 70 regulations allows a

qualitative or quantitative approach. However, the typical application at fuel cycle

facilities has been semi-quantitative as described in the NUREG-1520 examples. The

question presented here is whether a qualitative or semi-quantitative approach to

performing an ISA provides sufficient rigor and basis to support safety decisions for a

fuel recycling facility, or should quantitative techniques such as a PRA be established.

A. The Qualitative ISA

An ISA enhances safety by requiring a risk informed assessment to identify and rank

potential accidents. Safety is further enhanced by the development of a safety program

that includes the requirement to describe items relied on to prevent or mitigate an

accident and a description of how these items will be maintained.2 0 Because the function

of an ISA is to determine the location and cause of the off-normal / abnormal / accident

events in a facility, and prescribe the needed controls to either prevent these events or

limit the consequence of the events in order to meet the performance requirements,

determining the likelihood of the event is an important factor in developing a systematic

methodology for completing an ISA. For a qualitative ISA, objective criteria are applied

to categorize the accident sequence into one of a number of qualitative likelihood

categories.

A qualitative evaluation relies on an assessment of the reliability and availability

characteristics of IROFS or systems relied on to prevent or mitigate a particular event.

The likelihood of any particular accident sequence relies on the totality of the system of

IROFS. In meeting the performance requirements of 10 CFR § 70.61, one must consider

the entire set of IROFS as well as any supporting management measures required to

maintain or assure the availability of the IROFS.

To determine the reliability and availability of an individual IROFS, one must assess the

safety margin available compared to the process variation or uncertainty, the type of

control (active versus passive), the type and grading of the applicable management

measures, and the ability to detect failure (i.e., is failure readily apparent or must it be

found by surveillance?). The effectiveness of systems of IROFS in turn depends upon

defense in depth, redundancy, and independence, ideally all of which should be present.

The methodology used to validate a qualitative approach generally begins by assuring

that the compilation of potential accident sequences is complete. The full identification

of accident sequences is very important step for a robust ISA. The NRC has provided

guidance for this effort in NUREG- 1520, Rev. 1 and NUREG 1718, "Standard Review

19 Id

20 SECY-10-0022, Proposed Rule: Domestic Licensing of Source Material, at 3 (Mar. 4, 2010).

6
Plan for the Review of an Application for a Mixed Oxide (MOX) Fuel Fabrication

Facility." For each accident sequence, the consequences of the accident are evaluated in

terms of radiological or chemical exposure to determine whether the event must be

rendered "highly unlikely" or "unlikely" in accordance with 10 CFR § 70.61 (b) or (c).

The regulation, 10 CFR § 70.61, requires that high consequence events be highly

unlikely, because such events may involve high radiation doses. As stated in the

guidance, NUREG-1520, "highly unlikely" translates to a frequency limit of less than one

such accident in the industry every 100 years. As provided in NUREG-1520, this results

in a maximum frequency of 10-5 per event, per year. Similarly intermediate consequence

events include significant radiation exposure to workers (those exceeding 0.25 Sv or 25

rem per event). For intermediate consequence events, the guidance provides a range

between 10-4 and 10-5 per event, per year. Although these guidelines are by nature

quantitative, a licensee or applicant may propose qualitative or semi-quantitative

guidelines.

Applicants or licensees must ensure the availability of IROFS to meet the performance

requirements. In general, the reliability depends upon a formal surveillance program,

unless the control is either "fail safe" or "fail evident." "Fail safe" means that either the

control fails into a safe condition or when the control enters a failed state, action occurs

immediately to render the system safe. Examples of "fail evident" controls include

identifiable leaks or structural failures for passive controls that are readily evident to an

operator. Controls are usually categorized as passive controls, continuously active

controls, standby automatic controls, and administrative controls. Typically, passive

controls are regarded as more robust than active controls, and active controls are regarded

as more reliable than administrative controls. Surveillance intervals must be assigned to

ensure that the control will function.

To consistently use a qualitative approach for assessing IROFS, independence, defensein-depth, and initiating event frequency also need to be described as provided for in

NUREG-1520. Two parameters are independent if no credible single event can cause

failure of both parameters. Applicants and licensees typically utilize defense-in-depth to

further bolster their safety assessment. The question arising from this practice is "Do

these defense-in-depth measures also need to be IROFS?" Items that are utilized for

defense-in-depth are required to be IROFS if they are necessary to meet the performance

requirements of the system or process.

B. Quantitative Approach in the ISA

As described above, determining the likelihood of an event is an important factor in

developing a systematic methodology for completing an ISA. A quantitative evaluation

method is one that seeks to assign a numerical frequency to the accident sequences as a

whole, based on objective failure data. Although compliance with 10 CFR § 70.61 does

not require a quantitative approach for an ISA, most licensees have chosen to adopt a

quantitative definition of the terms "unlikely" and "highly unlikely," even if the licensee

is otherwise following a general qualitative approach for the ISA.

7
In addition, there is some industry-specific, objective, quantitative information - such as

reports of failure modes of equipment or violations, time intervals at which surveillance

is conducted, time intervals at which functional tests or configuration audits are

conducted, demand rates, and for fail-safe monitored or self-announcing IROFS, the time

it takes to render the system safe-that can be incorporated into an otherwise qualitative

ISA.

C. Comparing ISA and PRA Methodologies

1. Similarities between ISAs and PRAs

To describe how an ISA using quantitative or semi-quantitative techniques differs from a

PRA, one must first evaluate the various attributes of each approach in the context of a

fuel cycle or recycling facility. PRAs for reactors are generally either Level 1 or Level 2.

Level 1 PRAs for reactors generally include an initiating event analysis, a success criteria

analysis, an accident sequence development analysis, systems analysis, parameter

estimation analysis, human reliability analysis and quantification of the core damage

frequency given the design, operation and maintenance of the plant, and an interpretation

or discussion of the results.21 Level 1 PRAs also include an internal flood and fire

analysis and an external hazard analysis. A Level 2 PRA also includes a plant damage

state analysis and an accident progression analysis as well as quantification and

interpretation of results.

For reactors, the Level 1 PRA Initiating Event Analysis identifies and characterizes the

random internal events that could challenge plant operation while at power or while

shutdown, and that require successful mitigation by plant equipment and personnel to

prevent core damage from occurring. For'a facility performing an ISA, an initiating

event can be an external event (e.g., hurricane, earthquake, etc.), a facility event external

to the process being analyzed (e.g., fires, explosions, etc.), deviations from normal

operations of the process, or failure of an IROFS in the process. NRC guidance for

performing an ISA in NUREG-1520 stipulates that an item's failure rate should be

determined from actual data for that specific component or safety function in the current

system design under the current environmental conditions. When this data is limited or

not available, appropriate conservatism should be exercised in assigning frequency

indices.

The level 1 PRA success criteria analysis determines the minimum requirements for each

function or system to prevent core damage or to mitigate a release given an initiating

event. An accident sequence development analysis is then performed that models,

chronologically, a progression of events that can result from the initiating event leading

to either successful mitigation or to core damage. For a reactor Level 1 systems analysis,

the different combinations of failures that can preclude the ability of the system to

perform its function as defined by the success criteria are identified. Similarly, for an

21 Regulatory Guide 1.200 For Trial Use, "An Approach for Determining the Technical Adequacy of Probabilistic Risk

Assessment Results for Risk Informed Activities" (Feb. 2004).

8
ISA, a description of the facility processes, hazards, and types of estimated accident

sequences is developed and given an initiating event, the unmitigated events that could

result in a high or intermediate consequence as defined by 10 CFR § 70.61 are identified.

For reactor level 1 PRAs, a parameter estimation analysis quantifies the frequencies of

the identified initiating events and the equipment failure probabilities and equipment

unavailabilities of the modeled systems. Quantification of the PRA provides an

estimation of the core damage frequency given the design, operation, and maintenance of

the plant. The core damage frequency is based on the summation of the estimated core

damage frequency from each initiator class. The comparable step in conducting an ISA

requires the completion of a description of the facility processes, hazards, and types of

accident sequences. The description of the processes must include all processes in which

upset conditions could credibly lead to accidents with high or intermediate consequences.

All process designs must be described in sufficient detail to reasonably permit

identification of accident sequences and IROFS to prevent or mitigate them. The

description of the process hazards must include all hazards that could result in an accident

sequence for which the consequences exceed the performance requirements of 10 CFR §

70.61. The accident sequence must identify all accidents for which the consequences

could exceed the performance requirements of 10 CFR § 70.61. To ensure that all

accidents have been identified, the process design needs to be described in sufficient

detail to specify all the IROFS. A reactor PRA also typically includes an internal flood

and fire analysis as well as an external hazards analysis.

Both the ISA and the PRA are systematic methodologies to identify credible accident

sequences and both determine what processes, systems, components and operator actions

are required to assure safety. In both the ISA and PRA, the accidents that could occur are

reviewed and programs, components, systems and items to prevent or mitigate the

consequences of these accident scenarios are identified, evaluated and described.

2. Differences between ISAs and PRAs

The PRA is intended to comprehensively represent the facility and illustrate the

contribution to risk of the supporting features of the facility. In contrast, under the Part

70 approach, an ISA does not determine the overall quantitative risks associated with a

facility. An ISA identifies undesirable events or accidents with high or intermediate

consequences and then develops the needed safety measures (IROFS and management

measures) to prevent or mitigate these events. There is a likelihood associated with the

event that could be defined either qualitatively or quantitatively but there is not an overall

evaluation of risk. In performing an ISA, there is no attempt to credit components other

than those identified as IROFS as in any way potentially mitigating or preventing an

undesirable outcome. However, defense in depth Systems, Structures, and Components

(SSCs) are frequently identified in safety documents supporting the ISA, even though

they are not directly credited in the safety analysis.

As a consequence, when performing an ISA, a system that may have multiple attributes

that could reduce the likelihood of the event or reduce the consequence of an event may

9
only take credit for the identified IROFS. Additional components beyond those needed

to achieve the necessary reduction are typically not listed as IROFS or credited as

IROFS, and are not evaluated or credited when the overall event likelihood or

consequence is calculated. In contrast, a PRA should credit any SSC in the facility that

will reduce core damage frequency and may not necessarily apply criteria for important

to .safety items. However, as outlined above, if the ISA were to identify an SSC as part of

the overall safety strategy, then it would become an IROFS and thereby any

commitments made towards IROFS (e.g., quality assurance) would apply.

This is not usually a problem unless one attempts to use an ISA to determine the

likelihood of an occurrence following the determination of a degraded condition at a

facility, since there may be components and systems in a facility that are not credited in

the ISA. As a result, it may be difficult to use an ISA to determine the actual risk of a

facility following a degraded condition in the same manner that a PRA could be used in a

reactor, because the PRA considers the actual plant components and systems.

In summary, an ISA is essentially a design methodology to assure appropriate safety

controls are in place to meet performance objectives. ISAs are useful to determine the

needed safety requirements for a facility, and to focus inspections on risk significant

IROFS based on their contributions to preventing or mitigating accidents with the

potential for high-consequences. ISAs are not, however, a tool to determine the overall

risk of a facility, or the relative increase in the off-site risk of a facility following a

degraded condition.

IV. ISA Methods are Appropriate for Analysis of Fuel Recycling Facilities

As a threshold matter, it is important to note that ISA methodologies have been

successfully applied to fuel cycle facilities and that this application is regarded by the

NRC and industry participants as an improvement to the risk analysis and safety basis for

these facilities from the pre-2000 safety analyses used in fuel cycle licensing. ISA

methods have been effective, because the analysis is performance-based and it increases

understanding of the relevant risks and key safety components of a facility. In so doing,

the ISA allows licensees or applicants the flexibility to conduct this risk-based analysis as

appropriate for their facility. For the same reasons, ISA will be a successful regulatory

tool for the recycling industry.

A. ISAs Ensure Adequate Information is Provided and Analyses are

Conducted to Satisfy Performance Requirements

Throughout the aforementioned rulemaking process, the Commission highlighted the

benefits of a risk-informed, performance-based analysis like ISA to "increase confidence

in the margin of safety at a facility.'' 22 The Commission found that, "[b]y evaluating the

ISA methodology, and the ISA summary, supplemented by reviewing the ISA and other

22 Id.. at 41,339-40 ("[increased confidence] can be best accomplished through a risk-informed and performance-based

regulatory approach that includes... performance of an ISA to identify potential accidents at the facility and the items

relied on for safety").

10
information, as needed, at the licensee's facility, the staff can better understand the

potential hazards at the facility, how the applicant plans to address these hazards, and

thereby have confidence in the safety basis on which the license will be issued." 23

These benefits would equally apply to analysis of the potential hazards posed by a

recycling facility.

The NRC also praised the application of ISA to fuel cycle facilities, because ISA

methods allow licensees to ensure that they appropriately assess possible chemical

hazards. As explained by the NRC's Office of Nuclear Material Safety and Safeguards in

its ISA Guidance Document, ISA methods historically have been used for plants in the

chemical and petrochemical industries.24 The NRC applied ISA methods to fuel cycle

facilities in part because these facilities also involve a significant amount of chemical

processing. 25 The same is true for recycling facilities and, in fact, ISA methods

historically have been applied to recycling plants such as the Idaho Chemical Processing

26 Plant and Barnwell. ISA is therefore also appropriate for use with potential new

recycling facilities.

Ten years after publication of the final rule, the Commission continues to have

confidence in ISA methodology. At the Fuel Cycle Information Exchange ("FCIX") on

June 29, 2010, NRC Chairman Gregory B. Jaczko discussed the use of ISAs:

Among the most important changes to our oversight

process has been the Commission's decision to require

many licensees to perform an [ISA]. Through the ISAs,

licensees undertake a systematic analysis of their facility's

internal and external hazards, potential accident sequences,

and other physical and human factors that can compromise

a facility's safety. The ISAs have given both the NRC and

its licensees a lot more information about the risks to

facility safety, their likelihood, and how best to avoid and

mitigate them. 27

In sum, ISA is a methodology that the NRC believes will develop an appropriate safety

basis and ensure compliance with applicable performance requirements. For the same

reasons it has proven successful for fuel cycle licensees, ISA will benefit the risk analysis

for recycling licensees.

23 Id. at 41,348. 24 NUREG-1513, Integrated Safety Analysis Guidance Document I (May 2001). 25 Id

26 id

27 Gregory B. Jaczko, NRC Chairman, Prepared Remarks at the FCIX: The Fuel Cycle: Current and Future Challenges

(June 29, 2010) ("S-10-022"), available at http://www.nrc.gov/reading-rm/doccollections/commission/speeches/2010/s-I 0-022.html.

11
B. ISAs Provide Flexibility to a Diverse Group of Licensees

In addition to ensuring that the safety basis for a recycling facility is risk-informed and

will meet required performance criteria, ISA methods are appropriate for recycling

facilities, because of the inherent flexibility that they provide. That they do not include

stringent, quantitative requirements is a benefit to this approach. This flexibility is

essential to the recycling industry, the participants of which employ a unique variety of

new and emerging technologies that do not provide common information that can be

readily shared. The fuel cycle industry is similarly diverse, and ISA has been successful

in that industry largely because of its successful application to many different types of

facilities and risks.

The Part 70 ISA requirements are flexible in part because the regulation does not affix

quantitative definitions to probabilistic terms. The NRC has viewed the lack of

regulatory definitions for "unlikely," "highly unlikely," "likely," or "credible," as a

strength of the Part 70 ISA requirements. In publishing the proposed rule in 1999, the

Commission pushed back on suggestions to require quantitative standards, explaining

that:

[A] single definition for each term, that would apply to all

the facilities regulated by Part 70, may not be appropriate.

Depending on the type of facility and its complexity, the

number of potential accidents and their consequences could

differ markedly. Therefore, to ensure that the overall

facility risk from accidents is acceptable for different types

of facilities, the rule requires applicants to develop, for

NRC approval (see § 70.65), the meaning of "unlikely" and

"highly unlikely" specific to their processes and facility. 28

Indeed, 10 C.F.R. § 70.65(b)(9) requires that an application for a Part 70 license include a

description of the definitions of these terms as used in its ISA. The Commission

explained in the proposed rule that the Standard Review Plan for the Review of a License

Application for a Fuel Cycle Facility ("SRP") will direct licensees about this process. 29

In publishing the final rule, the NRC again affirmed its belief that explicit, quantitative

requirements were not necessary and, that the probabilistic terms in Part 70 were best left

undefined. The NRC addressed a comment that the regulations should define these

terms. 30 The Commission disagreed, saying:

Part 70 applies to different types of fuel cycle facilities,

some of which are more complex and have more accident

sequences than others. Accordingly, since the application

of the terms in the rule will be necessarily specific to the

individual context in which they are applied, the

28 SNM Proposed Rule, 64 Fed. Reg. at 41,341.

29 Id. at 41,341.

30 SNM Final Rule, 65 Fed. Reg. at 56,219.

12
development of a definition for these terms .in the rule

language is impracticable. The Commission, however, will

provide general guidance on the application of the terms

unlikely and highly unlikely in the SRP to aid licensees in

implementing the provisions of the rule. 31

The NRC has repeatedly and explicitly recognized the benefit of not defining or

quantifying probabilistic terms, so that the regulation may produce the same level of

performance from a variety of facilities. 32

When publishing the final rule revising Part 70 in 2000, the NRC noted the flexibility of

ISA as one of its strengths. The NRC agreed with a comment that the rule language "offers sufficient flexibility in selecting ISA methodology so that a broad spectrum of

facilities can be addressed and such that licensees have flexibility to interface with their

site processes, procedures and resources."' 33

The Commission responded to a comment in the rulemaking that the requirement for the

amount of information to be included in a Part 70 application was vague.34 The

Commission disagreed that this was a problem, defending the requirements on the basis

of the performance-driven outcome. The Commission explained that "the degree of

detail provided in the ISA Summary, with the other information available to NRC staff,

must be sufficient for the NRC staff to make the determination specified in § 70.66 (i.e.,

that the performance requirements of the regulation are satisfied)."35 In other words, the

Commission believed that prescribed, quantitative standards were not necessary.

Thus, the inherent flexibility of the performance-based approach of the ISA does not

necessarily mean that less information is provided. For example, one commenter

complained that the new rules would require a description in the ISA Summary of

processes that would produce accidents that do not exceed the performance requirements

of § 70.61, that is, that applicants would be required to provide too much information. 36

In response, the Commission explained that such information was necessary to assess the

completeness of the ISA Summary and to allow the NRC staff to make the determination

required by § 70.66.37 In short, the NRC intended that the regulations allow applicants

flexibility in how they perform the ISA, while still requiring them to meet set

performance criteria.

31 id

32 Of course, an applicant or licensee may assign quantitative definitions to these terms. As noted above, the NRC's

SRP provides guidance to Part 70 applicants, including direction regarding the definition of the probabilistic terms. See

NUREG-1520, Standard Review Plan for the Review of a License Application for a Fuel Cycle Facility (rev. I May

2010). In so doing, the SRP points out that a licensee may use quantitative definitions for these terms, or even a mix of

qualitative and quantitative information. NUREG-1520, at 3-27 to 3-29. It also provides a number of approaches for

using qualitative definitions. See id. at 3-26 to 3-37. As shown by the SRP, ISA provides significant flexibility for

applicants to tailor their risk-based analyses to the facility and risks at issue, as well as to the relevant data available.

" Id. at 56,215. 34 Id. at 56,213.

35 id. 36 Id. at 56,214. 3 7

id.

13
V. PRA Methods are not more appropriate than ISA Methods as Applied to

Analysis of Recycling Facilities

Despite the established benefits of ISA, there are several reasons why PRA is being

considered for recycling facilities. NRC has published a policy statement 38 advocating

use of PRA in its regulations. Industry concurs that PRA is the appropriate and preferred

methodology in certain settings. Still, Boolean analyses used in PRAs are not beneficial

to fuel recycling facilities, which have far fewer inter-dependent systems. Moreover,

there is insufficient data to conduct a PRA for a fuel recycling facility. On balance, ISA

is an effective risk assessment tool and ISA methods should still be available to recycling

applicants or licensees.

A. Application of ISA to Recycling Facilities Is Not Inconsistent with

NRC Policy Advocating PRA

NRC's policy statement of August 16, 199539 states that "[t]he use of PRA technology

should be increased in all regulatory matters to the extent supported by the state-of-theart in PRA methods and data and in a manner that compliments the NRC's deterministic

approach and supports the NRC's traditional defense-in-depth philosophy.",40

Application of ISA to recycling facilities is not inconsistent with this policy because,

importantly, the NRC added the caveat to its policy statement that PRA methodology

should be adopted "to the extent supported by ... data.",41 The Staff has interpreted this

to mean that where practical, it should use PRA methods, but that in some scenarios ISA

may be more appropriate. 42

In several contexts, the NRC has favored the use of ISA over PRA despite this policy

statement. In the early stages of the Part 70 rulemaking, the NRC Staff commented on

the use of ISA rather PRA for Part 70 facilities, subsequent to the Commission's policy

statement. 43 The Staff has explained that, although PRAs have been successfully applied

in the reactor licensing context, they were, for several reasons, not appropriate for fuel

cycle facilities.44 With respect to nuclear materials regulation generally, the Staff

believed:

(1) PRA may be applicable to only a few specific uses and,

for most licensed uses, other system analysis methods that

address the three risk questions will need to be considered

instead; (2) integrating deterministic and probabilistic

considerations will likely be a much less important issue,

and other issues, such as relating the level of analytic

38 Use of Probabilistic Risk Assessment Methods in Nuclear Regulatory Activities; Final Policy Statement, 60 Fed.

Reg. 42,622 (Aug. 16, 1995) ("PRA Final Policy Statement"). 39 Id

41 Id. at 42,628.

41 id.

42 SECY-10-0031, Revising the Fuel Cycle Oversight Process (Mar. 19, 2010).

41 SECY-98-138, Risk-Informed, Performance-Based and Risk-Informed, Less-Prescriptive Regulation in the Office of

Nuclear Material Safety and Safeguards (June 11, 1998) 44 Id

14
sophistication to the risk associated with specific nuclear

materials uses, will likely be much more important in the

materials framework; and (3) a broader range of licensee

and regulator circumstances will need to be addressed.45

The Staff explained that this distinction was borne out of the "substantial differences"

between "(1) nuclear reactors and the approximately 40 activities, systems, and devices

that use nuclear materials; (2) reactor licensees and the roughly 20,000 nuclear materials

licensees; and (3) the reactor regulatory program and the materials regulatory program,

including its Agreement State program."46 The NRC has thus long recognized that PRA

may not be the optimum analytical tool in all contexts, including for Part 70 facilities.

For another example, the Staff recommended that ISA apply to Part 40 fuel cycle

facilities with UF6 or UF4 inventories greater than a certain threshold quantity.47 The

bases for these conclusions echoed those provided in the Staff's regulatory analysis of its

revision to Part 70 in 2000.48 The Commission approved the ISA approach for UF4 and

UF6 in SECY-07-0146 in an SRM dated Oct. 10, 2007, and the Staff subsequently

proposed a new rule amending Part 40 to require ISA analyses. 49 The Staff in SECY-10-

0022 provided in the regulatory analysis of the proposed amendment to Part 40 included

with its draft proposed rule, that an ISA will "significantly improve" licensee and NRC

understanding of potential accidents and the IROFS necessary to prevent or mitigate

those accidents. 50 Proposed Rule: Domestic Licensing of Source Material -

Amendments/Integrated Safety Analysis, encl. 2 at 7 (Mar. 4, 2010) ("Proposed Rule:

Domestic Licensing of Source Material").

Application of ISA to recycling facilities is furthermore not inconsistent with NRC

policy, because many of the benefits of the PRA extolled by the policy statement are also

common to ISA. The statement provides:

The probabilistic approach to regulation is, therefore,

considered an extension and enhancement of traditional

regulation by considering risk in a more coherent and

complete manner. A natural result of the increased use of

PRA methods and techniques would be the focusing of

regulations on those items most important to safety.51

45 Id.

46 Id.

47 SECY-07-0146, Regulatory Options for Licensing New Uranium Conversion and Depleted Uranium Conversion

Facilities (Aug. 24, 2007)

41 SECY-00-01 11, Final Rule to Amend 10 CFR Part 70, Domestic Licensing of Special Nuclear Material, Attachment

9: Part 70 Amendment Regulatory Analysis (Mar. 27, 2000) ("Part 70 Amendment Regulatory Analysis")

49 SECY- 10-0022, Proposed Rule: Domestic Licensing of Source Material - Amendments/Integrated Safety Analysis

(Mar. 4, 2010)

" SECY-10-0022

51 PRA Final Policy Statement, 60 Fed. Reg. at 42,627.

15
In fact, a basic tenet of ISA is the analysis of hazards based on likelihood, and subsequent

determination of those items relied on to prevent the incident or mitigate its

consequences, so that performance criteria are met.

Finally, the policy statement recognizes that "a single approach for incorporating risk

analyses into the regulatory process is not appropriate." 52 Similarly, as previously noted,

Chairman Jaczko has advocated ISAs as well as PRAs and suggested that both would

continue to be an important part of the Commission's risk-informed and performancebased rules and programs. 53 NEI concurs that there is a role for both PRA and ISA in the

regulatory arena. It is not only not inconsistent, but in fact consistent with NRC policy

for recycling licensees and applicants to apply ISA, rather than PRA, methods.

B. There is Insufficient Data to Conduct a PRA for a Fuel Cycle Facility

Conducting a PRA is a' complex, resource intensive undertaking. Properly done, a PRA

relies on extensive databases that include information on equipment reliability, test data

for equipment performance under adverse conditions, as well as an understanding of

plant operations and conditions and their relative importance to the risk at the facility.

This data has been established over time at numerous reactor sites. While no reactor may

be identical to another, all have similar systems. Fuel cycle facilities rarely have similar

systems and equipment. For fuel cycle facilities, the needed databases would be costly

and difficult to develop while providing little additional safety benefit due to the lack of

inter-dependent systems in and other differences from reactors.

This is, in fact, another reason why application of ISA methods to recycling facilities is

consistent with NRC policy. The Staff has stated, with respect to revisions to Parts 40

and 70, that ISA methodology is preferable to PRA methodology for fuel cycle facilities

because sufficient reliability data is not available to perform quantitative ISAs for fuel

cycle facilities.54 It considered PRA as providing a basis for a "more refined grading of

protection, if the data were available to allow the quantitative approach without excessive

uncertainty bounds."'55 The Staff found that for fuel cycle facilities, "the reliability data

needed to perform a quantitative PRA would be difficult and expensive to assemble and

evaluate."' 56 The basis for this conclusion is that (1) fuel cycle facilities employ unique

equipment for which failure data may not have been kept; (2) fuel cycle facilities involve

considerable human interaction, the failure of which is difficult to model; and (3) there is

no shared reliability database in the fuel cycle industry as there is in the reactor industry,

because of the industry's competitive nature. 7 The Staff concluded that the PRA would

provide an incremental benefit over the ISA, but that the PRA is a less attractive option

due to the unavailability of data and immaturity of experience in the chemical industry

52 /d, at 42,628.

"3 S-10-022.

54 Id,; Part 70 Amendment Regulatory Analysis at 25.

55 Proposed Rule: Domestic Licensing of Source Material, encl. 2 at 7 (emphasis added); Part 70 Amendment

Regulatory Analysis at 14 (emphasis added).

56 Proposed Rule: Domestic Licensing of Source Material, encl. 2 at 12; Part 70 Amendment Regulatory Analysis at 25.

Proposed Rule: Domestic Licensing of Source Material, encl. 2 at 12; Part 70 Amendment Regulatory Analysis at 25.

16
with quantitative models. 58 For the same reasons, application of ISA rather than PRA

methods is also more appropriate for recycling facilities.

The policy statement caveat is especially relevant to recycling facilities. As

acknowledged by the NRC Staff, "PRA analysis is useful only where there is meaningful

and representative data to input into the model.",59 Like in fuel cycle facilities described

above, and unlike in reactor facilities, the current use of PRA in recycling facilities is

very limited, there are few existing recycling facilities, and the access to available data is

very limited. 60 Thus, there is not meaningful and representative data for recycling

facilities available, and PRA analysis is therefore not useful.

NRC Commissioner William C. Ostendorff has echoed this reasoning. At the FCIX on

July 1, 2010, and in response to a question about whether he believes ISA or PRA is

more appropriate for the safety analyses of recycling facilities, Commissioner Ostendorff

stated that he is "hard pressed" to see how the experience from the uniform reactor

industry can apply to quantitative analyses for the fuel cycle industry. His remarks

indicated that, given the variations within the fuel cycle industry and the lack of shared or

common data among licensees or potential applicants, a qualitative analysis is more

appropriate.

Safety is currently achieved and demonstrated at fuel facilities using an ISA that meets

the performance requirements of 10 CFR § 70.61. Although performing a PRA would.

support risk informed regulatory decision-making and in this manner aide the inspection

process and the allocation of inspection resources, the cost to the industry and the NRC,

would be high and without commensurate safety benefit. Moreover, as noted above, the

inspection process can be risk informed by focusing resources on IROFS needed to

prevent or mitigate high-consequence events based on the ISA process. This is consistent

with the NRC staff recommendation in SECY- 10-0031, Revising the Fuel Cycle

Oversight Process, at 10 (Mar. 19, 2010).

C. PRA's are not well suited for analysis of Fuel Cycle Facility Processes

At a reactor, if a safety system actuation occurs, typically multiple interdependent

components must respond in the appropriate time sequence to preclude the possibility of

core damage. This type of sequence of events lends itself to a Boolean analysis.61 The

processes at fuel facilities are not inter-dependent in the manner of reactor primary and

supporting systems.

In contrast to reactors, the safety of most fuel facility processes is not dependent upon

timely activation of safety systems in a sequence. If an upset condition occurs, the

processes are typically stopped and the event propagation does not extend beyond the

initial process that experienced the upset condition. Thus, with the exception of some

58 Proposed Rule: Domestic Licensing of Source Material, encl. 2 at 12; Part 70 Amendment Regulatory Analysis at

14, 25, and 27.

" SECY-09-0082, Update on Reprocessing Regulatory Framework-Summary of Gap Analysis 7 (May 28, 2009). 60 Id. encl. at 7.

61 See footnote 3.

17
events such as a facility-wide fire, the events are not coupled. Since an upset condition in

one part of the plant does not normally translate to an upset condition or a degraded state

in another part of the plant, the systems at fuel facilities, as compared to reactor systems,

do not require independence to achieve and maintain safety. The differences in

interdependency at a fuel cycle facility makes the need for Boolean analysis approaches

less important than at a reactor.

There are several additional aspects of PRA that make this method not well suited to fuel

cycle facilities. PRAs done for reactors use surrogate metrics to achieve the NRC Safety

Goal - they do not use the goal itself. Developing surrogate(s) for multi-step chemical

processes, such as those at fuel cycle facilities "vould be extremely difficult. Systems

analysis for a reactor plants is complicated since reactors employ multiple systems with

multiple trains of redundant and diverse equipment. In such cases, analytic tools such as

fault trees are essential to completing a quantitative PRA. However, such tools are not

needed for simpler equipment systems as used in chemical processes such as at fuel cycle

facilities. Dependencies between systems and SSCs are used to ensure that loss of

supporting systems are accurately reflected in "front line" systems. Reprocessing plants

have significantly less complexity and numerical analysis of dependencies is not needed;

these can be addressed qualitatively. Finally, reactor PRAs involve extensive human

actions including per-initiators (such as maintenance actions that could impact system

response when an event occurs), emergency procedures and severe accident guidelines.

These procedures address operator actions to cool the core and maintain the integrity of

the containment. ISA addresses the human element but a fuel cycle facility does not have

the extensive operational responses required of a reactor plant.

D. Fundamental differences between reactors and recycling facilities

The most significant difference between reactors and fuel cycle facilities is that fuel cycle

facilities do not have large inventories of stored high pressure fluids (such as water) that

could pose a steam pressure transient risk. Fuel facilities do not require large amounts of

cooling water to be available to prevent or mitigate accidents. At recycling facilities,

although large amounts of radioactive fission products are stored and processed on site,

these fission products are not stored in the presence of large energy sources or chemicals

that could affect the integrity of the fission product barriers. Although cooling water is

needed to maintain the fission product temperatures within established limits, the rate of

change of the temperature of these systems when experiencing a loss of coolant is

relatively slow compared to the change in temperature experienced when a light water

reactor loses cooling immediately following or during power operations. As a result, the

requirements for backup cooling systems at fuel facilities are much less complex than the

requirement for backup core cooling water at reactors where these systems are required to

prevent core damage. The fuel facility cooling requirements are easily addressed by

IROFS. In contrast reactor backup cooling water is provided as a result of a series of

interdependent sequential events which lend themselves to a PRA analysis.

The processes at fuel cycle facilities are essentially chemical processes, which can

require large chemical inventories. If these inventories are inadvertently released,

18
exposed to an ignition source, or exposed to another chemical or another environment,

potentially large amounts of energy could be released damaging the facility and releasing

radioactive materials to the environment, harming facility workers or adversely affecting

the safe operation of the facility. For these scenarios, safety is achieved by proper

storage, maintaining integrity of the storage boundaries, preventing ignition sources, and

preventing the introduction of other chemicals which could adversely react with the

chemical of concern. In addition, these systems are provided with preventative or

mitigative measures or safety features that are included in the facility ISA as IROFS to

ensure that if an adverse event occurs, it will not have a high or intermediate

consequence. The preventive and protective measures to accomplish safety for these

chemical processes do not lend themselves to a Boolean analysis. For example, a slight

change in pH that affects precipitation rates and is dependent upon the inadvertent slow

addition of an out of spec material is not accurately rendered to a simple algebraic

combinatorial system of variables as utilized in a PRA.

VI. Use of PRA to develop regulatory risk-insights for recycling facilities

Although a sound design and licensing basis for recycling facilities can be developed

based on ISA, there is one potential area in which PRA might prove useful. A high-level

simplified PRA for a recycling facility could be used to provide risk insights in the

context of demonstrating the margin within safety goals for accident scenarios from

fission product releases with potential for high consequences. Such an analysis would

provide a supporting basis for assessing confidence in the bounding assumptions applied

in the ISA. Such insights could be used to risk-inform regulatory decisions and, in this

manner, aide the inspection process and the allocation of inspection resources.

Alternately, the inspection process can be risk informed by focusing resources on IROFS

needed to prevent or mitigate high and intermediate consequence events based on the ISA

process. A decision as to which approach to use should weigh the relative costs against

the safety benefits potentially to be gained. However, for first-of-a-kind-facilities - such

as an initial US recycling facility using either a new or significantly evolved technology -

there may be intrinsic benefits to be gained from the global perspective on margin to

safety goals that a simplified high-level PRA might provide.

VII. Conclusion

In summary, an ISA is a risk-informed, performance-based way of achieving and

maintaining safety at fuel cycle facilities including recycling facilities following the

regulatory requirements in Part 70 and industry's proposed Part 7x. A quantitative

analysis utilizing quantitative failure data is not required to be able to demonstrate the

needed basis for safety decisions for fuel cycle and recycling facilities. As outlined

above, an ISA can be rigorously developed and used to support a safety decision for these

facilities. Using qualitative or semi-quantitative techniques, as described in the NRC

guidance, these facilities can achieve and demonstrate safety in an effective and efficient

manner.

19