The question is whether successful removal of decay heat is good evidence of satisfactory safety performance, or conversely, whether it is a good regulatory approach to wait for an actual failure of decay heat removal before inquiring about steps to restore satisfactory safety performance. Arguably it is not a good regulatory approach to presume satisfactory safety performance until safety functions are not only compromised but failed. After years of work applying risk models to regulatory decision-making, it is fair to say that some important elements of the answer to that question are available. But before we simply begin applying risk models, a closely related but distinct issue needs to be addressed. A consistent theme in many of these reports is deficient performance in programmatic areas, or perhaps even perception of institutional weaknesses.
Programmatic weaknesses can behave analogously to common cause failure mechanisms.
Steps towards such a model have been taken previously and are presented in the report. It is argued that a useful litmus test for development in this area is that a model is comprehensive enough if it supports discussion of the significant findings of a comprehensive AIT report. Specific examples, such as that provided by NEI, are considered an excellent basis for discussion of issues such as those mentioned above. Accordingly, a logic model was developed to support a more detailed discussion of the NEI example. This led to the conclusion that function-level monitoring of the kind originally proposed would not provide adequate ongoing assurance of satisfactory safety performance.