The International Nuclear Safety Advisory Group has prepared a draft proposal for an integrated process, as described in INSAG-25 (2010). This document aims at the most difficult of all safety-related actions; that is, the decision process surrounding the question of what is a sufficient level of safety. As noted in the INSAG document, the process must be flexible to adapt to the myriad of different situations under which these decisions must be made. For example, the decision process to be applied during the stage of conceptual design of a plant can be much broader and more thoroughly researched than can the process that must be applied when (purely for example) a redundant pump fails for some reason during operation and the appropriate subsequent action must be decided. The difference lies mainly in the time available for decision and action — much shorter in the second case.

The general roles of the major stakeholders in the safety management system were discussed in Section 10.2.4. Specific relationships during plant operation are much more complex, but at a higher level always consist of an operating organization overseen and audited by experienced and independent technical staff on behalf of the licensing authority. Fig. 10.8

illustrates a somewhat more detailed map of one possible set of processes involved in arriving at a safety-related decision.

To alleviate the enormous expenditure of resources involved in a step — by-step operation of the process involved in Fig. 10.8, it is usual to develop a set of symptom-based operating procedures for use by the individuals and groups who actually operate the plant controls. Properly developed and tested, these procedures can dramatically shorten the decision and action time required. Procedures must be developed through a comprehensive and interactive process such as that described in INSAG-25 (2010). They must also be periodically updated based on operating experience. The same rule must hold for equipment or design modifications that may be required periodically in a mature operating plant. Finally, if significant changes occur in the external environment of the plant (for example, a newly discovered threat) then a review may result in changes to operating procedures or equipment in order to deal with the new situation.