ML003739158

Draft Regulatory Guide DG-1062, for Comment, an Approach for Plant-Specific, Risk-Informed, Decisionmaking: Inservice Testing

ML003739158
Person / Time
Issue date:	06/30/1997
From:	Office of Nuclear Regulatory Research
To:
References
-nr, DG-1062
Download: ML003739158 (42)

Text

U.S. NUCLEAR REGULATORY COMMISSION June 1997 OFFICE OF NUCLEAR REGULATORY RESEARCH Division 1 Draft DG-1062 DRAFT REGULATORY GUIDE

Contact:

B. Hardin (301)415-6561 D. Fischer (301 )41 5-2728 D. Fischer(3011415-2728 DRAFT REGULATORY GUIDE DPG- 1062 AN APPROACH FOR PLANT-SPECIFIC, RISK-INFORMED, DECISIONMAKING: IN$ERVICE TESTING

.S - <

This regulatory guide is being issued in draft form to involve the public in the early stages of the development of a regulatory position in this area.

It has not received complete staff review and does not represent an official NRC staff position.

Public comments are being solicited on the draft guide (including any implementation schedule) and its associated regulatory analysis or value/impact statement. Comments should be accompanied by appropriate supporting data. Written comments may be submitted to the Rules and Directives Branch, Office of Administration, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001. Copies of comments received may be examined at the NRC Public Document Room, 2120 L Street NW., Washington, DC. Comments will be most helpful if received by September 30, 1997.

Requests for single copies of draft or active regulatory guides (which may be reproduced) or for placement on an automatic distribution list for single copies of future draft guides in specific divisions should be made in writing to the U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, Attention: Printing, Graphics and Distribution Branch, or by fax to (301)415-5272.

1. INTRODUCTION 1.1 Background During the last several years both the U.S. Nuclear Regulatory Commission (NRC) and the nuclear industry have recognized that probabilistic risk assessment (PRA) has evolved to be more useful in supplementing traditional engineering approaches in reactor regulation. After the publication of its policy statement (Ref. 1) on the use of PRA in nuclear regulatory activities, the Commission directed the NRC staff to develop a regulatory framework that incorporated risk insights. That framework was articulated in a November 27, 1995, paper to the Commission (Ref. 2). This regulatory guide, which addresses inservice testing (IST) and its companion regulatory documents (Refs. 3-8) implement, in part, the Commission policy statement and the staff's framework for incorporating risk insights into the regulation of nuclear power plants.

In 1995 and 1996, the industry developed a number of documents addressing the increased use of PRA in nuclear plant regulation. The American Society of Mechanical Engineers (ASME) initiated code cases addressing IST component importance ranking and testing of certain plant components using risk insights. The Electric Power Research Institute (EPRI) published its "PSA Applications Guide" (Ref. 9) to provide utilities with guidance on the use of PRA information for both regulatory and non-regulatory applications. The Nuclear Energy Institute (NEI) has been developing guidelines on risk-based IST.

1.2 Purpose and Scope

Current IST programs are performed in compliance with the requirements of 10 CFR 50.55a(f) and with Section X1 of the ASME Boiler and Pressure Vessel Code, which are a part of each plant's current licensing basis (CLB).1 This regulatory guide describes an acceptable alternative approach applying risk insights from PRA to make changes to a nuclear power plant's CLB specific to the IST program. An accompanying draft Standard Review Plan (SRP) chapter (Ref. 7) has been prepared for use by the NRC staff in reviewing RI-IST applications. Another draft guidance document, Draft Regulatory Guide DG-1 061, "An Approach for Plant-Specific Risk-Informed Decision Making: General Guidance" (Ref. 3) is referenced throughout this report. Draft Regulatory Guide DG-1 061 provides overall guidance on the technical aspects that are common to developing acceptable risk-informed programs for all applications such as IST (this guide), inservice inspection, graded quality assurance, and technical specifications. Additional information on PRA applications is given in draft NUREG-1 602, "A Standard for Probabilistic Risk Assessment (PRA) to Support Risk

'This regulatory guide adopts the 10 CFR Part 54 definition of current licensing basis. That is, "Current Licensing Basis (CLB) is the set of NRC requirements applicable to a specific plant and a licensee's written commitments for ensuring compliance with and operation with in applicable NRC requirements and the plant specific design basis (including all modifications and additions to such commitments over the life of the license) that are docketed and in effect. The CLB includes the NRC regulations contained in 10 CFR Parts 2, 19, 20, 21, 26, 30, 40, 50, 51, 54, 55, 70, 72, 73, 100 and appendices thereto; orders; license conditions; exemptions; and technical specifications. It also includes the plant-specific design-basis information defined in 10 CFR 50.2 as documented in the most recent final safety analysis report (FSAR) as required by 10 CFR 50.71 and the licensee's commitments remaining in effect that were made in docketed licensing correspondence such as licensee responses to NRC bulletins, generic letters, and enforcement actions, as well as licensee commitments documented in NRC safety evaluations or licensee event reports."

3

Informed Decisionmaking," (Ref. 10). Further information regarding the relationship between this guide, the related SRP chapter, DG-1061, and NUREG-1602 will be given in Section 1.4.

This regulatory guide proposes application-specific details on an acceptable method for developing risk-informed IST (RI-IST) programs and supplements the information given in Draft Regulatory Guide DG-1061. It proposes guidance on acceptable methods for utilizing PRA information with established traditional engineering information in the development of RI-IST programs that have improved effectiveness regarding the utilization of plant resources while still maintaining acceptable levels of quality and safety.

In this draft regulatory guide, an attempt has been made to strike a balance in defining an acceptable process for developing RI-IST programs without being overly prescriptive. Draft Regulatory Guide DG-1061 identifies a list of high-level safety principles that must be maintained during all risk-informed plant design or operational changes. Draft Regulatory Guide DG-1061 and this guide identify acceptable approaches for addressing these basic high-level safety principles, however, licensees may propose other approaches for consideration by the NRC staff. It is intended that the approaches presented in this guide be regarded as examples of acceptable practice and that licensees should have some degree of flexibility in satisfying regulatory needs on the basis of their accumulated plant experience and knowledge.

1.3 Organization This draft regulatory guide is structured to follow the approach given in Draft Regulatory Guide DG-1061. Chapter 2 gives a brief overview of a four-element process envisioned in the development of an RI-IST program. This process is iterative and generally not sequential.

These elements also summarize the NRC review of licensee risk-informed program proposals.

Chapter 3 addresses the first element in the process in which the proposed changes to the IST program are described. This description is needed to determine what supporting information is needed and to define how subsequent reviews will be performed. Chapter 4 contains guidance for performing the engineering evaluation needed to support the proposed changes to the IST program (second process element). Chapter 5 addresses program implementation, performance monitoring, and corrective action (third element). Chapter 6 addresses documentation requirements (fourth element) for licensee submittals to the NRC and identifies additional information that should be maintained in the licensee's records in case later review or reference is needed. The appendix contains additional guidance for dealing with certain IST-related issues such as might arise during the deliberations of the licensee in carrying out integrated decisionmaking. Acceptance guidelines are provided throughout the document for the individual topics.

1.4 Relationship to Other Guidance Documents This draft regulatory guide gives detailed guidance on an acceptable approach to implement risk-insights in IST programs. This application-specific guide makes extensive reference to Draft Regulatory Guide DG-1061.

Companion regulatory guides (Refs. 4 and 5) address graded quality assurance and technical specifications, and contain guidance similar to that given in this RI-IST guide. New SRP chapters associated with each of the risk-informed regulatory guides are given in References 6-8. The SRP sections are intended for staff use during the review of industry requests for 4

risk-informed program changes. SRP Section 3.9.7 (Ref. 7) addresses RI-IST and is consistent with the guidance given in this regulatory guide.

The industry has been developing guidance for use in developing risk-informed regulatory program changes. These documents have provided useful viewpoints for the staff's consideration during the development of the NRC regulatory guidance documents.

1.5 Relationship to the Maintenance Rule The Maintenance Rule requires that licensees monitor the performance or condition of structures, systems, or components (SSCs) against licensee-established goals, in a manner sufficient to provide reasonable assurance that such SSCs are capable of fulfilling their intended function. Such goals are to be established, where practicable, commensurate with safety, and are to take into account industrywide operating experience. When the performance or condition of a component does not meet established goals, appropriate corrective actions are to be taken.

Component monitoring that is performed as part of the Maintenance Rule implementation can be used to satisfy monitoring needs for RI-IST, and for such cases, the performance criteria chosen would be compatible with both the Maintenance Rule requirements/guidance and the RI-IST guidance provided herein.

1.6 Relationship to the Proposed Data Rule The proposed rule on reporting reliability and availability information for risk-significant systems and equipment (i.e., proposed section 50.76, 61 FR 5318) and the associated Draft Regulatory Guide DG-1 046 (Ref. 11) are intended to provide reliability and availability data on selected systems and equipment in U.S. commercial nuclear power plants for use by both the NRC and its licensees. The data would be compiled by the NRC in a centralized database.

The definitions and information requested are intended to be sufficient to qualify the database for regulatory applications of probabilistic risk assessment (PRA) that fall within the limitations of the data, e.g., RI-IST programs. Licensees that choose to implement RI-IST programs will be expected to use such plant-specific data, in conjunction with their plant specific PRA, to help categorize components into the two IST component groups, i.e., low safety-significant components (LSSCs) and high-safety-significant components (HSSCs).

Information gained about the types of failures that occur will also help define the appropriate testing strategies for the two groups of components. In addition, these data will help to improve the accuracy of plant-specific PRA estimates of changes in plant risk projected to result from changes in IST programs.

1.7 Abbreviations and Definitions ASME American Society of Mechanical Engineers CCF common cause failure CDF core damage frequency CLB current licensing basis EPRI Electric Power Research Institute FV Fussell-Vesely risk importance measure GQA graded quality assurance HEP human error probability 5

HSSC high-safety-significant component ISI inservice inspection IST inservice testing LERF containment large early release frequency LSSC low-safety-significant component MCS minimal cut set NEI Nuclear Energy Institute NUMARC Nuclear Utilities Management Research Council O&M Operations and Maintenance (ASME committee)

PRA probabilistic risk assessment PSA probabilistic safety assessment RAW risk achievement worth risk importance measure RI-IST risk-informed IST (e.g., RI-IST programs)

SRP standard review plan SSC(s) structures, systems, and components THERP Technique for Human Error Rate Prediction USAR Updated Safety Analysis Report USNRC U.S. Nuclear Regulatory Commission Regulatory guides are issued to describe to the public methods acceptable to the NRC staff for implementing specific parts of the NRC's regulations, to explain techniques used by the staff in evaluating specific problems or postulated accidents, and to provide guidance to applicants. Regulatory guides are not substitutes for regulations; nor do those guides require compliance. Regulatory guides are issued in draft form for public comment to involve the public in developing the regulatory positions. Draft regulatory guides have not received complete staff review; and they therefore do not represent official NRC staff positions.

The information collections contained in this draft regulatory guide are covered by the requirements of 10 CFR Part 50, which were approved by the Office of Management and Budget, approval number 3150-0011. The NRC may not conduct or sponsor, and a person is not required to respond to, a collection of information unless it displays a currently valid OMB control number.

2. AN ACCEPTABLE APPROACH TO RISK-INFORMED DECISIONMAKING FOR INSERVICE TESTING PROGRAMS 2.1 Key Safety Principles Draft Regulatory Guide DG-1061 identifies five key safety principles to be met for all risk informed applications and to be explicitly addressed in risk-informed plant program change applications. As indicated in Draft Regulatory Guide DG-1061, while these key principles are stated using traditional engineering terminology, efforts should be made, wherever feasible, to utilize risk evaluation techniques to help ensure and to show that these principles are met.

These key principles and the location in this guide where each is addressed for RI-IST programs are as follows:

1. The proposedchange meets the current regulations. [This applies unless the proposed change is explicitly related to a requested exemption or rule change.] (This principle is addressed in Sections 3.1 and 4.1 of this guide.)

6

2. Defense-in-depth is maintained.

(Section 4.3)

3. Sufficient safety margins are maintained.

(Section 4.3)

4. Proposedincreases in risk, and their cumulative effect, are small and do not cause the NRC Safety Goals to be exceeded.

(Sections 4.2, 4.4)

5. Performance-basedimplementation and monitoring strategiesare proposed that address uncertaintiesin analysis models and data andprovide for timely feedback and corrective action.

(Chapter 5)

Draft Regulatory Guide DG-1 061 gives additional guidance on the key safety principles applicable to all risk-informed applications. Figure 1 of this guide, repeated from Draft Regulatory Guide DG-1061, illustrates the consideration of each of these principles in risk informed decision making.

in g.

ecisiohmakint

.Aid: Mbpit 0ripEgiin

-. .:ad-iheir.:cuffiaulitiveeffect:i..

[:iSOW00'*!*i~Wh~ich." ...

ý: :ar'e~sm-al.andt do ibi c'"se :

.. -. e.t..dAddres Figure 1 Principles of Risk-informed Regulation 2.2 A Four-Element Approach to Risk-informed Decision Making for Inservice Testing Programs Chapter 2 of Draft Regulatory Guide DG-1061 describes a four-element process for developing risk-informed regulatory changes. An overview of this process specifically related to RI-IST programs is given in this chapter and illustrated in Figure 2. The order in which the elements are performed may vary or occur somewhat in parallel depending on the particular application and the preference of the program developers.

2.2.1 Element 1: Define Proposed Changes to the Inservice Testing Program.

In this element, the licensee should identify the particular components that would be affected by the proposed changes in testing practices This would include those components currently in the IST program and possibly some that are not if it is determined through new information 7

and insights such as the PRA that these additional components have importance for plant risk. Specific revisions to testing schedules and methods should be described. Plant systems and functions that rely on the affected components should be identified. Chapter 3 1..L gives a more detailed description of Element 1.

2.2.2 Element 2: Conduct Engineering Evaluation In this element, the proposed changes are examined in light of the current plant licensing basis to evaluate the effect of the changes. Areas that are to be evaluated include the expected effect of the proposed RI-IST program on design basis accidents, potential core damage accidents, defense-in-depth attributes,and safety margins. Traditional engineering and PRA methods are both used in the evaluation. The results of the two complementary methods are considered together in an integrated decision process that will be carried over into the implementation phase described below in Element 3. During the integration of all of the available information, it is expected that many issues will need to be resolved through the use of a well-reasoned judgment process often involving a combination of different engineering skills. This activity has typically been referred to in industry documents as being performed by an "expert panel." As discussed further at the end of this chapter and in the appendix, this important process is the licensee's responsibility and may be accomplished by means other than a formal panel. In any case, the key safety principles discussed in this guide must be addressed and shown to be satisfied regardless of the approach used for RI IST program decision making.

In the planning stages of the program, PRA results may be used to categorize components into LSSC and HSSC groupings. After a plan has been developed, a calculation is made using the plant-specific PRA to evaluate the effect of the planned program changes on the plant risk as measured by core damage frequency (CDF) and containment large early release frequency (LERF). The risk evaluation should explicitly consider the affected IST components to the extent that it is feasible to model them in the PRA. The necessary scope of the PRA depends upon the particular systems as well as modes of operation that are affected. Draft Regulatory Guide DG-1 061 contains extensive guidance regarding the engineering evaluation, including acceptance guidelines for projected risk change. Additional application-specific details concerning RI-IST programs and Element 2 are contained in Chapter 4 of this guide.

2.2.3 Element 3: Develop Strategies for Implementation, Performance Monitoring, and Corrective Action Strategies In this element, plans are formulated that ensure that component reliability is maintained commensurate with the component's safety significance. The planned conditions for operation should be consistent with the assumptions in the PRA analysis to ensure that the PRA results reflect the expected plant behavior. Both testing intervals and methods should be specified, and, to the extent practicable, the testing methods should address the relevant failure mechanisms that could significantly affect component reliability. In the event that component failures occur during the RI-IST program, guidance for evaluating the need for, and the implementation of, corrective action should be included in the plans. Specific guidance for Element 3 is given in Chapter 5.

8

2.2.4 Element 4: Document Program Proposal The final element involves preparing that documention to be included in the submittal and that to be maintained by the licensee for later reference (i.e., archival) if needed. The submittal will be reviewed by the NRC according to the standard review plans given in SRP (NUREG-0800) Chapter 19 and Section 3.9.7 (References 6 and 7 respectively).

Documentation requirements for RI-IST programs are given in Chapter 6 of this draft regulatory guide.

In carrying out this process, the licensee will need to make a number of decisions based on the best available information. Some of this information will be derived from traditional engineering practice and some will be probabilistic in nature resulting from PRA studies. It may be that certain issues discussed in this guide are best evaluated through the use of traditional engineering approaches, but for other issues, PRA may have advantages. It is the licensee's responsibility to ensure that its RI-IST program is developed using a well-reasoned and integrated decision process that considers both forms of input information (traditional engineering and probabilistic), including those cases in which the choice of direction is not obvious. Examples of this latter situation are when there is insufficient information to make a clear decision or if the PRA results appear to disagree with the traditional engineering data.

This important decisionmaking process may at times require the participation of special combinations of licensee expertise (staff), depending on the technical and other issues involved, and may at times also need outside consultants. Industry documents have generally referred to the use of an expert panel for such decisionmaking. The appendix to this guide discusses a number of IST-specific issues such as might arise in expert panel deliberations.

Traditional AnaysisP Define Submit Define 4

!Changei Perform Engineering nlsl If Implementationl Monitor Monitoring ing rpoe change Cag Ck~ag AnalysisPrra I Preogram Figure 2 Principal Elements of Risk-Informed, Plant-Specific Decision Making

3. ELEMENT 1: DEFINE PROPOSED CHANGES TO INSERVICE TESTING PROGRAM In this first element of the process, the proposed changes to the IST program are defined.

This involves describing what IST components (e.g., pumps, valves, snubbers) will be involved and how their testing would be changed. Also included in this element is an identification of supporting information and a proposed plan for the licensee's interactions with the NRC throughout the implementation of the RI-IST.

9

3.1 Description of Proposed Changes A full description would include: of the proposed change in the IST program is prepared. This description (1) An identification of the aspects of the plant's CLB that would be affected by the proposed RI-IST program. To provide a basis from which to evaluate the proposed changes, the licensee should also confirm that the plant's design and operation is in accordance with its CLB.

(2) An identification of the specific revisions to existing testing schedules and methods that would result from implementation of the proposed program.

(3) An identification of the components in the plant's CLB that are both directly and indirectly involved with the proposed testing changes. Any components that are not presently covered in the plant's IST program but are determined to be important to safety (e.g., through PRA insights) should also be identified. In addition, the particular systems that are affected by the proposed changes should be identified since this information is an aid in planning the supporting engineering analyses.

(4) An identification of the information that will be used in support of the changes. This will include performance data, traditional engineering analyses, and PRA information.

(5) A brief statement describing the way in which the proposed changes meet the objectives of the Commission's PRA Policy Statement.

3.2 Formal Interactions With the NRC This section gives guidance on the need for licensee reporting of program activities and for formal NRC review of changes made to RI-IST programs.

The licensee can make changes to its approved RI-IST program under the following conditions:

1. Changes made to the NRC-approved RI-IST program that could affect the process and results that were reviewed and approved by the NRC staff (including the change in plant risk associated with the implemention of the RI-IST program) should be evaluated to ensure that the basis for the staff's prior approval has not been compromised. If there is a question regarding this issue, the licensee should seek NRC review and approval prior to implementation.

2. All changes should also be evaluated using the change mechanisms described in applicable regulations (e.g., 10 CFR 50.55a, 10 CFR 50.59) to determine if NRC review and approval is required prior to implementation.

For example:

Changes to component groupings, test intervals, and test methods that do not involve a change to the overall RI-IST approach where the overall RI-IST approach was reviewed and approved by the NRC do not require specific (i.e., additional) review and 10

approval prior to implementation provided that the effect of the changes on plant risk increase is insignificant.

Component test method changes involving the implementation of an NRC endorsed ASME Code, NRC-endorsed Code Case, or published NRC guidance which were approved as part of the RI-IST program do not require prior NRC approval.

Test method changes that involve deviation from the NRC-endorsed Code requirements require NRC approval prior to implementation.

Changes to the RI-IST program that involve programmatic changes (e.g., changes to the plant probabilistic model assumptions, changes to the grouping criteria or figures of merit used to categorize components, and changes in the acceptance guidelines used for the licensee's integrated decisionmaking process) require NRC approval prior to implementation.

Component test method changes will typically involve the implementation of an applicable ASME Code or code case (as approved by the NRC) or published NRC guidance. Changes to the component test methods for these situations do not require prior NRC approval.

However, test method changes that involve deviation from the NRC approved code requirements do require NRC approval prior to implementation.

In its submittal, the licensee will include a proposed process for determining when formal NRC review and approval are or are not necessary. As discussed, once this process is approved by the NRC, formal NRC review and approval are only needed when the process determines that such a review is necessary, or when changes to the process are requested.

4. ELEMENT 2: ENGINEERING EVALUATION After the proposed change to the licensee's IST program has been defined, the licensee should conduct an engineering evaluation of the proposed change using a combination of traditional engineering methods and PRA. The purpose of this evaluation is to evaluate the proposed change in light of the CLB of the plant to ensure that plant risk is maintained at acceptable levels. The results of this evaluation are to be used in conjunction with the PRA based information such that the two different approaches complement one another. The major objective of this evaluation is to confirm that the proposed program change will not compromise defense in depth and other key safety principles described in Chapter 2. Draft Regulatory Guide DG-1061 gives general guidance for the performance of this evaluation supplemented by the RI-IST-specific guidance herein.

4.1 Traditional Engineering Evaluation This part of the evaluation is based on traditional engineering methods (not probabilistic).

Areas to be evaluated from this viewpoint include the potential effect of the proposed RI-IST program on design basis accidents, defense-in-depth attributes, and safety margins. As indicated above, defense-in-depth and safety margin should also be evaluated, as feasible, using risk techniques (PRA).

I1

4.1.1 Evaluating the Proposed Changes to the Current Licensing Basis A broad review of the CLB may be necessary. Proposed IST program changes could affect requirements or commitments that are not explicitly stated in the licensee's safety analysis report. Furthermore, staff approval of the design, operation, and maintenance of components at the facility have likely been granted in terms other than probability, consequences, or margin of safety. Therefore, it may be more appropriate to evaluate proposed IST program changes against other more explicit criteria (e.g., criteria used in either the licensing process or to determine the acceptability of component design, operation and maintenance).

The Director of the Office of Nuclear Regulation is allowed by 10 CFR 50.55a to authorize alternatives to the specific requirements of this regulation provided that the proposed alternative will ensure an acceptable level of quality and safety. Thus, alternatives to the examples of acceptable RI-IST approaches presented in this guide may be proposed by licensees so long as supporting information is provided that demonstrates that the key safety principles discussed in Chapter 2 of this guide are maintained.

Acceptance Guidelines The sources of information for the traditional engineering part of the evaluation should include the IST plan information, including component functions from the design-basis documents, references to relevant plant licensing commitments, and approved relief requests.

On a component-specific basis, the licensee should identify each instance where the proposed IST program change will affect the CLB of the plant and document the basis for the acceptability of the proposed change by explicitly addressing each of the key safety principles. If the CLB is not affected by the proposed IST program changes, the licensee should indicate this in its RI-IST program description.

4.1.2 Inservice Testing Program Scope IST requirements for certain safety-related pumps, valves, and snubbers are specified in 10 CFR 50.55a. These components are to be tested according to the requirements of Section Xl of the American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code (the Code) or the applicable Operations and Maintenance (O&M) Code. Both Section Xl and 10 CFR 50.55a state that the IST program includes certain components classified by the licensee as components which are required to perform a specific function in shutting down a reactor, maintaining the shutdown condition, or mitigating the consequences of an accident.

To ensure that the proposed RI-IST program will provide an acceptable level of quality and safety, the licensee should use the PRA to identify the appropriate scope of components to be included in the program. All of the components that are important to the scope of an RI IST program must be identified. This will normally include all components that are within the scope of the current lST program. In addition, licensees may identify SSCs with high risk significance which are not currently subject to traditional Code requirements or to a level of regulation which is commensurate with their risk significance. PRA systematically takes credit for non-Code SSCs as providing support, acting as alternatives, and acting as backups to those SSCs that are within the current code. To maintain the validity of the PRA as it is used to categorize components and to evaluate the effect of the proposed RI-IST program on plant risk, the assumptions regarding component reliability and availability must be preserved.

12

Accordingly, these additional risk-important SSCs should be included in licensees' RI-IST proposals. Specifically, the licensee's RI-IST program scope should include those ASME Code Class 1, 2 and 3 and non-Code components that the licensee's integrated decisionmaking process categorized as HSSCs and thus determined these components to be appropriate additional candidates for the RI-IST program.

To preserve the PRA assumptions which contribute to supporting the proposed RI-IST program, the PRA should also be used to evaluate RI-IST program test requirements (test interval and methods) as well as practicable. Consequently, for the IST components within the scope of the proposed RI-IST program, the licensee should examine the test strategies currently in place to evaluate the test strategy effectiveness, and where appropriate, modify the test strategy.

Acceptance Guidelines The RI-IST program scope is acceptable if it includes, in addition to components in the current Code prescribed program (i.e., Code class 1, 2, and 3 components), those ASME Code Class 1, 2, and 3 and non-Code components categorized as HSSC. Test strategies should be evaluated to ensure that they are consistent with PRA assumptions.

4.1.3 Inservice Testing Program Changes This section discusses what licensees need to consider if they propose to change only IST intervals (i.e., if they propose to continue to use the existing approved Code test methods),

or if they choose to change both IST intervals and test methods.

Acceptance Guidelines - General The licensee should reevaluate the IST interval (and methods as applicable) for HSSC components that were the subject of an approved relief request, or an NRC-authorized alternative test. The licensee should resubmit relief requests and requests that alternatives be authorized, along with risk-related insights, for NRC staff review and approval.

In establishing the test strategy for LSSC components, the licensee should consider component design, service condition, and performance, as well as risk insights. The proposed test interval must be supported by both generic and plant-specific failure rate data, and the test interval should be significantly less than the expected time to failure of the SSC in question. The rationale for the proposed change in test interval and its relationship to expected time to failure should be provided. The licensee should ensure that adequate component capability (i.e., margin) exists, above that required during design basis conditions, such that component operating characteristics over time do not result in reaching a point of insufficient margin before the next scheduled test activity. The IST interval should generally not be extended beyond once every 5 years or 3 refueling outages (whichever is longer) without specific compelling documented justification. Extensions beyond 5 years or 3 refueling outages (whichever is longer) will be considered as component performance data at extended intervals is acquired and as PRA technology improves.

IST components (with the exception of check valves) should, as a minimum, be exercised or operated at least once every refueling cycle. If practical, more frequent exercising should be considered for components in any of the following categories:

13

i) Components with high risk-significance; ii) Components in adverse or harsh environmental conditions; or iii) Components with any abnormal characteristics (operational, design, or maintenance conditions).

Licensees choosing to pursue RI-IST programs should consider the adoption of enhanced test strategies developed with ASME risk-based IST Code cases endorsed by the NRC 2 (or the revised ASME Code after the risk-based Code cases get incorporated into the Code and endorsed by the NRC). Deviations from endorsed Code cases (or revised ASME Code) should be reviewed and approved by the NRC staff via relief requests prior to implementation.

For components that the licensee proposes to place in the HSSC category and that are not in the licensee's current IST program, the following conditions should be met. These components should be tested in accordance with the ASME Code cases (or revised ASME Code), including compliance with all administrative requirements. Where ASME Section Xl or O&M Code testing is not practical, alternative test methods should be developed by the licensee to ensure operational readiness and to detect component degradation (i.e.,

degradation associated with failure modes identified as being important in the licensee's PRA). As a minimum, a summary of alternative test methods should be reviewed and approved by the NRC as part of this review and prior to implementation of the RI-IST program at the plant.

Acceptance Guidelines - Changes to Test Interval (Only)

If a licensee proposes to only change IST interval (i.e., if the licensee proposes to continue to use the existing approved Code test methods), the process used by the licensee to categorize components should satisfy the following conditions.

a) The engineering evaluation should give consideration to components that are potential candidates for decreased component test intervals as well as to candidates for increased intervals.

b) The effectiveness of the current IST program in determining the capability of the component to carry out its intended function should be assessed. Test intervals should only be extended for components that are tested using methods that have the capability to detect component degradation associated with the important failure modes and causes identified in the plant's PRA.

c) Extensions to test intervals will be "step-wise."

2 Generic Letter 96-05, "Periodic Verification of Design-Basis Capability of Safety-Related Motor-Operated Valves," issued September 18, 1996, indicates that risk insights may be used in developing MOV periodic verification programs. It also endorses (with limitations) ASME non-mandatory Code Case OMN-1, "Alternative Rules for Preservice and Inservice Testing of Certain Electric Motor Operated Valve Assemblies in LWR Power Plants," OM Code 1995 Edition; Subsection ISTC." This code case provides for the use of risk insights in establishing an MOV test program, but detailed guidance is not included. Licensee programs are subject to NRC review. Copies of Generic Letter 96-05 are available for inspection or copying for a fee from the NRC Public Document Room at 2120 L Street NW., Washington, DC; the PDR's mailing address is Mail Stop LL-6, Washington, DC 20555; telephone (202)634-3273;fax (202)634-3343.

14

Acceptance Guidelines - Changes to Test Interval and Method A process should be used to develop an appropriate test strategy for IST components. For the HSSC components this process should involve the following activities.

i) A component failure mode and cause analysis, ii) A structured qualitative assessment of the effectiveness of each potential test based on its ability to detect failure, to detect conditions that are precursors to failure, and predict end of service life, and iii) A strategy formulation and evaluation for each component, taking into account generic and plant-specific performance histories.

These tasks may be accomplished through the ASME's Code Cases (Refs. 10 and 14) if approved by the NRC. If a licensee proposes to change both IST intervals and IST methods, then the process used by the licensee to categorize components should identify components whose test strategy should be more focused as well as components whose test strategy might be relaxed. Extensions to test intervals should be made step-wise.

4.1.4 Relief Requests and Technical Specification Changes Licensees proposing changes in IST programs based on risk considerations need to address certain issues related to requesting relief from existing program requirements:

Acceptance Guidelines Relief is required for any HSSC or LSSC components for which the test methods are not in accordance with NRC approved ASME code requirements or NRC guidance.

Relief is required for any HSSC components for which the test frequencies are not in accordance with the approved ASME code requirements or NRC guidance.

The licensee must submit and have approval of a technical specification amendment prior to implementing the RI-IST program for any components for which there are proposed changes in technical specification requirements.

On a component-specific basis, the licensee should identify each instance where the proposed RI-IST program change is not consistent with the guidance given above. In each such case, the licensee should document the basis for the acceptability of the proposed difference.

4.2 Probabilistic Risk Assessment Overview of Approach for Probabilistic Evaluations Issues specific to the IST risk-informed process are discussed in this section. Draft Regulatory Guide DG-1061 contains much of the general guidance which is applicable for this topic.

15

The risk-informed application process is intended not only to support relaxation (test interval or method), but also to identify areas in which increased safety resources would be justified.

An acceptable RI-IST process should therefore not focus exclusively on areas in which reduced testing could be justified. The increased testing might take the form of a commitment to verify component operability other than through formal IST; for example, credit of this kind might be justified for components whose operability is indirectly and partially verified as a result of IST of other components. This chapter, therefore, addresses IST-specific considerations in the PRA in order to support both relaxation and enhancement of verification of component operability.

The following PRA outputs are generally needed for RI-IST applications.

1. core damage frequency (CDF) and CDF change

2. containment large early release frequency (LERF) and LERF change

3. minimal cut sets (MCS)

4. Fussell-Vesely Importance (FV) and risk achievement worth (RAW) for all SSCs before and after proposed changes, including those from all sensitivity studies In addition, the FV and RAW importances of all components are required to identify instances in which increased attention (IST or other programs such as technical specifications) might be warranted.

4.2.1 Probabilistic Risk Assessments for Inservice Testing Applications Quality and Scope of the PRA For the quantitative results of the PRA to play a major and direct role in decision-making, there is a need to ensure that they are derived from "quality" analyses. Guidance on quality issues for the baseline PRA and for the scope of the PRA is proposed in Draft Regulatory Guide DG-1061.

Level of Detail of the PRA The development of a RI-IST program will require that plant-specific PRA information be available to identify those IST components that contribute most significantly to the plant's estimated risk. Components covered should include the following.

Safety-related components that are relied on to remain functional during and after design-basis or beyond design basis events to ensure the integrity of the reactor coolant pressure boundary, the capability to shut down the reactor and maintain it in a safe shutdown condition, and the capability to prevent or mitigate the consequences of accidents that could result in potential offsite exposure comparable to 10 CFR Part 100 guidelines.

Non-safety-related components That are relied on to mitigate accidents or transients or are used in plant emergency operating procedures 16

Whose failure could prevent safety-related components from fulfilling their safety-related function Whose failure could cause a reactor scram or actuation of a safety-related system Acceptance Guidelines This issue is addressed acceptably if:

• The PRA quality and scope is acceptable as defined in Draft Regulatory Guide DG 1061.

• The components in the proposed RI-IST program are included in the PRA model, or reasons why they are not modeled are justified and documented in terms of the potential effect on the plant's risk.

• All components in the proposed RI-IST program for which credit is taken regarding the plant's accident response capability are shown to be within the scope of programmatic activities (IST, GQA, ISI, maintenance, monitoring).

• The licensee justifies that the proposed RI-IST program will not introduce vulnerabilities or remove from programmatic activities components needed to ensure satisfactory safety performance.

In addition, this guide describes licensee documentation and submittal needs for NRC review.

4.2.2 Calculating the Risk Increase from Changes in Test Interval In order for the PRA to support the decision appropriately, there should be a good functional mapping between the components associated with IST and the PRA basic event probability quantification. Part of the basis for the acceptability of any RI-IST program is a quantitative demonstration by use of a qualified PRA that established risk measures are not significantly increased by the proposed extension in testing intervals for selected components. In order to establish this demonstration, it is necessary that the PRA include models which appropriately account for the change in reliability of the components as a function of testing interval (or test frequency). When feasible, it is also desirable to model the effects of an enhanced testing method. For example, enhanced testing might be shown to improve or maintain component availability, even if the interval is extended. That is, a better test might compensate for a longer interval between tests. Licensees who apply for substantial increases in test interval are expected to address this area, i.e., to proactively seek improvements in testing that would compensate for the increased intervals under consideration.

The following steps should be performed.

(1) identification of all RI-IST systems, and components (2) identification of all affected cut-sets and RI-IST-related basic events 17

(3) review of the model used to quantify each affected basic event. Most fundamentally, the process should consider the effect of test strategy (interval and method) on unavailability.

A check should also be performed to determine if non-IST manipulation has been credited either in IST basic events or in compensating-component basic events. If a component is stroked or challenged between instances of IST, and if these activities are actually capable of forcing recognition of a component failure, then the effective fault exposure time is indeed less than the RI-IST interval. It can be appropriate to take credit for this effective shortening of fault exposure time in the PRA quantification, provided that there is assurance that the important failure modes are in fact identified by the stroking or the system challenges. This is not always trivial: if a functional success can be achieved by any one of n components in parallel, so that the function succeeds even if n-1 of the components fail, then merely monitoring successful functional response does not show whether all components are good, unless proactive verification of each component's state is undertaken. In addition to this, some instances of revealing a component fault through challenge have adverse consequences, including functional failure, and if credit is taken for shortening fault exposure time through functional challenges, then it is necessary to account for this downside in the quantification of accident frequency.

Modeling Increases In Test Interval The relationship between the component unavailability on demand, q, and the test interval is usually approximated by:

q = 1/2 AT where:

A is the failure rate, and T is the time interval between tests.

In addition to transitions to a failed state that occur between component demands or tests, there is also a "demand-related" contribution to unavailability, corresponding to the probability that a component will fail to operate when demanded, even though for some purposes it would have been considered "good" before being subjected to the stress of the demand itself. This would have the effect of adding a constant to the test-interval dependent contribution to q identified above. The assumption that the total q scales linearly with the test interval (i.e., doubles when test interval doubles) is "conservative" in the sense that it scales the test-interval-independent contribution along with the test-interval-dependent contribution, and in that respect tends to overstate the effect of test interval extension. This approximation is therefore considered acceptable; however, it should be noted that guidance aimed at improving the capability of tests to identify loss of performance margin is aimed partly at reducing the "demand" contribution as well, so that improved modelling in this area would appear to have the potential to support further improvements in allocation of safety resources.

As test intervals are extended, there is some concern that the failure rate, A, may increase.

This failure rate, generally assumed constant, is based on data from current IST test 18

intervals, and therefore does not include effects which may arise from extended test intervals. It is possible that insidious effects such as corrosion or erosion, intrusion of foreign material into working parts, adverse environmental exposure, breakdown of lubrication, etc. which have not been encountered with the current shorter test intervals could significantly degrade the component if test intervals become excessively long. One way to address this uncertainty is to use the PRA insights to help to design an appropriate implementation and monitoring program, for example, to approach the interval increase in a stepwise fashion rather than going to the theoretically-allowable maximum in a single step, or to stagger the testing of redundant components (test different trains on alternating schedules) so that the population of components is being sampled relatively frequently, even though individual members of the population are not. By using such approaches, the existence of the above effects can be detected and compensatory measures taken to correct the testing of the remaining population members. However, it is important that the monitoring includes enough tests to be relevant, and that the tests are capable of detecting the time related degradation (performance monitoring is discussed in Section 5.2).

Modeling Enhanced Testing Procedures In addition to the issues raised by leaving components untested for longer periods, there is also the issue of test effectiveness. Licensees are encouraged to employ enhanced testing techniques to improve detection of degraded and failed components. All licensees proposing to extend testing intervals should also address test effectiveness. This includes both conscious effort to improve testing according to state of the art guidance, and, for licensees who wish to invoke credit for detecting degraded components, improvements in reliability modelling of basic event probability as a function of testing policy.

Acceptance Guidelines The PRA should include a model which provides an appropriate measure of the risk significance of extending the test interval on selected components. This requires that the model directly addresses the change in component availability as a function of test interval. The analysis should include:

An explicit quantitative consideration of the degradation of the component failure rate as a function of time, supported by appropriate data and analysis, OR Arguments which support the conclusion that no significant degradation will occur.

The model should consider the effects of enhanced testing to the extent practicable.

If the application seeks a substantial increase in interval, a proactive search for compensating improvements in testing should be made. If the testing is shown to be already as effective as can be expected, an absolute requirement for test improvement should not be imposed. However, an evaluation should be made to determine whether any common cause group is slated for a major extension of test interval, and if so, whether there is any way that enhanced testing could address common cause potential.

19

If credit for enhanced testing was taken, the model should treat it explicitly.

4.2.3 Categorization of Components General guidelines for risk categorization of components using importance measures and other information are provided in Draft Regulatory Guide DG-1061. These general guidelines address acceptable methods for carrying out categorization and some of the limitations of this process. Guidelines that are specific to the IST application are given in this section. As used here, risk categorization refers to the process for grouping IST components into LSSC and HSSC categories.

As indicated, risk-importance results from the PRA may be used as one of the inputs to the categorization process. Unfortunately, many components of interest to RI-IST are often not included in existing PRA models, and so there is no quantified risk importance information for these components. When feasible, adding these components to the PRA should be considered by the licensee. In cases where this is not feasible, information based on traditional engineering analyses and judgment must be used to determine if a component should be treated as an LSSC or HSSC.

The identification of components for a change in IST intervals or test methods can be done using different methods. Component categorization by use of PRA importance measures to classify components into HSSC and LSSC categories is one method. Categorization or component grouping may also be accomplished using more traditional engineering approaches with data developed from operating experience.

In addition to component categorization efforts, the determination of safety significance of components by the use of PRA-determined importance measures is important for several other reasons:

When performed with a series of sensitivity evaluations, it can identify potential risk outliers by identifying IST components which could dominate risk for various plant configurations and operational modes, PRA model assumptions, and data and model uncertainties.

Importance measure evaluations can provide a useful means to identify improvements to current IST practices during the risk-informed application process.

System level importance results can provide a high level verification of component level results and can provide guidance for the ranking of IST components that are not modeled in the PRA.

While categorization is an essential step in defining how the RI-IST will be implemented, it is not an essential part of ensuring the maintainance of an acceptable level of plant risk. As described in Section 4.2.5, the sensitivity of risk importance measures to changes in IST strategy (i.e., proposed for RI-IST) can be used as one input to overall understanding of the effect of this strategy on plant risk. However, the traditional engineering evaluation described in Section 4.1 and the calculation of change in overall plant risk described in Section 4.2.5 provide the major input to the determination of whether the risk change is acceptable or not.

20

Acceptance Guidelines When using risk importance measures to identify high and low safety significant components, potential limitations of these measures have to be addressed. Variations (including uncertainties) in PRA modeling techniques, assumptions, and data could have a significant impact on the results of the component categorizations using importance measures.

Sensitivity studies and/or other evaluations have to be carried out to ensure that changes in risk importance categorizations due to these effects do not result in RI-IST programs that have unacceptable levels of plant risk. Issues that have to be considered and addressed when determining low safety significance of components include: truncation limits; different risk metrics; multiple component importances; consideration of all allowable plant configurations; sensitivity analysis for common cause failures; and sensitivity analysis for recovery actions. These issues are discussed in more detail in Draft Regulatory Guide DG 1061.

In addition to results from PRA importance measures (and the associated sensitivity studies),

IST components should also be categorized based on traditional engineering considerations and on plant-specific operational characteristics.

4.2.4 Other Technical Issues 4.2.4.1 Initiating Events For purposes of determining RI-IST requirements, all initiating events (internal and external) and all operating modes should be evaluated to see whether initiating events and predicted plant response are affected by RI-IST proposed changes. At a minimum, all internal event initiators that have been evaluated in the PRA and all external event initiators that have been shown to contribute to the upper 95 percent of the total CDF have to be included in the IST risk determination process. In addition, other initiators including those that have been screened out (eliminated) from the base PRA have to be considered by answering the following questions.

(1) Does the IST issue involve a change that could lead to an increase in the frequency of a particular initiator already included in the PRA?

(2) Does the IST issue involve a change that could lead to an increase in the frequency of a particular initiator initially screened out of the PRA?

(3) Does the IST issue affect the quantification of previously identified accident scenarios for specific initiators that were screened out and eliminated from the PRA because of truncation?

(4) Does the IST issue affect only specific initiators?

(5) Does the IST issue have the potential to introduce a new initiating event?

Acceptance Guidelines (1) The impact of the proposed plant change on the potential for event initiators (internal and external) already included in the PRA should be determined. For example, less frequent testing could lead to an increase in the frequency of transients for the loss-21

of-feedwater or loss of support systems. The initiators included in an evaluation should include any initiators for which the plant change directly affects the frequency of the initiating event.

(2) The impact of the plant change on the frequency of an initiating event originally identified in the PRA but screened due to low frequency should be determined. For example, if less frequent pump and valve testing could lead to an increase in the frequency of loss-of-coolant-accident (LOCA) initiators that were initially screened from an analysis of a shutdown plant operational state (POS), then the impact of such an increase in LOCA frequency should be reexamined.

(3) The impact of the plant change on the failure rates of SSCs already included in a risk analysis should be considered. SSCs that show a change in their failure probability as a result of the plant change should be addressed in the analysis. Therefore, initiators which depend on the affected SSCs to achieve safe shutdown and that were initially eliminated from the PRA should be reexamined.

(4) If the regulatory issue affects only specific initiators, only those specific initiators should be reexamined. For example, if the issue results in changes only to the fire barrier failure probabilities, only those initiators important to fire risk will have to be reexamined.

(5) The effect of an IST program change should be examined to determine whether it could introduce a new initiating event. If so, its effect should be included in the PRA.

4.2.4.2 Dependencies and Common Cause Failures The effects of dependencies and common cause failures (CCFs) for IST components need to be considered carefully because of the significance they can have on core damage frequency.

Generally, data are insufficient to produce plant-specific estimates based solely on the data.

For CCFs, data from generic sources may be required.

Acceptance Guidelines For those components for which CCF contributions are not included in the PRA models and this exclusion is justified on the basis of historical and engineering evidence driven by current IST requirements, there would be no assurance that the CCF contribution would not become significant under the new proposed IST requirements. Therefore, this issue has to be addressed either using sensitivity studies or as part of a qualitative assessment.

For RI-IST applications, the potential for cross system CCFs should be investigated.

Guidance for performing such evaluations is given in Draft Regulatory Guide DG-1061.

4.2.4.3 Uncertainty and Sensitivity Analyses Uncertainty and sensitivity analyses are expected to play an important (and complex) part in the support of risk-informed IST program changes. The current guidance on these topics is given in Draft Regulatory Guide DG-1061. It is expected that certain application-specific guidance will be developed from the ongoing NRC reviews of the proposed RI-IST pilot plant programs.

22

4.2.4.4 Human Reliability Analyses Guidance on this topic is given in Draft Regulatory Guide DG-1 061. Some IST-specific guidance follows.

Acceptance Guidelines The technique(s) used to identify and quantify human actions should be such that they take into account the performance-shaping (or performance-influencing) factors that are applicable for IST-related events.

The effects of innovative recovery actions that are modeled in the PRA should be considered to determine how component ranking can be affected. The concern here stems from situations in which very high success probabilities are assigned to recovery events for certain sequences, thereby resulting in related components being risk insignificant. Furthermore, the ranking of SSCs should not be affected by recovery actions that are only modeled for limited scenarios. Sensitivity analyses should be used to assess the impact of variations in the probability of failure to recover.

4.2.4.5 Use of Plant-Specific Data In selecting appropriate failure rate data to use in the RI-IST program for the IST components, the analyst is frequently faced with the question of whether to use plant-specific or generic data, or some combination of the two. For newer plants with little operating history, the only choice is use of generic data. For those cases where significant plant-specific data are available, usually it is most appropriate to combine plant specific and generic data with a method that gives appropriate weight to each.

As extended test intervals are phased in, revisiting failure data becomes more important. It also becomes more important for each licensee to review operating experience (in particular, degradation mechanisms) experienced at other plants for applicability to the licensee's plant.

Performance monitoring at individual plants cannot be expected to provide sufficient experience to justify failure rates significantly less than generic failure rates without reference to the operating experience of other plants.

Finally, in considering plant-specific failure data, it is important to be able to recognize poorly performing individual components, rather than allowing poor performance of a single component to be averaged over all components of that type. Poor performance may arise because of inherent characteristics of one member of what would otherwise be considered a uniform population. This would result in a higher than expected failure rate for the population and lead to less relaxation than might be anticipated. Of more concern is poor performance of components that arises because they are operating in a more demanding environment for example. If, for reasons of expediency, these components are grouped together with others for which the operating conditions are more favorable, then their failure rates could become artificially lowered, and, if requirements are relaxed based on the group failure rate, this could lead to a significant probability of experiencing an in-service failure of one of these poor performers.

23

Acceptance Guidelines For those cases where statistically significant plant-specific data are available, it is acceptable to use such data if they are appropriately combined with generic data.

For those licensees who propose to use plant-specific data only, the data should be justified.

When the PRA is updated periodically, components that have experienced failures should be checked for evidence that they are especially poor performers. An extreme example of such evidence would be multiple failures experienced by a single component in a class whose other members have experienced no failures over the same interval. Components that have experienced failures should be reviewed to see whether the testing scheme (interval and methods) would be considered adequate to support the performance credited to them in the risk analysis, based on a component-specific failure rate consistent with the number of failures experienced.

Section 5.3 of this guide discusses feedback and corrective action.

4.2.5 Evaluating the Effects of the Proposed Changes on Plant Risk An assessment of the overall or cumulative effect of all proposed changes in plant design and operation on plant risk is critical to determining the acceptability of the changes. This guide addresses acceptable methods for assessing risk changes associated with IST program changes, however, if changes in graded quality assurance or technical specifications are also being considered, the integrated effects of all of these proposed activities should be evaluated.

Licensees should not assume a low failure rate in one application, e.g., IST, then reduce quality assurance of components included in the IST program (possibly negating the assumed low failure rate) without providing justification. It is possible that more frequent testing (RI IST) could compensate for a reduction in quality assurance or maintenance provided, again, that supporting analysis and documentation is included in a licensee's submittal.

Acceptance Guidelines See Section 2.4.2 of Draft Regulatory Guide DG-1061 for more extensive guidance on this subject.

4.3 Demonstration of Conformance with Key Safety Principles Section 2.1 of this guide indicates specific sections of the guide that address each of the key safety principles including acceptance guidelines. Two of the more difficult areas are those involving consideration of defense in depth and safety margin. These are addressed in this section to identify the major areas to be considered consistent with Draft Regulatory Guide DG-1061. More application-specific guidance will be added after the staff gains more experience from the review of the IST pilot plant programs.

24

Defense-in-Depth Evaluation As stated in Draft Regulatory Guide DG-1061, General Design Criteria, national standards, and engineering principles such as the single failure criterion are to be considered.

Assurance that this criterion is met is when:

• The PRA shows that there is preserved a reasonable balance between core damage prevention, prevention of containment failure, and consequence mitigation,

• There is not an over-reliance on programmatic activities to compensate for plant design weaknesses,

• System redundancy, independence, and diversity are maintained commensurate with the expected frequency and consequences of challenges to the system,

• Defenses against potential common cause failures are maintained, and the introduction of new common cause failure mechanisms is avoided,

• Independence of barriers is not degraded, and

• Defenses against human errors are maintained.

Safety Margin Evaluation Assurance that this criterion is met is mainly demonstrated by showing that the codes and standards or alternatives approved for use by the NRC that are associated with IST and discussed in Section 4.1 are met. The second means for demonstrating sufficient safety margin is a review of the safety analysis acceptance criteria in the CLB (e.g., updated safety analysis report (USAR), supporting analyses) showing that these criteria are still met for the proposed RI-IST program, or that sufficient margin exists to account for analysis and data uncertainty.

4.4 Integrated Decision Making This section discusses the integration of all of the technical considerations involved in reviewing submittals from licensees proposing to implement RI-IST programs. General guidance for risk-informed applications is given Draft Regulatory Guide DG-1061 (Ref. 3) and in the new SRP sections, Chapter 19 (Ref. 6) for general guidance, and Section 3.9.7 (Ref. 7) for IST programs. These documents discuss a set of regulatory findings that form the basis for the staff's writing an acceptable. safety evaluation report (SER) for a licensee's risk informed application. Specifically, Section 2.1 of Draft Regulatory Guide DG-1061 identifies a set of "expectations" that licensees should follow in addressing the key safety principles.

Due to the importance of these findings, certain of them will be repeated here.

Necessary Findings

• The comprehensive plant model, including the PRA and the associated deterministic analysis, is technically sound and supports the rest of the findings regarding the proposed RI-IST program. The analysis is based on the as-built and as-operated and maintained plant.

25

All safety impacts of the proposed changes to the licensee's IST program have been evaluated in an integrated manner as part of an overall risk management approach in which the licensee is using risk analysis to improve operational and engineering decisions broadly and not just to eliminate requirements he sees as undesirable. The approach used to identify changes in requirements for IST were used to identify areas where requirements in IST should be increased as well as reduced.

The acceptability of the proposed changes to the licensee's IST program have been evaluated by the licensee in an integrated fashion that ensures that all of the key safety principles are met.

The cumulative risk evaluation accounting for all of the proposed IST program changes confirms that changes to the plant core damage frequency (CDF) and large early release frequency (LERF) are small in conformance with the guidelines given in Section 2.4.2.1 of Draft Regulatory Guide DG-1061.

Appropriate consideration was given to uncertainty in the analyses and interpretation of the results.

Certain qualitative and defense-in-depth evaluations have been performed, and insights from these have been duly incorporated into the classification scheme, the performance goals, and the associated programmatic activities. These evaluations confirm that sufficient safety margins and defense in depth are maintained.

The licensee's proposal was subjected to quality controls including an independent peer review.

Pumps, valves, snubbers and operator actions have been identified and appropriately classified for use in prioritizing and implementing the program. In particular, important components not modeled in the PRA have been identified and appropriately classified utilizing available deterministic supporting information.

After the RI-IST program is approved and initiated, plant performance is supported by testing and analysis and maintained by programmatic activities goals by comparison against specific performance criteria.

The data, analysis methods and assessment criteria used in the development of the RI-IST are scrutable and available for public review.

These findings are seen to comprise both probabilistic and traditional engineering considerations, which are addressed in more detail in this chapter and in Draft Regulatory Guide DG-1061.

Licensees are expected to review commitments related to outage planning and control to verify that they are appropriately reflected in the licensee's component grouping. Licensees should verify that IST components that play an integral role in the licensee's plans and procedures for maintaining the key shutdown safety functions are in the high safety significant component group. This should include components required to maintain adequate defense in depth as well as components that might be operated as a result of contingency plans developed to support the outage.

26

Licensees are also expected to review licensing basis documentation to ensure that the traditional engineering related factors mentioned above are adequately modeled or otherwise addressed in the PRA analysis.

When making final programmatic decisions, choices must be made based on all of the available information. There may be cases where information is incomplete or where conflicts appear to exist between the traditional engineering data and the PRA-generated information. It is the responsibility of the licensee in such cases to ensure that well-reasoned judgement is used to resolve the issues in the best manner possible including due consideration to the safety of the plant. This process of integrated decision making has been discussed in various industry documents (Refs. 9 through 11) with reference to the use of an "expert panel." The appendix to this draft regulatory guide includes some detailed guidance on certain aspects of integrated decision making specific to RI-IST programs. As discussed in the appendix, it is not intended to specify that an administrative body such as an expert panel must be always formed by the licensee to fulfill this function. Following below are some general acceptance guidelines for this important activity with more specific details given in the appendix.

In summary, acceptability of the proposed change should be determined using an integrated decision-making process that addresses three major areas: (1) an evaluation of the proposed change in light of the plant's current licensing basis, (2) an evaluation of the proposed change relative to the key principles and the acceptance criteria, and (3) the proposed plans for implementation, performance monitoring, and corrective action. As stated in the Commission's Policy Statement on the increased use of PRA in regulatory matters, the PRA information used to support the RI-IST program should be as realistic as possible, with reduced unnecessary conservatisms yet including a consideration of uncertainties. These factors are very important when considering the cumulative plant risk and accounting for possible risk increases as well as risk benefits. The licensee should carefully document all of these kinds of considerations in the RI-IST program description including those areas that have been quantified through the use of PRA as well as qualitative arguments for those areas that cannot be readily quantified.

Acceptance Guidelines The licensee's proposed RI-IST program should be supported by both a traditional engineering analysis and a PRA analysis.

The licensee's RI-IST program submittal should be consistent with the acceptance guidelines contained throughout this draft regulatory guide, specically with the findings listed in this section, or justify why an alternative approach is acceptable.

If the licensee's proposed RI-IST program is acceptable based on both the deterministic and probabilistic analyses, it may be concluded that the proposed RI-IST program provides "an acceptable level of quality and safety" [see 10 CFR 50.55a(a)(3)(i)].

27

5. ELEMENT 3: IMPLEMENTATION, PERFORMANCE MONITORING, AND CORRECTIVE ACTION STRATEGIES J Upon approval of an RI-IST program, the licensee should have in place an implementation schedule for testing all HSSCs and LSSCs identified in their program. This schedule should include test strategies and testing frequencies for HSSCs and LSSCs that are within the scope of the licensee's IST program and components identified as HSSCs that are not currently in the IST program.

5.1 Program Implementation The current ASME Code requires that all safety-related components within the program scope as defined in the applicable ASME Code be tested on a quarterly frequency regardless of safety significance. The authorization of a risk-informed inservice testing program will allow the extension of certain component testing intervals and modification of certain component testing methods based on the determination of individual component importance.

The implementation of an authorized program will involve scheduling test intervals based on the results of probabilistic analysis and deterministic evaluation of each individual component.

The RI-IST program should distinguish between LSSCs and HSSCs for testing intervals.

Components that are being tested using specific ASME Codes, NRC-endorsed Code cases for RI-IST programs, or other applicable guidance should be individually identified in the RI-IST program. The test intervals of the HSSCs should be included in the RI-IST program for verification of compliance with the ASME Code requirements and applicable NRC-endorsed ASME code cases. Any component test interval or method which is not in conformance with (

the above should have an approved relief request for that component. Plant corrective action and feedback programs should be appropriately referenced in the IST program and implementing and test procedures to ensure that testing failures are fed back to the plant expert panel and IST coordinator for reevaluation and possible adjustment to the component's grouping and test strategy.

It is acceptable to implement RI-IST programs on a phased approach. Implementation of interval extension for LSSCs may begin at the discretion of the licensee. Implementation may take place on a component, train, or system level because extension of the test interval for these components (i.e., either individually or as a group) will have already been demonstrated through PRA and associated sensitivity analysis to have a minimal impact on the figures of merit. However, it is not acceptable to immediately adjust the test intervals of LSSCs to the maximum testing interval allowed by the PRA analysis unless component performance has demonstrated significant reliability or that aging is not an issue. Normally, test interval increases will be done step-wise with gradual extensions being permitted consistent with cumulative performance data for operation at the extended intervals. The licensee will be required to submit the actual testing intervals with their RI-IST program submittal.

For HSSCs, if the licensee initially chooses not to implement any of the ASME Code cases directed at providing alternative test strategies for RI-IST programs (when endorsed by the NRC staff), then testing will be conducted at the required Code interaval. Otherwise, the implementation phase of the RI-IST program will be predominantly guided by ASME Code 28

cases. Implementation may take place on a component, train, or system level as allowed in the Code case.

For components that the licensee proposes to place in the HSSC group that are not in the current IST program, the following conditions should be applied:

These components should be inservice tested commensurate with their safety significance.

Where ASME Section XI or O&M testing is practical, these components should be tested in accordance with the ASME Code, including compliance with all administrative requirements.

Where ASME Section XI or O&M testing is not practical, alternative test methods should be developed by the licensee to ensure operational readiness and to detect component degradation (i.e., degradation associated with failure modes identified as being important in the licensee's PRA). As a minimum, a summary of alternative test methods should be reviewed and approved by the NRC as part of this review and prior to implementation of the risk-informed IST program at the plant. This is consistent with previous NRC practice.

A majority of components contained within plant IST programs are exercised or operated for reasons other than inservice testing such as during normal plant operations and as a result of other component inservice testing. The remaining components are exercised only during IST.

An exercise of a component as part of a system test or normal operations does not constitute an inservice test because it provides little or no information on component degradation. However, depending on the system test or plant activity and the extent that the component is exercised, assurance can be gained that the component operated at the time of the test. While this provides little or no information on component degradation, it does provide some assurance that any degradation that may have occurred was not significant enough to degrade the system function.

An acceptable method to extend the test interval for LSSCs that are exercised as a result of plant operations and other testing is to group like components and stagger their testing equally over the interval identified for a specific component based on the probabilistic analysis and deterministic evaluation of each individual component. Component grouping should also consider valve actuator type for power operated valves and pump driver type, as applicable. With this method, generic age-related failures can potentially be identified while allowing immediate implementation for some components. LSSCs which are exercised only during RI-IST should have their intervals extended by gradually stepping out the current and successive test intervals until the proposed extended test interval established by the licensee in their engineering evaluation is attained. Then, these low LSSCs should be tested on a staggered basis. The selected test frequency for LSSCs that are to be tested on a staggered basis should be justified in the RI-IST program.

Acceptance Guidelines For either HSSCs or LSSCs that will be tested in accordance with the current Code test interval and method requirements, no specific implementation schedule is necessary. The test interval should be included in the licensee's RI-IST program.

For either HSSCs or LSSCs that will employ NRC-endorsed ASME Code cases, implementation of the revised test strategies should be documented in the licensee's RI-IST program.

29

For any alternative test strategies proposed by the licensee, the licensee should submit a relief request to the NRC as discussed in Section 4.1.4 of this guide.

The licensee may group and test LSSCs, which are exercised as a result of plant operation or testing of other components, on a staggered and extended interval basis provided that they have acceptable performance histories. Grouping is acceptable provided it complies with guidance.

Component monitoring that is performed as part of the Maintenance Rule implementation can be used to satisfy monitoring as described in the RI-IST program guidance. In these cases, the performance criteria chosen have to be compatible with the RI-IST guidance provided in this guide.

For LSSCs that will be tested at an interval greater than the Code test interval, which are not exercised as a result of plant operation or testing of other components, the licensee should increase the test interval successively in a step-wise manner until the components are tested at the maximum proposed test interval provided these components have acceptable performance histories. If no age-dependent failures occur, then the test interval can be gradually extended until the component, or group of components if tested on a staggered basis, is tested at the maximum proposed extended test interval.

5.2 Performance Monitoring The purpose of performance monitoring is to help confirm that the failure rates assumed for this equipment remain valid, and that no insidious failure mechanisms which are related to extended test intervals become important enough to alter the failure rate assumed in the PRA models. The important criteria must be measurable and the test frequency must be sufficient to provide meaningful data. In addition, the testing procedures and analysis must provide assurance that performance degradation is detected with sufficient margin that there is no adverse effect on public health and safety (i.e., the failure rates cannot be allowed to rise to unacceptable levels before detection and corrective action take place).

A performance monitoring program should be included as part of the licensee's RI-IST program if extending the test intervals for LSSCs is proposed. This program must provide assurance that components placed on the extended test interval will continue to perform as assumed in the PRA, and that any performance degradation is detected and corrected before the extended test program is fully implemented. The program should also include monitoring similar component performance at other plants to establish a sufficient data base of temporal related degradation. Testing procedures should detect degradation in component performance and ideally would replicate, as much as practical, actual demand conditions.

In summary, the performance monitoring program should have the following attributes:

Enough tests are included to provide meaningful data; The test is devised such that incipient degradation can reasonably be expected to be detected, and The licensee trends appropriate parameters as required by the ASME Code or ASME Code Case and as necessary to provide validation of the PRA.

30

Acceptance Guidelines The acceptance guidelines for this item consist of evaluating the licensee's proposed performance monitoring process to assure that it responds to the attributes listed in the preceding discussion. Assurance must be established that degradation is not significant for components that are placed on an extended test interval, and that failure rate assumptions for these components are not compromised by test data. It must be clearly established that sufficient testing is provided as part of the program to provide significant data, and that the test procedures and evaluation methods are implemented which provide reasonable assurance that degradation will be detected. Trending as appropriate should be performed by comparing parameters measured during RI-IST programs with the same paramenters measured during the original IST programs.

5.3 Feedback and Corrective Action If component failures or degradation occur at a higher rate than assumed in the basis for the RI- IST program, the following basic steps should be followed to implement corrective action:

The cause(s) of the failures or degradation should be determined and corrective action implemented.

The assumptions and failure rates used to categorize components according to risk should be reevaluated to determine if component importance rankings have changed.

The equipment test effectiveness templates should be reevaluated, and the RI-IST program should be modified accordingly.

Acceptance Guidelines

a. The licensee's corrective action program should evaluate RI-IST components that either fail to meet the test acceptance criteria or are otherwise determined to be in a nonconforming condition (e.g., a failure or degraded condition discovered during normal plant operation).

b. The evaluation should:

(1) Comply with Criterion XVI, "Corrective Action," of Appendix B to 10 CFR Part 50 (2) Determine the impact of the failure or nonconforming condition on system/train operability since the previous test, (3) Determine and correct the root cause of the failure or nonconforming condition (e.g., improve testing practices, repair or replace the component),

(4) Assess the applicability of the failure or nonconforming condition to other components in the RI-IST program (including any test sample expansion that may be required for grouped components such as relief valves),

(5) Correct other susceptible RI-IST components as necessary, (6) Assess the validity of the PRA failure rate and unavailability assumptions in light of the failure(s), and (7) Consider the effectiveness of the component's test strategy in detecting the failure or nonconforming condition. Adjust the test interval and/or test 31

methods, as appropriate, where the component (or group of components) experiences repeated failures or nonconforming conditions.

c. The corrective action evaluations should be provided to the licensee's PRA group so that any necessary model changes and re-grouping are done as might be appropriate.

The effect of the failures on plant risk should be evaluated as well as a confirmation that the corrective actions taken will restore the plant risk to an acceptable level.

d. The RI-IST program documents should be revised to document any RI-IST program changes resulting from corrective actions taken.

5.4 Periodic Assessments RI-IST programs should contain explicit provisions whereby component performance data periodically gets fed back into both the component categorization and component test strategy determination (i.e., test interval and methods) process.

Adequate program implementation requires that the RI-IST program results be predicted, monitored, and fed back into several key steps of the program development process.

Periodic assessments should be performed to reflect changes in plant configuration, component performance, test results, industry experience, and to reevaluate the effectiveness of the RI-IST program. These assessments should also take into consideration corrective actions that have been taken on past IST program components. Licensees should include in their RI-IST program proposals plans for these assessments, and they may wish to coordinate these reviews with other related activities such as periodic PRA updates, industry operating experience programs, the Maintenance Rule program, and other risk-informed program initiatives.

The assessment should:

Determine if component performance and conditions are acceptable (i.e., as compared to predicted or assumed levels). If performance and conditions are not acceptable then the cause(s) should be determined and corrective action implemented, Review and revise as necessary the assumptions, reliability data, and failure rates used to categorize components to determine if component groupings have changed.

Plant-specific data should be incorporated into the generic data using appropriate updating techniques, and Reevaluate equipment performance as well as test effectiveness to determine if the RI-IST program should be adjusted (based on both plant-specific and generic information).

The licensee should have procedures in place to identify the need for more emergent RI-IST program updates (e.g., following a major plant modification, or significant equipment performance problem).

32

Acceptance Guidelines The test strategy for RI-IST components should be periodically assessed (at least once every two refueling outages) to take into consideration results of RI-IST and new industry findings.

The licensee's RI-IST program proposal should also include a plan for periodically assessing the plant PRA model to determine the need to incorporate new industry findings and new information resulting from the RI-IST program. (Plant-specific data by itself cannot be the sole basis to determine component operability because the statistics will not be sufficient.

Therefore, the RI-IST PRA model must also reflect industry experience.)

6. ELEMENT 4: DOCUMENTATION The recommended format and content of an RI-IST submittal are presented in this chapter.

Use of this format by licensees will help ensure the completeness of the information provided, will assist the NRC staff in locating the information, and will aid in shortening the time needed for the review process. Additional guidance on style, composition, and specifications of safety analysis reports is provided in the Introduction to Revision 3 to Regulatory Guide 1.70, "Standard Format and Content of Safety Analysis Reports for Nuclear Power Plants (LWR Edition)."

6.1 Risk-Informed Inservice Testing Program Plan The licensee's submittal should describe the proposed RI-IST program with enough detail to be clearly understandable to the reviewers of the program. The description should cover the five items listed in Chapter 3 including sufficient detail such that reviewers of the program can understand how the program would be implemented in a phased approach. These items are: (1) changes to the plant's CLB, (2) changes to testing intervals and methods including a description of the process used for determining these, (3) listing of affected components including an explicit description of the grouping of different components in a staggered testing program, (4) identification of supporting information, and (5) brief statement regarding the way in which the proposed changes are consistent with the Commission's PRA Policy Statement. Also included should be a description of the process that was used for the categorization of components (further discussed in Section 6.2.3) and for the determination of when formal interaction with the NRC is or is not needed when making changes to an approved RI-IST program (Section 3.2). Exemptions from the regulations, technical specification amendments, and relief requests that are required to implement the licensee's proposed RI-IST program should also be given.

6.2 Probabilistic Risk Assessment Records and Supporting Data 6.2.1 Determination and Quantification of Accident Sequences This section should present the methods and techniques used to identify and quantify any accident sequences that are specific to IST. Draft Regulatory Guide DG-1061 includes more extensive guidance for this topic.

33

6.2.2 Initiating Events The process used to identify initiating events and the results from the evaluation should be documented. The description of the process should include how it will result in the identification of the complete set of initiating events important to the supporting analysis, including those initiating events that may result from the failure of IST-affected components.

For each initiating event identified by the process, present: (1) a description of the initiating event, (2) the rational for including or excluding the event, (3) the event's frequency, and (4) a discussion of how frequency was estimated. If any individual initiating events are collapsed into a group, describe the basis for such a grouping. All information should be provided in the main report.

6.2.3 Categorization of Inservice Testing Components In this section, the techniques used to categorize the RI-IST components should be discussed. When available, results from the categorization of the components from different viewpoints should be provided (e.g., traditional engineering analysis, probabilistic, and integrated). The technique used should be described including an identification of specific importance measures when used. The final results from the categorization should be presented in either one of two categories, high or low (i.e., HSSC or LSSC). The rationale used in the integrated decisionmaking process to place components in either category should be described for each component.

6.2.4 Assessment of Proposed Changes This section should describe the estimated effect of the proposed RI-IST program changes on plant risk consistent with the general guidance given in Draft Regulatory Guide DG-1061 and with the IST-specific guidance given in Section 4.2 of this regulatory guide.

6.2.5 Uncertainty/Sensitivity Analyses The data used in any uncertainty calculations (i.e., uncertainty distributions for basic events or input parameters) and any sensitivity calculations (e.g., giving additional or less credit for operator actions than that considered in the base case) should be provided consistent with the guidance provided in Draft Regulatory Guide DG-1061. How uncertainty was accounted for in the component categorization, and what sensitivity studies were performed to ensure the robustness of the categorization, should be described.

6.2.6 Plant Data Systems and Components Pertinent to IST Summarize design and operating features of components and systems considered as part of the supporting analyses. Component records included with the submittal should clearly demonstrate the application of the specific criteria established by the licensee's integrated decision-making process (e.g., expert panel) to make a final determination of component grouping. Additional information that should be included in the proposal include specific ASME code cases that the licensee is implementing and the effected components. For each system, include a table summarizing key design and operating data. Such values used in the analysis should be identified and justified. Refer to appendices or other documents (e.g.,

34

specific sections of the USAR) as necessary for more details. Systems to be considered should include the pertinent portions of all systems credited in the plant-specific probabilistic analysis.

Plant Operating Experience Summarize any events involving pump and valve failures that have occurred at this plant or similar plants. Include in this summary any lessons learned from these events and indicate actions taken to prevent or minimize recurrence of the events.

Operating Procedures Present and describe the important operator actions as defined by existing procedures associated with events involving pump and valve failures. The descriptions should include what the operator is supposed to do and when it must be done. The conditions under which the operator takes each action, the expected time for performing the action, and how the time was derived should be identified. A summary of training materials associated with pump and valve failure events should be supplied. Include in this summary a synopsis of any simulator exercises associated with such events.

6.3 Integrated Decision Making Process Records In addition to the general documentation requirements identified in Draft Regulatory Guide DG-1061, provide a description of each issue considered in the integrated decision-making process and a discussion of how the resolution of each issue impacts the original probabilistic ranking. Information should be provided in the main report. Additional information specific to RI-IST programs regarding this important process is provided in the Appendix to this report.

6.4 Performance Monitoring Program The licensee's program for monitoring the performance of both HSSC and LSSC components should be described. The licensee should have procedures developed to collect the following types of component performance data:

Number of starts (or cycles) that each RI-IST component was subjected to under operational conditions and under test conditions, Number of failures that each RI-IST component experienced under operational conditions and under test conditions, and Number of hours that each RI-IST component was unavailable for corrective maintenance, preventive maintenance, and for testing.

6.5 Feedback and Corrective Action Program As required by the current ASME Code, a record of each test should be maintained in which component failure occurred and corrective action was required. Procedures should be in place which are initiated by component failures that are detected by the RI-IST program as well as by other mechanisms (e.g., normal plant operation, inspections). Procedures should 35

also exist to determine their impact on the plant PRA. Component-specific performance data should be used to support periodic PRA and RI-IST program updates.

6.6 Implementation Plans and Schedule The licensee's implementation plans should be provided, including a proposed schedule for initiating the program pending NRC approval. The phased implementation plan should state the composition of the component groupings for the staggered test strategy which are of the same type, size, manufacturer, model, and service conditions. Their staggered frequency over the test interval should also be included. Components should be identified that are to have their test intervals extended. The final test interval (at the maximum extended interval) of these components should also be included in the submittal.

36

REFERENCES

1. USNRC, "Use of Probabilistic Risk Assessment Methods in Nuclear Regulatory Activities; Final Policy Statement," Federal Register, Vol. 60, p 42622, August 16, 1995.

2. USNRC, "Framework for Applying Probabilistic Risk Analysis in Reactor Regulation,"

SECY-95-280, November 27, 1995.'

3. USNRC, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Current Licensing Basis," Draft Regulatory Guide DG-1 061, June 1997.2

4. USNRC "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Graded Assurance," Draft Regulatory Guide DG-1 064, June 1997.2 Quality

5. USNRC, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," Draft Regulatory Guide DG-1065, June 1997.2

6. USNRC, "Standard Review Plan for Risk-Informed Decision Making," Standard Review Plan, NUREG-0800, Draft Chapter 19, June 1997.2

7. USNRC, "Standard Review Plan for Risk-Informed Decision Making: Inservice Testing," Standard Review Plan, NUREG-0800, Draft Section 3.9.7, June 1997.2

8. USNRC, "Standard Review Plan for Risk-Informed Decision Making: Technical Specifications," Standard Review Plan, NUREG-0800, Draft Chapter 16.1, June 1997.2

9. Electric Power Research Institute, "PSA Applications Guide," EPRI TR-105396, August 1995.

10. USNRC, "A Standard for Probabilistic Risk Assessment (PRA) to Support Risk Informed Decisionmaking," Draft NUREG-1 602, June 1997.2 1Copies are available for inspection or copying for a fee from the NRC Public Document Room at 2120 L Street NW.,

Washington, DC; the PDR's mailing address is Mail Stop LL-6, Washington, DC 20555; telephone (202)634-3273; fax (202)634-3343.

2Requests for single copies of draft or active regulatory guides or draft NUREG documents (which may be reproduced) or for placement on an automatic distribution list for single copies of future draft guides in specific divisions should be made in writing to the U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, Attention: Printing, Graphics and Distribution Branch, or by fax to (301)41 5-5272.

37

11. USNRC, "Guidelines for Reporting Reliability and Availability Information for Risk Significant Systems and Equipment in Nuclear Power Plants," Draft Regulatory Guide DG-1 046, April 1996.2 12 Idaho National Engineering Laboratory, "Common Cause Failure Data Collection and Analysis System," INEL-94/0064, Volumes 1-6, December 1995.

38

APPENDIX A DETAILED GUIDANCE FOR INTEGRATED DECISION MAKING A. 1 Introduction The increased use of probabilistic risk assessment (PRA) in nuclear plant activities such as in risk-informed inservice testing (IST) programs will require a balanced use of the probabilistic information with the more traditional engineering (sometimes referred to as "deterministic")

information. Some structured process for considering both types of information and making decisions will be needed that will allow improvements to be made in plant effectiveness while maintaining adequate safety levels in the plant. This will be particularly important during initial program implementation and also for the subsequent early phases of the program. In some instances, the physical data from the PRA and from the deterministic evaluations may be insufficient to make a clearcut decision. At times, these two forms of information may even seem to conflict. In such cases, it is the responsibility of the licensee to assemble the appropriate skilled utility staff (and in some cases consultants) to consider all of the available information in its various forms and to supplement this information with engineering judgment to determine the best course of action. The participants involved in this important role have generally been referred to in various industry documents as an "Expert Panel." In this appendix, this functional activity will be described as being an engineering evaluation without specifying how the evaluation is to be performed administrativley. It is not the intention of this guidance to indicate that a special administrative body needs to be formed within the utility to satisfy this role. It is the function that is important and that must be performed in some well-organized, repeatable, and scrutable manner by the licensee. This functional activity is all pervasive in the implementation phase of such activities as inservice inspection (ISI) and IST, and accordingly, the responsibility of the licensee to see that this function is done well is great.

A.2 Basic Categories of Information To Be Considered Risk-importance measures may be used together with other available information to determine the relative risk ranking (and thus categorization) of the components included in the evaluation. Results from all of these sources are then reviewed prior to making final decisions about where to focus IST resources.

Although the risk-ranking of components can primarily be used as the basis for prioritizing IST at a plant, additional considerations need to be addressed (e.g., defense in depth, common cause, and the single failure criterion) which may be more constraining than the risk-based criteria in some cases. Consideration must be given to these issues before the IST requirements for the various components are determined.

IST experience should contribute an understanding of the important technical bases underlying the existing testing program before it is changed. The critical safety aspects of these bases should not be violated inadvertently in changing over to a RI-IST, and important plant experience gained through the traditional IST should be considered during the change.

The plant-specific PRA information should include important perspectives with respect to the limitations of PRA modeling and analysis of systems, some of which may not be explicitly addressed within the PRA analysis. An understanding should also be provided as to how the proposed changes in pump and valve testing could affect PRA estimates of plant risk.

A-1

Plant safety experience should provide insights associated with the traditional analyses (Chapter 15 of the plant Final Safety Analysis Report) and any effect that proposed changes in testing might have on the traditional perspective of overall plant safety.

Plant operational input should supplement the insights of plant safety with additional information regarding the operational importance of components under normal, abnormal, and emergency conditions. There should also be input on operating history, system interfaces, and industry operating experience to supplement information from the IST.

Maintenance considerations should provide perspectives on work practices, implementation of the maintenance rule, and equipment operating history.

Systems design considerations should include the potential effect of different design configurations (e.g., piping, valves, and pumps) on planning for a risk-informed IST, particularly if future plant modifications are contemplated or if systems are temporarily taken out of service for maintainence or replacement or repair.

A.3 Specific Areas To Be Evaluated This section addresses some technical and administrative issues that are currently believed to be particularly important for IST risk-informed applications. Additional issues of a more general nature that may arise in expert panel deliberations are given in the general SRP and in Draft Regulatory Guide DG-1061.

Each safe-shutdown function, such as reactivity control, reactor coolant system integrity, coolant inventory control, primary system heat removal, etc. (or use the Appendix R safe-shutdown function paths), should retain one system that is considered more safety significant with pump and valve testing planned accordingly.

In other words, a minimum set of high safety significant equipment should be operable to maintain defense-in-depth.

It should be confirmed that pump and valve classifications have given proper attention to systems identified in emergency operating procedures (and other systems) depended upon for operator recovery actions, primary fission product barriers excluded from the PRA due to their inherent reliability (such as the RPV), passive items not modeled in the PRA (such as piping, cable, supports, building or compartment structures such as the spent fuel pool), and systems relied upon to mitigate the effects of external events in cases where the PRA considered only internal events.

Failure modes modeled by the PRA may not be all-inclusive. Consideration should be given to the failure modes modeled and the potential for the introduction of new failure modes related to the IST application. For example, if valve mispositioning has been assumed to be a low-probability event because of independent verification and therefore is not included in the PRA assumptions, any changes to such independent verifications should be evaluated for potential impact on the PRA results. Reverse flow in check valves should be evaluated.

A-2

Other qualitative/quantitative analyses that shed light on the relative safety importance of components, such as FMEA, shutdown risk, seismic risk, SBO/ATWS/fire protection should be included in the resource information base.

Attention should be given to the fact that component performance can be degraded from the effects of aging and this issue will need to be addressed and documented.

The engineering evaluation should include the choice of new test frequencies, the identification of compensatory measures for potentially important components, and the choice of test strategies for the HSSCs.

Until the ASME recommendations for improved test methods are available, the different existing IST test methods should be evaluated prior to choosing the test methods to be used for the HSSCs depending on their expected failure modes, service conditions, etc.

Due to the importance of maintaining defense in depth, particular attention should be given to identifying any containment systems involving IST components.

A-3

Regulatory Analysis

1. Statement of the problem During the past several years, both the Commission and the nuclear industry have recognized that probabilistic risk assessment (PRA) has evolved to the point that it can be used increasingly as a tool in regulatory decisionmaking. In August 1995 the Commission published a policy statement that articulated the view that increased use of PRA technology would 1) enhance regulatory decisionmaking, 2) allow for a more efficient use of agency resources, and 3) allow a reduction in unnecessary burdens on licensees. In order for this change in regulatory approach to occur, guidance must be developed describing acceptable means for increasing the use of PRA information in the regulation of nuclear power reactors.

2. Obiective To provide guidance to power reactor licensees and NRC staff reviewers on acceptable approaches for utilizing risk information (PRA) to support requests for changes in a plant's current licensing basis (CLB). It is intended that the regulatory changes addressed by this guidance should allow a focussing of both industry and NRC staff resources on the most important regulatory areas while providing for a reduction in burden on the resources of licensees. Specifically, guidance is to be provided in several areas that have been identified as having potential for this application. These applications include risk-informed inservice testing, technical specifications, and graded quality assurance.

3. Alternatives The increased use of PRA information as described in the draft regulatory guides being developed for this purpose is voluntary. Licensees can continue to operate their plants under the existing procedures defined in their CLB. It is expected that licensees will choose to make changes in their current licensing bases to use the new approaches described in the draft regulatory guides only if it is perceived to be to their benefit to do so.

4. Consequences Acceptance guidelines included in the draft regulatory guides state that only small increases in overall risk are to be allowed under the risk-informed program. Reducing the test frequency of valves identified to represent low risk as provided for under this program is an example of a potential contributor to a small increase in plant risk. However, an improved prioritization of industry and NRC staff resources, such that the most important areas associated with plant safety receive increased attention, should result in a corresponding contributor to a reduction in risk. Some of the possible impacts on plant risk cannot be readily quantified using present PRA techniques and must be evaluated qualitatively. The staff believes that the net effect of the risk changes associated with the risk-informed programs, as allowed using the guidelines in the draft regulatory guides, should result in a very small increase in risk, maintain a risk-neutral condition, or result in a net risk reduction in some cases.

5. Decision Rationale It is believed that the changes in regulatory approach provided for in the draft regulatory guides being developed will result in a significant improvement in the allocation of resources both for the NRC and for the industry. At the same time, it is believed that this program can be implemented while maintaining an adequate level of safety at the plants that choose to implement risk-informed programs.

6. Implementation It is intended that the set of risk-informed regulatory guides be published by the end of CY 1997.

N

)

UNITED STATES FIRST CLASS MAIL NUCLEAR REGULATORY COMMISSION POSTAGE AND FEES PAID WASHINGTON, DC 20555-0001 USNRC PERMIT NO. G-67 OFFICIAL BUSINESS PENALTY FOR PRIVATE USE, $300