Revision 3 – December 2015 

USNRC STANDARD REVIEW PLAN 

This Standard Review Plan (SRP), NUREG-0800, has been prepared to establish criteria that the U.S. Nuclear Regulatory 

Commission (NRC) staff responsible for the review of applications to construct and operate nuclear power plants intends to use in 

evaluating whether an applicant/licensee meets the NRC regulations. The SRP is not a substitute for the NRC regulations, and 

compliance with it is not required. However, an applicant is required to identify differences between the design features, analytical 

techniques, and procedural measures proposed for its facility and the SRP acceptance criteria and evaluate how the proposed 

alternatives to the SRP acceptance criteria provide an acceptable method of complying with the NRC regulations. 

The SRP sections are numbered in accordance with corresponding sections in Regulatory Guide (RG) 1.70, "Standard Format and 

Content of Safety Analysis Reports for Nuclear Power Plants (LWR Edition)." Not all sections of RG 1.70 have a corresponding 

review plan section. The SRP sections applicable to a combined license application for a new light-water reactor (LWR) are based 

on RG 1.206, "Combined License Applications for Nuclear Power Plants (LWR Edition)." These documents are made available to 

the public as part of the NRC policy to inform the nuclear industry and the general public of regulatory procedures and policies. 

Individual sections of NUREG-0800 will be revised periodically, as appropriate, to accommodate comments and to reflect new 

information and experience. Comments may be submitted electronically by email to NRO_SRP@nrc.gov

Requests for single copies of SRP sections (which may be reproduced) should be made to the U.S. Nuclear Regulatory 

Commission, Washington, DC 20555, Attention: Reproduction and Distribution Services Section by fax to (301) 415-2289; or by 

email to DISTRIBUTION@nrc.gov. Electronic copies of this section are available through the NRC public Web site at 

http://www.nrc.gov/reading-rm/doc-collections/nuregs/staff/sr0800/, or in the NRC Agencywide Documents Access and 

Management System (ADAMS), at http://www.nrc.gov/ reading-rm/adams.html, under ADAMS Accession No. ML15089A068. 

NUREG-0800 

U.S. NUCLEAR REGULATORY COMMISSION 

STANDARD REVIEW PLAN 

19.0 PROBABILISTIC RISK ASSESSMENT AND SEVERE ACCIDENT EVALUATION FOR 

NEW REACTORS 

REVIEW RESPONSIBILITIES 

Primary - Organization responsible for the review of the applicant’s probabilistic risk 

assessment 

Organization responsible for the review of severe accident design features 

Secondary - Organization responsible for the review of structural engineering 

Technical organizations identified in the Review Interface section of this plan 

may be consulted, as needed 

I. AREAS OF REVIEW 

This section of the Standard Review Plan (SRP) pertains to the staff review of the designspecific probabilistic risk assessment (PRA) for a design certification (DC) and plant-specific 

PRA for a combined license (COL) application, respectively. This SRP section also pertains to 

the staff review of the applicant’s deterministic evaluation of design features for the prevention 

or mitigation of severe accidents. 

Subsequent to COL issuance, the staff may review the applicant's PRA (or portions thereof) 

in the context of licensing actions, following the guidance provided in Regulatory Guide 
19.0-2 Revision 3 – December 2015 

(RG) 1.174, “An Approach for Using Probabilistic Risk Assessment in Risk-Informed 

Decisions on Plant-Specific Changes to the Licensing Basis,” and RG 1.200, “An Approach 

for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for RiskInformed Activities,” and SRP Sections 19.1, “Determining the Technical Adequacy of 

Probabilistic Risk Assessment for Risk-Informed License Amendment Requests after Initial Fuel 

Load,” and Section 19.2, “Review of Risk Information Used to Support Permanent Plant Specific 

Changes to the Licensing Basis: General Guidance,” (previously SRP Chapter 19). Associated 

application-specific regulatory guidance and SRP sections should be consulted, while 

maintaining the validity of the staff findings associated with the licensing basis related to PRA 

and severe accidents. 

The purpose of the staff’s review is to ensure that the applicant has adequately addressed the 

Commission’s objectives regarding the appropriate way to address consideration of severe 

accidents and the use of PRA in the design and operation of facilities under review. These 

objectives are outlined in RG 1.206, “Combined License Applications for Nuclear Power Plants 

(LWR Edition),” Section C.I.19.2 and should be addressed in Section 19.1.1 of the applicant’s 

final safety analysis report (FSAR). 

The scope of a DC review is limited to the design-specific aspects within the scope of the design 

certification. The design-specific PRA developed during the DC stage may not identify sitespecific information (e.g., local hazards, switchyard and offsite grid configuration, and ultimate 

heat sink) and may not explicitly model all aspects of the design (e.g., balance of plant). A 

seismic PRA cannot be performed without a site-specific probabilistic seismic hazard analysis 

(PSHA) and as-built information. Consequently, a PRA-based seismic margin analysis (SMA) is 

acceptable. 

This SRP provides guidance for reviewing PRA-based SMA submitted in support of a DC or 

COL application. DC/COL-ISG-20 (Ref. 14) discusses post-DC activities to update the 

PRA-based SMA throughout the licensing process of new reactors, including COL action items 

and post-licensing activities, to ensure a coherent and consistent process for the quality of 

PRA-based SMA to adequately meet Title 10 of the Code of Federal Regulations 

(10 CFR) 52.47(a)(27), 10 CFR 52.79(a)(46), 10 CFR 52.79(d)(1), and 10 CFR 50.71(h). The 

applicant’s design-specific PRA may include assumptions regarding site parameters and the 

interfaces with undeveloped aspects of the design. This is acceptable at the DC stage and 

results in the identification of PRA-based insights that include design, site, and operational 

assumptions. Although the staff has not published a format and content document specific to 

DC applications, RG 1.206, Section C.I.19, is intended to include all information needed for the 

staff to review a COL application that does not refer to a DC. Therefore, DC applicants are 

expected to provide the material in RG 1.206, Section C.I.19, except for those elements that 

require site-specific or plant-specific information not yet available. 

As indicated above, format and content guidance for COL applications is provided in RG 1.206. 

COL applicants not referring to a DC should follow the guidance in RG 1.206, Section C.I.19. 

The staff will review the full scope of information requested by this guidance. Where the DC 

included generic analysis of external events, the COL applicant may demonstrate that the 

relevant parameters of the generic analysis bound the corresponding site-specific parameters. 

Alternatively, the COL applicant may show that a particular initiating event is too infrequent or 

inconsequential to affect core damage frequency (CDF) or large release frequency (LRF). 

Otherwise, the event must be included in the description of risk results and insights. 
19.0-3 Revision 3 – December 2015 

For a COL application that references a DC, the staff review of the PRA for the COL should 

focus on the plant-specific aspects of the PRA and site-specific design features that deviate 

from the referenced DC and the associated differences in risk results and insights. Similar 

limitation in the scope of the review applies to severe accident evaluations. This review 

corresponds to RG 1.206, Section C.III.19. In accordance with the Statement of Consideration 

(72 FR 49365), for the revised 10 CFR Part 52, “License, Certifications, and Approvals for 

Nuclear Power Plants,” the design-specific PRA is excluded from the Tier 1 or Tier 2 information 

that comprises the DC information. As a result, the description of the PRA and its results 

included in Chapter 19 of the DC FSAR is subject to the restrictions of 10 CFR 52.63(a)(1) 

concerning the finality of DCs. 

An applicant’s COL or DC FSAR is expected to contain a qualitative description of PRA insights 

and uses, as well as some quantitative PRA results, such that the staff can perform the review, 

ensure risk insights were factored into the design, and make the evaluation findings described in 

this SRP section. In accordance with the Statement of Consideration (72 FR 49387) for the 

revised 10 CFR Part 52, the U.S. Nuclear Regulatory Commission (NRC) expects that, 

generally, the information that it needs to perform its review of an application from a PRA 

perspective is that information contained in the applicant’s FSAR Chapter 19. The staff should 

issue a request for additional information (RAI) and conduct audits of the complete PRA 

(e.g., models, analyses, data, and codes) to obtain clarifying information as needed. The staff 

will document any NRC audits performed in audit reports so that they may be referenced in the 

staff’s safety evaluation report (SER). However, neither the RAI process nor onsite audits 

should be used to supplement an incomplete application. 

Section IV.A.2.a in each existing design certification rule (DCR) requires COL applicants to 

provide a plant-specific design control document (DCD) containing the same type of information 

and using the same organization and numbering as the generic DCD. This applies to the 

description of the PRA and its results included in Chapter 19 of the FSAR, but does not apply to 

the PRA that supports a COL application (including, but not limited to, the event tree analyses, 

the fault tree analyses, the data analyses, the human reliability analyses, the PRA computer 

model). Furthermore, Section IV.A.2.a in each existing DCR applies to the overall content and 

organization of information among the FSAR chapters, but does not apply to the content or 

organization of information within each FSAR chapter. 

Specifically, Chapter 19 of each plant-specific FSAR must describe the PRA and severe 

accident evaluations; however, the format of information within Chapter 19 is left to the 

discretion of each COL applicant. The staff should ensure that applicants’ FSAR Chapter 19 

contains the information needed to review the COL application, regardless of how the 

information is formatted or organized within FSAR Chapter 19. In the future revision of 

RG 1.206, Section C.III.1 will be revised in accordance with Section IV.A.2.a in each existing 

DCR. 

The structural performance of the containment under severe accident loads reviewed by the 

staff encompasses: (1) the applicant’s assessment of the Level C (or factored load) pressure 

capability of the containment in accordance with 10 CFR 50.44(c)(5); (2) the applicant’s 

demonstration of the containment capability to withstand the pressure and temperature loads 

induced by the more likely severe accident scenarios as stipulated in SECY-93-087, “Policy, 

Technical, and Licensing Issues Pertaining to Evolutionary and Advanced Light-Water Reactor 

Designs,” Section I.J; (3) the applicant’s containment structural fragility assessment for 

overpressurization; and (4) the applicant’s assessment of the seismic capacity of the 
19.0-4 Revision 3 – December 2015 

containment structure in meeting the expectation documented in SECY-93-087, Section II.N. 

The staff also reviews the applicant’s assessment of the structural effects of postulated 

containment phenomenological challenges such as direct containment heating and ex-vessel 

explosions loads on the containment. The review and evaluation focus on the structural 

performance of the containment boundary as the ultimate barrier to radionuclide releases to the 

environment in a severe accident. 

COL Action Items and Certification Requirements and Restrictions. For a DC application, the 

review will also address COL action items and requirements and restrictions (e.g., interface 

requirements and site parameters). 

For a COL application referencing a DC, a COL applicant must address COL action items 

(referred to as COL license information in certain DCs) included in the referenced DC. 

Additionally, a COL applicant must address requirements and restrictions (e.g., interface 

requirements and site parameters) included in the referenced DC. 

Review Interfaces 

The organization responsible for structural engineering supports the review of the PRA and 

severe accident evaluation in two main areas: the applicant’s evaluation of seismic contributors 

(specifically the seismic hazard analysis and estimation of seismic capacities (acceleration at 

which there is high confidence in low probability of failure [HCLPF]) and the applicant’s analysis 

of containment performance. This organization provides written input to the SER. Acceptance 

criteria for these sections are outlined below. 

The review of an applicant’s degree of compliance with requirements of 10 CFR 50.44, 

“Combustible Gas Control for Nuclear Power Reactors,” is conducted with guidance in SRP 

Section 6.2.5 and performed in coordination with the review of containment performance under 

severe accident conditions. 

Other organizations that use the PRA and severe accident evaluation results and insights in 

their programs, processes, and reviews (e.g., human factors, emergency preparedness, 

security, inspection, technical specifications (TS), regulatory treatment of nonsafety systems 

(RTNSS), maintenance rule implementation, fire protection) may need to interface with the PRA 

staff in evaluating these areas. The PRA staff should be prepared to discuss the prioritization of 

structures, systems, and components (SSC) based on risk significance, as well as PRA-based 

insights related to the design. This information will help reviewers of other areas focus their 

review on safety-significant issues. In addition, PRA staff reviews Tier 1 to ensure appropriate 

treatment of important insights and assumptions from the PRA as described in Section C.II.1 of 

RG 1.206, and SRP Section 14.3, “Inspections, Tests, Analyses, and Acceptance Criteria.” 

The organizations that are responsible for the review of the design of the plant for external 

natural hazards (e.g., earthquakes, high winds, external fires, external flooding), hazards related 

to human activities (e.g., transportation and local industry) and in-plant area hazards (internal 

fire and flooding) may need to support the PRA staff in reviewing these hazards. The PRA staff 

may also request support from the organizations that review the systems and thermal-hydraulic 

(T-H) analyses to ensure that the applicant’s PRA properly considers and addresses important 

issues (e.g., failure mechanisms, system interactions, and T-H modeling and uncertainties). 

The organizations responsible for the review of severe accident issues, including severe 

accident management alternatives, in Sections 7.2 and 7.3 of the Environmental Report (ER) 

need to maintain coordination with the PRA staff to assure consistency in the review of severe 
19.0-5 Revision 3 – December 2015 

accident information given in the ER and the review of severe accident evaluations in 

Chapter 19 of the FSAR. 

The NRC technical branch responsible for PRA reviews the acceptability of the applicant’s 

methodology for identifying risk-important human actions. The human factors engineering staff 

is responsible for ensuring that risk-important human actions included in HFE design process 

are the same as those identified in Chapter 19. The NRC reviewers should be aware that riskimportant human actions may be distributed throughout multiple Chapter 19 tables, a practice 

that has caused delay in completing reviews. 

The NRC technical branch responsible for the review of information in Chapter 19 of a DC or 

COL application obtains support from reviewers responsible for the review of instrumentation 

and control (I&C) described in Chapter 7 of a DC or COL FSAR, as necessary, to confirm that: 

1. The analysis adequately accounts for the I&C systems relied upon; 

2. There is reasonable assurance that the I&C systems needed for mitigation of 

events beyond the design basis (including severe accidents) are designed to 

perform their intended function in the environment expected during the event, and 

over the time span for which they are needed; 

3. All common cause failure (CCF) mechanisms for digital instrumentation and 

control (DI&C) systems have been accounted for in the PRA. 

II. ACCEPTANCE CRITERIA 

Requirements for DC Applicants 

1. 10 CFR 51.55(a) states that each DC application must include a separate document 

entitled “Applicant’s Environmental Report - Standard Design Certification,” which must 

address the costs and benefits of the severe accident mitigation design alternatives 

(SAMDA), and the bases for not incorporating SAMDAs in the design to be certified. 

2. 10 CFR 52.47(a)(1) states that each DC application must include the site parameters 

postulated for the design, and an analysis and evaluation of the design in terms of those 

site parameters. 

3. 10 CFR 52.47(a)(2) states that it is expected that the standard plant will reflect through 

its design, construction, and operation an extremely low probability for accidents that 

could result in the release of radioactive fission products. 

4. 10 CFR 52.47(a)(4) states that each DC application must contain an FSAR that includes 

an analysis and evaluation of the design and performance of SSCs with the objective of 

assessing the risk to public health and safety resulting from operation of the facility and 

including determination of the margins of safety during normal operations and transient 

conditions anticipated during the life of the facility, and the SSCs provided for the 

prevention of accidents and the mitigation of the consequences of accidents. 

5. 10 CFR 52.47(a)(8) states that a DC application must contain an FSAR that provides the 

information necessary to demonstrate compliance with any technically relevant portions 
19.0-6 Revision 3 – December 2015 

of the Three Mile Island requirements set forth in 10 CFR 50.34(f), except paragraphs 

10 CFR 50.34(f)(1)(xii), 10 CFR 50.34(f)(2)(ix), and 10 CFR 50.34 (f)(3)(v). 

6. 10 CFR 52.47(a)(23) states that a DC application for light-water reactor (LWR) designs 

must contain an FSAR that includes a description and analysis of design features for the 

prevention and mitigation of severe accidents, e.g., challenges to containment integrity 

caused by core-concrete interaction, steam explosion, high-pressure core melt ejection, 

hydrogen combustion, and containment bypass. 

Note: The Statement of Consideration (72 FR 49380) for the 2007 revision of 

10 CFR Part 52 states that postulated severe accidents are not design-basis 

accidents (DBA) and the severe accident design features do not have to meet 

the requirements for DBA (see SECY-93-087, “Policy, Technical, and Licensing 

Issues Pertaining to Evolutionary and Advanced Light-Water Reactor Designs,” 

dated April 2, 1993). However, the severe accident design features are part of a 

plant’s design-basis information. 

7. 10 CFR 52.47(a)(27) states that a DC application must contain an FSAR that includes 

description of the design-specific PRA and its results. 

Note: 

• The Statement of Consideration (72 FR 49365) for the 2007 revision of 

10 CFR Part 52 states that the definition of Tier 2 in Section II.E.1 of the DCRs 

has been modified to exclude the design-specific PRA and the evaluation 

of SAMDAs. The PRA and SAMDA evaluations do not need to be included in 

Tier 2 because they are not part of the design-basis information. 

• The Statement of Consideration (72 FR 49380) for the 2007 revision of 

10 CFR Part 52 states the understanding that the complete PRA (e.g., codes) will 

be available for NRC inspection at the applicant’s offices, if needed. The NRC 

expects that, generally, the information that it needs to perform its review of the 

DC application from a PRA perspective is that information that will be contained 

in applicants’ FSAR Chapter 19. 

• Prior to the revision to 10 CFR Part 52 in August 2007, regulations required DC 

applicants to separately submit their PRAs. As a result, Chapter 19 of the 

design-specific DCDs submitted before the issuance of this rule revision did not 

include many PRA quantitative results. 

• Part of the PRA required by 10 CFR 50.71(h)(1) no later than initial fuel load is 

the seismic PRA. Since this cannot be completed until the plant is built, 

Chapter 19 of the DCD must describe the assumed seismic hazard and results of 

a PRA-based SMA. 

8. 10 CFR 52.47(b)(2) states that a DC application must contain an ER as required by 

10 CFR 51.55. 

Note: The Statement of Consideration (72 FR 49443) for the 2007 revision of 

10 CFR Part 52 states that this assessment is distinct from, and in addition to, the 
19.0-7 Revision 3 – December 2015 

requirement in paragraph 10 CFR 52.47(a)(23) to provide a description and analysis of 

severe accident design features. 

Requirements for COL Applicants 

1. 10 CFR 51.50(c) states that each COL application must include a separate document 

entitled “Applicant’s Environmental Report - Combined License Stage.” If the COL 

references a DC, then the COL ER may incorporate by reference the environmental 

assessment previously prepared by the NRC for the referenced DC. If the DC 

environmental assessment is referenced, then the COL ER must contain information to 

demonstrate that the site characteristics for the COL site fall within the site parameters in 

the DC environmental assessment. 

2. 10 CFR 52.79(a)(1) states that each COL application must include the boundaries of the 

site; the proposed general location of each facility on the site; the seismic, 

meteorological, hydrologic, and geologic characteristics of the proposed site (with 

appropriate consideration of the most severe of the natural phenomena that have been 

historically reported for the site and surrounding area as well as sufficient margin to 

account for limited accuracy, quantity, and time in which the historical data have been 

accumulated). It must also include the location and description of any nearby industrial, 

military, or transportation facilities and routes. It must provide the existing and projected 

future population profile of the area surrounding the site. Finally, it must include a 

description and safety assessment of the site on which the facility is to be located. 

3. 10 CFR 52.79(a)(2) states that it is expected that reactors will reflect through their 

design, construction, and operation an extremely low probability for accidents that could 

result in the release of radioactive fission products. 

4. 10 CFR 52.79(a)(5) states that a COL application must contain an FSAR that includes 

an analysis and evaluation of the design and performance of SSCs with the objective of 

assessing the risk to public health and safety resulting from operation of the facility and 

including determination of the margins of safety during normal operations and transient 

conditions anticipated during the life of the facility, and the SSCs provided for the 

prevention of accidents and the mitigation of the consequences of accidents. 

5. 10 CFR 52.79(a)(17) states that a COL application for a LWR design must contain an 

FSAR that provides the information with respect to compliance with a technically 

relevant positions of the Three Mile Island (TMI) requirements in 10 CFR 50.34(f), with 

the exception of 10 CFR 50.34(f)(1)(xii), 10 CFR 50.34(f)(2)(ix), 10 CFR 50.34(f)(2)(xxv) 

and 10 CFR 50.34(f)(3)(v). 

6. 10 CFR 52.79(a)(18) states that a COL application must contain the information required 

by 10 CFR 50.69(b)(2), if the applicant seeks to use risk-informed treatment of SSCs in 

accordance with 10 CFR 50.69. 

7. 10 CFR 52.79(a)(38) states that a COL application for a LWR design must contain an 

FSAR that includes a description and analysis of design features for the prevention and 

mitigation of severe accidents, for example, challenges to containment integrity caused 

by core-concrete interaction, steam explosion, high-pressure core melt ejection, 

hydrogen combustion, and containment bypass. 
19.0-8 Revision 3 – December 2015 

8. 10 CFR 52.79(a)(46) states that a COL application must contain an FSAR that includes 

a description of the plant-specific PRA and its results. 

Note: 

• The Statement of Consideration (72 FR 49387) for the 2007 revision of 10 CFR 

Part 52 states the understanding that the complete PRA (e.g., codes) would be 

available for NRC inspection at the applicant’s offices, if needed. The NRC 

expects that, generally, the information that it needs to perform its review of the 

COL application from a PRA perspective is that information that will be contained 

in applicants’ FSAR Chapter 19. 

• RG 1.206 provides guidance on reporting PRA-related information. As discussed 

in the Statement of Consideration (72 FR 49387) for the 2007 revision of 10 CFR 

Part 52 the guidance focuses on qualitative description of insights and uses, but 

also acknowledges that some quantitative PRA results should be submitted. 

• In accordance with the requirements in 10 CFR 52.79(d)(1), COL applicants must 

provide the basis for determining that the SMA of the DCD is applicable to the 

proposed plant or perform a plant-specific SMA. In any case, a plant-specific 

supplement must identify any SSCs outside the scope of the DCD that are relied 

upon for safe shutdown after an earthquake. 

9. 10 CFR 52.79(c)(1), 10 CFR 52.79 (d)(1), and 10 CFR 52.79 (e)(1) state that if a COL 

application references a standard design approval, standard DC, or the use of one or 

more manufactured nuclear power reactors licensed under Subpart F of 10 CFR Part 52, 

then the plant-specific PRA information must use the PRA information for the design 

approval, DC, or manufactured reactor, respectively, and must be updated to account for 

site-specific design information and any design changes or departures. 

Note: The Statement of Consideration (72 FR 49388) for the 2007 revision of 10 CFR 

Part 52 states in the case where a COL application is referencing a DC, the NRC only 

expects the design changes and differences in the modeling (or its uses) pertinent to the 

PRA information to be addressed to meet the submittal requirement of 

10 CFR 52.79(d)(1). 

10. Section IV.A.2.a of each DCR states that a COL application which references a DC must 

include a plant-specific FSAR containing the same type of information and using the 

same organization and numbering as the generic DCD for the certified design, as 

modified and supplemented by the applicant’s exemptions and departures. 

SRP Acceptance Criteria 

Background

Specific SRP acceptance criteria to meet the relevant requirements of the NRC regulations 

identified above are as follows for the review described in this SRP section. The SRP is not a 

substitute for the NRC regulations, and compliance with it is not required. However, an 

applicant is required to identify differences between the design features, analytical techniques, 

and procedural measures proposed for its facility and those corresponding features, techniques, 

and measures in the SRP acceptance criteria, and evaluate how the proposed alternatives to 
19.0-9 Revision 3 – December 2015 

the SRP acceptance criteria provide acceptable methods of compliance with the NRC 

regulations that underlie the acceptance criteria. 

The SRP acceptance criteria are derived from Commission direction and staff guidance 

published in multiple documents, including the following: 

1. Policy Statement, “Severe Reactor Accidents Regarding Future Designs and Existing 

Plants,” 50 FR 32138, August 8, 1985. 

2. Policy Statement, “Safety Goals for the Operations of Nuclear Power Plants,” 

51 FR 28044, August 4, 1986. 

3. Policy Statement, “Nuclear Power Plant Standardization,” 52 FR 34884, 

September 15, 1987. 

4. Policy Statement, “Regulation of Advanced Nuclear Power Plants,” 59 FR 35461, 

July 12, 1994. 

5. Policy Statement, “The Use of Probabilistic Risk Assessment Methods in Nuclear 

Regulatory Activities,” 60 FR 42622, August 16, 1995. 

6. SECY-90-016, “Evolutionary Light-Water Reactor (LWR) Certification Issues and their 

Relationship to Current Regulatory Requirements,” Agencywide Documents Access and 

Management System (ADAMS) Accession No. ML003707849, dated January 12, 1990, 

and the related staff requirements memorandum (SRM), ADAMS Accession No. 

ML003707885, dated June 26, 1990. 

7. SECY-93-087, “Policy, Technical, and Licensing Issues Pertaining to Evolutionary and 

Advanced Light-Water Reactor Designs,” ADAMS Accession No. ML003708021, dated 

April 2, 1993, and the related SRM, ADAMS Accession No. ML003708056, dated 

July 21, 1993. 

8. SECY-93-087 and the Commission’s SRM provide guidance for meeting the 

deterministic containment performance goal (CPG) in the evaluation of the passive 

Advanced Light Water Reactors (ALWRs) as a complement to the conditional 

containment failure probability (CCFP) approach. SECY-93-087 indicates the following 

with respect to the deterministic containment performance assessment: 

The containment should maintain its role as a reliable, leaktight barrier (e.g., by ensuring 

that containment stresses do not exceed American Society of Mechanical Engineers 

(ASME) Service Level C limits for metal containment or factored load category for 

concrete containments) for approximately 24 hours following the onset of core damage 

under the most likely severe accident challenges, and following this period, the 

containment should continue to provide a barrier against the uncontrolled release of 

fission products. 

9. SECY-93-087, Section II.N, and the Commission’s SRM also provide guidance for a 

sequence-level seismic margins analysis (SMA). PRA insights will be used to support a 

margin-type assessment of seismic events. A PRA-based SMA will consider 

sequence-level HCLPFs and fragilities for all sequences leading to core damage or 
19.0-10 Revision 3 – December 2015 

containment failure up to approximately 1.67 times the ground motion acceleration of the 

design-basis safe-shutdown earthquake (SSE). 

10. SECY-96-128, “Policy and Key Technical Issues Pertaining to the Westinghouse AP600 

Standardized Passive Reactor Design,” ADAMS Accession No. ML003708224, dated 

June 12, 1996, and the related SRM, ADAMS Accession No. ML003708192, dated 

January 15, 1997. 

11. RG. 1.7, “Control of Combustible Gas Concentrations in Containment,” Revision 3, 

March 2007. 

12. RG 1.216, “Containment Structural Integrity Evaluation for Internal Pressure Loadings 

above Design-Basis Pressure,” Revision 0, August 2010. 

13. SECY-97-044, “Policy and Key Technical Issues Pertaining to the Westinghouse AP600 

Standardized Passive Reactor Design,” ADAMS Accession No. ML003708316, dated 

February 18, 1997, and the related SRM, ADAMS Accession No. ML003708232, dated 

June 30, 1997. 

The above NRC policy statements provide guidance regarding the appropriate course of action 

to address severe accidents and the use of PRA. The SRMs relating to SECY-90-016, 

SECY-93-087, SECY-96-128, and SECY-97-044 provide Commission-approved guidance for 

implementing features in new designs to prevent severe accidents and to mitigate their effects, 

should they occur. In particular, the SRM on SECY-93-087 provides direction about the 

treatment of external events in PRAs to support DC and COL applications. Specifically: 

1. The Commission approved the use of 1.67 times the design-basis SSE for a margin-type 

assessment of seismic events. 

2. The Commission approved the use of PRA insights to support a margins-type 

assessment of seismic events. A PRA-based SMA will consider sequence-level HCLPF 

and fragilities for all sequences leading to core damage or containment failures up to 

approximately one and two thirds the ground motion acceleration of the Design-Basis 

SSE. 

3. The Commission approved the use of simplified probabilistic methods, such as but not 

limited to the Electric Power Research Institute (EPRI) Fire-Induced Vulnerability 

Evaluation (FIVE) methodology, to evaluate fire risk. 

4. The Commission approved the staff’s position that advanced LWR vendors should 

perform bounding analyses of site-specific external events likely to be a challenge to the 

plant (such as river flooding, storm surge, tsunami, volcanism, high winds, and 

hurricanes). When a site is chosen, its characteristics should be compared to those 

assumed in the bounding analyses to ensure that the site is enveloped. If the site is 

enveloped, the COL applicant need not perform further PRA evaluations for these 

external events. The COL applicant should perform site-specific PRA evaluations to 

address any site-specific hazards for which a bounding analysis was not performed or 

which are not enveloped by the bounding analyses to ensure that no vulnerabilities due 

to siting exist. 
19.0-11 Revision 3 – December 2015 

In addition, Regulatory Issue Summary (RIS) 07-06, “Regulatory Guide 1.200 Implementation,” 

dated March 22, 2007, states that PRAs required under 10 CFR Part 52 should use NRCendorsed consensus standards to the extent practicable. 

Acceptance Criteria

Based on these guidance documents and the major objectives stated in Subsection I, the staff 

has established the following acceptance criteria for its review. These acceptance criteria apply 

to the PRA and severe accident evaluation in general. Specific subsets of the criteria apply to 

individual elements of the applicant’s analyses (e.g., Level 1 shutdown PRA, severe accident 

management). 

1. The staff will determine whether the applicant has used the PRA to do the following: 

A. Identify and address potential design features and plant operational 

vulnerabilities; for example, vulnerabilities in which a small number of failures 

could lead to core damage, containment failure, or large releases that could drive 

plant risk to unacceptable levels with respect to the Commission’s goals. 

B. Reduce or eliminate the significant risk contributors of existing operating plants1

applicable to the new design, by introducing appropriate features and 

requirements. 

C. Select among alternative features, operational strategies, and design options. 

2. The staff will determine whether the applicant has adequately demonstrated that the risk 

associated with the design compares favorably against the Commission’s goals of less 

than 1 x 10-4 per year (/yr) for CDF and less than 1 x 10-6/yr for LRF. 

3. The staff will determine whether the design compares favorably with the Commission’s 

approved use of a CPG, which includes (1) a deterministic goal that containment 

integrity be maintained for approximately 24 hours following the onset of core damage 

for the more likely severe accident challenges and (2) a probabilistic goal that the 

conditional containment failure probability be less than 0.1 for the composite of all coredamage sequences assessed in the PRA. The staff will determine whether the applicant 

has adequately demonstrated that the design properly balances preventive and 

mitigative features and represents a reduction in risk when compared to existing 

operating plants. The staff will determine whether the applicant has provided a sound 

technical basis for selecting the most likely severe accident challenges or followed the 

approach outlined in Section C.3.1(a) of RG 1.216.2

4. The staff will determine whether the applicant has identified risk-informed safety insights 

based on systematic evaluations of the risk associated with the design. The applicant 

should identify and describe the following: 

 

1 The reference to existing operating plants applies to the LWR plant technology that existed at the time the Commission issued its 

Severe Accident Policy Statement on August 8, 1985. 

2 RG 1.216, “Containment Structural Integrity Evaluation for Internal Pressure Loadings above Design-Basis Pressure,” states that: 

“The applicant provides the technical basis for identifying the more likely severe accident challenges. The staff will review the 

technical basis for identifying the more likely severe accident challenges on a case-by-case basis. An example of an acceptable 

way to identify the more likely severe accident challenges is to consider the sequences or plant damage states that, when 

ordered by percentage contribution, represent 90 percent or more of the core damage frequency.” 
19.0-12 Revision 3 – December 2015 

A. The design’s robustness, levels of defense-in-depth, and tolerance of severe 

accidents initiated by either internal or external events 

B. The risk significance of potential human errors associated with the design 

5. The staff will determine whether the applicant has complied with 10 CFR 50.34(f)(1)(i): 

“Perform a plant/site specific probabilistic risk assessment, the aim of which is to seek 

such improvements in the reliability of core and containment heat removal systems as 

are significant and practical and do not impact excessively on the plant.” 

6. The staff will determine whether the applicant has used the PRA results and insights, 

including those from uncertainty analyses, importance analyses, and sensitivity 

studies, in an integrated fashion. Expected uses of the PRA are listed in RG 1.206, 

Section C.I.19.2, and should be addressed in Section 19.1.1 of the applicant’s FSAR, as 

well as in the descriptions of programs that receive input from the PRA. The guidance 

documents related to the specific programs that receive input from the PRA contain 

acceptance criteria related to these programs. For example, Section C.I.17.4 of 

RG 1.206 presents the reliability assurance program (RAP) submittal guidance and SRP 

Section 17.4 gives the associated staff review guidance, including acceptance criteria. 

7. The staff will determine whether the applicant has performed risk importance studies to 

determine the: (1) importance of components to risk; (2) importance of systems to risk; 

(3) importance of operator actions to risk; and (4) importance of initiating events to risk. 

Both risk increase (e.g., risk-achievement worth; Birnbaum importance) and riskdecrease (e.g., Fussell-Vesely importance; risk-reduction worth) measures should be 

used. 

8. The staff will determine whether the applicant’s uncertainty analysis identifies major 

contributors to the uncertainty associated with the estimated risks. For designs using 

passive safety systems and active defense-in-depth systems, the staff will determine 

whether the applicant has performed sensitivity studies without credit for the nonsafetyrelated defense-in-depth systems. These studies provide additional insights about the 

risk importance of the defense-in-depth systems that are taken into account in selecting 

nonsafety-related systems for regulatory treatment according to the RTNSS process 

(See SRP Section 19.3 for additional information). 

9. Consistent with the guidance in Section 5 of RG 1.174, the staff expects that the 

applicant will have subjected its PRA to quality control. In accordance with the 

Statement of Consideration (72 FR 49365) for the revised 10 CFR Part 52, the PRA is 

not part of the design-basis information, therefore, the PRA is not subject to the quality 

assurance requirements of 10 CFR Part 50, “Domestic Licensing of Production and 

Utilization Facilities,” Appendix B, “Quality Assurance Criteria for Nuclear Power Plants 

and Fuel Reprocessing Plants.” However, the applicant should describe the quality 

control program that was applied to the PRA. The reviewer should verify that this quality 

control program includes, as a minimum, the following elements: 

A. Use of personnel qualified for the analysis 

B. Use of procedures that ensure control of documentation, including revisions, and 

provide for independent review, verification, or checking of calculations and 

information used in the analyses 
19.0-13 Revision 3 – December 2015 

C. Documentation and maintenance of records, including archival documentation as 

well as submittal documentation 

D. Use of procedures that ensure that appropriate attention and corrective actions 

are taken if assumptions, analyses, or information used previously are changed 

or determined to be in error 

10. The staff will determine whether the technical adequacy of the PRA is sufficient to justify 

the specific results and risk insights that are used to support the DC or COL application. 

Toward this end, the applicant’s PRA submittal should be consistent with prevailing PRA 

standards, guidance, and good practices as needed to support its uses and applications 

and as endorsed by the NRC (e.g., RG 1.200). As discussed in RGs 1.174 and 1.200, 

the quality of a PRA is measured in terms of its appropriateness with respect to scope, 

level of detail, and technical adequacy. Technical adequacy should be assessed via a 

peer review as described in RG 1.200.3 The applicant’s adherence to the 

recommendations provided in RGs 1.174 and 1.200 pertaining to quality and technical 

adequacy will result in a more efficient and consistent NRC staff review process. With 

respect to PRA quality, the following items are noted: 

A. There are no regulatory requirements in 10 CFR Part 52 that specifically pertain 

to PRA quality with respect to DC or COL applications. 

B. RG 1.206 and this SRP section indicate the expected scope and level of detail of 

a PRA used to support a DC or COL application. Exceptions to this expected 

scope and level of detail may be acceptable if adequately justified by the 

applicant. 

11. PRAs that meet the applicable supporting standards for Capability Category I and meet 

the high-level requirements defined in the ASME PRA Standard (ASME/ANS RA-S-2008 

and addenda ASME/ANS RA-Sa–2009) should generally be acceptable for DC and COL 

applications. Alternatively, the applicant may identify, and justify the acceptability of, 

alternative measures for addressing PRA quality and technical adequacy. The staff 

should specifically review the acceptability of these alternative measures in the context 

of the specific uses of the PRA in the licensing process. 

12. In making its determination of technical adequacy of the PRA, the staff will consider the 

information provided by applicants in FSAR Chapter 19 and responses to the staff's 

RAIs or obtained by the staff during onsite audits. In addressing the technical adequacy 

of the PRA, the applicant should discuss: 

A. Prior NRC staff review of the PRA (e.g., during the DC process), findings 

(i.e., facts and observations) from that review, disposition of those findings, and 

 

3 Peer review of the DC PRA is not required prior to application. However, if a peer review was conducted prior to the application; 

the staff should examine the peer review report. If a certain aspect of the PRA deviates from accepted good practices, the 

applicant/holder should justify that this deficiency does not impact the PRA results or risk insights. Otherwise, applicants/holders 

need to correct the deficiency and resubmit the PRA results and risk insights. If a peer review has not been performed, the 

applicants/holders should justify why their PRAs are adequate in terms of scope, level of detail, and technical acceptability. PRA 

self-assessment is an acceptable tool for assessing the technical adequacy of a PRA performed in support of an application for a 

design certification. If the applicant’s/holder’s justification fails to provide the staff with an appropriate level of confidence in the 

models, results, and insights, the staff should conduct an audit of the applicant’s/holder’s PRA against the technical elements

described in RG 1.200, “An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for RiskInformed Activities,” to determine the PRA technical adequacy. 
19.0-14 Revision 3 – December 2015 

the relevance of that review to the technical adequacy of the current plantspecific PRA. 

B. The scope, level of detail, and technical adequacy needed to support the specific 

uses and risk-informed applications. 

C. The method used for determination of technical adequacy for pertinent PRA 

scope areas for which the NRC has not endorsed PRA standards (i.e., identify 

the guidance and good practices documents relied upon to determine the 

technical adequacy of the PRA). 

D. The independent peer review process, including the qualifications of the team 

members and the findings identified as a result of the review. 

E. The process for dispositioning independent peer review findings and maintaining 

or upgrading the PRA, as appropriate, to ensure that it reasonably reflects the 

as-designed, as-built, and as-operated plant, including the corrective action and 

feedback mechanisms involving the periodic evaluation of the PRA, consistent 

with its uses and risk-informed applications, on the basis of actual plant-specific 

equipment, train, and system performance and relevant industry operational 

experience. 

13. The staff will determine whether the assumptions made in the applicant’s PRA during 

design development and certification, in which a specific site may not have been 

identified or all aspects of the design (e.g., balance of plant) may not have been fully 

developed, are identified in the DC application and either remain valid or are adequately 

addressed within the COL application. 

14. The staff will determine whether FSAR Chapter 19 includes PRA quantitative and 

qualitative results, including CDF, LRF, the identification of key PRA assumptions, the 

identification of PRA-based insights, and discussion of the results and insights from 

importance, sensitivity, and uncertainty analyses. 

15. The staff will determine whether the internal events PRA quantitative results are 

provided for internal fires and floods and their contributions. 

16. It is acceptable for applicants to report significant risk contributors by separate hazard 

groups (i.e., provide separate lists of the contributors for internal events, the contributors 

for internal floods, the contributors for seismic events, the contributors for internal fires, 

etc.). Applicants may also elect to develop an integrated list of significant risk 

contributors that summarize the results across all hazard groups. 

17. In the context of the PRA results and insights, the term “significant” is intended to be 

consistent with its definition in RG 1.200. The definitions of “significant accident 

sequence” and “significant contributor” are suitable for both LERF and LRF. Using any 

other definition of “significant” inconsistent with the definitions provided by RG 1.200 

shall be subject to additional staff review and approval. 

18. The NRC staff should review the applicant’s PRA maintenance process, which should be 

described in FSAR Chapter 19, including planned implementation of the program during 

design, construction and operation phases of the facility. The NRC expects COL 
19.0-15 Revision 3 – December 2015 

applicants to describe their approach for maintaining and periodically upgrading the PRA 

in accordance with RG 1.206, Section C.I.19.7 and RG 1.200. PRA maintenance should 

commence at the time of application for both DC and COL applicants. If the certification 

is issued, the generic PRA would not need to be updated except as appropriate in 

connection with a DC amendment request. The NRC staff should confirm that the PRA 

maintenance process provides that the PRA performed in support of a COL application 

be updated to reflect plant modifications if there are changes to the design during the 

design, construction and operation phases of the facility. For purposes of reporting the 

effects of plant modifications and changes to the NRC in accordance with the 

requirements of 10 CFR 50.71(e), the NRC expects the following when changes affect 

the PRA: 

A. PRA numerical changes should be reported when the cumulative risk impact of 

the changes resulting from the plant modifications, design changes or departures 

from the DC is more than a 10% change (either positive or negative) in the total 

CDF or total LRF from what was previously reported. 

B. All changes in key assumptions per RG 1.200 and all changes in risk insights as 

defined in RG 1.206 including differences between the updated risk insights and 

the certified design risk insights should also be reported to the NRC in 

accordance with the guidance in Section C.III of RG 1.206. 

C. All changes or departures from the design that result in a revision of PRA-based 

qualitative results should also be reported to the NRC. 

19. 10 CFR 50.71(h)(2) states that each COL holder must maintain and upgrade the PRA 

required by 10 CFR 50.71(h)(1). This means that COL holders, in accordance with 10 

CFR 50.71(h), must upgrade the PRA used to support the COL to cover those initiating 

events and modes of operation contained in NRC-endorsed consensus standards that 

exist one year prior to each required upgrade. 

20. RG 1.200 describes the elements of a PRA maintenance and update program that is 

acceptable to the staff. If the staff can confirm that the applicant’s proposed program 

includes the key elements described in RG 1.200, it may conclude that such a program 

is acceptable. 

21. The PRA Standard in Part 7, “Requirements for High Wind Events At-Power PRA,” does 

not specify Supporting Requirements for Capability Category 1 for developing the wind 

hazard. In the analysis of high winds, tornado frequencies developed with methods and 

data in NUREG/CR-4461, Revision 1, and based on data for the central region of the 

United States will normally be acceptable because the central region of the country has 

the highest occurrence rate of tornadoes and the highest tornado intensities. 

22. In the analysis of high winds, tornados may not always be bounding with respect to the 

damaging effects of missiles. In coastal regions prone to severe hurricanes, a missile 

generated by hurricane force winds may be more damaging than one created by a 

tornado. Interim Staff Guidance DC/COL-ISG-024 pertaining to RG 1.221 provides an 

acceptable approach for treatment of hurricane missiles in the PRA. 
19.0-16 Revision 3 – December 2015 

23. Section 5 of RG 1.7 provides criteria acceptable to the NRC staff for demonstrating the 

requirements in 10 CFR 50.44(c)(5) regarding containment structural integrity have been 

met. 

24. The RG 1.216 describes methods that the NRC staff considers acceptable for 

(1) predicting the internal pressure capacity for containment structures above the designbasis accident pressure, (2) demonstrating containment structural integrity related to 

combustible gas control, and (3) demonstrating containment structural integrity through 

an analysis that specifically addresses the Commission’s performance goals related to 

the prevention and mitigation of severe accidents. 

Acceptance Criteria for a PRA-based SMA

This section provides guidance for the NRC reviewer of an applicant’s PRA-based SMA. 

However, if an applicant performs a seismic PRA (SPRA), then the staff should confirm that a 

peer review to Part 5 of the ASME/ANS PRA Standard has been performed and that the SPRA 

meets Capability Category 1 of that Standard. 

25. The staff will determine whether the applicant has performed a PRA-based SMA to 

determine the seismic capacity of the plant and for each sequence that may lead to core 

damage or large release. 

26. The design-specific plant system and accident sequence analysis for a PRA-based SMA 

is performed in accordance with, at a minimum, the Capability Category I requirements 

of Section 5-2.3 of Part 5 of the ASME/ANS PRA Standard (Ref. 6), with the exceptions 

that the analysis does not need to be based on site-specific and plant-specific 

information and does not have to rely on an as-built and as-operated plant. 

27. Screening of rugged SSCs may be performed in a PRA-based SMA based on the DC’s 

Certified Seismic Design Response Spectra (CSDRS) with its peak ground acceleration 

(PGA) scaled by a factor of 1.67. The basis for the screening should be adequately 

documented and ensure that the so-called “supercomponents,” as described in Note 3 of 

Section 5-2.3 of Part 5 of the ASME/ANS PRA standard, will not control the plant 

seismic margin capacity. 

28. The staff will determine whether a safe-shutdown equipment list (SSEL) (for the seismic 

hazard approach) or a seismic equipment list (SEL) (for the seismic PRA approach) has 

been prepared which documents the SSCs associated with the accident sequences that 

will require seismic fragility evaluation for determining sequence-level HCLPF. 

29. The seismic fragility evaluation of SSCs may be performed based on Capability 

Category I requirements of Section 5-2.2 of Part 5 of the ASME/ANS PRA standard to 

the extent applicable as endorsed by RG 1.200. Such an evaluation is acceptable with 

the following exceptions for implementing Part 5 for DCs: 

A. For review of DC applications, the seismic fragility calculations are based on 

design-specific information provided within the scope of a DC application. Siteand plant-specific information cannot be relied on for computing seismic fragility 

because this information is normally not available during the review of the DC 

application. Two methods, separation of variable and conservative deterministic 

failure margin (Ref. 11 and 13), are acceptable for determining seismic fragility. 
19.0-17 Revision 3 – December 2015 

B. The seismic fragility calculation should use the response spectrum shape defined 

as the DC’s CSDRS. 

30. Generic data (such as test data, generic seismic qualification test data, and test 

experience data) can be used to support the seismic fragility analysis of components or 

equipment; however, justification should be provided to demonstrate that the generic 

data are consistent and applicable to components or equipment within the scope of the 

DC. 

31. The procedure described in E.5 of the EPRI TR Report 1002988 (Ref. 8) is acceptable 

for developing fragilities for components or equipment on the SEL, which is to be 

qualified by seismic qualification tests. If an applicant uses EPRI Report 1002988 to 

develop fragilities, there should be less than a 1 percent probability of failure at ground 

motion equal to 1.67 times the CSDRS, including consideration of testing uncertainties. 

32. The seismic demands to equipment defined in terms of the required response spectra 

should use CSDRS-based (or hard rock high frequency, if applicable) seismic input and 

account for the structural amplifications caused by the supporting structures, including 

soil-structure interaction effects and supporting systems, and incorporate an additional 

seismic margin factor, as appropriate. 

33. The HCLPF value for an SSC is earthquake motion level at which there is a high (95%) 

confidence of a low (at most 5%) probability of failure. The composite uncertainty (Beta 

c) may be used to approximate the HCLPF, which would be the ground motion level at 

which the composite probability of failure is at most 1%. 

34. The HCLPF value should be expressed in terms of PGA in the PRA-based SMA 

process. 

35. The plant-level HCLPF capacity should be determined based on the sequence-level 

HCLPF values for all sequences as identified in the design-specific plant system and 

accident sequence analysis. 

36. The Min-Max method4 is acceptable for computing sequence-level HCLPF values. 

37. The staff will determine whether the design-specific plant-level HCLPF value has been 

demonstrated to be equal to or greater than 1.67 times the CSDRS PGA. 

III. REVIEW PROCEDURES 

General Principles 

The reviewer will select material from the procedures described below, as may be appropriate 

for a particular case. These review procedures are based on the identified SRP acceptance 

criteria. If the application deviates from these acceptance criteria, the staff should determine 

 

4

 A Min-Max method is used to determine the HCLPF capacity for an accident sequence from the HCLPF capacities of the 

contributing SSC failures, or the HCLPF capacity for the plant as a whole from the HCLPF capacities of the group of seismicinitiated accident sequences. The overall HCLPF capacity of two or more SSCs that contribute to a sequence using OR Boolean 

logic is equal to the lowest individual HCLPF capacity of the constituents of the group. If AND Boolean logic is used, the HCLPF 

capacity of the group is equal to the highest individual HCLPF capacity of the constituents. When evaluating several accident 

sequences to determine the “plant level HCLPF capacity,” the plant-level HCLPF capacity is equal to the lowest of the sequencelevel HCLPF capacities. 
19.0-18 Revision 3 – December 2015 

that the proposed alternative provides an acceptable method of complying with the relevant 

NRC requirements identified in Subsection II. 

The staff will review the description of the PRA and its results in order to make the evaluation 

findings described in this SRP section. In addition to a qualitative description, the staff will 

review some quantitative results (e.g., mean core damage frequencies, mean large release 

frequencies, and importance measures). The NRC should review this information to ensure that 

it is able to conclude that the applicant has performed sufficiently complete and scrutable 

analyses, the results and insights support the application, and the applicant has in place 

programs and processes that will enable it to maintain an up-to-date PRA for these uses and 

applications. 

RG 1.206, Section C.I.19, provides detailed guidance on the information expected to be 

included in Chapter 19 of the applicant’s FSAR. Specific application content that the staff 

should review is not reproduced in this SRP section, only review guidance on specific topics. 

Instead, the staff should use RG 1.206 in parallel with the SRP to determine that the appropriate 

topics have been addressed by the applicant. Although Chapter 19 of the applicant’s FSAR 

should include the information needed by the staff to determine that the relevant acceptance 

criteria have been met, some staff audits of the PRA and supporting analyses may be 

necessary to fully understand, review, and confirm the PRA results, insights, and associated 

analytical bases. The staff may refer to the summary reports from these audits in the SER. 

However, for instances in which additional information is needed to complete the staff’s review 

of the FSAR, the staff will use the RAI process. Reviewers utilizing the RAI process should 

make it clear to the applicant that if an RAI results in substantive change to information in the 

FSAR or DCD, these documents must be revised to reflect the new information. 

For additional information, the staff should consider the information provided in Chapter 19 of 

past SERs for advanced LWRs. The NRC issued the Final Safety Evaluation Report (FSER) for 

the DC of the Advanced Boiling-Water Reactor design (ABWR) as NUREG-1503, the FSER for 

the DC of the System 80+ reactor design as NUREG-1462, the FSER for the DC of the AP600 

design as NUREG-1512, and the FSER for the DC of the AP1000 design as NUREG-1793. 

The staff issued the FSER for the DC of the Economic, Simplified, Boiling-Water Reactor 

(ESBWR) design by letter dated March 9, 2011. It is available at ADAMS Accession No. 

ML103470210. In addition, although it relates to the staff review of license applications 

requesting risk-informed changes to an applicant’s licensing bases, Section A.11 of SRP 

Section 19.2 lists documents that the staff could use as reference or background material during 

the review process. The bibliography lists documents by category, covering desirable PRA 

attributes, review of the PRA, uncertainty and sensitivity analyses, and use of the PRA in risk 

ranking. It also provides a bibliography for aspects of PRA modeling (e.g., initiating events, 

CCF modeling, human performance modeling). 

As expressed in the review interfaces portion of Subsection I of this SRP section, other 

technical branches are expected to use the applicant’s PRA results and insights to inform their 

review based on risk significance. 

RG 1.206 indicates the expected scope and level of detail of a PRA used to support a DC or COL 

application. Exceptions to this expected scope and level of detail may be acceptable if adequately 

justified by the applicant. 

For review of a DC application, the reviewer should follow the above procedures to verify that 

the design, including requirements and restrictions (e.g., interface requirements and site 
19.0-19 Revision 3 – December 2015 

parameters), set forth in the FSAR meet the acceptance criteria. DCs have referred to the 

FSAR as the DCD. The reviewer should also consider the appropriateness of identified COL 

action items. The reviewer may identify additional COL action items; however, to ensure these 

COL action items are addressed during a COL application, they should be added to the DC 

FSAR. 

For review of a COL application, the scope of the review is dependent on whether the COL 

applicant references a DC, an early site permit or other NRC approvals (e.g., manufacturing 

license, site suitability report or topical report). 

Specific Review Guidance 

The staff’s review focuses on the methods, results and insights of the design-specific or plantspecific PRA and severe accident evaluations. 

Design-Specific PRA (Specific Areas of Review) 

1. The staff reviews the process used by the applicant to develop its design-specific or 

plant-specific PRA, including supporting or associated analyses (e.g., T-H analyses, 

human reliability analyses). 

2. The staff reviews the applicant’s process for maintaining and upgrading the PRA, as 

necessary, to ensure that (1) it reasonably reflects the plant design, operation, and 

experience and (2) its scope, level of detail, and technical adequacy are appropriate for 

its use in complying with the relevant regulations for new reactors. 

3. The staff reviews the applicant’s uses and risk-informed applications (or proposed uses 

and applications)5 of the PRA for each phase (i.e., design, licensing, construction 

operations). Specifically, the PRA staff should interface with the primary review branch 

in the evaluation of licensee programs that use the PRA results and insights (e.g., 

human factors program, maintenance rule implementation, RAP). Likewise, the PRA 

staff should interface with the primary review branch in the evaluation of specific riskinformed applications (e.g., 10 CFR 50.69 implementation, risk-informed performancebased fire protection implementation, risk-informed inservice inspection, risk-informed 

inservice testing). When the applicant enters a new phase, the staff may review any 

changes to the uses and applications. 

4. The staff reviews the description of the applicant’s PRA in Chapter 19 of the FSAR and 

its associated results and insights, addressing the full scope of information outlined in 

RG 1.206, Section C.I.19. In particular, the staff should review the applicant’s 

identification of significant plant features (including nonsafety-related systems) and 

operator actions that are important to reduce risk and confirm that the plant will meet the 

expectation identified above that reactors will reflect an extremely low probability for 

accidents that could result in the release of significant quantities of radioactive fission 

 

5

 If the applicant is merely identifying expected uses and applications of the PRA in subsequent phases, the staff will typically not 

perform detailed reviews of this information, but rather, will use this information in planning and preparing for these reviews in the 

subsequent phases. However, if the applicant requests, as part of its application, review and approval of a risk-informed 

application that will be implemented during a later phase, the staff will perform the necessary review. For example, at the COL 

phase, an applicant may propose to implement 10 CFR 50.69, “Risk-Informed Categorization and Treatment of Structures, 

Systems and Components for Nuclear Power Reactors,” during the construction phase and need to have that risk-informed 

application approved before that time. The staff should use additional guidance outside this SRP section (e.g., RG 1.174 and 

RG 1.178 for risk-informed TS) to support these reviews. 
19.0-20 Revision 3 – December 2015 

products. In addition, for a COL referencing a DC, the staff should compare the COL 

applicant's PRA-based insights with those described in the DC to identify potential 

changes and to verify that the applicant has properly dispositioned each insight. 

5. The staff review should include a broad (qualitative and quantitative) comparison of 

risks, by initiating event category, between the proposed design and existing operating 

plant designs (from which the proposed design evolved) to identify the major design 

features that contribute to the reduced risk of the proposed design compared to existing 

plant designs (e.g., passive systems, less reliance on offsite and onsite power for 

accident mitigation, and divisional separation). 

6. The staff reviews key assumptions in the PRA related to design areas that have not 

been completed. Where a design acceptance criteria (DAC) has been approved by the 

Commission, the staff allows the DAC approach to be used in specific areas (i.e., 

radiation protection, piping, instrumentation and controls, and human factors 

engineering) in lieu of detailed design information. However, to allow staff to evaluate 

the resolution of severe accident issues in the design and to ascertain how the risk 

insights from the design PRA are derived, DC applicants should address those portions 

of the design covered by DAC in the design PRAs to the extent practicable. If it is not 

practical to model certain areas that employ DAC in the design PRA, the applicant 

should identify those areas and qualitatively assess their impacts on the PRA results and 

insights. Any assumptions made regarding the reliability or performance of SSCs under 

DAC during this process shall be verified when the design is finalized. Furthermore, the 

staff should review the DC applicant’s PRA in accordance with the available guidance on 

parts of the design where DAC are used. 

7. The staff reviews the PRA-related inspections, tests, analyses and acceptance criteria 

(ITAAC), COL action items, and other commitments, including any actions identified or 

proposed to address them. The applicant’s PRA-based insights table may be a good 

starting point for this review, as it should identify these items. The staff should note any 

item that cannot be resolved until after the COL application phase and review the 

commitments and schedule for resolution of the given items, and the proposed method 

of completion. 

Design-Specific PRA (Level I PRA Technical Adequacy) 

1. The reviewer confirms that the applicant has: (1) identified those high-level requirements 

or attributes of the applicable PRA standard that the PRA did not embody, (2) addressed 

the impact on the qualitative and quantitative results of the PRA of excluding those highlevel requirements or attributes of the standard that are applicable but have not been 

incorporated. The PRA is excluded from Tier 2 of the DC and it is not part of the designbasis information. However, the PRA is used to help identify Tier 1 (e.g., ITAAC) and 

Tier 2 information, including, but not limited to risk insights as described in Section C.II.1 

of RG 1.206. 

2. RG 1.200 contains the staff's guidance concerning PRA technical adequacy and peer 

review. Peer review of the DC PRA is not required prior to application, however, if a 

peer review or self-assessment was conducted prior to the application, the staff should 

examine the documented results. If a certain aspect of the PRA does not follow the 

positions in RG 1.200, the applicant should justify that this aspect of the PRA is 

acceptable and does not impact the PRA results or risk insights. Otherwise, applicants 
19.0-21 Revision 3 – December 2015 

need to correct the deficiency and resubmit the PRA results and risk insights. If a peer 

review has not been performed, the applicants should justify why their PRAs are 

adequate in terms of scope, level of detail, and technical adequacy. If the applicant’s 

justification fails to provide the staff with an appropriate level of confidence in the 

models, results, and insights, the staff should conduct an audit of the applicant’s PRA 

against the technical elements described in RG 1.200 to determine the PRA technical 

adequacy. 

Design-Specific PRA (Procedures Specific to Passive Designs) 

1. The issue of T-H uncertainties in passive plant designs arises from the passive nature of 

the safety-related systems used for accident mitigation. Passive safety systems rely on 

natural forces, such as gravity, to perform their safety functions. Such driving forces are 

small compared to those of pumped systems, and the uncertainty in their values, as 

predicted by a best-estimate T-H analysis, can be of comparable magnitude to the 

predicted values themselves. Therefore, some accident sequences with a frequency 

high enough to impact results, but not predicted to lead to core damage by a bestestimate T-H analysis, may actually lead to core damage when PRA models consider TH uncertainties. One approach to addressing this issue is to perform sensitivity studies 

to see the effect of assuming bounding values for T-H parameters on success criteria 

and performing studies of the sensitivity of changes in success criteria on CDF. 

A. The reviewer assures that the applicant has (1) identified all key T-H parameters 

that could affect the reliability of a passive system and introduce uncertainty into 

the determination of success criteria, and (2) accounted for the uncertainty in the 

analyses that establish the success criteria. 

B. The reviewer examines the results of any sensitivity studies performed by the 

applicant and the choice of T-H accident analysis codes used to perform such 

studies. Applicants frequently use the Modular Accident Analysis Program 

(MAAP) code for such studies. The staff is aware of T-H modeling issues with 

the code that could compromise its ability to confirm the validity of the PRA 

success criteria involving minimal sets of mitigating equipment. Use of this code 

is acceptable only if sufficient benchmarking studies have been done which 

compare MAAP results with those of a T-H code the staff has reviewed and 

approved and show that MAAP is able to capture the important T-H phenomena 

and the timing of such phenomena in simulations of accident sequences included 

in the PRA. If a small set of accident scenarios is used in the studies, the 

reviewer confirms that the applicant has provided an adequate rationale for its 

selection of scenarios, including a discussion of the criteria used for selection. 

2. For passive plant designs, the staff reviews the applicant’s use of the PRA to identify 

“nonsafety-related,” SSCs that require regulatory treatment (i.e., to support the RTNSS 

program). Specifically this includes the following evaluations performed by the applicant 

as described in SRP 19.3: 

A. Evaluation of the risk significance of nonsafety systems using the Focused PRA 

B. Evaluation of uncertainties associated with assumptions made in the PRA 

models of passive systems 
19.0-22 Revision 3 – December 2015 

C. PRA initiating event frequency evaluation 

Design-Specific PRA (Procedures Specific to Integral Pressurized Water Reactors) 

1. For small, modular integral pressurized water reactor designs, the staff reviews the 

results and description of the applicant’s risk assessment for a single reactor module; 

and, if the applicant is seeking approval of an application for a plant containing multiple 

modules, the staff reviews the applicant’s assessment of risk from accidents that could 

affect multiple modules to ensure appropriate treatment of important insights related to 

multi-module design and operation. 

The staff will verify that the applicant has: 

i. Used a systematic process to identify accident sequences, including significant 

human errors, that lead to multiple module core damages or large releases and 

described them in the application 

ii. Selected alternative features, operational strategies, and design options to 

prevent these sequences from occurring and demonstrated that these accident 

sequences are not significant contributors to risk. These operational strategies 

should also provide reasonable assurance that there is sufficient ability to 

mitigate multiple core damages accidents. 

2. Shutdown and refueling operations for small, modular reactor designs may be performed 

in ways which are new and completely different from those used at large traditional 

LWRs either licensed or under review by the NRC. In these cases, a more in-depth 

review will be needed to assure that the PRA model is of acceptable scope, level of 

detail, and technical adequacy. Reviewers should confirm that applicants identify and 

describe the expected plant operating states (POS) in a refueling outage between the 

time the output breaker to the grid is opened for plant shutdown and when it is closed to 

resume power operation after the outage. The reasonableness of the PRA model for 

low power and shutdown modes of operation cannot be judged without a description of 

each POS that includes an estimate of the expected time in the POS, a description of 

the expected changes in configuration of the nuclear steam supply system, a description 

of the methods of removing heat from the fuel during each POS, a description of the 

automatic and human actions expected to occur during each POS and an assessment of 

the potential upset conditions and human errors during each POS that could contribute 

to a loss of decay heat removal. 

Design-Specific PRA (Level 2 PRA) 

For DC applications and COL applications not referencing the Level 2 PRA in the DC, 

the reviewer6 carries out an independent assessment of the plant response to selected 

severe accident scenarios using the latest version of the MELCOR computer code. The 

assessment should examine accident scenarios from the PRA, which are chosen based 

on a combination of frequency, consequence, and dominant risk. Some of these 

scenarios should be similar or identical to sequences analyzed by the applicant and 

reported in the PRA. The reviewer compares the results of corresponding sequences 

and release categories in the two studies. If the results of the assessment do not 

 

6

 Support from an independent contractor or staff in the Office of Research may be necessary. 
19.0-23 Revision 3 – December 2015 

support and confirm the applicant’s simulation of the accident progression, analysis 

methodology, and interpretations of its analyses of the reactor, containment, and system 

response to severe accidents, the reviewer engages with the applicant to resolve the 

differences in results. 

Design-Specific PRA (PRA for Non-Power Modes of Operation) 

1. Given that shutdown risk may be highly outage-specific, the staff reviews the shutdown 

PRA insights to confirm that operational assumptions used to develop an average 

shutdown model (e.g., use of nozzle dams, outage schedule, containment status, 

procedural requirements) have been clearly documented in the FSAR. If licensee 

practices deviate dramatically from these assumptions in the future, the insights 

obtained from the shutdown PRA may no longer be valid. It is the COL applicant’s 

responsibility to confirm the assumptions made at the DC stage, and if done properly 

should capture any significant differences. 

2. The staff reviews the applicant’s assumptions related to equipment availability and 

compares them to TS requirements. Risk-significant equipment should be evaluated 

with respect to 10 CFR 50.36(c)(2)(ii)(D) to determine whether additional TS 

requirements are needed. 

3. The staff reviews the applicant’s implementation of the applicable expeditious actions 

outlined in NRC Generic Letter (GL) 88-17 (Ref. 15). The staff needs to ensure that the 

applicant is meeting the expeditious actions consistent with the guidance for meeting the 

guidelines in GL 88-17 which are described in detail in Enclosures 1 and 2 of the GL. 

Deviation from GL 88-17 guidance could lead to configurations where cold leg 

penetrations are permitted to be open in Pressurized Water Reactors (PWRs) without 

the appropriate steam generator (SG) manway open or when nozzle dams are installed 

in the wrong order. Such configurations may invalidate PRA results. Staff may review 

NRC Information Notice (IN) 88-36 (Ref. 17) to understand the risks associated with 

these configurations. The staff also reviews the licensee’s ability to close containment 

as described in GL 88-17. 

4. The staff reviews the applicant’s implementation of industry guidance for safety during 

outages provided in NUMARC-91-06 (Ref. 10). In particular, the staff should assure 

that, if the applicant plans to use freeze seals, the potential for loss-of-coolant accidents 

due to failed freeze seals has been considered in the PRA. The potential for such 

accidents is discussed in NRC IN 91-41 (Ref. 18). Reviewers should also confirm the 

existence of an adequate means to control reactor vessel level and an adequate means 

to control reactor vessel temperature and pressure during shutdown in Boiling Water 

Reactors (BWRs). 

5. The staff reviews the low power and shutdown Level 2 analysis using methods similar to 

the at power assessment, considering (1) an estimation of containment capacity 

considering the capacity of any temporary penetrations, and (2) the feasibility of 

operators to close containment before adverse environmental conditions prevent 

closure. 

The staff reviews the low power and shutdown internal flood and internal fire analysis 

using methods similar to the at power assessment, considering (1) each defined plant 

operational state, (2) the impact of breached or failed fire barriers that could impact a fire 
19.0-24 Revision 3 – December 2015 

area, and (3) the impact of impaired or disabled flood barriers that could impact a flood 

zone. 

6. Accidents during non-power modes of operation generally are not part of the design 

bases of the facility. Consequently, non-power operations, associated accident 

sequences and specific accident phenomenology are not considered in the review of the 

accident analyses provided in Chapter 15 of the FSAR. Indeed, the staff’s review of the 

level of safety during non-power modes of operation provided by the design of the facility 

and operating procedures and controls in place is limited to the review of the PRA for 

non-power modes of operation. This puts additional burden on the PRA reviewer to 

pursue issues, as necessary, to assure that the PRA model has fidelity and the 

assumptions in the risk analyses are justified. In some cases the reviewer may need to 

engage reviewers from other technical branches that have expertise in particular areas 

(e.g., systems operation, T-H performance, operating experience). Reviewers should 

therefore be aware of the following issues related to safety during non-power modes of 

operation: 

A. Based on previous PRAs, studies by the EPRI and studies performed by the 

staff, roughly 80 percent of risk for traditional PWR designs occurs during periods 

when the reactor coolant system is drained and open (midloop operation is a 

subset of this condition). 

B. The time it takes to reach boiling in the reactor vessel following loss of the decay 

heat removal function can be very short during PWR midloop operation (e.g., 12 

minutes). Steaming into the containment will lead to intolerable conditions that 

could seriously affect the ability of personnel to close the containment. 

C. During reduced inventory operation in a PWR a large vent for the reactor coolant 

system (RCS), such as a hot leg SG plenum man way, is necessary before 

opening a cold leg penetration to prevent expelling water from the core following 

a loss of residual heat removal. RCS piping penetrations may exist below the 

active fuel and pathways may exist via connected systems that could lead to 

draining the reactor vessel. In these cases reviewers should identify the isolation 

functions available and operable and assure that they are treated accurately in 

the PRA model. 

Design-Specific PRA (PRA-Based SMA) 

1. Staff responsible for the review of the description and results of the applicant’s PRA 

review the design-specific plant system and accident sequence analysis in accordance 

with the acceptance criteria given in Section II of this SRP. 

2. Staff responsible for the review of the seismic and structural design of the facility review 

(1) the applicant’s evaluation of seismic fragilities, and (2) the applicant’s determination 

of plant-level HCLPF in accordance with the acceptance criteria given in Section II of this 

SRP. 

The staff reviewing the plant system and accident sequence analysis verifies that the applicant 

has considered random equipment failures, seismic interactions, as well as operator actions in 

the plant system and accident sequence analysis as applicable. It is important that the plant 

systems analysis focus on those sequences leading to core damage or containment failures, 
19.0-25 Revision 3 – December 2015 

including applicable sequences leading to the following containment failures: (1) loss of 

containment integrity, (2) loss of containment isolation, and (3) loss of function for prevention of 

containment bypass. The applicant should address the following operating modes in the 

analysis: (1) at power (full power), (2) low power, and (3) shutdown. 

Design-Specific PRA (Treatment of Internal Fires) 

1. The NRC staff reviews the findings of the peer review to Part 4 of the ASME/ANS PRA 

Standard, if available. The reviewer reviews the applicant’s assessment of the risk 

associated with internal fires. NUREG/CR-6850 (EPRI 1011989), “Fire PRA 

Methodology for Nuclear Power Facilities,” issued September 2005 and 

EPRI TR-100370, “Fire-Induced Vulnerability Evaluation (FIVE),” EPRI, April 1992 are 

methods acceptable to the staff for performing fire PRA in support of certification of a 

new reactor design or initial licensing of a new reactor. The FIVE methodology is 

considered to be a simplified method suitable for identifying fire vulnerabilities and 

performing screening evaluations. NUREG/CR-6850 is considered to be a preferable 

method for performing fire PRA to support applications for design certification or a COL 

because methodological issues raised in past fire risk analyses, including individual plant 

examination of fire analyses, have been addressed in NUREG/CR-6850. Reviewers 

may find that applicants for design certification use an approach to implementing the 

analysis tasks in NUREG/CR-6850 that is simpler than that suggested in 

NUREG/CR-6850. This can occur when the specifics of cable routings, ignition sources, 

and target locations in each fire zone of the plant are not known at the time the design 

certification application is submitted. Such an approach may be acceptable if 

conservative assumptions are used such that it is reasonable to conclude that the results 

bound those expected with the more detailed approach described in NUREG/CR-6850 

with respect to CDF and LRF. Examples of conservative assumptions that have been 

accepted by the staff in previous reviews are listed below: 

A. Fire ignition in any fire area continues to grow unchecked into a fully developed 

fire without credit for fire suppression and causes the maximum possible damage 

to SSCs in the area. 

B. Bounding fire initiating event frequencies are applied. 

C. No credit is taken for the distance between fire sources and targets. 

D. All fire-induced equipment damage occurs at the beginning of the event. 

E. Any fire in the switchyard is assumed to result in a reactor trip. 

F. Although design features have been implemented to prevent spurious actuations 

induced by a single fire in a building, the PRA should assume that fire 

propagation in the building may lead to spurious actuation of equipment that 

could cause initiating events or prevent mitigating systems from operating 

properly. 

2. The reviewer confirms that the fire risk analysis uses the same systems and accident 

sequence models as the internal events evaluation. 
19.0-26 Revision 3 – December 2015 

3. The reviewer confirms that the applicant has determined the appropriate internal event 

sequences based on the specific fire location and correctly modified these sequences to 

consider the effects of specific fires and include the possibility of fire propagation through 

potentially failed fire barriers. 

4. The reviewer confirms that the applicant reports the CDF and LRF derived from the fire 

PRA in the FSAR and provides a characterization of the dominant accident sequences 

and associated major contributors to CDF for each sequence in the FSAR. 

Design-Specific PRA (Treatment of High Winds) 

The NRC staff reviews the findings of the peer review to Part 7 of the ASME/ANS PRA 

Standard, if available. The reviewer evaluates the applicant’s methodology and use of data for 

estimating initiating event frequencies and assumptions in its high winds risk assessment and 

verifies that the methodology is consistent with the state-of-the art and that the assumptions are 

reasonable for estimating the CDF associated with high wind events that could damage the 

plant. 

Design-Specific PRA (Procedures for Specific PRA Audit Topics) 

1. The staff will determine whether the scope, level of detail, and technical adequacy of the 

design-specific and plant-specific PRA are appropriate for the application and any 

identified uses and risk-informed applications, as follows: 

A. The applicant’s analyses should be comprehensive in scope and address all 

applicable internal and external events and all plant operating modes. Since 

some aspects of the applicant’s approach may involve non-PRA techniques to 

address specific events (e.g., PRA-based seismic margins), the PRA staff review 

should ensure that the scope of the applicant’s analyses is appropriate for the 

identified uses and applications of the PRA. 

B. The level of detail of the applicant’s PRA should be commensurate with the 

identified uses and applications of the PRA (e.g., sufficient to gain risk-informed 

insights and use such insights, in conjunction with assumptions made in the 

PRA, to identify and support requirements important to the design and plant 

operation). The PRA should reasonably reflect the actual plant design, 

construction, operational practices, and relevant operational experience of the 

applicant and the industry. The burden is on the applicant to justify that the PRA 

approach, methods, and data, as well as the requisite level of detail necessary 

for the NRC staff’s review and assessment, are appropriate. RGs 1.174 and 

1.200 provide additional guidance on the level of detail that should be included in 

the PRA. If detailed design information (e.g., regarding cable and pipe routing) is 

not available or if it can be shown that detailed modeling does not provide 

significant additional information, it is acceptable to make bounding-type 

assumptions consistent with the guidelines in RG 1.200. However, the risk 

models should still be able to identify vulnerabilities as well as design and 

operational requirements such as ITAAC and COL action items. In addition, the 

bounding assumptions should not mask any risk-significant information about the 

design and its operation. 
19.0-27 Revision 3 – December 2015 

2. The staff will determine whether the applicant has performed sensitivity studies sufficient 

to gain insights about the impact of uncertainties (and the potential lack of detailed 

models) on the estimated risk. The objectives of the sensitivity studies should include 

(1) determining the sensitivity of the estimated risk to potential biases in numerical 

values, such as initiating event frequencies, failure probabilities, and equipment 

unavailabilities, (2) determining the impact of the potential lack of modeling details on the 

estimated risk, and (3) determining the sensitivity of the estimated risk to previously 

raised issues (e.g., motor-operated valve reliability). As noted in Element 1.1 of 

Table A-1 in Appendix A to RG 1.200, special emphasis should be placed on PRA 

modeling of novel and passive features in the design, as well as addressing issues 

related to those features, such as DI&C, explosive (squib) valves, and the issue of T-H 

uncertainties. 

3. The following guidelines for reviewing DI&C system risk assessments are based on the 

lessons learned from previously accepted new reactor DI&C system PRA reviews. The 

review should consider the following steps, as applicable, to ensure that the risk 

contributions from DI&C, including software, are reflected adequately in the overall plant 

risk results: 

A. The level of review of the DI&C portion of the PRA may be limited due to 

limitations such as the lack of design details, lack of applicable data, and the lack 

of consensus in the technical community regarding acceptable modeling 

techniques for determining the risk significance of the DI&C system. The level of 

review should be proportional to the use of results and insights from the 

applicant’s DI&C risk assessment. 

B. The modeling of DI&C systems should include the identification of how DI&C 

systems can fail and what these failures can affect. The failure modes of DI&C 

systems are often identified by the performance of failure modes and effects 

analyses (FMEA). It is difficult to define DI&C system failure modes especially 

for software because they occur in various ways depending on specific 

applications. Also, failure modes, causes, or effects often are intertwined or 

defined ambiguously, and sometimes overlap or are contradictory. The reviewer 

should review the depth of the FMEA or other hazard analysis techniques 

employed by the applicant to ensure the process employed is systematic and 

comprehensive in its identification of failure modes. The PRA reviewer should 

work with the I&C reviewer to evaluate the methodology and results provided by 

the applicant. Examine applicant documentation to ensure that the most 

significant failure modes of the DI&C are documented with a description of the 

sequence of events that need to take place to fail the system. The sequence of 

events should realistically represent the system’s behavior at the level of detail of 

the model. 

C. The DI&C system CCF events should be identified by the applicant and the 

bases for grouping of CCFs should be provided. Review the discussion of how 

the applicant determined the probabilities associated with CCFs. The PRA 

reviewer should work closely with the I&C reviewer responsible for implementing 

SRP Section 7.1, “Fundamental Design Principles,” to evaluate the applicant’s 

justifications. 
19.0-28 Revision 3 – December 2015 

D. Uncertainties in DI&C modeling and data should be addressed in the DI&C risk 

assessment. It is expected that the DI&C risk assessment will address 

uncertainties by at least performing a number of sensitivity studies that vary 

modeling assumptions, reliability data, and parameter values both at the 

component and system level. The reviewer should evaluate the sensitivity 

studies performed by the applicant on the PRA models and data to assess the 

effect of uncertainty on CDF, risk, and PRA insights. Sensitivity studies may be 

particularly helpful in assessing the effectiveness of design attributes. Additional 

support for the review and treatment of uncertainties is provided by 

NUREG-1855, Volume 1, Main Report: “Guidance on the Treatment of 

Uncertainties Associated with PRAs in Risk-Informed Decision Making,” dated 

March 2009. 

E. The DI&C reviewer should confirm that DI&C system equipment is capable of 

meeting its safety function in environments associated with accident sequences 

modeled in the PRA. This is done in collaboration with the reviewer for the PRA 

and severe accident evaluation that provides input on the expected environments 

that need to be considered. 

F. The PRA reviewer should confirm that the impact of external events 

(i.e., seismic, fire, high winds, flood, and others) on DI&C has been addressed in 

the PRA. The DI&C reviewer confirms that an appropriate failure mode and 

effects assessment for external hazards has been performed for the purpose of 

supporting treatment of DI&C in the PRA. A specific concern is the impact of fire 

on DI&C systems. 

G. Important scope, boundary condition, and modeling assumptions need to be 

determined and evaluated. Verify that the assumptions made in developing the 

PRA model and data are realistic, and that the associated technical justifications 

are sound and documented. The reviewer should pay attention to assumptions 

about the potential effects from failure of defensive measures.7 A DI&C 

defensive measure may have the unintended consequence of causing spurious 

trips or spuriously failing functional capabilities. The applicant should describe 

the segregation process that prevents this from occurring. The PRA reviewer 

should work with the I&C reviewer to evaluate the process discussed by the 

applicant. 

H. The PRA reviewer should evaluate the treatment of the recovery actions taken 

for loss of DI&C functions, referring to RG 1.200 and good practices in human 

reliability assessment (HRA) for additional guidance. Coordinate the review with 

staff evaluating areas such as main control room design, and minimum alarms 

and controls inventory. If recovery actions are modeled, they should consider 

loss of instrumentation and the time available to complete such action. 

I. Verify that a method for quantifying the contribution of software failures to DI&C 

system reliability was used and documented. 

 

7

 i.e., measures that provide DI&C fault prevention, removal, and tolerance, e.g., memory allocation, network/bus design features, 

automatic tester system, diagnostics, and data acquisition system. 
19.0-29 Revision 3 – December 2015 

J. It is important to evaluate claims by applicants regarding the credit that should be 

given for defensive design features. Verify that key assumptions from the DI&C 

PRA are captured under the applicant’s design reliability assurance program (DRAP), which is described in SRP Chapter 17, Section 17.4. The applicant should 

describe adequately where and how the D-RAP captures the DI&C system key 

assumptions, such as how future software and hardware modifications will be 

conducted to ensure that high reliability and availability are maintained over the 

life of the plant. 

The following 10 additional steps, as applicable, are included if a more detailed review is 

needed (e.g., through field audits): 

A. Verify that physical and logical dependencies are identified and their bases 

provided in the DI&C PRA. The probabilistic model should encompass all 

relevant dependencies of a DI&C system on its support systems. For example, if 

the same DI&C hardware is used for implementing several DI&C systems that 

perform different functions, a failure in the hardware, software, or system of the 

DI&C platform may adversely affect all these functions. Should these functions 

be needed at the same time, they would be affected simultaneously. This impact 

should be explicitly included in the probabilistic model. The DI&C system 

probabilistic model should be fully integrated with the probabilistic model of other 

systems. Coordinate with the I&C reviewer. 

B. Ensure that spurious actuations of diverse backup systems or functions are 

evaluated and the overall risk impact documented. 

C. Common cause failures can occur in areas where there is sharing of design, 

application, or functional attributes, or where there is sharing of environmental 

challenges. Review the extent to which the DI&C systems were examined by the 

applicant to determine the existence of such areas. Each of the areas found to 

share such attributes should be evaluated in the DI&C analysis to determine 

where CCF should be modeled and to estimate their contribution. Based on the 

results of this evaluation, D&IC software and/or hardware/software dependent 

CCFs may need to be applied in several areas within subsystems (e.g., logic 

groups), among subsystems of the same division, across divisions or trains, and 

across systems. For example, CCF assignments should be based on similarity 

in design and function of component or system modules. 

The CCF events should be identified and modeled by the applicant. The CCF 

probabilities and their bases should be evaluated and provided based on an 

evaluation of coupling mechanisms (e.g., similarity, design defects, external 

events, and environmental effects) combined with an evaluation of defensive 

measures meant to protect against CCF (e.g., separation and independence, 

operational testing, maintenance, diagnostics, self-testing, fault tolerance, and 

software/hardware design/development techniques and processes). Failures of 

system modules common across multiple applications should be identified 

(e.g., CCF of common function modules). If the safety functions of a DI&C 

system (and the redundancy within safety functions) use common software, 

dependency should be identified for software faults. That is, when common 

software is used for different safety functions (or in the redundancy within a 

safety function) it may fail each function. Hardware CCF between different safety 
19.0-30 Revision 3 – December 2015 

functions using the same hardware should be identified. Dependencies between 

hardware and software should be identified. The applicant should provide the 

rationale for the degree of dependency assumed for DI&C CCF. 

An important expectation is that the applicant included sufficient equipment in the 

CCF groups. The evaluation should address why various channels, trains, 

systems, etc., were or were not placed in each CCF group. The justification 

should discuss common software/hardware among the equipment considered 

and the level(s) of dependency among them. The reviewer should work with the 

I&C reviewer to evaluate the applicant’s justifications. 

D. It is important to evaluate claims by applicants regarding the credit that should be 

given for defensive design features. Design features such as fault tolerance, 

diagnostics, and self testing are intended to increase the safety of DI&C systems, 

and therefore are expected to have a positive effect on the system’s safety. 

However, these features may also have a negative impact on the safety of DI&C 

systems if they are not designed properly or fail to operate appropriately. The 

potentially negative effects of these features should be included in the 

probabilistic model. The PRA should account for the possibility that after a failure 

is detected, the system may fail to reconfigure properly, may be set up into a 

configuration that is less safe than the original, may fail to mitigate the failure 

altogether, or the design feature itself may contain the fault. The benefits of 

these features also may be credited in the PRA. Care should be taken to ensure 

that design features intended to improve safety are modeled correctly 

(e.g., ensuring that the beneficial impacts of these features are only credited for 

appropriate failure modes and that the limitations, including failure of the design 

feature itself, is considered in the model). 

An issue associated with including a design feature such as fault tolerance in a 

DI&C system modeled in a PRA is that its design may be such that it can only 

detect, and hence mitigate, certain types of failures. A feature may not detect all 

the failure modes of the associated component, but just the ones it was designed 

to detect. The PRA model should only give credit to the ability of these features 

to automatically mitigate these specific failure modes; it should consider that all 

remaining failure modes cannot be automatically tolerated. Those failure modes 

that were not tested should not be considered in the fault coverage, and should 

be included explicitly in the logic model. 

When a specific datum from a generic database, such as a failure rate of a digital 

component, is used in a DI&C risk assessment, the risk analyst, in conjunction 

with the I&C reviewer, should assess whether the datum was adjusted for the 

contribution of design features specifically intended to limit those postulated 

failures. If so, the failure rate may be used in the PRA, but no additional fault 

coverage should be applied to the component, unless it is demonstrated that the 

two fault coverages are independent. Otherwise, applying the same or similar 

fault coverages would generate a non-conservative estimate of the component’s 

failure rate. A fault-tolerant feature of a DI&C system can be explicitly included 

either in the logic model or in the PRA data, but not both. 
19.0-31 Revision 3 – December 2015 

With respect to the above design features, the concept of fault coverage is used 

to express the probability that a failure will be tolerated for the types of failures 

that were tested. Fault coverage is a function of the failures that were used in 

testing. It is essential that the reviewer be aware of the types of failures that 

were used in testing to apply a value of fault coverage to a PRA model. 

How fault coverage is measured and defined should be evaluated by the risk 

analyst in conjunction with the I&C reviewer. 

E. If a DI&C system shares a communication network with other DI&C systems, the 

effects on all systems due to failures of the network should be modeled jointly. 

The impact of communication faults on the related components or systems 

should be evaluated, and any failure considered relevant should be included in 

the probabilistic model. 

F. If hardware, software, and system CCF probabilities are treated together in the 

PRA and if the applicant uses standard methods such as the multiple Greek 

letter method, alpha factor method, or beta factor method to model DI&C system 

CCFs, an NRC audit of these calculations, their bases, and the modeling 

assumptions may be warranted. 

G. The data for hardware failure rates (including CCF) will likely be more robust than 

the software failure data. Review of applicant claims regarding data should be 

proportional to the use made of the PRA results. If limited use is made, limited 

review is necessary. If the applicant claims CCF rates that are more than an 

order of magnitude lower than other component groups (especially for software), 

an NRC audit of data calculations may be warranted. Data (either public or 

system-specific) have been a limiting factor in the evaluation of risk for DI&C 

systems. The guidelines in Subsection 4.5.6, “Data Analysis,” of the ASME 

Standard for PRA, ASME/ANS RA-Sa-2009, for nuclear power plant applications 

should be satisfied consistent with the clarifications and qualifications of 

RG 1.200. Determine if the process used to determine basic event probabilities 

is reasonable. Check the assumptions made in calculating the probabilities of 

basic events (unavailabilities). Confirm that the data used in the PRA are 

appropriate for the hardware and software version being modeled, or that 

adequate justification is provided. 

Note that a fault-tolerant feature of a DI&C system (or one of its components) can 

be explicitly included either in the logic model or in the probabilistic data of the 

components in the model. It should not be included in both because this would 

result in double-counting the feature’s contribution. 

H. If the values of the data used appear to be skewed and use of different values 

might change the insights drawn from the DI&C risk assessment, confirm that the 

data meet the following criteria: 

a. The data are obtained from the operating experience of the same equipment 

as that being evaluated, and preferably in the same or similar applications 

and operating environment. Uncertainty bounds should appropriately reflect 

the level of uncertainty. (Applies to both component- specific and generic 

data) 
19.0-32 Revision 3 – December 2015 

b. The sources for raw data or generic databases are provided. (Applies to both 

component-specific and generic data) 

c. The method used in estimating the parameters is documented, so that the 

results can be reproduced. (Applies to component specific data) 

d. If the system being modeled is qualified for its environment but the data 

obtained are not drawn from systems qualified for that environment, the data 

should account for the differences in application environments. (Applies to 

both component-specific and generic data) 

e. Data for CCF meet the above criteria in Ha to Hd. (Applies to both 

component-specific and generic data, as appropriate) 

f. Data for fault coverage meet the above criteria in Ha to Hd. (Applies to both 

component-specific and generic data, as appropriate) 

g. Documentation is included on how the basic event probabilities are calculated 

in terms of failure rates, mission times, and test and maintenance 

frequencies. (Applies to both component-specific and generic data) 

I. The use of DI&C systems in nuclear power plants raises the issue of dynamic 

interactions, specifically: 

a. The interactions between a plant system and the plant’s physical processes, 

(i.e., the value of process variables), and 

b. The interactions within a DI&C system (e.g., communication between 

different components, multi-tasking, multiplexing, etc.). 

The reviewer should confirm that interactions have been addressed in the PRA 

model for DI&C systems or should evaluate the rationale for not modeling them. 

J. Target reliability and availability specifications should be described adequately 

for the operational phase of D-RAP (details of the operational phase are provided 

in SRP Sections 17.4 and 17.6). If the PRA lacks sufficient quantitative results to 

determine target values, the applicant should describe adequately how expert 

judgment will establish reliability and availability goals. How the applicant will 

carry out performance monitoring for diverse backup systems (if necessary) and 

DI&C systems should be clearly explained. These specified values should be 

defined to help ensure that no safety conclusions based on review of the risk 

analysis of the DI&C are compromised once the plant is operational. Coordinate 

this review with NRC staff evaluating the levels of diversity and defense-in-depth 

(D3) in the DI&C system. An implementation and monitoring program should 

address how the applicant will ensure that the design continues to reflect the 

assumed reliability of the systems and components during plant operation. 

Severe Accident Evaluation (FSAR Section 19.2) 

1. The staff reviews the applicant’s description and analysis of the design features to 

prevent and mitigate severe accidents, in accordance with the requirements in 
19.0-33 Revision 3 – December 2015 

10 CFR 52.47(23) or 10 CFR 52.79(a)(38), for a DC or a COL application, respectively. 

This review should specifically address the issues identified in SECY-90-016 and 

SECY-93-087 (listed with their SRMs above) for prevention (e.g., anticipated transients 

without scram, midloop operation, station blackout, fire protection, and intersystem lossof-coolant accident) and mitigation (e.g., hydrogen generation and control, core debris 

coolability, high-pressure core melt ejection, containment performance, dedicated 

containment vent penetration, equipment survivability). 

2. The staff reviews the information provided by the applicant to satisfy the requirements of 

10 CFR 52.47(8) or 10 CFR 52.79(a)(17), for a DC or a COL application, respectively. 

In particular, both regulations invoke 10 CFR 50.34(f)(1)(i) to specify that a designspecific or plant-specific PRA should be performed to seek improvements in core heat 

removal system reliability and containment heat removal system reliability that are 

significant and practical and do not excessively impact the plant. 

3. The reviewer compares the design features that affect containment performance and the 

calculated performance of the containment with published results for operating plants 

and evaluates whether or not the design under review is robust and has a high tolerance 

for severe accidents when compared to that of the operating plants. The comparison 

and conclusions are documented in the SER. 

4. The reviewer identifies the design features and requirements introduced by the applicant 

to reduce or eliminate significant contributors to risk in existing operating plants and 

evaluates the extent to which these features provide a good balance between prevention 

and mitigation. The evaluation is documented in the SER. 

5. Using acceptance criteria listed above in Section II, the reviewer evaluates the 

applicants assessment of structural performance of the containment under severe 

accident loads which encompasses: (1) an assessment of the Level C (or factored load) 

pressure capability of the containment in accordance with 10 CFR 50.44(c)(5), 

(2) demonstration of the containment capability to withstand the pressure and 

temperature loads induced by the more likely severe accident scenarios as stipulated in 

SECY-93-087, Section I.J, (3) a containment structural fragility assessment for 

overpressurization, and (4) seismic HCLPF assessment of the containment in meeting 

the SECY-93-087, Section II.N, expectation. 

IV. EVALUATION FINDINGS 

The reviewer verifies that the applicant has provided sufficient information and that the review 

and calculations (if applicable) support conclusions of the following type to be included in the 

staff’s SER. The reviewer also states the bases for those conclusions. 

In the SER, the staff should provide a summary description of the applicant’s design-specific or 

plant-specific PRA and severe accident evaluations, following the topical outline provided in 

RG 1.206, Section C.I.19. The SER should also identify the PRA and severe accident 

evaluation information that the applicant docketed and the information reviewed by the NRC 

during audits. The results of the staff review, including staff audits, should reflect a consistent 

and scrutable evaluation of the applicant’s PRA and severe accident evaluations. 
19.0-34 Revision 3 – December 2015 

Based on an evaluation of the acceptance criteria from Subsection II of this SRP section, with 

guidance given in Subsection III, the staff will generally need to make a finding in the following 

areas: 

1. The applicant has used the PRA and severe accident evaluation to identify and assess 

the balance of preventive and mitigative features, including consideration of operator 

actions. The Commission anticipates that the plant's operation will reflect a reduction in 

risk compared to existing operating plants. 

2. The applicant has used PRA results and insights to support other programs, as identified 

in Subsection I of this SRP section. 

3. The PRA reasonably reflects the as-designed, as-built, and as-operated plant, and the 

PRA maintenance program will ensure that the PRA will continue to reflect the asdesigned, as-built, and as-operated plant, consistent with its identified uses and 

applications. 

4. The PRA is of the appropriate scope, level of detail, and technical adequacy for its 

identified uses and applications. 

5. Appropriate ITAAC (including design acceptance criteria if applicable), interface 

requirements, and COL items have been identified. 

6. The applicant has performed adequate systematic evaluations of the risk associated with 

the design and used them to identify risk-informed safety insights in a manner consistent 

with the Commission’s stated goals. 

7. In accordance with the Commission’s objectives for new reactor designs, the applicant 

has introduced appropriate and effective design features that contribute to the mitigation 

of severe accidents. The Commission anticipates that these features will reduce the 

significant risk contributors when compared to existing operating plants. 

8. The applicant’s containment performance evaluation meets the requirement of 

10 CFR 50.44, the SECY-93-087 expectations for containment structural performance, 

and the staff’s expectation of the quality of the containment pressure fragility analysis. 

9. For DC and COL reviews, the findings will also summarize the staff’s evaluation of 

requirements and restrictions (e.g., interface requirements and site parameters) and 

COL action items relevant to this SRP section. 

V. IMPLEMENTATION 

The staff will use this SRP section in performing safety evaluations of DC and COL applications 

submitted pursuant to 10 CFR Part 52. Except when the applicant proposes an acceptable 

alternative method for complying with specified portions of the Commission’s regulations, the 

staff will use the method described herein to evaluate conformance with Commission 

regulations. 

The provisions of this SRP section apply to reviews of applications submitted six months or 

more after the date of issuance of this SRP section, unless superseded by a later revision. 
19.0-35 Revision 3 – December 2015 

VI. REFERENCES 

1. 50 FR 32128, “Severe Reactor Accidents Regarding Future Designs and Existing 

Plants,” Federal Register, Volume 50, No. 153, pp. 32138-32150, August 8, 1985. 

2. 51 FR 28044, “Safety Goals for the Operations of Nuclear Power Plants Policy 

Statement,” Federal Register, Volume 51, No. 149, pp 28044-28049, August 4, 1986. 

3. 52 FR 34884, “Nuclear Power Plant Standardization,” Federal Register, Volume 52, 

No. 178, pp. 34884-34886, September 15, 1987. 

4. 59 FR 35461, “Regulation of Advanced Nuclear Power Plants: Statement of Policy,” 

Federal Register, Volume 59, No. 132, pp 35461-35462, July 12, 1994. 

5. 60 FR 42622, “Use of Nuclear Probabilistic Risk Assessment Methods in Nuclear 

Regulatory Activities; Final Policy Statement,” Federal Register, Volume 60, No. 158, 

pp. 42622-42629, August 16, 1995. 

6. American Society of Mechanical Engineers/American Nuclear Society, ASME/ANS RASa-2009, “Standard for Level 1/Large Early Release Frequency Probabilistic Risk 

Assessment for Nuclear Power Plant Applications,” New York, NY, 2009. Standards are 

available at http://www.asme.org.

7. Electric Power Research Institute, EPRI NP-6041, “Nuclear Plant Seismic Margin R-1,” 

Palo Alto, CA, August 1991. EPRI reports are available at http://www.epri.com.

8. Electric Power Research Institute, EPRI TR-1002988, “Seismic Fragility Application 

Guide,” Palo Alto, CA, December 2002. EPRI reports are available at 

http://www.epri.com. 

9. Electric Power Research Institute, EPRI TR-103959, “Methodology for Developing 

Seismic Fragilities,” Palo Alto, CA, June 1994. EPRI reports are available at 

http://www.epri.com. 

10. Nuclear Energy Institute, NEI NUMARC 91-06, “Guidelines for Industry Actions to 

Assess Shutdown Management,” December 1991. NEI reports are available at 

http://www.nei.org. 

11. U.S. Code of Federal Regulations, “Domestic Licensing of Production and Utilization,” 

Part 50, Chapter 1, Title 10, “Energy.” 

12. U.S. Code of Federal Regulations, “Environmental Protection Regulations for Domestic 

Licensing and Related Regulatory Functions,” Part 51, Chapter 1, Title 10, “Energy.” 

13. U.S. Code of Federal Regulations, “Licenses, Certifications, and Approvals for Nuclear 

Power Plants,” Part 52, Chapter 1, Title 10, “Energy.” 

14. U.S. Nuclear Regulatory Commission, DC/COL-ISG-20, “Interim Staff Guidance on 

Implementation of a Probabilistic Risk Assessment-Based Seismic Margin Analysis for 

New Reactors,” October 16, 2009. ADAMS Accession No. ML100491233. 
19.0-36 Revision 3 – December 2015 

15. U.S. Nuclear Regulatory Commission, GL 88-17, “Loss of Decay Heat Removal,” 

October 17, 1988. 

16. U.S. Nuclear Regulatory Commission, GL 89-01, “Implementation of Programmatic 

Controls for Radiological Effluent Technical Specifications in the Administrative Controls 

Section of the Technical Specifications and the Relocation of Procedural Details of 

RETS to the Offsite Dose Calculation Manual or to the Process Control Program,” 

January 31, 1989. 

17. U.S. Nuclear Regulatory Commission, IN 88-36, “Possible Sudden Loss of RCS 

Inventory during Low Coolant Level Operation,” June 8, 1988. 

18. U.S. Nuclear Regulatory Commission, IN 91-41,”Potential Problems with the Use of 

Freeze Seals,” June 27, 1991. 

19. U.S. Nuclear Regulatory Commission, “Control of Combustible Gas Concentrations in 

Containment,” Revision 3, Regulatory Guide 1.7, March 2007. ADAMS Accession No. 

ML070290080. 

20. U.S. Nuclear Regulatory Commission, “An Approach for Using Probabilistic Risk 

Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing 

Basis,” Regulatory Guide 1.174, Revision 2. May 2011. ADAMS Accession No. 

ML100910006. 

21. U.S. Nuclear Regulatory Commission, “An Approach for Determining the Technical 

Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities,” 

Regulatory Guide 1.200, Revision 2. March 2009. ADAMS Accession No. 

ML090410014. 

22. U.S. Nuclear Regulatory Commission, “Combined License Applications for Nuclear 

Power Plants (LWR Edition),” Regulatory Guide 1.206. June 2007. ADAMS Accession 

No. ML070630003. 

23. U.S. Nuclear Regulatory Commission, “Containment Structural Integrity Evaluation for 

Internal Pressure Loadings above Design-Basis Pressure,” Regulatory Guide 1.216. 

August 2010. ADAMS Accession No. ML093200703. 

24. U.S. Nuclear Regulatory Commission, SECY-90-016, “Evolutionary Light-Water Reactor 

(LWR) Certification Issues and Their Relationship to Current Regulatory Requirements,” 

January 12, 1990. ADAMS Accession No. ML003707849. 

25. U.S. Nuclear Regulatory Commission, SECY-93-087, “Policy, Technical, and Licensing 

Issues Pertaining to Evolutionary and Advanced Light-Water Reactor Designs,” April 2, 

1993. ADAMS Accession No. ML003708021. 

26. U.S. Nuclear Regulatory Commission, SECY-96-128, “Policy and Key Technical Issues 

Pertaining to the Westinghouse AP600 Standardized Passive Reactor Design,” June 12, 

1996. ADAMS Accession No. ML003708224. 
19.0-37 Revision 3 – December 2015 

27. U.S. Nuclear Regulatory Commission, SECY-97-044, “Policy and Key Technical Issues 

Pertaining to the Westinghouse AP600 Standardized Passive Reactor Design,” February 

18, 1997. ADAMS Accession No. ML003708316. 

28. U.S. Nuclear Regulatory Commission, SRM-SECY-90-016, “Evolutionary Light-Water 

Reactor (LWR) Certification Issues and their Relationship to Current Regulatory 

Requirements,” June 26, 1990. ADAMS Accession No. ML003707885. 

29. U.S. Nuclear Regulatory Commission, SRM-SECY-93-087, “Policy, Technical, and 

Licensing Issues Pertaining to Evolutionary and Advanced Light-Water Reactor 

Designs,” July 21, 1993. ADAMS Accession No. ML003708056. 

30. U.S. Nuclear Regulatory Commission, SRM-SECY-96-128, “Policy and Key Technical 

Issues Pertaining to the Westinghouse AP600 Standardized Passive Reactor Design,” 

January 15, 1997. ADAMS Accession No. ML003708192. 

31. U.S. Nuclear Regulatory Commission, SRM-SECY-97-044, “Policy and Key Technical 

Issues Pertaining to the Westinghouse AP600 Standardized Passive Reactor Design,” 

June 30, 1997. ADAMS Accession No. ML003708232. 

PAPERWORK REDUCTION ACT STATEMENT 

The information collections contained in the Standard Review Plan are covered by the requirements of 10 CFR Parts 50, 51, and 52, 

and were approved by the Office of Management and Budget, approval numbers 3150-0011, 3150-0021, and 3150-0151. 

PUBLIC PROTECTION NOTIFICATION 

The NRC may not conduct or sponsor, and a person is not required to respond to, a request for information or an information 

collection requirement unless the requesting document displays a currently valid OMB control number. 

 
19.0-38 Revision 3 – December 2015 

SRP Section 19.0

Description of Changes

Section 19.0 “PROBABILISTIC RISK ASSESSMENT AND SEVERE ACCIDENT 

EVALUATION FOR NEW REACTORS”

This SRP section affirms the technical accuracy and adequacy of the guidance previously 

provided in Revision 2, dated June 2007 of this SRP. See ADAMS Accession No. 

ML071700652. 

The technical changes incorporated in Revision 3, dated September 2014 include: 

(1) incorporation of guidance previously contained in Interim Staff Guidance (ISG) 

DC/COL-ISG-003 (ADAMS Accession No. ML081430087) concerning the review of PRA 

information and severe accident assessments submitted to support DC and COL applications, 

(2) incorporation of guidance previously contained in ISG DC/COL-ISG-020 (ADAMS Accession 

No. ML100491233) concerning review of information from PRA-based seismic margin analyses 

submitted in support of DC and COL applications, (3) incorporation of guidance previously 

contained in ISG DI&C/COL-ISG-003 (ADAMS Accession No. ML080570048) concerning 

review of DI&C system PRAs, including treatment of CCFs in PRAs and uncertainty analysis 

associated with new reactor digital systems, (4) incorporation of additional procedures for 

review of PRA information and severe accident assessments developed during NRC reviews of 

DC and COL applications completed after Revision 2 of SRP 19.0 was issued, (5) additional 

proposed acceptance criteria and review procedures for the staff’s review of an applicant’s 

assessment of risk from accidents that could affect multiple modules in facilities with small 

modular integral pressurized water reactors (iPWRs), and (6) additional review procedures for 

the staff’s review of the results of the PRA for non-power modes of operation. 

Descriptions of the technical changes in each SRP section are as follows: 

I. AREAS OF REVIEW 

1. The list of the Commission’s objectives regarding the appropriate way to address 

severe accidents and use PRA in the design and operation of facilities under 

review was removed. RG 1.206 is identified as the proper source for the list. 

2. Added a statement describing the scope of newly added guidance for the review 

of PRA-based seismic margin analysis. 

3. Added a statement clarifying the various types of information from COL 

applicants the staff may expect to see when the applicant incorporates by 

reference a generic risk assessment of external events in the DCD. 

4. Added statements identifying the information that should be provided by 

applicants for staff review and the format requirements for the information. 

5. Added a statement describing the scope of the staff’s review of applicant’s 

analysis of containment capability. 

6. Added a statement clarifying the scope of the PRA staff’s review of Tier 1 

information in the DCD. 
19.0-39 Revision 3 – December 2015 

7. Added statements that identify additional organizations with which staff with 

primary review responsibility may need to interface with. 

8. A statement was added to clarify the interface between the review of combustible 

gas control and the review of severe accidents. 

9. Several statements were added to clarify the division or responsibility of the PRA 

reviewer and the I&C reviewer regarding treatment of the DI&C systems in the 

PRA. 

10. Some considerations for design certification rules were deleted. 

II. ACCEPTANCE CRITERIA 

1. Added a description of 10 CFR 52.47(a)(1) to the list of requirements applicable 

to DC applicants. 

2. In regards to the requirements in 10 CFR 52.47(a)(27), a statement was added to 

clarify that a PRA-based SMA is an acceptable surrogate for seismic PRA in a 

design certification application since a seismic PRA cannot be performed unless 

the site has been adequately characterized. 

3. Added a statement describing requirements in 10 CFR 52.79(a)(1) for COL 

applicants. 

4. Added statements describing Commission expectations regarding containment 

performance and SMA. 

5. Added several statements describing Commission expectations for use of the 

PRA in advanced reactor design and licensing. 

6. Added (1) a statement to indicate that the PRA is not part of the design bases 

and therefore not subject to quality assurance requirements in 10 CFR Part 50, 

Appendix B, and (2) guidelines that establish, at a high level, acceptable 

elements for a quality assurance program. 

7. Several statements were added that describe the staff’s acceptance criteria for 

technical adequacy of the PRA, including the standards and guidance that will be 

applied. 

8. Two statements were added that identify specific results from the PRA the staff 

will need to consider in order to complete its review of Chapter 19 of the FSAR. 

9. Guidance was added regarding acceptable approaches for reporting significant 

risk contributors in Chapter 19 of the DCD and FSAR, including an acceptable 

interpretation of the term “significant.” 

10. A statement was added that describes acceptance criteria pertaining to 

description of the PRA maintenance program in Chapter 19 of the FSAR. 

11. A statement was added that describes acceptance criteria pertaining to 

description of the PRA upgrade program in Chapter 19 of the FSAR. 
19.0-40 Revision 3 – December 2015 

12. A statement was added describing acceptable methods for determining tornado 

frequencies. 

13. A statement was added identifying an acceptable method for evaluating 

containment structural integrity for internal pressure loadings above design-basis 

pressure. 

14. Several statements were added that describe the acceptance criteria for PRAbased SMA previously contained in DC/COL-ISG-20. 

15. Statements were added to describe the applicability of RG 1.7 and RG 1.216 to 

the containment performance assessment which is part of the severe accident 

evaluation. 

16. A footnote was added stating that PRA self-assessment is an acceptable tool for 

assessing the technical adequacy of a PRA performed in support of an 

application for a design certification. 

17. A footnote was added to describe Min-Max method which used to determine the 

HCLPF capacity. 

18. Additional acceptance criteria for the staff’s review of an applicant’s assessment 

of risk from accidents that could affect multiple modules in facilities with small 

modular integral pressurized water reactors (iPWRs) were added. 

III. REVIEW PROCEDURES 

1. A statement was added emphasizing the need for reviewers to assure that when 

RAIs lead to a substantive change to information in the FSAR or DCD, these 

documents are revised to reflect the new information. 

2. A statement was added to notify readers that the NRC had issued the FSER for 

the DC of the ESBWR and to identify this FSER as a resource for reviewers to 

use in their review of Chapter 19 of DC and COL applications. 

3. A statement was added directing reviewers to follow the approach for riskinforming staff review activities provided in the introduction to NUREG-0800 when 

performing reviews of small, modular iPWRs. 

4. Procedures were added to ensure that reviewers consider specific areas of the 

PRA in their reviews. 

5. Procedures were added regarding review of results and descriptions of the 

assessment of internal fires in the PRA. 

6. Procedures were added for reviewing technical adequacy of Level 1 PRA. 

7. Procedures were added for reviewing specific issues associated with passive 

designs. 

8. Procedures were added for review of topics specific to iPWRs. 
19.0-41 Revision 3 – December 2015 

9. Procedures were added for reviewing PRA for Non-Power Modes of Operation. 

10. Procedures were added for review of Level 2 PRA issues. 

11. Procedures were added for reviewing PRA-based SMA. 

12. Procedures were added for review of results and descriptions of the assessment 

of high winds in the PRA. 

13. Procedures were added for use during audits of the PRA in the applicant’s office. 

14. Procedures were added for reviewing design features that have been added to 

mitigate severe accidents. 

15. A statement was added to make clear that the EPRI Fire-Induced Vulnerability 

Evaluation (FIVE) method is acceptable along with the method in NUREG\CR6850 for addressing fire in the PRA. 

16. An explicitly review procedure was added for the containment performance 

assessment. 

17. Review procedures for the staff’s review of an applicant’s assessment of risk from 

accidents that could affect multiple modules in facilities with small, modular, 

integral pressurized water reactors (iPWRs) were added. 

18. Additional review procedures for the staff’s review of an applicant’s assessment of 

risk from accidents that could affect multiple modules in facilities with small 

modular integral pressurized water reactors (iPWRs) were added 

19. Additional review procedures for the staff’s review of the results of the PRA for 

non-power modes of operation were added. 

IV. EVALUATION FINDINGS 

Three additional findings that reviewers should pursue were added. These findings relate to 

specific objectives of the Commission for use of PRA in the design of new and advanced 

reactors. 

V. IMPLEMENTATION 

No Changes 

VI. REFERENCES 

A number of additional documents are referred to in Sections II and III. Complete references for 

these documents have been added to the reference section (i.e., Section VI).