ONR GUIDE THE PURPOSE, SCOPE, AND CONTENT OF SAFETY CASES. Nuclear Safety Technical Assessment Guide. NS-TAST-GD-051 Revision 4

Transcription

1 Title f dcument ONR GUIDE THE PURPOSE, SCOPE, AND CONTENT OF SAFETY CASES Dcument Type: Nuclear Safety Technical Assessment Guide Unique Dcument ID and Revisin N: NS-TAST-GD-051 Revisin 4 Date Issued: July 2016 Review Date: July 2019 Apprved by: Graham Heys Prfessinal Lead Recrd Reference: Trim Flder (2016/230683) Revisin cmmentary: This is a minr refresh and has been updated t be fully cmpatible with ONR Safety Assessment Principles It incrprates minr additinal explanatins. A mre extensive update is in preparatin, but will need sme stakehlder engagement prir t issue. In the meantime the current versin is fit fr purpse. TABLE OF CONTENTS 1. INTRODUCTION PURPOSE AND SCOPE RELATIONSHIP TO LICENCE AND OTHER RELEVANT LEGISLATION RELATIONSHIP TO SAPS, WENRA REFERENCE LEVELS AND IAEA SAFETY STANDARDS ADDRESSED DEFINITION OF A NUCLEAR SAFETY CASE THE PURPOSE OF A SAFETY CASE OVERALL QUALITIES OF A SAFETY CASE THE STRUCTURE AND CONTENT OF A SAFETY CASE THE SAFETY CASE IN CONTEXT SAFETY CASES FOR DIFFERENT STAGES OF A FACILITY S LIFE CYCLE SITE-WIDE SAFETY CASES OWNERSHIP, MANAGEMENT AND REVIEW OF SAFETY CASES COMMON PROBLEMS, SHORTCOMINGS AND TRAPS WITH SAFETY CASES REFERENCES GLOSSARY AND ABBREVIATIONS (EXAMPLE LIST) APPENDICES Office fr Nuclear Regulatin, 2016 If yu wish t reuse this infrmatin visit fr details. Published 07/16 Template Ref: ONR-DOC-TEMP-002 Revisin 3 Page 1 f 23

2 Office fr Nuclear Regulatin 1. INTRODUCTION 1.1 This technical assessment guide is guidance t ONR inspectrs n the purpse, scpe and cntent f safety cases. 1.2 The previus update brught in develpments in ONR thinking, particularly fllwing the Haddn-Cave reprt int the Nimrd crash [1]. This revisin is anther evlutinary update with changes made t ensure full cmpatibility with the 2014 majr revisin f the Safety Assessment Principles [2]. 2. PURPOSE AND SCOPE 2.1 The purpse f this dcument is t prvide ONR inspectrs with brad guidance n safety cases. The guide sets ut the purpse f nuclear safety cases and expectatins n hw they are used, their verall qualities, hw they may be structured and what infrmatin they shuld cntain. 2.2 Guidance is als prvided n cmmn prblems with safety cases based n ONR s experience (Appendix 1). Safety case shrtcmings identified in the Nimrd Review are set ut in Appendix The scpe cvers safety cases fr the different phases in the life cycle f facilities, e.g. design, cnstructin, cmmissining, peratin, decmmissining. Guidance is given t inspectrs n the issues that shuld be addressed in safety cases fr the different phases f peratin. 2.4 The guide des nt address the fllwing in any depth: arrangements fr the prductin f safety cases and the implementatin f these arrangements; peridic reviews f safety cases; specific activities that safety cases cver; envirnmental and nn-nuclear safety issues that licensees may include in safety cases. 2.5 Mre detailed guidance is given elsewhere e.g. assessment guide NS-TAST-GD-050 [3] and inspectin guides NS-INSP-GD-014 [4] and NS-INSP-GD-015 [5]. 2.6 The guide des nt prescribe the actual cntent r level f detail that needs t be addressed in safety cases. These are a matter fr the licensee t determine taking int accunt the hazards and the specifics f each safety case. ONR s expectatins fr specific tpic areas are set ut in the suite f Technical Assessment Guides. 2.7 This TAG cntains guidance t advise and infrm ONR staff in the exercise f their regulatry judgment. Althugh the guide has been develped fr ONR s wn use, it indicates t licensees and ther stakehlders the standards that ONR expects t be met in safety cases. 3. RELATIONSHIP TO LICENCE AND OTHER RELEVANT LEGISLATION LICENCE 3.1 The regulatry basis fr this guide encmpasses a number f licence cnditins. LC23 (Operating Rules), specifically 23(1), requires a licensee t prduce an adequate safety case in respect f any peratin that may affect safety. LC19 (Cnstructin r Reprt: NS-TAST-GD-051 Revisin 4 TRIM Ref: 2016/ Page 2 f 23

3 Office fr Nuclear Regulatin Installatin f New Facility), LC20 (Mdificatin t Design f Facility under Cnstructin), LC21 (Cmmissining), LC22 (Mdificatin r Experiment n Existing Facility) and LC35 Decmmissining) all require adequate dcumentatin t justify safety within the cntext f the specific cnditin. LC14 (Safety Dcumentatin) and LC15 (Peridic Review) require a licensee t make and implement adequate arrangements fr the prductin f safety cases and fr the peridic review and reassessment f safety cases, respectively. 3.2 Fr the whle f a facility s life cycle, the safety f any activity must be substantiated and dcumented. Exceptins are nly permitted fr unfreseen events and emergencies when rapid respnses are needed fr safety purpses. With well-planned safety management arrangements such events shuld be extremely rare, but when they arise they need t be handled within the cntext f emergency arrangements that require as far as practicable risk assessments t be undertaken, respnses planned and recrds made at the time. OTHER RELEVANT LEGISLATION 3.3 In additin t the nuclear licence cnditin requirements, safety dcumentatin may be required under ther legislatin (e.g. IRR 1999, REPPIR 2001, MHSAW 1999) r t meet the requirements f ther regulatrs (e.g. EA, SEPA). 3.4 Sectins 2 and 3 f the HSW Act 1974 require the emplyer t reduce the risks t emplyees and ther persns, s far as is reasnably practicable. In judging whether licensees have cmplied with their legal duties ONR makes use f the risk management prcedures explained (fr example) in Reducing Risks, Prtecting Peple dcument. The fundamental requirement is that the safety case shuld demnstrate hw risks are reduced t levels that are As Lw As Reasnably Practicable (ALARP). 4. RELATIONSHIP TO SAPS, WENRA REFERENCE LEVELS AND IAEA SAFETY STANDARDS ADDRESSED SAPS 4.1 The Safety Assessment Principles fr Nuclear Facilities (SAPs) [2] prvide a framewrk t guide regulatry decisin-making in the nuclear permissining prcess. The SAPs include a sectin n the Regulatry Assessment f Safety Cases (paras f [2]) with principles SC.1 SC.8. These principles encmpass: safety case prcesses (SC.1 and SC.2); safety case characteristics (SC.3 t SC.6); and safety case management (SC.7 and SC.8). As identified in the Applicatin f the SAPs Sectin and The Regulatry Assessment f Safety Cases Sectin f the SAPs, during safety case assessment inspectrs shuld use the principles prprtinately cmmensurate with the radilgical hazards presented. 4.2 Other SAPs that are relevant in the prductin and implementatin phases f safety cases include the principles n Leadership and Management fr Safety (paras f [2]). These SAPs cver the aspects f safety culture, resurces, cmpetences, the use f cntractrs, decisin making and the effectiveness f managing, auditing, reviewing and being a learning rganisatin. These attributes are fundamental t the successful prductin, implementatin and maintenance f safety cases. Reprt: NS-TAST-GD-051 Revisin 4 TRIM Ref: 2016/ Page 3 f 23

4 Office fr Nuclear Regulatin WENRA REACTOR SAFETY REFERENCE LEVELS 4.3 The bjective f the Western Eurpean Nuclear Regulatrs Assciatin (WENRA) is t develp a cmmn apprach t nuclear safety in Eurpe by cmparing natinal appraches t the applicatin f IAEA safety standards. Their Reference Safety Levels (RSLs), which are primarily based n the IAEA safety standards, represent gd practices in the WENRA member states and represent a cnsensus view f the main requirements t be applied t ensure nuclear safety. In particular, ONR s plicy is that the WENRA RSLs [6] are identified as Relevant Gd Practice fr existing Civil Nuclear Reactrs (see sectin 4 f [7]). 4.4 Safety cases are directly addressed in Issue N f WENRA s reprt n reactr Reference Safety Levels [6]. Cntents and updating f safety analysis reprt (SAR). This states that the licensee shall prvide a SAR t demnstrate that the plant fulfils relevant safety requirements and use it as the basis fr cntinuus supprt fr safe peratin and fr assessing the safety implicatins f changes t the facility r t perating practices. This appendix (Issue N) within the WENRA RSLs prvides sme useful guidance and has been taken int accunt in this guidance. IAEA SAFETY STANDARDS 4.5 IAEA General Safety Requirements, GSR Part 4, 2009, Safety Assessment fr Facilities and Activities [8] states that Safety Assessments (safety cases) are t be undertaken as a means f evaluating cmpliance with safety requirements (and thereby the applicatin f the fundamental safety principles) fr all facilities and activities and t determine the measures that need t be taken t ensure safety. The safety assessments are t be carried ut and dcumented by the rganisatin respnsible fr perating the facility r cnducting the activity, are t be independently verified and are t be submitted t the regulatry bdy when required as part f the licensing r authrisatin prcess. Guidance n the frmat and cntent f the safety assessments is prvided in IAEA reprts (e.g. [9] and [10]). ADVICE TO INSPECTORS 5. DEFINITION OF A NUCLEAR SAFETY CASE 5.1 The guidance in the SAPs identified that A safety case is a lgical and hierarchical set f dcuments that describes risk in terms f the hazards presented by the facility, site and the mdes f peratin, including ptential faults and accidents, and thse reasnably practicable measures that need t be implemented t prevent r minimise harm. It takes accunt f experience frm the past, is written in the present, and sets expectatins and guidance fr the prcesses that shuld perate in the future if the hazards are t be cntrlled successfully. The safety case clearly sets ut the trail frm safety claims thrugh arguments t evidence. [2]. 5.2 The term nuclear safety case may relate t a site, a facility, part f a facility, a mdificatin t a facility r t the peratins within a facility, r t ne r mre significant issues. The licensee may wish t prduce hlistic safety cases in which bth nuclear and nn-nuclear risks are cnsidered. Hwever, since this guidance applies specifically t nuclear safety aspects, the term nuclear safety case is shrtened t safety case. 6. THE PURPOSE OF A SAFETY CASE Reprt: NS-TAST-GD-051 Revisin 4 TRIM Ref: 2016/ Page 4 f 23

5 Office fr Nuclear Regulatin 6.1 The primary purpse f a safety case is t prvide the licensee with the infrmatin required t enable safe management f the facility r activity in questin. Therefre it shuld be understandable t and useable by thse with direct respnsibility fr safety. The SAPs say: The prcess fr prducing safety cases shuld take int accunt the needs f thse wh will use the safety case t ensure safe peratins. It is essential that the safety case dcumentatin is clear and lgically structured s that the infrmatin is easily accessible t thse wh need t use it (see paragraph 87). This includes designers, peratins and maintenance staff, technical persnnel and managers wh are accuntable fr safety [2] 6.2 A safety case shuld cmmunicate a clear and cmprehensive argument that a facility can be perated r that an activity can be undertaken safely. The safety case fr a facility r activity shuld demnstrate that the assciated risk and hazards have been assessed, apprpriate limits and cnditins have been defined and adequate safety measures have been identified and put in place. 6.3 In particular, the purpse f a safety case is described in para 101 f the SAPs[2]: T achieve these, a safety case shuld: (a) identify the facility s hazards by a thrugh and systematic prcess; (b) identify the failure mdes f the plant r equipment by a thrugh and systematic fault and fault sequence identificatin prcess; (c) demnstrate that the facility cnfrms t relevant gd engineering practice and sund safety principles. (Fr example, a nuclear facility shuld be designed against a set f deterministic engineering rules, such as design cdes and standards, using the cncept f defence in depth 1 and with adequate safety margins.) Instances where gd practice has nt been met shuld be identified and a demnstratin prvided t justify why these are cnsidered t grssly disprprtinate; (d) prvide sufficient infrmatin t demnstrate that engineering rules have been applied in an apprpriate manner. (Fr example, it shuld be clearly demnstrated that all structures, systems and cmpnents have been designed, cnstructed, cmmissined, perated and maintained in such a way as t enable them t fulfil their safety functins fr their prjected lifetimes.); (e) analyse nrmal peratins and shw that resultant dses f inising radiatin, t bth members f the wrkfrce and the public are, and will cntinue t be, within regulatry limits and ALARP; (f) analyse identified faults and severe accidents, using cmplementary fault analysis methds t demnstrate that risks are ALARP; (g) demnstrate that radiactive waste management and decmmissining have been addressed in an apprpriate manner; and (h) prvide the basis fr the safe management f peple, plant and prcesses. (Fr example, the safety case shuld address management and staffing levels, training requirements, maintenance requirements, perating and maintenance instructins, and cntingency and emergency instructins). Further guidance n these tpics is set ut in the relevant sectin(s) f these principles. 1 Fr additinal guidance n defence in depth, see [2], in particular SAP EKP.3 and assciated guidance paragraphs Reprt: NS-TAST-GD-051 Revisin 4 TRIM Ref: 2016/ Page 5 f 23

6 Office fr Nuclear Regulatin 6.4 The safety case is a key element t enable safe management f the facility r activity in questin. It is imprtant t thse wh interact directly with the facility, fr example the peratrs wh cntrl the cnditins within the facility and thse wh maintain the facility. It is als imprtant t senir management wh are respnsible and accuntable fr safety. They rely upn the safety case fr accurate and bjective infrmatin n risks and cntrl measures t make infrmed decisins that may affect safety. Therefre, the key users f the safety case shuld be invlved in its develpment, prductin/review and implementatin. 6.5 The safety case shuld be a living dcument which is subject t review and change as time prceeds. Fr example, the safety case may change due t imprtant changes t the facility, its mde f peratin, r the understanding f safety related issues. It may als change in the light f perating experience r peridic review. 7. OVERALL QUALITIES OF A SAFETY CASE There are several features which are fundamental t a gd safety case. These are summarised here in terms f eight verall qualities. The safety case shuld be; 7.1 Intelligible The safety case shuld be intelligible and structured lgically t meet the needs f thse wh will use it (e.g. peratrs, maintenance staff, technical staff, managers accuntable fr safety). T achieve this: 7.2 Valid There shuld be a sufficient descriptin f the facility, its purpse and its peratin, t serve the purpse f the safety case. All descriptins and terms shuld be easy t understand by the key users. All arguments shuld be cgent and be develped cherently. All references and supprting infrmatin shuld be identified and be easily accessible. There shuld be a clear trail frm claims thrugh the arguments t the evidence that fully supprts the cnclusins, tgether with cmmitments t any future actins. Operatinal requirements, including maintenance, etc. shuld be clearly defined. A safety case shuld accurately represent the current status f the facility in all physical, peratinal and managerial aspects. It shuld reflect changes that have arisen frm previus mdificatins, revised perating methds, perating experience, examinatin and test results, different analytical methds and peridic reviews. Fr new facilities r mdificatins, the safety case shuld accurately represent the design intent. 7.3 Cmplete A safety case shuld cmprehensively analyse the activities assciated with nrmal peratin, identify and analyse the faults f ptential safety cncern and demnstrate that risks are ALARP. The ALARP argument shuld include Reprt: NS-TAST-GD-051 Revisin 4 TRIM Ref: 2016/ Page 6 f 23

7 Office fr Nuclear Regulatin explanatin f the ptins fr alternative designs r appraches that were cnsidered at the initial stages. A safety case shuld cntain the infrmatin necessary t shw that the facility is adequately safe and what will be needed fr it t remain s ver the perid fr which the safety case is valid. There shuld be reference ut frm the safety case t imprtant supprting wrk, such as engineering substantiatin. The safety case shuld be able t act as an entry pint fr accessing all relevant supprting infrmatin n which it is built. 7.4 Evidential The arguments develped in the safety case shuld be supprted with verifiable and relevant evidence (i.e. dcumented, measurable, etc.). This shuld encmpass: Identificatin f key assumptins and the basis fr these. The degree f sensitivity t key assumptins (sensitivity studies may be needed fr key data assumptins). The link between engineering and safety prvisins shuld be demnstrated in line with the requirements f defence-in-depth. Claims relating t the integrity r perfrmance f engineering features shuld be supprted in the engineering substantiatin dcuments. The necessary understanding f the behaviur f nvel systems r prcesses shuld be established frm apprpriate research and develpment. The analytical methds used t substantiate safety, including any cmputer cde analyses, shuld be shwn t be fit fr purpse with adequate verificatin and validatin. If a limit n the validity f an apprach exists, evidence shuld be prvided t shw that the apprach is used within the valid regin r the use f inferred r extraplated infrmatin needs t be carefully substantiated. Where safety is demnstrated using claims based n previus experience, sufficient evidence shuld be presented t shw that it is relevant t the new safety case. 7.5 Rbust A safety case shuld demnstrate that the nuclear facility will r des cnfrm t gd nuclear engineering practice and sund safety principles, including defence-in-depth and adequate safety margins. The arguments and evidence presented in the safety case shuld be prprtinate t the expsed hazards and risks. 7.6 Integrated Hazards frm and dependencies n ther facilities r external services (e.g. grid supplies) shuld be identified and related claims r assumptins shuld be substantiated. The safety case shuld be integrated with and reference the safety cases and dcuments fr such dependencies. 7.7 Balanced In the wrds f Lrd Cullen at the Ladbrke Grve Rail Inquiry, safety cases shuld encurage peple t think as actively as they can t reduce risks. Therefre: Reprt: NS-TAST-GD-051 Revisin 4 TRIM Ref: 2016/ Page 7 f 23

8 Office fr Nuclear Regulatin A safety case shuld present a balanced accunt, taking int cnsideratin the level f knwledge and understanding. Areas f uncertainty shuld be identified, nt just strengths and claimed cnservatism. Ptential weaknesses r areas fr imprvement in the facility design r the safety argument shuld be explained clearly and penly (e.g. in the summary r main cnclusins f the safety case). 7.8 Frward lking The safety case shuld demnstrate that the facility will remain safe thrughut a defined life-time. T achieve this, a safety case: Shuld demnstrate adequate cntrl f radilgical hazards befre any assciated risks actually exist. Identify the imprtant aspects f peratin and management that need t be implemented t maintain safety, including maintenance, inspectin and testing regimes and perating limits and cnditins. Detail any cnstraints that will apply in the facility s life-time. Shuld take accunt f the effects f ageing and degradatin n the facility. Shuld identify the radiactive waste management arrangements e.g. dispsal rutes fr waste. Cnsider the safety case fr decmmissining t an adequate extent. Identify any unreslved issues alng with the timescale fr their reslutin. Any further wrk, analytical r physical (e.g. inspectins) needed t supprt the thrugh-life safety case shuld be identified with the timescale fr cmpletin. 8. THE STRUCTURE AND CONTENT OF A SAFETY CASE 8.1 A safety case shuld be structured in a lgical manner and be demnstrably cmplete. It shuld be accessible and understandable t thse respnsible fr safety. There is explicit guidance in paras f the SAPs[2] but this can be restated as that the safety case shuld readily prvide answers t the fllwing questins: 1. What des the safety case cver (a new site/facility, facility extensin, mdificatin)? 2. What des the site/facility, etc. lk like (site layut, design, key features)? 3. What must be right and why (e.g. structural integrity, perfrmance)? 4. Hw is this achieved (e.g. regulatins, cdes, standards and specificatins)? 5. What can g wrng (faults, hazards internal and external)? 6. What prevents/mitigates against it ging wrng (e.g. prtectin systems, redundancy, diversity, prcedures)? 7. What if it still ges wrng (risk/cnsequences, emergency arrangements)? 8. Are the risks ALARP? 9. What culd be dne t make it safer; what areas need further wrk (e.g. substantiatin, research) and what are the limitatins and uncertainties)? 10. What must be dne t implement the safety case (e.g. perating limits and cnditins, prcedures, maintenance, resurce and training requirements)? Reprt: NS-TAST-GD-051 Revisin 4 TRIM Ref: 2016/ Page 8 f 23

9 Office fr Nuclear Regulatin 11. Hw lng will the safety case be valid (e.g. full life time r shrter due t life limiting features)? 12. What happens at the end-f-life (decmmissining principles / strategy)? 8.2 Sme licensees have fund it beneficial t prduce a safety case strategy dcument early n in a significant prject t prmte effective planning and early stakehlder engagement. The dcumentatin framewrk shuld be defined befre wrk begins n the safety case. This will ensure there is a clear and lgical structure, aiding bth its prductin and subsequent use. The framewrk shuld be develped int a detailed plan f the individual dcuments required. This can prve useful in identifying ptential hles at an early stage and it helps in mnitring prgress twards cmpletin. The detailed plan can f curse change, as wrk prgresses, with dcuments being added r deleted. 8.3 The precise structure and scpe f the dcumentatin will be a matter fr the licensee t determine taking int accunt the significance f the hazard, the cmplexity f the safety case and the needs f key users. A safety case may cmprise a hierarchy f dcuments. The tp tier will cntain the cre f the safety arguments and increasingly detailed technical dcuments and supprting analysis will be presented in lwer tiers. At the lwest level there are likely t be the engineering substantiatin and design details, pssibly including experimental results, data n reliability, relevant peratinal experience. 8.4 The claims in a safety case shuld be supprted by rbust arguments and evidence. The evidence may be based n: scientific laws; applicatin f relevant cdes and standards; calculatinal analysis (e.g. fault analysis, DBA, PSA); direct evidence frm testing and peratinal experience; r prir research. The evidence supprting the safety claims shuld be relevant, f an apprpriate quality, sufficient and cmmensurate with the ptential risks and cmplexity f the system f interest. Different types f evidence are usually needed t supprt multi-legged arguments fr safety claims. 8.5 Fr large r cmplex safety cases it is useful t have a tp tier summary dcument, smetimes knwn as the Safety Reprt. This apprach can significantly imprve the usability and accessibility f large cmplex safety cases, and in particular can bring ut key aspects f the safety case t users and decisin makers. The tp tier dcument shuld describe the facility and its peratin, summarise the main hazards and the safety functins required t cntrl them, explain the means f delivering these functins, and summarise the main cnclusins. The safety arguments shuld be cherent, cnsistent and readily understd. It shuld be meaningful if read in islatin, as well as prviding the main entry pint and clear links t the safety case dcumentatin as a whle. 9. THE SAFETY CASE IN CONTEXT 9.1 It shuld always be remembered that the dcumented safety case is nt an end in itself. It frms an imprtant part f hw the licensee manages safety. The requirements f the safety case need t be implemented and managed effectively t deliver safety. The licensee must ensure cntinually that the safety case is cnsistent with the as-built facility and that the facility is perated and maintained in accrdance with safety case requirements and assumptins. The licensee must have effective prcesses t ensure these bjectives are achieved. 9.2 Fundamental t the safety case are the principles, standards and criteria which the licensee intends t maintain. These must, as a minimum, meet statutry requirements Reprt: NS-TAST-GD-051 Revisin 4 TRIM Ref: 2016/ Page 9 f 23

10 Office fr Nuclear Regulatin and in particular, shw that risks t individuals will be acceptably lw and ALARP. They will include design standards, safety criteria and general standards f safety management. They shuld be mutually cnsistent and their selective use shuld be avided. It is imprtant that the licensee s standards and criteria d nt cnflict with any statutry duties and requirements. 10. SAFETY CASES FOR DIFFERENT STAGES OF A FACILITY S LIFE CYCLE 10.1 In the life cycle f a facility frm cnceptin thrugh t decmmissining, there are varius key stages which require special cnsideratin. The safety case fr each stage shuld demnstrate the safety f that stage befre it cmmences and shuld be frward lking t subsequent stages. Any cnstraints impsed n subsequent stages shuld be identified in the safety case. Fr facilities under design r cnstructin the safety case at each stage shuld cntain sufficient detail t give cnfidence that the safety intent will be achieved in subsequent stages The principal stages in the life cycle fr a facility, the assciated safety cases and their particular purpse are shwn in Table 1. Sub-divisin f a prject int principal stages is carried ut under the arrangements fr Licence Cnditins 19 t 22. It is preferable that a separate safety case is prduced fr each f the majr stages The varius stages listed in Table 1 result frm significant steps in facility definitin, thugh a particular facility r peratin may nt require all safety case stages. This is particularly s fr the Early Design stage, which may nt require a Preliminary Safety Case, fr example fr prjects with shrt time scales r f an established design In sme cases, where the installatin is cmplex, the nine stages identified may nt be sufficient and subdivisins wuld be useful r beneficial. Fr example a safety case fr cnstructin may need t be divided int civil cnstructin and facility installatin stages. Similarly a safety case fr cmmissining may need t be divided int ne r mre nn-active and active stages. In fact, cmmissining initially with nn-active materials is nrmal practice fr all majr new nuclear prcess facilities Supplementary dcuments will ften be added t the safety case t cver an activity at a pint in time. Fr example; 1. as a methd statement t demnstrate that the integrity f facility will be maintained and quality assured during cnstructin and installatin wrk, r 2. t demnstrate the safety f a temprary facility mdificatin by defining and substantiating, fr a limited perid f time, peratins which are utside the nrmal envelpe prescribed by existing rules and instructins Develpment f a safety case shuld be an interactive prcess and ensure that lessns are learned and applied befre ging frward t the next stage. Fr new prjects, dcuments shuld be cmpleted in step with the design. Hwever, t ensure that the engineering prceeds in a manner that prvides cnfidence that the safety requirements will be met, it is imprtant that a satisfactry safety case is achieved befre certain stages in the prject cmmence (i.e. design, cnstructin, cmmissining, peratin, and decmmissining). Sme areas will need t prgress at an early stage (e.g. human factrs) t influence the design. It is imprtant that the whle life cycle f the facility is taken int cnsideratin in all stages, fr example decmmissining feasibility shuld be taken int accunt during the design stage. Reprt: NS-TAST-GD-051 Revisin 4 TRIM Ref: 2016/ Page 10 f 23

11 Office fr Nuclear Regulatin 11. SITE-WIDE SAFETY CASES 11.1 Fr sites where there are multiple facilities, the licensee may chse t prduce separate safety cases fr specific facilities, activities, functins r parts f a site, tgether with a site-wide safety case. The purpse f a site-wide safety case is t demnstrate that the site as a whle is safe and t substantiate dependencies and claims made n it by individual facility safety cases (e.g. facility interfaces, cmmn services and emergency arrangements. It shuld shw that the safety cases fr a set f facilities (etc.) are cmprehensive, cnsistent and adequately integrated. Individual facility safety cases shuld refer t the site-wide safety case, as necessary In additin, the site-wide safety case shuld cver whle licensee aspects such as safety management, safety culture and rganisatinal capability (see [11] and [12]). These tpics shuld be addressed, as apprpriate, in facility safety cases but the sitewide case is mre able t demnstrate that the licensee has an adequate rganisatinal structure and resurces, safety plicy and safety management arrangements t perate the whle site safely The site-wide safety case shuld enable the reader t understand the significance f key services, majr hazards and significant safety issues fr the site as a whle. The reader shuld be able t understand the main arguments substantiating safety, hw hazards are prperly cntrlled, why the site s risks are acceptably lw, and the imprvements necessary, in the interest f safety. Fr large r cmplex sites, it is useful t summarise the site-wide safety case in a tp tier reprt (see para 7.5) Where the licensed site is adjacent t, r frms an enclave within anther licensed site, then bth licensees must give cnsideratin in site-wide safety cases t any shared services r shared emergency arrangements and t the impact that ne may have, as an external hazard, n the ther. Adequate arrangements need t be made t ensure that infrmatin is shared t enable the abve cnsideratins t be taken int accunt Site-wide safety cases shuld be subject t peridic review and reassessment. The ttal suite f safety cases n the site and their peridic review schedules shuld be set ut by the licensee. The timing f peridic reviews f safety cases is discussed in [3]. 12. OWNERSHIP, MANAGEMENT AND REVIEW OF SAFETY CASES 12.1 The licensee is legally respnsible fr the safety case and its adequacy. Thse wh have direct respnsibility within the licensee fr delivering safety shuld have wnership f the safety case. Fr example, wnership f a safety case fr a specific facility shuld reside within the peratinal line management. Ownership is nt a figure head rle. It requires an understanding f the safety case and the limits and cnditins derived frm it and the respnsibility t ensure it is adequately managed and maintained It is imprtant that the safety case is kept up t date during each stage f a facility life cycle. This will include the impact f facility/plant mdificatins, new infrmatin (frm research, additinal analyses, etc.) and the utcme frm peridic reviews. The safety case shuld als be reviewed and if necessary updated t take accunt f the lessns frm peratinal experience and incidents. This shuld include experience frm a range f surces, including: within the facility in questin; elsewhere n the site r the licensee; the nuclear industry in the UK r internatinally; and ther sectrs Any updates shuld encmpass changes t safety case dcumentatin (revisin r replacement) plus amendments t rules, instructins, drawings, peratinal Reprt: NS-TAST-GD-051 Revisin 4 TRIM Ref: 2016/ Page 11 f 23

12 Office fr Nuclear Regulatin prcedures and training requirements. Dcumentatin which n lnger frms part f a current safety case, r which has been superseded, shuld be identified and archived. This infrmatin still frms part f the frmal histrical recrd, and remains subject t the arrangements made under Licence Cnditin Licence Cnditin 15 requires that the licensee shall make and implement adequate arrangements fr the peridic and systematic review and reassessment f safety cases. Further guidance n peridic reviews is prvided in NS-TAST-GD-050 [3] Ownership f the safety case is likely t change in line with the different stages f the facility life cycle (e.g. at the design stage, wnership culd be within the prject team). Transfer f wnership shuld be a frmal prcess with clear handver, and acceptance, f respnsibilities In additin t the rle f safety case wner, it is gd practice fr a licensee t have a separate rle f safety case prcess wner. The latter is respnsible fr the whle prcess fr prducing safety cases. This includes prcess review and imprvement t ensure gd quality, fit fr purpse safety cases are prduced cnsistently. Further guidance n the safety case prcess is prvided in NS-INSP-GD-014 [4]). 13. COMMON PROBLEMS, SHORTCOMINGS AND TRAPS WITH SAFETY CASES 13.1 ONR has cnsiderable experience f reviewing and assessing licensees safety cases in supprt f its regulatry activities. It is imprtant that inspectrs learn frm this experience and are made aware f the cmmn prblems that have arisen in the past and which they may encunter in the future. Appendix 1 has further infrmatin n the cmmn types f prblem It is als imprtant that ONR learns frm ther sectrs where there is a requirement t prduce safety cases. The Nimrd Review [1] prvides a cmprehensive and valuable surce f learning int hw safety cases can g wrng, alng with advice n hw t address the shrtcmings. This has direct relevance t nuclear safety cases and aligns with sme f ONR s experience (see Appendix 1). Sme f the key pints frm the Nimrd Review are highlighted in Appendix 2. Inspectrs are encuraged t read [1]; the safety case aspects are cvered in Chapters 9 t 11 and Licensees shuld als be applying learning frm their wn experience (including significant issues identified by ONR) and frm elsewhere (including utside the nuclear sectr, including the Nimrd Review in particular). Inspectrs shuld lk fr evidence that this is happening and ask licensees hw lessns have been applied t deliver imprvements t safety cases Significant r persistent issues with safety cases are indicative f underlying prblems with the way they are prduced. Inspectrs shuld ensure that the causes f such prblems are addressed, nt just the symptms. See NS-INSP-GD-014 [4] fr further guidance. 14. REFERENCES 1 The Nimrd Review; An Independent Review int the Lss f the RAF Nimrd MR2 Aircraft XV230 in Afghanistan in 2006, Charles Haddn-Cave QC, Octber Safety Assessment Principles fr Nuclear Facilities Editin Revisin 0. Nvember Reprt: NS-TAST-GD-051 Revisin 4 TRIM Ref: 2016/ Page 12 f 23

13 Office fr Nuclear Regulatin 3 ONR HOW2 Nuclear Safety Technical Assessment Guide - Peridic Safety Reviews (PSR), NS-TAST-GD-050 Revisin 3, April ONR HOW2 Nuclear Safety Inspectin Guide - LC14 Safety Dcumentatin, NS-INSP-GD-014, Revisin 2, May ONR HOW2 Nuclear Safety Inspectin Guide LC15 Peridic Review, NS-INSP-GD-015 Revisin 2, April Western Eurpean Nuclear Regulatrs Assciatin. Reactr Harmnizatin Grup. WENRA Reactr Reference Safety Levels. WENRA. September ONR HOW2 Nuclear Safety Technical Assessment Guide - The Demnstratin f ALARP (as lw as reasnably practicable), NS-TAST-GD-005, Revisin 7, December Safety Assessment fr Facilities and Activities, IAEA General Safety Requirements, GSR Part 4, Frmat and Cntent f the safety analysis reprt fr Nuclear Pwer Plants, IAEA Safety Guide N. GS-G-4.1, Safety Assessment fr the Decmmissining f Facilities using Radiactive Materials, IAEA Safety Guide N. WS-G-5.2, The Management System fr Facilities and Activities, IAEA Safety Requirements, GS-R-3, ONR HOW2 Nuclear Safety Technical Assessment Guide - Functin and Cntent f a Safety Management Prspectus, NS-TAST-GD-072, Revisin 2, GLOSSARY AND ABBREVIATIONS (EXAMPLE LIST) ALARP As lw as reasnably practicable BPEO Best Practicable Envirnmental Optin BSL Basic Safety Level BSL(LL) Basic Safety Level (legal limit) BSO Basic Safety Objective CBA Cst Benefit Analysis CCF Cmmn Cause Failure CNS Civil Nuclear Security (Office fr Nuclear Regulatin) DBA Design Basis Analysis DBE Design Basis Earthquake DEPZ Detailed Emergency Planning Zne HSE Health and Safety Executive HSWA74 The Health and Safety at Wrk etc Act 1974 IAEA Internatinal Atmic Energy Agency Reprt: NS-TAST-GD-051 Revisin 4 TRIM Ref: 2016/ Page 13 f 23

14 Office fr Nuclear Regulatin NDA NEPLG OBE PSA PSR SAP SFAIRP SEPA SSC TAG WENRA Nuclear Decmmissining Authrity Nuclear Emergency Planning Liaisn Grup Operating Basis Earthquake Prbabilistic Safety Analysis Peridic Safety Review Safety Assessment Principle(s) S far as is reasnably practicable Scttish Envirnment Prtectin Agency Structure, System and Cmpnent Technical Assessment Guide(s) Western Eurpean Nuclear Regulatrs Assciatin 16. APPENDICES Appendix 1: Cmmn prblems with safety cases Appendix 2: Nimrd Review - Safety case shrtcmings & traps Reprt: NS-TAST-GD-051 Revisin 4 TRIM Ref: 2016/ Page 14 f 23

15 Office fr Nuclear Regulatin TABLE 1 PRINCIPAL STAGES OF A NUCLEAR FACILITY LIFE-CYCLE AND ASSOCIATED SAFETY CASES Majr stage f Facility life cycle Early design Pre-Cnstructin and Installatin (including mdificatins) Assciated safety case (SC) Preliminary Safety Case Pre-Cmmencement (Cnstructin) Safety Case Particular purpse f safety cases T make a statement f design philsphy, the cnsideratin f design ptins and a descriptin f the resultant cnceptual design sufficient t allw identificatin f main nuclear safety hazards, cntrl measures and prtectin systems. T prvide a descriptin f the prcess being adpted t demnstrate cmpliance with the legal duty t reduce risks t wrkers and the public SFAIRP. T prvide details f the safety principles and criteria that have been applied by the licensee (r Requesting Party) in its wn assessment prcesses, including risks t wrkers and the public. T bradly demnstrate that the principles and criteria are likely t be achieved. T prvide an verview statement f the apprach, scpe, criteria and utput f the deterministic safety analyses. T prvide an verview statement f the apprach, scpe, criteria and utput f the prbabilistic safety analyses. T specify the site characteristics t be used as the basis fr the safety analysis (the generic siting envelpe ) T prvide explicit references t standards and design cdes used justificatin f their applicability and a brad demnstratin that they have been met (r exceptins justified). T prvide infrmatin n the quality management arrangements fr the design, including design cntrls; cntrl f standards; verificatin and validatin; and the interface between design and safety. T give a statement giving details f the safety case develpment prcess, including peer review arrangements, and hw this gives assurance that nuclear risks are identified and managed. T prvide Infrmatin n the quality management system fr the safety case prductin. T identify and explain any nvel features,* including their imprtance t safety. T identify and explain any deviatins frm mdern internatinal gd practices. T prvide sufficient detail fr ONR t satisfy itself that SAPs and WENRA reference levels are likely t be satisfied. T prvide, where apprpriate, infrmatin abut all the assessments cmpleted by ther (including verseas) nuclear safety regulatrs. T identify utstanding infrmatin that remains t be develped and its significance. T prvide infrmatin abut any lng-lead items that may need t be manufactured. T prvide infrmatin n radiactive waste management and decmmissining. * The definitin f a nvel feature is any majr system, structure r cmpnent nt previusly licensed in a nuclear facility anywhere in the wrld. T define the dcumentary scpe and extent f the safety case. T explain hw the decisins regarding the achievement f safety functins ensure that the verall risk t wrkers and public will be reduced SFAIRP. T prvide respnses t utstanding regulatry issues frm the Preliminary Safety Case. T prvide sufficient infrmatin t substantiate the claims made in the Preliminary Safety Case. T prvide sufficient infrmatin t enable ONR t assess the design against all relevant SAPs. Reprt : NS-TAST-GD-051 Revisin 4 TRIM Ref: 2016/ Page 15 f 23

16 Office fr Nuclear Regulatin Majr stage f Facility life cycle Assciated safety case (SC) Pre-Inactive Cmmissining Safety case Pre-Active Cmmissining Safety case Particular purpse f safety cases T demnstrate that the detailed design prpsal will meet the safety bjectives befre cnstructin r installatin cmmences, and that sufficient analysis and engineering substantiatin has been perfrmed t prve that the plant will be safe. T prvide detailed descriptins f system architectures, their safety functins and reliability and availability requirements. T cnfirmatin and justify the design cdes and standards that have been used and where they have been applied, nncmpliances and their justificatin. T prvide infrmatin n fault analyses including Design Basis Analysis, Severe Accident Analysis and PSA. T justify the safety f the design thrughut the plant s life cycle, frm cnstructin thrugh peratin t decmmissining, and including n-site spent fuel and radiactive waste management issues. Where apprpriate, t identify ptentially significant safety issues raised during previus assessments f the design by ther (including verseas) nuclear safety regulatrs, and explanatins f hw their reslutin has been r is t be achieved. T identify the safe perating envelpe and the perating regime that maintains the integrity f the envelpe. T cnfirm: a) which aspects f the design and its supprting dcumentatin are cmplete; b) which aspects are still under develpment and identificatin f utstanding cnfirmatry wrk that will be addressed. Where necessary, the safety case shuld be updated t reflect the abve additinal details. T demnstrate that the facility as-built meets relevant safety criteria and is capable f safe peratin. T enable the prductin f a prgramme f safety cmmissining activities that will:- demnstrate as far as practicable the safe functining f all systems and equipment, prve as far as practicable all safety claims, cnfirm as far as practicable all safety assumptins, cnfirm as far as practicable the effectiveness f all safety related prcedures. T list aspects f safety that cannt be demnstrated inactively. T sentence any shrtfalls revealed during inactive cmmissining. T demnstrate that the inactive cmmissined facility cntinues t meet relevant safety criteria and is capable f safe peratin. T demnstrate that the active cmmissining activities can and will be carried ut safely and that the perating prcedures fr cmmissining are supprted by the safety case. T enable the prductin f a prgramme f safety cmmissining activities that will:- demnstrate the safe functining f all systems and equipment where nt already demnstrated prve all safety claims where nt already prved cnfirm all safety assumptins where nt already cnfirmed cnfirm the effectiveness f all safety related prcedures where nt already cnfirmed as effective. T demnstrate that there are n aspects f safety that remain t be demnstrated after active cmmissining. T identify limits and cnditins necessary in the interest f safety. T demnstrate cmpliance with the legal duty t reduce risks t wrkers and the public SFAIRP. Reprt : NS-TAST-GD-051 Revisin 4 TRIM Ref: 2016/ Page 16 f 23

17 Office fr Nuclear Regulatin Majr stage f Facility life cycle Pre-Operatin Operatin Pst Operatin Pre-Decmmissining Decmmissining Pst-Decmmissining Assciated safety case (SC) Pre-Operatinal Safety case Facility r Statin Safety Case r Site- Wide Safety Case if relevant Updated as necessary Peridically reviewed Pst-Operatinal Safety Case Safety Strategy Overview (applies in cmplex decmmissining prjects nly) Decmmissining Strategy Safety Case fr Decmmissining Operatins Pst-Decmmissining Clearance Safety Case Particular purpse f safety cases T demnstrate that the facility (as built and cmmissined) meets the safety standards and criteria set dwn in the precmmencement safety case. T demnstrate that detailed analysis has been undertaken t prve that the facility will be safe. T demnstrate that all necessary pre-peratinal actins have been cmpleted, validated and implemented. T identify limits and cnditins necessary in the interest f safety. T demnstrate cmpliance with the legal duty t reduce risks t wrkers and the public SFAIRP. T demnstrate safety f peratin fr a defined perid. T demnstrate cmpliance with the legal duty t reduce risks t wrkers and the public SFAIRP. T take accunt f experience t review and changes that have been necessary, and ensure the safety case is still valid. T review the safety adequacy f the facility in the light f its current and prjected cnditin and against mdern safety standards and expectatins. T take a strategic lk frward t cnsider facility lifetime and cntingency requirements. T demnstrate that the facility is adequately safe fr pst peratins care and maintenance activities prir t start f decmmissining (if such a perid is apprpriate). T demnstrate cmpliance with the legal duty t reduce risks t wrkers and the public SFAIRP. T describe hw safety will be managed thrugh the prpsed decmmissining prgramme fr the prject. T demnstrate that there will be a prgressive, timely and systematic reductin f hazard. T define safety gals and criteria fr the prject as a whle. T demnstrate cmpliance with the legal duty t reduce risks t wrkers and the public SFAIRP. T set ut in brad terms the apprach that is t be fllwed during decmmissining. T substantiate in principle the safety f the decmmissining task and demnstrate that there will be a prgressive and systematic reductin in hazard. T define safety gals and criteria fr the decmmissining task. T demnstrate cmpliance with the legal duty t reduce risks t wrkers and the public SFAIRP. The individual safety justificatin fr each f the ptentially many very small, shrt jbs. These include risk assessments, methd statements and peer reviews, and can ften be nrmal wrks prcedures such as thse fr facility mdificatins. T demnstrate that there has ceased t be any danger frm inising radiatin frm anything n site. Nte: Mre infrmatin n ONR s expectatins fr PSRs and PCSRs is given in the dcument New Nuclear Pwer Statins - Generic Design Assessment Guidance t Requesting Parties. Althugh the guidance is specific fr new nuclear pwer statins, it is nevertheless indicative f ONR s expectatins fr ther types f new facilities. Reprt : NS-TAST-GD-051 Revisin 4 TRIM Ref: 2016/ Page 17 f 23

18 Office fr Nuclear Regulatin APPENDIX 1: COMMON PROBLEMS WITH SAFETY CASES This appendix summarises sme f the cmmn prblems with safety cases that have been encuntered by ONR. They are gruped in accrdance with the eight qualities f a safety case identified in sectin 7 f the main text. The list is nt intended t be exhaustive. This appendix shuld be read in cnjunctin with Appendix 2 which has extracts frm the Nimrd Review with respect t shrtcmings in safety cases. Significant r persistent issues with safety cases are indicative f underlying prblems with the way they are prduced. Inspectrs shuld ensure that the causes f such prblems are addressed, nt just the symptms. See NS-INSP-GD-014 [4] fr further guidance. 1 INTELLIGIBLE Much f the safety case is written in the frm f a technical dissertatin with insufficient attentin paid t the needs f the users, hence the dcument des nt prvide a sufficiently clear view f the safety case t facilitate safe peratin. This is frequently due t a lack f invlvement f the likely users in the prductin and review f the safety case and/r the lack f a usability test befre the safety case is signed-ff. There is a difference between a safety case being technically sund and being fit-fr-purpse. Excessive detail is presented in the head safety case dcument making it unnecessarily lng. As a result, the significant safety claims and threads f the safety arguments cannt be readily fund. This can be due t repetitin r t a cut and paste apprach, where cnsiderable infrmatin and detail are incrprated in the head safety case dcument rather than being referenced. The auditable trail frm the head dcument t key infrmatin in supprt f imprtant safety claims can be difficult t fllw. This includes incnsistencies between different parts f the case t an extent that safety arguments are ambiguus r undermined. The prblems abve can be caused r exacerbated when large, cmplex safety cases are assembled by prducing many dcuments that are reviewed and apprved individually. The whle safety case is assumed t be fit-fr-purpse when all the individual dcuments have been signed-ff. 2 VALID The claims and assumptins made in the safety case d nt reflect the actual state f the facility. This may be due t as-built differences between the design and the actual facility, the effects f subsequent mdificatins and cncessins, ageing and degradatin effects, a lack f peratr input r a lack f knwledge and familiarity f the facility by the safety case authrs. The safety case has insufficient cnsideratin f the cumulative impact n safety due t mdificatins. The safety case desn t take prper accunt f incidents that have ccurred in the facility r elsewhere. Incidents are usually cnsidered as part f lnger term peridic review prcesses but there shuld be mre direct links between OPEX systems and impact n the extant safety case. 3 COMPLETE The safety case strategy and scpe is inadequate. This can be due t time pressure and/r lack f cnsideratin f viable ptins befre deciding n the curse f actin. The resultant safety case may be technically crrect but it is nt the apprpriate case fr the circumstances. ALARP arguments are presented retrspectively after decisins have been made and the ALARP justificatin is tagged n at the end f a safety case. If there is inadequate cnsideratin f ptins at the safety case strategy stage, r an inapprpriate ptin is selected, the utcme is unlikely t satisfy ALARP requirements. Page 18 f 23