ML031140549
Text
Withdrawn NRC Generic Letter 1991-18, Information to Licensees Regarding Two NRC Inspection Manual Sections on Resolution of Degraded and Nonconforming Conditions and on Operability, dated November 7, 1991, has been withdrawn.
ADAMS Accession Number: ML031140549 See Federal Register notice 81 FR 31969, dated May 20, 2016
t 0
UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D. C. 20555 November 7, 1991 TO: ALL NUCLEAR POWER REACTOR LICENSEES AND APPLICANTS SUBJECT INFORMATION TO LICENSEES REGARDING TWO NRC INSPECTION MANUAL SECTIONS ON RESOLUTION OF DEGRADED AND NONCONFORMING CONDITIONS AND ON OPERABILITY (GENERIC LETTER 91-18)
The NRC staff has issued two sections to be included in Part 9900, Technical Guidance, of the NRC Inspection Manual. The first is, "Resolution of Degraded and Nonconforming Conditions." The second is, "Operable/Operability: Ensuring the Functional Capability of a System or Component." Copies of the additions to the NRC Inspection Manual (enclosure) are provided for information only. No specific licensee actions are required.
The additions to the NRC Inspection Manual are based upon previously issued guidance. However, because of the complexity involved in operability determinations and the resolution of degraded and nonconforming conditions, there have been differences in application by NRC staff during past inspection activities. Thus, the purpose of publishing this guidance is to ensure consistency in application of this guidance by the NRC. Regional inspection personnel have been briefed on this guidance. The NRC will conduct further training on these topics to ensure uniform staff understanding.
The use of this guidance by inspectors may raise backfitting issues for specific licensees. The NRC backfitting procedures apply in such cases. Licensees should consult with the Regional office regarding the application of specific staff positions in the guidance.
Please contact the appropriate NRC Project Manager if you have any questions regarding this matter.
Jam s G. Partlow As sbciate Director for Projects ffice of Nuclear Reactor Regulation
Enclosure:
As stat 91110402934ev. CG PDR 1~ocA* OS'ooc3 a ~t
ENCLOSURE 1 UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON. D. C. 20566
- t NRC INSPECTION MANUAL flTSR ftnin ^nern. TrfLmlA 1 EIglTnflArF PAKI VVVV; ILvmlvlum Wwawr%#.--
RESOLUTION OF DEGRADED AND NONCONFORMING CONDITIONS Issue Date: 10/31/91 9900 Degraded Conditions
RESOLUTION OF DEGRADED AND NONCONFORMING CONDITIONS Table of Contents LaMe 1.0 PURPOSE AND SCOPE ............................... 1 2.0 DEFINITIONS ....................... ............................... 2 2.1 Current Licensing Basis ............................... 2 2.2 Design Basis ............................... 2 2.3 Degraded Condition ............................... 2 2.4 Nonconforming Condition ............................... 2 2.5 Full Qualification ............................... 2
3.0 BACKGROUND
................................. 3 4.0 DISCUSSION OF NOTABLE PROVISIONS ............................... 3 4.1 Public Health and Safety ................................. 3 4.2 Operability Determinations ............................... 3 4.3 The Current Licensing Basis and 10 CFR 50 Appendix B.................... 3 4.3.1 10 CFR 50, Appendix B........................... 3 4.3.2 Changing the Current Licensing Basis to Satisfy an Appendix B Corrective Action ...... 4 4.4 Discovery of an Existing But Previously Unanalyzed Condition or Accident ............................ 4 4.5 Justification for Continued Operation (JCO)................. 4 4.5.1 Background ...................................... 4 4.5.2 JCO Definition . . 5 4.5.3 Items for Consideration in a JCO . . 5 4.5.4 Discussion of Industry-Type JCOs . ...............
S 4.6 Reasonable Assurance of Safety.............................. 6 5.0 REFERENCE ........... ..... . . . . 6 9900 Degraded Conditions -i- Issue Date: 10/31/91
RESOLUTION OF DEGRADED AND NONCONFORMING CONDITIONS 1.0 PURPOSE'AND SCOPE:
To provide guidance to NRC inspectors on resolution of degraded and nonconforming conditions affecting the following systems, structures, or components (SSCs):
(i) Safety-related SSCs, which are those relied upon to remain functional during and following design basis events (A)to ensure the integrity of the reactor coolant pressure boundary, (B)to ensure the capability to shut down the reactor and maintain it in a safe shutdown condition, or (C) to ensure the capability to prevent or mitigate the consequences of accidents that could result in potential offsite consequences comparable to the 10 CFR Part 100 guidelines. Design basis events are defined the same as in 10 CFR 50.49(b)(1).
(ii) All SSCs whose failure could prevent satisfactory accomplishment of any of the required functions identified in (i)A, B, and C.
(iii) All SSCs relied on in the safety analyses or plant evaluations that are a part of the plant's current licensing basis. Such analyses and evaluations include those submitted to support license amendment requests, exemption requests, or relief requests, and those submitted to demonstrate compliance with the Commission's regulations such as fire protection (10 CFR 50.48), environmental qualification (10 CFR 50.49), pressurized thermal shock (10 CFR 50.61), anticipated transients without scram (10 CFR 50.62),. and station blackout (10 CFR 50.63).
(iv) Any SSCs subject to 10 CFR Part 50, Appendix B.
(v) Any SSCs subject to 10 CFR Part 50, Appendix A, Criterion 1.
(vi) Any SSCs explicitly subject to facility Technical Specifications (TS).
(vii) Any SSCs subject to facility TS through the definition of operability (i.e., support SSCs outside TS).
(viii) Any SSCs described in the FSAR.
This guidance is directed toward NRC inspectors that are reviewing actions of licensees that hold an operating license. Although this guidance generally reflects existing staff practices, application on specific plants may constitute a backfit. Consequently, significant differences in licensee practices should be discussed with NRC management to ensure that the guidance is applied in a reasonable and consistent manner for all licensees.
Issue Date: 10/31/91-1 9900 Degraded Conditions
. 0
2.0 DEFINITIONS
2.1 Current Licensing Basis Current licensing basis (CL) is the set of NRC requirements applicable to a specific plant, and a licensee's written commitments for assuring compliance with and operation within applicable NRC requirements and the plant-specific design basis (including all modifications and additions to such commitments over the life of the license) that are docketed and in effect. The CLB includes the NRC regulations contained in 10 CFR Parts 2, 19, 20, 21, 30, 40, 50, 51, 55, 72, 73, 100 and appendices thereto; orders; license conditions; exemptions, and Technical Specifications (TS). It also includes the plant-specific design basis information defined in 10 CFR 50.2 as documented in the most recent Final Safety Analysis Report (FSAR) as required by 10 CFR 50.71 and the licensee's commitments remaining in effect that were made in docketed licensing correspondence such as licensee responses to NRC bulletins, generic letters, and enforcement actions, as well as licensee commitments documented in NRC safety evaluations or licensee event reports.
2.2 Design Basis Design basis is that body of plant-specific design bases information defined by 10 CFR 50.2.
2.3 Degraded Condition A condition of an SSC in which there has been any loss of quality or functional capability.
2.4 Nonconforming Condition A condition of an SSC in which there is failure to meet requirements or licensee commitments. Some examples of nonconforming conditions include the following:
- 1. There is failure to conform to one or more applicable codes or standards specified in the FSAR.
- 2. As-built equipment, or as-modified equipment, does not meet FSAR design requirements.
- 3. Operating experience or engineering reviews demonstrate a design Inadequacy.
- 4. Documentation required by NRC requirements such as 10 CFR 50.49 is not available or deficient.
2.5 Full Oualification Full qualification constitutes conforming to all aspects of the current licensing basis, including codes and standards, design criteria, and commitments.
9900 Degraded Conditions .2. Issue Date: 10/31/91
4.3.2 Changing the Current Licensing Basis to Satisfy an Appendix B Corrective Action A licensee may change the design of its plant as described in the FSAR in accordance with 10 CFR 50.59 at any time. Whenever such changes are sufficient to resolve a degraded or nonconforming condition involving an SSC that is subject both to Appendix B and 50.59, they may be used to satisfy the corrective action requirements of Appendix B, in lieu of restoring the affected equipment to its original design. However, whenever such a change involves a unreviewed safety question (USQ) or change in a Technical Specification (TS), the licensee must obtain a license amendment in accordance with 10 CFR 50.90 prior to operating the plant with the degraded or nonconforming condition. In order to resolve the degraded or nonconforming condition without restoring the affected equipment to its original design, a licensee may need to obtain and exemption from 10 CFR 50 in accordance with 10 CFR 50.12, or relief from a design code in accordance with 10 CFR 50.55a. The use of 10 CFR 50.59, 50.12 or 50.SSa in fulfillment of Appendix B corrective action requirements does not relieve the licensee of the responsibility to determine the root cause, to examine other affected systems, or to report the original condition, as appropriate.
Further guidance on 10 CFR 50.59 is provided in the NRC Inspection Manual, Part 9900, "50.59 Changes, Testing, and Experiments."
4.4 Discovery of an Existing But Previously Unanalyzed Condition or Accident In the course of its activities, the licensee may discover a previously unanalyzed condition or accident. Upon discovery of an existing but previously unanalyzed condition that significantly compromises plant safety, the licensee shall report that condition in accordance with 10 CFR 50.72 and 50.73, and put the plant in a safe condition.
For a previously unanalyzed condition or accident that is considered a significant safety concern, but is not part of the design basis, the licensee may subsequently be required to take additional action after consideration of backfit issues (see Section 50.109(a)(5)).
4.5 Justification for Continued ODeration (JCO) 4.5.1 Background The license authorizes the licensee to operate the plant in accordance with the regulations, license conditions and the TS. If an SSC is degraded or nonconforming but operable, the license provides authorization to operate and the licensee does not need further Justification. The licensee must, however, promptly identify and correct the condition adverse to safety or quality in accordance with 10 CFR Part 50, Appendix B, Criterion XVI.
Under certain defined and limited circumstances, the licensee may find that strict compliance with the TS would cause an unnecessary plant action not in the best interest of public health and safety. NRC review and response is required prior to the licensee taking actions that are contrary to compliance with the license conditions or TS unless an emergency situation is present such that 10 9900 Degraded Conditions Issue Date: 10/31/91
3.0 BACKGROUND
A nuclear power plant's SSCs are designed to meet NRC requirements, satisfy the current licensing basis, and conform to specified codes and standards. For degraded or nonconforming conditions of these SSCs, the licensee may be required to take actions required by the Technical Specifications (TS). The provisions of Title 10 of the Code of Federal Regulations (10 CFR), Part 50, Appendix B, Criteria XVI, may apply requiring the licensee to identify promptly and correct conditions adverse to safety or quality. Reporting may be required in accordance with Sections 50.72, 50.73, and 50.9(b) of 10 CFR Part 50, 10 CFR Part 21, and tne Technical Specifications (TS). Collectively, these requirements may be viewed as a process for licensees to develop a basis to continue operation or to place the plant in a safe condition, and to take prompt corrective action.
Changes to the facility in accordance with 10 CFR 50.59 may be made as part of the corrective action required by Appendix B. The process displayed by means of the attached chart titled, "Resolution of Degraded and Nonconforming Conditions,"
recognizes these and other provisions that a licensee may follow to restore or establish acceptable conditions. These provisions are success paths that enable licensees to continue safe operation of their facilities.
4.0 DISCUSSION OF NOTABLE PROVISIONS 4.1 Public Health and Safety All success paths, whether specifically stated or not, are first directed to ensuring public health and safety and second to restoring the systems, structures, or components (SSCs) to the current licensing basis of the plant as an acceptable level of safety. Identification of a degraded or nonconforming condition that may pose an immediate threat to the public health and safety requires the plant to be placed in a safe condition.
Technical Specifications (TS) address the safety systems and provide Limiting Conditions for Operation (LCOs) and Allowed Outage Times (AOTs) required to ensure public health and safety.
4.2 Ooerability Determinations For guidance on operability see the Inspection Manual, Part 9900, OPERABLE/OPERABILITY: ENSURING THE FUNCTIONAL CAPABILITY OF A SYSTEM OR COMPONENT," and see the Inspection Manual, Part 9900, "STANDARD TECHNICAL SPECIFICATIONS STS SECTION 1, OPERABILITY."
4.3 The Current Licensina Basis and 10 CFR 50. ARoendix B 4.3.1 10 CFR 50, Appendix B The design and operation of a nuclear plant is to be consistent with the current licensing basis. Whenever degraded or nonconforming conditions of SSCs subject to Appendix B are identified, Appendix B requires prompt corrective action to correct or resolve the condition. The timeliness of this corrective action should be commensurate with the safety significance of the issue.
Issue Date: 10/31/91 9900 Degraded Conditions
CFR 50.54(X) Is applied. A JCO, as defined herein for general NRC purposes, is the licensee's technical basis for requesting NRC responses to such action.
4.5.2 JCO Definition A Justification for Continued Operation' (JCO) is the licensee's technical basis for requesting authorization to operate in a manner that is prohibited (e.g.,
outside TS or license) absent such authorization. The preparation of JCOs does not constitute authorization to continue operation.
4.5.3 Items for Consideration in a JCO Some items which are appropriate for consideration in a licensee's development of a JCO include:
o Availability of redundant or backup equipment o Compensatory measures including limited administrative controls o Safety function and events protected against o Conservatism and margins, and o Probability of needing the safety-function.
o PRA or Individual Plant Evaluation (IPE) results that determine how operating the facility in the manner proposed in the JCO will impact the core damage frequency.
4.5.4 Discussion of Industry-Type JCOs Currently, some licensees refer to two other documents or processes as JCOs that are not equivalent to and do not perform the same function as the NRC-recognized JCO (as defined in 4.5.2). This is an acceptable industry practice and to the extent the industry JCO fulfills other NRC requirements, the JCOs will be selectively reviewed and audited accordingly.
In the first industry-type JCO, the licensee may consider the entire process depicted in the attached chart as a single JCO that includes such things as the basis for operability, PRA, corrective action elements, and alternative operations.
In the second industry-type JCO, the licensee may consider the documentation that is developed to support facility operation after the operability decision has been made as a JCO. This documentation can cover any or all of the items listed under 'Interim Operation* on the attached chart.
'Regulations, generic letters, and bulletins may provide direction on specific issue JCOs, which do not require that they be submitted. Licensees may also use the JCO for situations other than for operating in a prohibited manner.
The JCO term has been used in Generic Letters 88-07 on Environmental Qualifications of Electrical Equipment and 87-02 on Seismic Adequacy. Licensees should continue to follow earlier guidance regarding the preparation of JCOs on specific issues.
Issue Date: 10/31/91 9900 Degraded Conditions
Although the OJCO- is used differently by some licensees, the NRC concern the operability decision is correct, documentation of licensee's actions is that appropriate, and submittals to the NRC are complete. are The licensee's documentation of the JCO's is normally proceduralized through the existing record system, which is auditable. plant 4.6 Reasonable Assurance of Safety For SSCs that are not expressly subject to TS and that are determined inoperable, the licensee should assess the reasonable assurance of safety.to be the assessment is successful, then the facility may continue to operate If while prompt corrective action is taken. Items to be considered for such an assessment include the following:
o Availability of redundant or backup equipment o Compensatory measures including limited administrative controls o Safety function and events protected against o Conservatism and margins, and o Probability of needing the safety function.
o PRA or Individual Plant Evaluation (IPE) results that determine how operating the facility in the manner proposed in the JCO will impact the core damage frequency.
5.0 REFERENCE See attached chart on next page titled, 'Resolution of Degraded and Nonconforming Conditions.'
9900 Degraded Conditions .6- Issue Date: 10/31/91
aESOUMON OF DEGRADED AND N01-COMPORM" CONOMONS IA eonuiOm iNOmiR"N ofo CAmv w notb" SO pA IAM mmsN4XPPVP&AWMM SOMI Oecom owa
°wmamYC m A
- corimaIck a TrnO Y cm
- crM AA" N GU E WE I EflY ANO W EM -
cEM NC~no oou Woze MU 'mooi to CtEn0r cvADmuse ua clb CD O
c rnoSAtot__
s CLOUW D Ym. WEf A bleOAO wh~arf cOw uirf W att?
Va"Wti o a e a W mo N. G ourd C4 EqPa~ c plamn r O W? 1WMNSOLOYUW OtW M A~
_ am-n 9moW ouo_
4 m o a
ENCLOSURE 2 UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON. 0 C. 26 NRC INSPECTION MANUAL oTSR PART 9900: TECHNICAL GUIDANCE OPERABLE/OPERABILITY:
ENSURING THE FUNCTIONAL CAPABILITY OF A SYSTEM OR COMPONENT 9
Issue Date: 10/31/91 9900 Operability
OPERABLE/OPERABILITY:
ENSURING THE FUNCTIONAL CAPABILITY OF A SYSTEM OR COMPONENT Table of Contents 1.0 PURPOSE AND SCOPE ....
. ........................................... 1 2.0 DEFINITIONS .................................... 2 2.1 Current Licensing Basis .. 2 2.2 Design Basis .. 2 2.3 Degraded Condition... 2 2.4 Nonconforming Condition.. . 2 2.5 Full Qualification .. 2 3.0 STANDARD TECHNICAL SPECIFICATION OPERABILITY DEFINITION AND DISCUSSION . . . .3 3.1 Operability Definition... 3 3.2 Variation of Operability Definition in Plant Specific TS....3 3.3 Specified Function(s).. 3 3.4 Support System Operability -
Understanding System Interrelationships. 3
4.0 BACKGROUND
......... ............................. 4 5.0 ADDITIONAL GUIDANCE FOR OPERABILITY DETERMINATIONS ................ 5 5.1 Focus on Safety.............. . ............. 5 5.2 Full Qualification.. .. ........ 6 5.3 Deal with Operability and Restoration of Qualification Separately ..................... 6 5.4 Determining Operability and Plant Safety is a Continuous Decision-Making Process .
5.5 Timeliness of Operability Determinations ................... 7 9900 Operability . j Issue Date: 10/31/91
OPERABLE/OPERABILITY:
ENSURING THE FUNCTIONAL CAPABILITY OF A SYSTEM OR COMPONENT Table of Contents 5.0 ADDITIONAL GUIDANCE FOR OPERABILITY DETERMINATIONS (continued)
. .. 7 5.6 Timeliness of Corrective Action.....
5.7 Justification for Continued Operation.......................7
. . 8 6.0 DETAILED DISCUSSION OF SPECIFIC OPERABILITY ISSUES .
. 8 6.1 Scope and Timing of Operability Determinations .
6.2 Treatment of Single Failures 9 inOperability Determinations ..
6.2.1 Definition of Single Failure....................9 6.2.2 Capability to Withstand a Single Failure isa Design Consideration . ........ 9 6.2.3 Discovery of a Design Deficiency in Which Capability to Withstand a Single Failure is Lost ....................... 10 6.3 Treatment of Consequential Failures I 0.
in Operability Determinations . .............
Definition of Consequential Failure ............ IO 6.3.1 6.3.2 Consequential Failures and Operability Determinations . . 10 Consequential Failures and Appendix B .. 10 6.3.3 6.4 Operability During TS Surveillances 10 and Preventive Maintenance . . ...............................
6.5 Surveillance and Operability Testing 11 in Safety Configuration . ...................................
12 6.6 Hissed Technical Specification Surveillance .................
12 6.7 Use of Manual Action in Place of Automatic Action ..........
j j- 9900 Operability Issue Date: 10/31/91
OPERABLE/OPERABILITY:
ENSURING THE FUNCTIONAL CAPABILITY OF A SYSTEM OR COMPONENT Table of Contents 6.0 DETAILED DISCUSSION OF SPECIFIC OPERABILITY ISSUES (continued) 6.8 Indeterminate' State of Operability . . 13 6.9 Use of Probabilistic Risk Assessment in Operability Decisions ................................... 14 6.10 Environmental Qualification ................................ 14 6.11 Technical Specification Operability vs.
ASME Code,Section XI Operative Criteria . . 15 6.12 Support System Operability ................................. 16 6.13 Piping and Pipe Support Requirements . . 17 6.14 Flaw Evaluation .. I8...........
6.15 Operational Leakage ...................................... 19 6.16 Structural Requirements . ....... .............
19 9900 Operability -ji j Issue Date: 10/31/91
OPERABLE/OPERABILITY:
ENSURING THE FUNCTIONAL CAPABILITY OF A SYSTEM OR COMPONENT 1.0 PURPOSE AND SCOPE To provide guidance to NRC inspectors for the review of licensee operability (SSCs):
determinations affecting the following systems, structures, or components (I) Safety-related SSCs, which are those relied upon to remain functional during and following design basis events (A) to ensure the integrity of the reactor coolant pressure boundary, (B) to ensure the capability to shut down the reactor and maintain it in a safe shutdown condition, or (C) to ensure the capability to prevent or mitigate the consequences of accidents that could result in potential offsite consequences comparable to the 10 CFR Part 100 guidelines. Design basis events are defined the same as in 10 CFR 5O.49(b)(1).
(ii) All SSCs whose failure could prevent satisfactory accomplishment of any of the required functions identified in (i) A, B, and C.
(iii) All SSCs'relied on in the safety analyses or plant evaluations that are a part of the plant's current licensing basis. Such analyses and evaluations include those submitted to support license amendment requests, exemption requests, or relief requests, and those submitted to demonstrate compliance with the Commission's regulations such as fire protection (10 CFR 50.48), environmental qualification (10 CFR 50.49), pressurized thermal shock (10 CFR 50.61), anticipated transients without scram (.10 CFR 50.62), and station blackout (10 CFR 50.63).
(iv) Any SSCs subject to 10 CFR Part 50, Appendix B.
(v) Any SSCs subject to 10 CFR Part 50, Appendix A, Criterion 1.
(vi) Any SSCs explicitly subject to facility Technical Specifications (TS).
(vii) Any SSCs subject to facility TS through the definition of operability (i.e., support SSCs outside TS).
(viii) Any SSCs described in the FSAR.
of This guidance is directed toward NRC inspectors that are reviewihg actions generally licensees that hold an operating license. Although this guidance reflects existing staff practices, application on specific plants may constitute should a backfit. Consequently, significant differences in licensee practices in a be discussed with NRC management to ensure that the guidance is applied reasonable and consistent manner for all licensees'.
Issue Date: 10/31/91 *1. 9900 Operability
2.0 DEFINITIONS
2.1 Current Licensing Basis Current licensing basis (CLB) is the set of NRC requirements applicable to a specific plant, and a licensee's written commitments for assuring compliance with and operation within applicable NRC requirements and the plant-specific design basis (including all modifications and additions to such commitments over the life of the license) that are docketed and in effect. The CLB includes the NRC regulations contained in 10 CFR Parts 2, 19, 20, 21, 30, 40, 50, 51, 55, 72, 73, 100 ano appendices thereto; orders, license conditions; exemptions, and Technical Specifications (TS). It also includes the plant-specific design basis information defined in 10 CFR 50.2 as documented in the most recent Final Safety Analysis Report (FSAR) as required by 10 CFR 50.71 and the licensee's commitments remaining in effect that were made in docketed licensing correspondence such as licensee responses to NRC bulletins, generic letters, and enforcement actions, as well as licensee commitments documented in NRC safety evaluations or licensee event reports.
2.2 Design Basis Design basis is that body of plant-specific design bases information defined by 10 CFR 50.2.
2.3 Degraded Condition A condition of an SSC in which there has been any loss of quality or functional capability.
2.4 Nonconforming Conditio A condition of an SSC in which there is failure to meet requirements or licensee commitments. Some examples of nonconforming conditions include the following:
- 1. There is failure to conform to one or more applicable codes or standards specified in the FSAR.
- 2. As-built equipment, or as-modified equipment, does not meet FSAR design requirements.
- 3. 'Operating experience or engineering reviews demonstrate a design inadequacy.
- 4. Documentation required by NRC requirements such as 10 CFR 50.49 Is not available or deficient.
2.5 Full Oualification Full qualification constitutes conforming to all aspects of the current licensing basis, including codes and standards, design criteria, and comituents.
9900 Operability Issue Date: 10/31/91
3.0 STANDARD TECHNICAL SPECIFICATIONS OPERABILITY DEFINITION AND DISCUSSION 3.1 ODerability Definition The Standard Technical Specifications (STS) define operable or operability as follows:
"A system, subsystem, train, component, or device shall be OPERABLE or have OPERABILITY when it is capable of performing its specified functions, and when all necessary attendant instrumentation, controls, electrical power, cooling or seal water, lubrication or other auxiliary equipment that are required for the system, subsystem, train, component, or device to perform its function(s) are also capable of performing their related support function(s).'
3.2 Variations of Operabilltv Definition in Plant Specific TS There are several variations in existing plant specific TS of the above basic definition. Therefore, some Judgement is required in application of this guidance on operability. Word differences that exist are not viewed by the NRC to imply any significant overall difference in application of the plant specific TS. Any problems that result from existing inconsistencies between a plant specific definition of operability and this guidance should be discussed with regional management, who should discuss the issues with NRR if deemed necessary.
In all cases, a licensee's plant-specific definition is governing.
3.3 Specified Function(s)
The definition of operability refers to capability to perform the Uspecified functions.' The specified function(s) of the system, subsystem, train, component, or device (hereafter referred to as system) is that specified safety function(s) in the current licensing basis for the facility.
In addition to providing the specified safety function, a system is expected to perform as designed, tested and maintained. When system capability is degraded to a point where it cannot perform with reasonable assurance or reliability, the system should be Judged inoperable, even if at this instantaneous point in time the system could provide the specified safety function. See Section 6.11, which discusses ASME Section XI, for an example.
3.4 Suooort System Operabilitv - Understanding System Interrelationships The definition of operability embodies a principle that a system can perform its specified safety function(s) only when all its necessary support systems are capable of performing their related support functions. Therefore, an NRC inspector should expect that each licensee understands which support systems are necessary to ensure the operability of main systems and components that perform specified safety functions. Such an understanding is mandatory. Otherwise the licensee will not be able to implement the definition of operability.
Issue Date: 10/31/91 9900 Operability
4.0 BACKGROUND
The purpose of the Technical Specifications is to ensure that the plant is operated within its design basis and to preserve the validity of the safety analyses, which are concerned with both the prevention and mitigation of accidents. Because both prevention of accidents and the ability to mitigate them must be continuously ensured, the process of ensuring OPERABILITY for safety or safety support systems is ongoing and continuous. The focus of operability is foremost on the capability to ensure safety.
The process of ensuring operability is continuous and consists of the verification of operability by surveillances and formal determinations of operability whenever a verification or other indication calls into question the system's or component's ability to perform its specified function.
Verification of operability is supplemented by continuous and ongoing processes such as:
o Day-to-day operation of the facility o Implementation of programs such as inservice testing and inspection o Plant walkdowns or tours o Observations from the control room o Quality assurance activities such as audits and reviews o Engineering design reviews including design basis reconstitution.
Without any information to the contrary, once a component or system is established as operable, it is reasonable to assume that the component or system should continue to remain operable, and the previously stated verifications should provide that assurance. However, whenever the ability of a system or structure to perform its specified function is called into question, operability must be determined from a detailed examination of the deficiency.
The determination of operability for systems is to be made promptly, with a timeliness that is commensurate with the potential safety significance of the issue. If the licensee chooses initially not to declare a system Inoperable, the licensee must have a reasonable expectation that the system is operable and that the prompt determination process will support that expectation. Otherwise, the licensee should immediately declare the system or structure inoperable. Where there is reason to suspect that the determination process is not, or was not prompt, the Region may discuss with the licensee, with NRR consultation as appropriate, the reasoning for the perceived delay.
The TS establish operability requirements on systems required for safe operation and include surveillance requirements to demonstrate periodically that these systems are operable. Performance of the surveillance requirement is usually considered to be sufficient to demonstrate operability provided that there is reasonable assurance that the system continues to conform to all appropriate criteria in the current licensing basis (CLB). Whenever conformance to the appropriate criteria in the CLB is called into question, performance of the surveillance requirement alone, is usually not sufficient to determine operability.
9900 Operability Issue Date: 10/31/91
When operability verification or other processes indicate a potential deficiency or loss of quality, licensees should make a prompt determination of operability and act on the results of that determination. The licensee should also restore the quality of the system in accordance with 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action.
5.0 ADDITIONAL GUIDANCE FOR OPERABILITY DETERMINATIONS In the course of review activities or through normal plant operation, a licensee may become aware of degraded or nonconforming conditions affecting the SSCs defined in Section 1. These activities include, but are not limited to, the following:
o Review of operational events o Design modifications to facilities o Examinations of records o Additions to facilities o Vendor reviews or inspections o Plant system walkdowns.
These and other paths for identifying degraded or nonconforming conditions, including reports from industry and other utilities, should result in the prompt identification and correction of the deficiency by the licensee.. Licensees should make an operability determination and take follow-on corrective action in the following circumstances:
o Discovery of degraded conditions of equipment where performance is called into question o Discovery of nonconforming conditions where the qualification of equipment (such as conformance to codes and standards) is called into question o Discovery of an existing but previously unanalyzed condition or accident. NOTE: For a previously unanalyzed condition or accident that is considered a significant safety concern, but is not part of the design basis, the licensee may subsequently be required to take additional action after consideration of backfit issues (See 10 CFR 50.109 (a)(5)).
The following guidance for dealing with i-ssues that are closely associated with operability determinations has been derived from the NRC regulations and from previous guidance issued to licensees.
5.1 ELuauonfrtx The inmediate and primary attention must be directed to safety concerns.
Reporting and procedural requirements should not interfere with ensuring the health and safety of the public. To continue operation while an operability determination is being made, the licensee must have a reasonable expectation that the system is operable and that the determination process will support that expectation.
Issue Date: 10/31/91 9900 Operability
5.2 Full Oualification Full qualification constitutes conforming to all aspects of the current licensing basis, including codes and standards, design criteria, and commitments.
The SSCs defined in section I are designed and operated, as described in the current licensing basis (CLB), to include design margins and engineering margins of safety to ensure, among other things, that some loss of quality does not mean immediate failure. The CLB includes commitments to specific codes and standards, design criteria, and some regulations that also dictate margins. Many licensees add conservatism so that a partial loss of quality does not affect their commitments to the margins. The loss of conservatism not taken credit for in the safety analyses and not committed to by the licensee to satisfy licensing requirements does not require a system to be declared inoperable. All other losses of quality or margins are subject to an operability determination and corrective action.
5.3 Deal with Operabilitv and Restoration of Oualification Separately Operability and qualification are closely related concepts. However, the fact that a system is not fully qualified does not, in all cases, render that system unable to perform its specified function if called upon. According to the definition of operability, a safety or safety support system or structure must be capable of performing its specified function(s) of prevention or mitigation as described in the current licensing basis, particularly the TS bases or FSAR.
The prompt determination of operability will result in decisions or actions pertaining to continued plant operation, while qualification or requalification becomes a corrective action goal. Qualification concerns, whether it is a lack of required quality or loss of quality because of degradation, can and should be promptly considered to determine the effect of the concern on the operability of the system.
If operability is assured based on this prompt determination, plant operation can continue while an appropriate corrective action program is implemented to restore full qualification. This is consistent with the plant TS being the controlling document for making decisions about plant operations, while 10 CFR Part 50, Appendix B. Criterion XVI, Corrective Action, is the requirement document for dealing with restoring equipment qualification.
The principle of treating the related concepts of operability and restoration of qualification separately is to ensure that the operability determination is focused on safety and is not delayed by decisions or actions necessary to plan or implement the corrective action, i.e., restoring full qualification.
9900 Operability . Issue Date: 10/31/91
5.4 Determining ODerability and Plant Safety is a Continuous Decision-Making Process Licensees are obligated to ensure the continued operability of SSCs as specified by TS, or to take the remedial actions addressed in the TS. For other SSCs which may be in a degraded or nonconforming condition, it must be determined whether a condition adverse to quality exists and whether corrective actions are needed.
Operability is verified, as discussed above, by day-to-day operation, plant tours, observations from the control room, surveillances, test programs, and other similar activities. Deficiencies in the design basis or safety analysis or problems identified by the operability verification lead to the operability determination process by which the specific deficiency and overall capability of the component or system are examined. The process, in one form or another, is ongoing and continuous. As a practical matter, decision making requires good information and takes time. However, the process used by licensees should call for prompt and continuous attention to deficiencies and potential system inoperabilities. In addition, the licensee's process should call for imediately.
declaring equipment inoperable when reasonable expectation of operability does not exist or mounting evidence suggests that the final analysis will conclude that the equipment cannot perform its specified safety function(s).
5.5 Timeliness of ODerability Determinations Timeliness of operability determinations should be commensurate with the safety significance of the issue. Once the deficiency has been identified and the specific component or system has been identified, the determination can be made regarding the capability to perform the specified function(s). There is not an explicit requirement in-the regulations for the timing of the decision. As discussed further in Section 6.0, timeliness is important and is determined by the safety significance of the issue. The Allowed Outage Times (AOTs) contained in TS generally provide reasonable guidelines for safety significance.
5.6 Timeliness of Corrective Action Timeliness of corrective action (i.e., the requirements in 10 CFR Part 50, Appendix B, Criterion XVI, for *prompt' corrective action) should be commensurate with the safety significance of the corrective action.
The determination of operability establishes a basis for plant operation while the corrective action establishes or re-establishes the design basis/qualification of the safety or safety support system. As in Section 5.5 above, there is no explicit requirement in the regulations for timeliness of these corrective actions, except that 10 CFR Part 50, Appendix B. Criterion XVI requires it to be "prompt*. Again, timeliness is determined by the safety significance of the issue.
5.7 Justification for Continued Deration See the NRC Inspection Manual, Part 9900, Technical Guidance, *Resolution of Degraded and Nonconforming Conditions,' for guidance on JCOs.
Issue Date: 10/31/91 .7. 9900 Operability
6.0 DETAILED DISCUSSION OF SPECIFIC OPERABILITY ISSUES 6.1 Scope and Timing of Ooerabilitv Determinations Determining system, structure, or component (SSC) operability is a continuous process that cannot be avoided. Action is required any time an SSC that is required by TS or NRC requirement to be operable is found to be inoperable If an immediate threat to public health and safety is identified, action to place the plant in a safe condition should begin as soon as this circumstance is known and should be completed expeditiously.
Once a degraded or nonconforming condition of specific SSCs is identified, an operability determination should be made as soon as possible consistent with the safety importance of the SSC affected. In most cases, it is expected that the decision can be made immediately (e.g., loss of motive power, etc.). In other cases it is expected the decision can be made within approximately 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of discovery even though complete information may not be available. Some few exceptional cases may take longer. For SSCs in TS, the Allowed Outage Times (AOTs) contained in TS generally provide reasonable guidelines for safety significance. For SSCs outside TS, engineering judgement must be used to determine safety significance. The decision should be based on the best information available and must be predicated on the licensee's reasonable expectation that the SSC is operable and that the prompt determination process will support that expectation. When reasonable expectation does not exist, the SSC should be declared inoperable and the safe course of action should be taken.
The licensee should examine the full scope of the current licensing basis, including the TS and FSAR commitments, to establish the conditions and performance requirements to be met for determining operability. The operability decision may be based on analysis, a test or partial test, experience with operating events, engineering judgment, or a combination of these factors taking into consideration equipment functional requirements. An initial determination regarding operability should be revised, as appropriate, as new or additional Information becomes available.
The scope of an operability determination needs to be sufficient to address the capability of the equipment to perform its safety function(s). Operability determinations should therefore include the following actions:
o Determine what equipment is degraded or potentially nonconforming.
O Determine the safety function(s) performed by the equipment.
o Determine the circumstances of the potential nonconformance, Including the possible failure mechanism.
o Determine the requirement or' commitment established for the equipment, and why the requirement or.commitment may not be met.
o Determine by what means and when the potentially nonconforming equipment was first discovered.
9900 Operability Issue Date: 10/31/91
o Determine safest plant configuration including the effect of transitional action.
o Determine the basis for declaring the affected system operable, through:
- a. analysis
- b. test or partial test,
- c. operating experience, and
- d. engineering Judgement.
If an NRC-approved action (such as provided in an (e.g., LCO action statement) is immediately taken to compensate for failed equipment placing one channel of reactor protection in the tripped condition upon failure of the channel such the that the specified safety function can be maintained), continued operation of facility is permitted.
However, continued operation with an inoperable channel in the tripped condition is not advisable because a subsequent failure willalso result in a plant trip that will challenge plant safety systems. It is not advisable from the standpoint of plant availability.
6.2 Treatment of Single Failures in ODerability Determinations 6.2.1 Definition of Single Failure 10 CFR Part 50, Appendix A, "General Design Criteria for Nuclear Power Plants,"
defines a single failure as:
KA single failure means an occurrence which resultssafety in the loss of capability of a component to perform its intendedare considered functions.
Multiple failures resulting from a single occurrence to be a single failure."
6.2.2 Capability to Withstand a Single Failure is a Design Consideration Appendix A contains general design criteria (GDC) forsimilar SSCs that perform major safety functions. Many of the GDC contain a statement to the following:
- Suitable redundancy in components and features andcapabilities suitable interconnections, leak detection, isolation and containment shall be provided to assure that for onsite electrical power- system operation (assuming offsite power in not available) and for offsite electrical power system operation (assuming onsite power aissingle not available) the system safety function can be accomplished assuming failure."
See, for example, GDC 17, 34, 35, 38, 41, 44. Therefore, acapability to withstand plant-specific a single failure in fluid or electrical systems.is not result Ina loss design does of consideration, which ensures that a single failure the capability of the system to perform its safety functions.
Issue Date: 10/31/91 .9- 9900 Operability
6.2.3 Discovery of a Design Deficiency In Which Capability a Single Failure is Lost to Withstand A design deficiency in which capability to withstand should be evaluated and treated as a degraded a single failure is lost, with any degraded or nonconforming condition, and nonconforming condition. As operability is required. a prompt determination of For any design deficiency in which the capability is lost, the licensee must address the quality to withstand a single failure deficiency affects the design basis requirements aspects and if the design promptly correct the deficiency in accordance for the particular plant, with 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action.
6.3 Treatment of Consequential Failures in Operability Determinations 6.3.1 Definition of Consequential Failure A consequential failure is a failure of an SSC within the design basis. For example, if during caused by a postulated accident (LOCA) (a design basis event), the broken pipe a loss of coolant accident nearby pump, then the pump would not be able could whip and incapacitate a is called a consequential failure because the to function. Such a pump failure design basis event itself. pump failed as a result of the In general, facility design takes any such consequential failures that are deemed credible case, that would mean that the broken pump was into consideration. In this would take credit for to mitigate the LOCA. not one that the safety analysis 6.3.2 Consequential Failures and Operability Determinations Operability determinations should be performed failures (i.e., an SSC failure that would be for those potential consequential basis event) for which the SSC In question a direct consequence of a design consequential failures would cause a loss of needs to function. Where mitigating the effects of the event, the affected function needed for limiting or cannot perform all of its specified functions. SSC is inoperable because it discovered during design basis reconstitution Such situations are most likely failure modes are identified. studies, or when new credible 6.3.3 Consequential Failures and Appendix B With any consequential failure, the licensee must if the failure affects the design basis requirementsaddress the quality aspects and promptly correct the deficiency in accordance for the particular plant, Criterion XVI, Corrective Action. with 10 CFR Part 50, Appendix B, 6.4 Operability During TS Surveillances and Preventive Maintenance During preventive maintenance (PM), equipment rendered incapable of performing the function(s) may be removed from service and equipment is clearly inoperable. specified for safety. This For equipment subject to the Technical 9900 Operability Issue Date: 10/31/91
Specifications (TS), the PM activity and any other action that may be required by the Limiting Conditions for Operation (LCOs), is expected tosubject be completed Time (AOT). For safety equipment not to the within the Allowed Outage through the TS either explicitly by direct inclusion in the TS or implicitly with definition of operability, the licensee's PM activities should be consistent the importance of the equipment to safety and the function(s) of the equipment and a reasonable time goal should be set to complete the PM.
for PM In all cases, care should be exercised in removing equipment from service licensee to avoid accumulating long out-of-service times of safety trains. The The should reestablish operability before the equipment is returned to service. in licensee also may need to reestablish operability for systems or components, dependent upon the equipment undergoing the whole or in part, that are actively based on PM activity. The need for testing to reestablish operability should beaffected.
a reasonable Judgement about how the inoperable equipment may have been because If retesting to reestablish operability is not possible or practicable of safety concerns, analysis or other means should be used to demonstrate operability.
and If TS surveillances require that safety equipment be removed from service is rendered incapable of performing its safety function, the equipment inoperable. The LCO action statement shall be entered unless the TS explicitly direct otherwise. Upon completion of the surveillance, the licensee should verify restoration to operable status of at least those portions of the equipment or system features that were altered to accomplish the surveillance.
as NOTE: With regard to surveillances or other similar activities (such periods inservice testing) that render systems inoperable for extended (i.e., those that may exceed the Allowed Outage Time (AOT)), licensees must have prior NRC approval by license amendment for the surveillance requirement or redefine the tests. It is not the intent of surveillances or other similar program requirements to cause unwarranted plant shutdowns or to unnecessarily challenge other safety systems.
Action See 'Maintenance - Voluntary Entry into Limiting Conditions for Operation 9900, Statements to Perform Preventive Maintenance," NRC Inspection Manual, Part Technical Guidance.
6.5 Surveillance and Ooerabilitv Testing in Safety Configuration safety Many systems are designed to perform both normal operational and (TS) functions. It is preferable that both the Technical Specification surveillance requirement testing and any other operability testing be performed in the same configuration as would be required to perform the safety function, of i.e., safety mode. However, testing in the normal configuration or mode operation may be required for systems if testing in the safety mode will result in unwarranted safety concerns or transients. The mode of operation for the TS surveillance requirements test is usually prescribed and the acceptance criteria are established on that basis.
If a system should fail while it is being tested in the safety mode of operation, the system is to be declared inoperable. For ongoing periodic testing that must Issue Date: IO/31/91 9900 Operability
be performed during normal mode operation, the licensee mode operational acceptance criteria that are based on ashould establish normal the safety mode requirements. direct relationship to Operability verification is then provided by acceptable normal mode operational test results.
Test failures should be examined to determine the root problem before resumption of testing. Repetitive testing cause and correct the test results without identifying the root cause or correction to achieve acceptable a previous test is not acceptable as a means to establish of any problem in or verify operability.
6.6 Missed Technical Specification Surveillance The Standard Technical Specifications (STS) contain Surveillance 4.0.3 which states: Requirement
'Failure to perform a Surveillance Requirement within interval shall constitute a failure to meet the OPERABILITYthe specified time for a Limiting Condition for Operation. Exceptions to requirements are stated in the individual specifications. Surveillance these requirements not have to be performed on inoperable equipment.' Requirements do Plant-specific Technical Specification (TS) variations exist, in which case the plant-specific TS govern. of this statement may The Allowed Outage Time (AOT) in the action requirements interval that permits corrective action to be taken to satisfy specifies a time a time interval is specified in the action requirements the LCO. If such adopted by license amendment, the 24-hour provision or if the licensee has of Requirement 4.0.3 as discussed in Generic Letter (GL) 87-09, amended Surveillance a missed surveillance within these time intervals meets the completion of with systems discovered to be inoperable, the time interval the requirements. As of the missed surveillance. Failure to perform a TS begins upon discovery specified time interval is considered a condition prohibitedrequirement within the reportable at least under 10 CFR Part 50.73; it also by the TS and is enforcement action. may be subject to Generic Letter 87-09 and other documents provide surveillance extension, applicability, and success. extensive guidance on discussion involves only the operability issues. criteria. The above 6.7 Use of Manual Action in Place of Automatic Action, Automatic action is frequently provided as a design safety system to ensure that the specified functionsfeature specific to each accomplished. Limiting safety system settings for nuclear of the system will be in 10 CFR Part 50.36, "Technical Specifications,* as reactors are defined protective devices related to those variables having settings for automatic functions. Where a limiting safety system setting is significant safety on which a safety limit has been placed, the setting specified for a variable must be so chosen that automatic protective action will correct the abnormal situation limit is exceeded. Accordingly, it is not appropriate before a safety to take credit for manual 9900 Operability Issue Date: 10/31/91
action in place of automatic action for protection of safety limits to consider equipment operable. This does not preclude operator action to put the plant in a safe condition, but operator action cannot be a substitute for automatic safety limit protection.
The licensing of specific plant designs includes consideration of automatic and manual action. While approvals have been granted for either or both type actions, not every combination of circumstances has been reviewed from an operability standpoint. Although it is possible, it is not expected that many determinations of operability will be successful for manual action in place of automatic action. Credit for manual initiation to mitigate the consequences of design basis accidents should have been established as part of the licensing review of a plant.
For any other situation in which substitution of manual action for automatic action may be acceptable, the licensee's determination of operability with regard to the use of manual action must focus on the physical differences between automatic and manual action and the ability of the manual action to accomplish the specified function. The physical differences to be considered include, but are not limited to, the ability to recognize input signals for action, ready access to or recognition of setpoints, design nuances that may complicate subsequent manual operation such as auto-reset, repositioning on temperature or pressure, timing required for automatic action, etc., minimum manning requirements, and emergency operation procedures written for the automatic mode of operation. The licensee should have written procedures in place and training accomplished on those procedures before substitution of any manual action for the loss of an automatic action.
The assignment of a dedicated operator for manual action is not acceptable without written procedures and a full consideration of all pertinent differences.
The consideration of manual action in remote areas also must include the ability and timing in getting to the area, training of personnel to accomplish the task, and occupational hazards to be incurred such as radiation, temperature, chemical, sound, or visibility hazards. One reasonable test of the reliability and effectiveness of manual action may be the approval of manual action for the same function at a similar plant. Nevertheless, this is expected to be a temporary condition until the automatic action can be promptly corrected in accordance with 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action.
6.8 elndeterminate* State of Operabilitv An SSC is operable when it is capable of performing its specified function(s) and when all necessary support SSCs are also capable of performing their related support functions. See operability definition and discussion in Section 3.0.
Otherwise, the SSC is inoperable. When a licensee has cause to question the operability of an SSC, the operability determination is to be prompt; the timeliness must be commensurate with the potential safety significance of the issue. The determination process during this -time; however, must be predicated on the licensee's reasonable expectation that the SSC is operable and that the prompt determination process will support that expectation.
Issue Date: 10/31/91 9900 Operability
- it In the absence of reasonable expectation that the SSC is operable, the SSC is to be declared inoperable immediately. Subsequent evaluation may conclude that an SSC declared inoperable Is in fact operable. The licensee's actions subsequent to declaring an SSC inoperable are guided by the regulations, TS, plant procedures, and so forth. In addition, the licensee should determine when and under what circumstances the system became inoperable so that reporting requirements may be met and NRC followup actions may properly reflect the circumstances and the licensee's efforts to correct and prevent recurrences. In summary, an SSC is either operable or inoperable at all time. 'Indeterminate" is not a recognized state of operability.
6.9 Use of Probabilistic Risk Assessment in Operabilitv Decisions Probabilistic risk assessment (PRA) is a valuable tool for the relative evaluation of accident scenarios while considering, among other things, the probabilities of occurrence of accidents or external events. The definition of operability states; however, that the SSC must be capable of performing its specified function(s). The inherent assumption is that the occurrence conditions or event exists and that the safety function can be performed. The use of PRA or probabilities of 'the occurrence of accidents or external events is not acceptable for making operability decisions.
However, PRA may provide valid and useful supportive information for a licensee amendment. The PRA is also useful for determining the safety significance of SSCs. The safety significance, whether determined by PRA or other analyses, is a necessary factor in decisions on the appropriate "timeliness' of operability determinations. Specific guidance on the timeliness of determinations is presented in Section 5.5.
6.10 Environmental Oualification When the NRC or licensee identifies a potential deficiency in the environmental qualification of equipment (i.e., a licensee does not have an adequate basis to.
establish qualification), the licensee is expected to make a prompt determination of operability, to take immediate steps to establish a plan with a reasonable schedule to correct the deficiency, and to write a Justification for Continued Operation (JCO) (See Note below), which will be available for NRC review. The licensee may be able to make a finding of operability using analysis and partial test data to provide reasonable assurance that the equipment will perform its safety function(s) in its accident environment when called upon to do so. The licensee should also show that subsequent failure of the equipment will not result in significant degradation of any safety function or provide misleading information to the operator.
NOTE: the JCO referred to in questions of equipment qualification is specifically addressed by Generic Letter 88-07 dated April 7, 1988. This environmental qualification *JCO includes an operability determination. It also states that the licensee should evaluate whether the findings are reportable under 10 CFR 50.72, 10 CFR 50.73, 10 CFR Part 21, the Technical Specifications, or any other pertinent reporting requirements, including 10 CFR 50.9.
9900 Operability Issue Date: 10/31/91
The following actions should be taken if a licensee is unable to demonstrate equipment operability:
o For inoperable equipment in a system subject to the TS, the licensee shall follow the appropriate action statements. This could require that the plant be shut down or remain shut down.
o For inoperable equipment in a system not subject to the TS, the licensee may continue reactor operation if the safety function can be accomplished by other designated equipment that is qualified, or if limited administrative controls can be used to ensure the safety function is performed.
6.11 Technical Specification Operability vs. ASME Code.Section XI Operative Criteria The Technical Specifications (TS) normally apply to overall system performance but sometimes contain limiting values for certain component performance, which are specified to ensure that the design basis and safety analysis is satisfied.
The values (e.g., pump flow rate, valve closure time, valve leakage rate, safety/relief valve set point pressure) are operability verification criteria.
If these values are not met at any time, the applicable LCO shall be entered.
The ASME Section XI inservice testing plans required under 10 CFR 50.55(a) for pumps and valves may contain the same or different limits and additional the component performance acceptance values which, if not met, will indicate that pump or valve has seriously degraded so that corrective action would be required or to ensure or restore the operability and operational readiness of the pump valve. The ASME Section XI acceptance criteria include "required action ranges" or limiting values for certain component performance parameters. These required action ranges or limiting values as defined by the code as component performance arameters, may be less conservative than the TS values which are safety analysis imits. However, action must be taken when the TS requirements are not met.
Generic Letter 89-04 Attachment 1, Position 8, defines the starting point for the Allowed Outage Time (AOT) in TS action statements for ASME Section XI pumps and data fall in the required action range, regardless of valves. When performance whether the limit is equal to or more conservative than the TS limit, the pump or valve must be declared inoperable immediately (the term "inoperative' is used in the text of ASME Section XI; the pump or valve is both linoperative and inoperable) and the TS action statement for the associated system must be entered.
In cases where the required action range limit is more conservative than its corresponding TS limit, the corrective action may not be limited to replacement or repair; it may be an analysis to demonstrate that the specific performance degradation does not impair operability and that the pump or valve will still fulfill its function, such as delivering the required flow. A new required action range may be established after such analysis which would then allow a new determination of operability.
Issue Date: 10/31/91 9900 Operability
The durations specified by the Code for analyzing test results have not been accepted by the NRC for postponing entering a TS action statement. As soon as data are recognized as being within the required action range for pumps or as exceeding the limiting value of full-stroke time for valves, the associated component must be declared inoperable and, if subject to the TS, the AOT specified in the action statement must be started at the time the component was declared inoperable. For inoperable pumps and valves considered by ASME Section XI but not subject to the TS, the action should be consistent with the safety significance of the issue and the functions served by the affected system(s).
Recalibrating test instruments and then repeating pump or vdlve tests is an acceptable alternative to the corrective action of repair or replacement, but is not an action that can be taken before declaring the pump or valve inoperable.
However, if during a test it is obvious that a test instrument is malfunctioning, the test may be halted and the instruments promptly recalibrated or replaced.
During a test, anomalous data with no clear indication of the cause must be attributed to the pump or valve under test. For this occurrence, a prompt determination of operability is appropriate with follow-on corrective action as necessary.
Note: In the above discussion,'required action range' and 'inoperative" are ASME Section XI terms.
6.12 SuDDort System Operabilitv The definition of operability embodies the principle that a system can perform its function(s) only if all necessary support systems are capable of performing their related support functions. It is incumbent upon each licensee to understand which support systems are necessary to ensure operability of systems and components that perform specified safety functions.
When a support system is determined to be inoperable, all systems for which that support system is reguired for systems operability should be declared inoperable and the LCOs for those systems entered. Any appropriate remedial actions specified by a supported system LCO action statement (to compensate for the inoperable supported system) should be taken.
When a support system is determined to be inoperable, the licensee should employ the same operability determination process for the supported systems, as the licensee would for any other degraded system. In particular, the scope and timing of such operability decisions should follow the guidance in Section 6.1.
There are cases where judgment on the part of a licensee is appropriate in determining whether a support system is or is not required. One example is the case of a ventilation system. A ventilation system may be reau1re to ensure that other safety-related equipment can perform its safety function in the summer, but may not be reguired in the winter. Similarly, the electrical power supply for heat tracing may be required in the winter to ensure that a safety-related system equipment can perform its safety function, but may not be reguired in the summer. The need for judgment in reviewing what individual licensees do in specific cases should be recognized. If a licensee determines that a 9900 Operability Issue Date: 10/31/91
Technical Specification (TS) system is capable of performing its specified function(s) with an inoperable support system that is not in the TS, then no additional action outside of restoring the inoperable support systems is needed.
Furthermore, the licensee may modify the support function like any other change to the facility by use of the 10 CFR 50.59 process and FSAR update.
For some support systems, there are specific Allowed Outage Times (AOTs) specified in the TS. Ideally, the AOT contained in the TS for a support system should be equal to or less than the AOT for any system for which that support system is required for system operability. Problems where inconsistencies exist between an AOT for a support system and the AOT for a system for which that support system is required should be discussed with regional management who should discuss the issue with NRR if deemed necessary. While such inconsistencies are being resolved, the more restrictive AOT should be used. In some cases an amendment to the TS may be necessary.
In all cases, the following principles should be used:
- a. The most important safety concern is to ensure that the capability to perform a specified safety function is not lost as a result of more than one train of a support or supported system being declared inoperable.
When a support or supported system is declared inoperable in one train, the corresponding independent support or supported systems and all other associated support systems in the opposite train(s) should be ensured to be operable; i.e., the complete capability to perform the specified safety function has not been lost. The term 'ensure' as used here, allows for an administrative check by examining logs or other information to determine if required features are out-of-service for maintenance or other reasons.
These actions are not to be used in lieu of required TS actions.
- b. Upon determining that a loss of functional capability condition exists, actions specified in the support and supported system LCOs should be taken to mitigate the loss of functional capability.
6.13 Piling and Pipe Support Reouirements All piping and pipe supports found to be degraded or nonconforming should be subjected to an operability determination. To assist licensees in the determinations, operability guidance has been provided specific to various components. These components include the piping, supports, support plates, and anchor bolts. IE Bulletin No. 79-14 addressed the seismic analysis for as-build safety-related piping systems. The supplement to IE Bulletin 79-14 dated August 15, 1979 and Supplement 2 to IE Bulletin 79-14 dated September 7, 1979 provide additional guidance. Concrete anchor bolts and pipe supports are addressed with specific operability criteria in Supplement I to Revision 1 of IE Bulletin 79-02.
The criteria for evaluating operability of seismic design piping supports and anchor bolts relating to Bulletins 79-02 and 79-14 are detailedin the E. Jordan memo to the Regions dated July 1979, and the V. Noonan memo dated August 7, 1979.
Upon discovery of a nonconformance with piping and pipe supports, licensees may use the criteria in Appendix F of Section III of the ASME Code for operability determinations. These criteria and use of Appendix F are valid until the next refueling outage when the support(s) are to be restored to the FSAR criteria.
Issue Date: 10/31/91 9900 operability
For systems determined to be otherwise operable but which do not meet the above criteria, licensees should treat the systems or components as if inoperable until NRC approval is obtained for any additional criteria or evaluation methods used to determine operability. Where a piping support is determined to be inoperable, a determination of operability should be performed on the associated piping system.
6.14 Flaw Evaluation Regulation 10 CFR 50.55a(g) and Standard Technical Specification (STS) 3.4.10 (the section number may vary with plant specific TS) require that the structural integrity of ASME Code Class 1, 2, and 3 components be maintained according to Section XI of the ASME Code. In the conduct of inservice inspection, maintenance activities, or during plant operation, flaws in components will be discovered.
The operability of such systems containing flaws may depend on the flaw characterization or evaluation performed by the licensee and the acceptability of continued service of the component. Since the characterization and/or evaluation is vital to the determination of operability, the licensee's efforts following flaw detection must be prompt.
Components containing flaws characterized or determined to be within the acceptance standards in IWB-3500 (IWC-3500 for Class 2 components) of Section XI are acceptable for continued service and, although no determination of operability is necessary, reporting must be in accordance with regulatory requirements.
Upon discovery of a flaw exceeding the acceptance standards in IWB-3500 (IWC-3500 for Class 2 components), the licensee should promptly determine operability. The evaluation and acceptance criteria of IWB-3600 may be used in the determination.
For Class 3 moderate energy piping, i.e., Class 3 piping with a maximum operating temperature below 200 IF and a maximum operating pressure below 275 psig, the evaluation and acceptance criteria in Generic Letter 90-05 may be used.
The licensee may treat the system containing the flaw(s), evaluated and found to meet the acceptance criteria in IWB-3600, as operable until NRC approval in accordance with IWB-3600 is obtained. For Class 3 moderate energy piping, the licensee may treat the system containing the flaw(s), evaluated and found to meet the acceptance criteria in Generic Letter 90-05, as operable until relief is obtained from the NRC. The licensee must promptly submit its evaluation for either case to the NRC for review and approval.
Alternative evaluation procedures and/or acceptance criteria may also be used for flaws exceeding IWB-3600 or Generic Letter 90-05. When alternative evaluation procedures and/or acceptance criteria are used as a basis for acceptable continued service, the licensee must treat the system containing the flaw(s) as inoperable until NRC approval of procedures. and criteria is obtained. Prior to the approval, the plant must be placed in a safe condition or for systems in the TS, the plant must enter the corresponding Limiting Condition for Operation.
9900 Operability Issue Date: 10/31/91
6.15 Operational Leakaae If leakage develops in the reactor coolant system,notthere are additional requirements. The Technical Specifications (TS) do permit any pressure boundary leakage. The Operational Leakage Limiting Condition for Operation (LCO) must be entered upon discovery of pressure boundary leakage; therefore, an operability determination is not appropriate.
Article NB-2121 of Section III of the ASME Code excludes code requirements from materials not associated with the pressure retaining function of a component, such as packing and gaskets. However, leakage from the reactor coolant system is limited to specified values in the TS depending on whether the leakage is from identified, unidentified, or specific sources such as the steam generator tubes or reactor coolant system pressure isolation valves. If the leakage exceeds the TS limits, the LCO must be entered.
For reactor coolant system leakage within the limits of the TS, the licensee should determine operability for the degraded component and and include in the determination the effects of the leakage onto other components materials.
Furthermore, the regulations and TS require that the structural integrity of ASME Code Class 1, 2, and 3 components be maintained according 3 component to Section XI of the ASME Code. If a leak is discovered in a Class 1, 2, or in the conduct of inservice inspections, maintenance activities, or during plant operation, IWA-5250 of Section XI requires corrective measures be taken based on repair or replacement in accordance with Section XI. In addition, a through-wall flaw does not meet the acceptance criteria in IWB-3600.
Upon discovery of leakage from a Class 1, 2, or 3 component should pressure boundary (i.e., pipe wall, valve body, pump casing, etc.) the licensee declare the component inoperable. The only exception is for Class 3 moderate energy piping as discussed in Generic Letter 90-05. For Class 3 moderate energyevaluated piping, the licensee may treat the system containing the through-wall flaw(s), and found to meet the acceptance criteria in Generic Letter 90-05, as operable until relief is obtained from the NRC.
6.16 Structural Reouirements Category I structures and supports (referred to herein as structures) which are subject to periodic surveillance and inspection in accordance with the requirements of Technical Specifications (TS) shall be considered operable if the limits stipulated in the TS are met. If these limits are not met, the Limiting Condition for Operations (LCOs) are to be entered for the affected structure.
If the degradation affects the ability of the structure to provide the required design support for systems attached to the structure, an operability determination must be performed for these systems as well.
Degradation affecting Category I structures include, forwater example, concrete cracking and spalling, excessive deflection or deformation, leakage, rebar corrosion, missing or bent anchor bolts, etc. If these degradations are identified in Category I structures which are not subject to periodic Issue Date: 10/31/91 '19- 9900 Operability
'Il surveillance and inspection, they should be assessed by the licensee to determine the capability of these structures to perform their specified function. As long as the identified degradation does not result in the exceedance of acceptance limits specified in applicable design codes and standards, referenced in the design basis document, the affected structures are operable.
Significant degradations resulting in the exceedance of the acceptance limits must be promptly reported in accordance with the requirements in 10 CFR 50.72 and evaluated by the licensee for determination of operability. These evaluations should include the criteria used for the operability determination and the rationale for continued plant operation .n a degraded condition outside of the.
design basis. The licensee's evaluations should also include the plan for corrective action, as required by Criterion XVI of Appendix B to 10 CFR Part 50, to restore degraded structures to their original design requirements. As stated above, any system which depends upon the degraded structure for required support should also be examined for operability if the degradation or nonconformance calls into question the performance of the system. NRC inspectors, with possible support from headquarters, should review licensees' evaluations of structural degradations to determine their technical adequacy and conformance to licensing and regulatory requirements.
END 9900 Operability Issue Date: 10/31/91
i)
ENCLOSURE 3 LIST OF RECENTLY ISSUED GENERIC LETTERS Generic Date of Letter No. Subject Issuance Issued To 91-17 GENERIC SAFETY ISSUE 29, 10/17/91 ALL HOLDERS OF OP "BOLTING DEGRADATION OR LICENSES OR CONST FAILURE IN NUCLEAR POWER PERMITS FOR NUCLEAR PLANTSM POWER PLANTS 91-16 LICENSED OPERATORS' AND 10/03/91 HOLDERS OP LIC OR OTHER NUCLEAR FACILITY CONSTR. PERMITS FOR PERSONNEL FITNESS FOR DUTY NUC PWR/NPRs AND ALL LICENSED OPERATORS
& SENIOR OPERATORS 91-15 OPERATING EXPERIENCE 09/23/91 ALL POWER REACTOR FEEDBACK REPORT, SOLENOID- LICENSEES AND OPERATED VALVE PROBLEMS AT APPLICANTS US REACTORS 91-14 EMERGENCY TELECOMMUNICA- 09/23/91 ALL HOLDERS OF OP TIONS LICENSES OR CONST.
PERMITS 91-13 REQUEST FOR INFO RELATED 09/19/91 LICENSEES AND APPLI-TO RESOLUTION OF G1130, CANTS Braidwood, Byron "ESSENTIAL SERVICE WATER Catawba, Comanche Peak SYS FAILURES AT MUTLI-UNIT Cook, Diablo, McGuire SITES," PURSUANT TO 10CFR50.54(f) 91-12 OPERATOR LICENSING NAT. 08/27/91 ALL PWR REACTOR EXAMINATION SCHEDULE AND APPLICANTS FOR AN OPERATING LICENSE 91-11 RESOLUTION OF GENERIC 07/18/91 ALL HOLDERS OF ISSUES 48, "LCOs FOR CLASS OPERATING LICENSES 1E VITAL INSTRUMENT BUSES,"
and 49, INTERLOCKS AND LCOs FOR CLASS lE TIE BREAKERS" PURSUANT TO 10CFR50.54(f) 91-10 EXPLOSIVES SEARCHES AT 07/08/91 TO ALL FUEL CYCLE PROTECTED AREA PORTALS FACILITY LICENSEES WHO POSSESS, USE, IMPORT OR EXPORT FORMULA QUANTITIES OF STRATEGIC SPECIAL NUCLEAR MATERIAL 88-20 INDIVIDUAL PLANT EXAMINATION 06/28/91 ALL HOLDERS OF SUPP. 4 OF EXTERNAL EVENTS (IPEEE) OLs AND CPs FOR FOR SEVERE ACCIDENT VULNERA- NUCLEAR POWER BILITIES - 10 CFR 50.54 (f) REACTORS