ML042080035

NRC Regulatory Issue Summary 2004-XX: Revision to Guidance Formerly Contained in NRC Generic Letter 91-18, Information to Licensees Regarding Two NRC Inspection Manual Sections on Resolution of Degraded and Nonconforming Conditions and on O

ML042080035
Person / Time
Issue date:	07/27/2004
From:	Office of Nuclear Reactor Regulation
To:
Kavanagh K, DRIP/IROB, 415-3743
Shared Package
ML042080029	List: ML042080035
References
GL-91-018
Download: ML042080035 (44)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION OFFICE OF REACTOR REGULATION WASHINGTON, DC 20555-0001 NRC REGULATORY ISSUE

SUMMARY

2004-XX:

REVISION TO GUIDANCE FORMERLY CONTAINED IN NRC GENERIC LETTER 91-18, INFORMATION TO LICENSEES REGARDING TWO NRC INSPECTION MANUAL SECTIONS ON RESOLUTION OF DEGRADED AND NONCONFORMING CONDITIONS AND ON OPERABILITY Addresses All holders of operating licenses for nuclear power reactors, including those who have permanently ceased operations and have certified that fuel has been permanently removed from the reactor vessel.

Intent The U.S. Nuclear Regulatory Commission (NRC) is issuing this Regulatory Issue Summary (RIS) to inform licensees that the two sections of NRC Inspection Manual Part 9900, Technical Guidance, Operable/Operability: Ensuring the Functional Capability of a System or Component and Resolution of Degraded and Nonconforming Conditions, have been revised and combined into one document. The revised inspection guidance reflects relevant changes that have been made to NRC regulations and NRC policies and practices, and clarifies selected issues based on operating experience. This RIS requires no action or written response on the part of an addressee.

Background Information NRC staff inspection guidance on operability is contained in NRC Inspection Manual Part 9900, Technical Guidance, Operable/Operability: Ensuring the Functional Capability of a System or Component. This guidance was previously provided to licensees in Generic Letter (GL) 91-18, issued on November 7, 1991.

NRC staff inspection guidance on the resolution of degraded and nonconforming conditions at licensed reactor facilities is contained in NRC Inspection Manual Part 9900, Technical Guidance, Resolution of Degraded and Nonconforming Conditions. This guidance was also provided to licensees in GL 91-18, and an updated version was provided in Revision 1 of GL 91-18, which was issued on October 8, 1997. The purpose of Revision 1 of GL 91-18 was to more explicitly discuss the role of the 10 CFR 50.59 evaluation process in the resolution of degraded and nonconforming conditions.

NRC Inspection Manual, Part 9900, Technical Guidance, Operability Determinations and Resolution of Nonconformances of Structures, Systems, and Components, provides guidance to NRC inspectors for reviewing the actions of licensees to deal with questions about the ML042080035

RIS 2004-XX Page 2 of 3 operability of structures, systems, and components (SSCs) and to establish acceptable conditions following the discovery of degraded and nonconforming conditions in SSCs. The NRC requirements for operability of SSCs, as stated in technical specifications (TSs), and for resolving degraded and nonconforming conditions affecting the SSCs may collectively be viewed as a process for licensees to stay in conformance with their TS requirements, and to develop a basis for continued operation or place the facility in a safe condition and take prompt corrective action when conditions warrant. This process has not fundamentally changed since the previous version of the Part 9900 guidance. The attached revised Part 9900 guidance updates information that has changed as a result of changes to regulations or to NRC policies and procedures. This guidance supercedes the guidance previously provided by GL 91-18 and Revision 1.

Summary of Issue The NRC recently reviewed this inspection guidance to assess its currency and concluded that the guidance needed to be updated to reflect regulatory changes, including the implementation of the revised reactor oversight process (ROP), the requirement that licensees appropriately assess and manage risk related to proposed maintenance activities (10 CFR 50.65(a)(4)), and implementation of the revision of 10 CFR 50.59. The update describes in general terms the interrelations between operability determinations and resolution of degraded and nonconforming conditions with 10 CFR 50.65 and 10 CFR 50.59, to better define the scope of the guidance and to remove ambiguity in the change control process. The update also clarifies selected issues in the guidance based on operating experience.

In addition, the NRC concluded that the two documents were closely related and would be clearer if combined and made more process-oriented. The attachment to this RIS contains the revised Part 9900 section covering both operability and the resolution of degraded and nonconforming conditions.

Backfit Discussion This RIS requires no action or written response and, therefore, is not a backfit under 10 CFR 50.109. Consequently, the staff did not perform a backfit analysis.

Federal Register Notification A notice of opportunity for public comment was published in the Federal Register on , 2004 (XX FR xxxxx), to give interested parties an opportunity to suggest ways for improving the guidance. The staff concludes that this RIS and the attached NRC inspection guidance are informational and pertain to a staff position that does not represent a departure from current regulatory requirements and practices.

ML042080035

RIS 2004-XX Page 3 of 3 Paperwork Reduction Act Statement This RIS does not request any information collection.

Please refer any questions that you may have about this matter to the technical contact identified below.

Bruce Boger, Director Division of Inspection Program Management Office of Nuclear Reactor Regulation Technical

Contact:

Kerri Kavanagh, NRR 301-415-3743 E-mail: kak@nrc.gov Attachments:

1. NRC Inspection Manual Part 9900: Technical Guidance, Operability Determinations and Resolution of Nonconformances of Structures, Systems, and Components.

2. List of Recently Issued NRC Regulatory Issue Summaries

NRC INSPECTION MANUAL IROB PART 9900: TECHNICAL GUIDANCE OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS Issue date: 9900 combined

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS 1.0 INTENT (new) 2.0 SCOPE/APPLICABILITY (revised) 3.0 DEFINITIONS 3.1 Current Licensing Basis 3.2 Design Basis (revised) 3.3 Operability (revised) 3.4 Functionality (new) 3.5 Specified Safety Function(s) and Specified Function(s) (revised) 3.6 Support Systems and Operability (revised) 3.7 Variations of Operability Definition in Plant-Specific TS 4.0 IDENTIFICATION OF DEGRADED OR NONCONFORMING CONDITIONS 4.1 Review Activities (revised) 4.2 Degraded Condition (revised) 4.3 Nonconforming Condition (revised) 4.4 Fully Qualified (revised) 5.0 OPERABILITY DETERMINATIONS 5.1 Timing of Operability Determinations (revised) 5.2 Immediate Determination (revised) 5.3 Prompt Determination (revised) 5.4 Reasonable Expectation (new) 5.5 Circumstances Requiring Operability Determinations (revised) 5.6 Scope of Determinations/Comparison to Current Licensing Basis (revised) 5.7 Presumption of operability (new) 5.8 Documentation (new)

Issue Date: -i- 9900 Revised

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS 6.0 CONTINUING OPERATIONS WITH DEGRADED AND NONCONFORMING CONDITIONS 6.1 Operable But Degraded (revised) 6.2 Operability and Corrective Actions to Restore Full Qualification are Separate Issues (revised) 6.3 Enforcement Discretion/Justification for Continued Operations (revised) 7.0 CORRECTIVE ACTION 7.1 The Current Licensing Basis and 10 CFR 50, Appendix B (revised) 7.2 Timing of Corrective Actions (new) 7.3 Compensatory Measures (revised) 7.4 Final Corrective Action (revised) 7.4.1 Change to Facility or Procedures in Lieu of Restoration (revised) 7.4.2 Change to the Current Licensing Basis (revised)

Appendix A SURVEILLANCES A.1 Operability During TS Surveillances A.2 Surveillance and Operability Testing in the Safety Configuration A.3 Missed Technical Specification Surveillance (revised)

Appendix B MAINTENANCE B.1 Assessment and Management of Risk During Maintenance (new)

B.2 Operability During Maintenance (revised)

B.3 Relationship Between Operable and Available with Respect to the ROP Performance Indicators (PIs) (new)

B.4 Aging Component Reliability and Connection to the Maintenance Rule (new)

Appendix C SPECIFIC OPERABILITY ISSUES C.1 Relationship Between the General Design Criteria and the Technical Specifications (new)

C.2 Treatment of Single Failures in Operability Determinations 9900 Revised - ii - Issue Date:

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS C.3 Treatment of Consequential Failures in Operability Determinations C.4 Use of Alternative Analyses in Operability Determinations (new)

C.5 Use of Manual Action in Place of Automatic Action C.6 Use of Probabilistic Risk Assessment in Operability Decisions C.7 Environmental Qualification (revised)

C.8 Technical Specification Operability vs. ASME Code,Section XI Operative Criteria C.9 Support System Operability (revised)

C.10 Piping and Pipe Support Requirements C.11 Flaw Evaluation (revised)

C.12 Operational Leakage (revised)

C.13 Structural Requirements C.14 Use of an Alternative Source Term in Operability Determinations (new)

Issue Date: - iii - 9900 Revised

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS 1.0 INTENT The Code of Federal Regulations and a plants operating license, including its technical specifications, provide requirements for safety related structures, systems, and components (SSCs) to ensure that plant operation does not pose an undue risk to public health and safety. Although these provide a wide spectrum of requirements to limit the risk of plant operation on the public, they cannot possibly address all conceivable events or conditions that may arise or be discovered during plant operation.

Operators should be continuously aware of the status of the SSCs of their facilities. The intent of operability determinations is for licensed operators to make timely determinations concerning whether SSCs can perform their specified function(s) upon discovery of degraded or nonconforming conditions. Specified functions are those described in the current licensing basis (CLB) for these facilities.

Plant staff that are knowledgeable in the subject matter and possess appropriate knowledge of plant operations should make the operability determinations for the facility. This means licensed operators because they are the individuals responsible for operating the plant. However, individuals in other organizations such as Engineering or Licensing may assist in performing operability determinations.

Operators should focus their immediate and primary attention to safety of the plant. Whether explicitly discussed in plant documentation or not, when a degraded or nonconforming condition is identified that may pose an immediate threat to public health and safety, the plant should be placed in a safe condition. In addition, for unusual circumstances, the licensee must take whatever action is necessary to limit the risk to public health and safety, in a manner that is consistent with that provided by the regulations. Furthermore, while an operability determination is being made, operators must have a reasonable expectation that the system is operable and that the determination will support that expectation. Finally, reporting and procedural requirements should not interfere with ensuring the health and safety of the public.

This guidance is for NRC inspectors in its review of licensee determinations of operability. However, many facilities have elected to use this guidance in developing their plant processes for operability determinations. Although this guidance generally reflects existing staff practices, it may not be directly applicable at specific plants. Consequently, significant differences among licensee practices should be discussed with NRC management to ensure that the intent of this guidance is met, and that the guidance is applied in a reasonable and consistent manner for all licensees.

If, during an inspection, an NRC inspector obtains information reasonably indicating a possible degraded or nonconforming condition affecting any of the SSCs listed in Section 2.0, the inspector should promptly inform the appropriate level of licensee management so that the licensee can promptly evaluate the operability or functionality of the SSCs as appropriate.

2.0 SCOPE/APPLICABILITY Licensees that hold an operating license, including those who have permanently ceased operations and have certified that fuel has been permanently removed from the reactor vessel, and all holders Issue Date: 9900 Revised

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS of operating licenses for nonpower reactors, including those whose licenses no longer authorize operation, should have a process to make determinations of operability and functionality when degraded or nonconforming conditions affecting its SSCs are identified.

This guidance is applicable to any of the following SSCs which includes SSCs in plant TS and support SSCs (specifically, the related functions that support the SSCs in plant TS). In addition, as part of an effective program for problem identification and corrective action, licensees should also assess any degraded or nonconforming conditions to determine the functionality of SSCs that are not in plant TS, consistent with the safety significance.

(i) Safety-related SSCs. As defined in 10 CFR 50.49(b)(1), these SSCs are relied upon to remain functional during and following design basis events to ensure (A) the integrity of the reactor coolant pressure boundary, (B) the capability to shut down the reactor and maintain it in a safe shutdown condition, or (C) the capability to prevent or mitigate the consequences of accidents that could result in potential offsite exposures comparable to the 10 CFR Part 100 guidelines. Design basis events are conditions of normal operation, including anticipated operational occurrences, design basis accidents, external events, and natural phenomena for which the plant must be designed to ensure satisfactory accomplishment of functions (A) through (C).

(ii) All SSCs whose failure could prevent satisfactory accomplishment of any of the required functions identified in (i), (A) through (C).

(iii) All SSCs relied on in the safety analyses or plant evaluations that are a part of the plant's CLB. Such analyses and evaluations include those submitted to support license amendment requests, exemption requests, or relief requests, UFSAR changes, and those analyses and evaluations submitted to demonstrate compliance with the Commission's regulations such as those for combustible gas control (10 CFR 50.44), fire protection (10 CFR 50.48), environmental qualification (10 CFR 50.49), pressurized thermal shock (10 CFR 50.61), anticipated transients without scram (10 CFR 50.62), and station blackout (10 CFR 50.63).

(iv) Any SSCs subject to 10 CFR Part 50, Appendix B, Quality Assurance Criteria for Nuclear Power Plants and Fuel Processing Plants.

(v) Any SSCs subject to 10 CFR Part 50, Appendix A, Criterion 1, Quality Standards and Records.

(vi) Any SSCs explicitly subject to facility technical specifications (TS).

(vii) Any SSCs subject to facility TS through the definition of operability (i.e., support SSCs outside TS).

(viii) Any SSCs within the scope of the Maintenance Rule (10 CFR 50.65).

3.0 DEFINITIONS 3.1 Current Licensing Basis 9900 Revised Issue Date:

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS Current licensing basis (CLB) is the set of NRC requirements applicable to a specific plant, and a licensee's written commitments for ensuring compliance with, and operation within, applicable NRC requirements and the plant-specific design basis (including all modifications and additions to such commitments over the life of the license) that are docketed and in effect. The CLB includes the NRC regulations in 10 CFR Parts 2, 19, 20, 21, 26, 30, 40, 50, 51, 54, 55, 72, 73, 100 and appendices thereto; orders; license conditions; exemptions, and technical specifications. It also includes the plant-specific design basis information defined in 10 CFR 50.2 as documented in the most recent UFSAR as required by 10 CFR 50.71 and the licensee's commitments remaining in effect that were made in docketed licensing correspondence such as licensee responses to NRC bulletins, generic letters, and enforcement actions, as well as licensee commitments documented in NRC safety evaluations or licensee event reports.

3.2 Design Basis Design basis is that body of plant-specific design information defined by 10 CFR 50.21 and documented in the most recent UFSAR (as required by 10 CFR 50.71). The design basis of safety related SSCs was initially established during original plant licensing and relates primarily to the accident mitigation functions of safety related SSCs as described in the plants accident analysis.

The design basis of safety related SSCs is a subset of its licensing basis.

3.3 Operability The Standard Technical Specifications (STS) define OPERABLE or OPERABILITY as follows:

"A system, subsystem, train, component, or device shall be OPERABLE or have OPERABILITY when it is capable of performing its specified safety functions, and when all necessary attendant instrumentation, controls, normal or emergency electrical power, cooling and seal water, lubrication and other auxiliary equipment that are required for the system, subsystem, train, component, or device to perform its function(s) are also capable of performing their related support function(s)."

An SSC must be capable of performing the specified safety function(s) required by its design and licensing bases, within the required range of physical conditions for its safety mission and the required initiation time and duration. In addition, the SSCs technical specification operability requirement requires the SSC to meet all its surveillance requirements, which are related to its underlying safety mission for accident mitigation purposes. An SSC that does not meet a surveillance requirement shall be declared inoperable. For the purposes of operability determinations, the mission time is the duration of SSC operation, following an accident, that the UFSAR accident analysis credits an SSC in performing its safety function.

3.4 Functionality 1

Guidance and examples for identifying 10 CFR 50.2 design bases are contained in Regulatory Guide 1.186, which endorses Appendix B to the Nuclear Energy Institute (NEI) document NEI 97-04, Guidance and Examples for Identifying 10 CFR 50.2 Design Bases.

Issue Date: 9900 Revised

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS The term functionality is used when referring to SSCs not explicitly included in plant TS. It refers to the ability of these SSCs to perform their designed functions. The designed function is not limited to either the function described in the UFSAR or 10 CFR 50.2. Although this guidance is worded to reflect assessment of SSCs in plant TS, the principles in this guidance for timely assessment of whether SSCs can perform their specified functions are also applicable to the SSCs that are not in plant TS. This assessment and the resolution of degraded or nonconforming conditions are part of an effective licensee problem identification and corrective action program.

3.5 Specified Safety Function(s) and Specified Function(s)

Specified safety functions of SSCs are the safety function(s) discussed in the CLB for the facility.

The specified safety function(s) of SSCs are usually stated in the plant UFSAR and the Bases of the TS.

Specified function(s) of SSCs are the functions performed by some SSCs with safety functions and by those SSCs without safety functions. The specified safety functions of SSCs are a subset of all specified functions for the SSCs.

An SSC meets its specified function when it can perform as designed, tested, and maintained.

When SSC capability or reliability is degraded to a point where there is no longer reasonable assurance it can perform its specified functions, the SSC should be judged inoperable or not functional, even if at this instantaneous point in time the system could provide the specified function.

For an example, see Appendix C.8, which discusses ASME Section XI. A reliability reduction that calls into question the ability of an SSC to perform its specified safety function should also trigger an operability determination.

3.6 Support Systems and Operability SSCs in TS can perform their specified safety functions only when all necessary support systems are capable of performing their related support functions. When a support system that is not explicitly addressed in TS is determined to be incapable of performing its necessary support function(s), all specified systems that require the support system to function in order to be operable must immediately be declared inoperable and the TS LCOs for those systems must immediately be entered. The licensee must take the appropriate remedial measures specified by the supported system TS LCO required actions.

For those licensees with the improved standard technical specifications, STS LCO 3.0.6 provides the requirements for supported system LCOs that are not met solely due to the support system LCO not being met. Specifically, STS LCO 3.0.6 states:

When a supported system LCO is not met solely due to a support system LCO not being met, the Conditions and Required Actions associated with this supported system are not required to be entered. Only the support system LCO ACTIONS are required to be entered.

This is an exception to LCO 3.0.2 for the supported system. In this event, an evaluation shall be performed in accordance with Specification 5.5.15, "Safety Function Determination Program (SFDP)." If a loss of safety function is determined to exist by this program, the appropriate Conditions and Required Actions of the LCO in which the loss of safety function exists are required to be entered.

9900 Revised Issue Date:

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS When a support systems Required Action directs a supported system to be declared inoperable or directs entry into Conditions and Required Actions for a supported system, the applicable Conditions and Required Actions shall be entered in accordance with LCO 3.0.2.

3.7 Variations of Operability Definition in Plant-Specific TS There are several variations in existing plant specific TS of the above basic definition. Therefore, some judgement is required in application of this guidance on operability. Word differences that exist are not viewed by the NRC to imply any significant overall difference in application of the plant specific TS. Any problems that result from existing inconsistencies between a plant-specific definition of operability and this guidance should be discussed with regional managers, who should discuss the issues with NRR if deemed necessary. In all cases, a licensee's plant-specific definition is governing.

4.0 IDENTIFICATION OF DEGRADED OR NONCONFORMING CONDITIONS 4.1 Review Activities The process of reviewing the performance of SSCs and ensuring their operability is continuous.

Many plant processes provide for continuous and ongoing review of SSCs, where degraded or nonconforming conditions may be identified. These activities include, but are not limited to, the following:

C Day-to-day operation of the facility C Implementation of programs such as inservice testing and inspection C Plant walkdowns or tours C Observations from the control room C Quality assurance activities such as audits and reviews C Engineering design reviews including design basis reconstitution.

C Maintenance activities C Actual equipment performance (including common mode failures)

C Review of operational events C Design modifications to facilities C Examinations of records C Additions to facilities C Vendor reviews or inspections C Plant system walkdowns C Operational experience reports C Part 21 notifications Performance of TS surveillances also periodically verify that SSCs are operable. Performance of the surveillance requirement is usually considered to be sufficient to demonstrate operability, provided that there is reasonable assurance that the system continues to conform to all appropriate criteria in the CLB. However, whenever conformance to the appropriate criteria in the CLB is called into question, performance of the surveillance requirement alone is usually not sufficient to determine operability.

Issue Date: 9900 Revised

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS When any processes indicate a potential degraded or nonconforming condition, the plant must assess the operability of any affected SSCs. An example could be a TS surveillance that passed the given test, but the results exhibited a degrading trend.

4.2 Degraded Condition A condition of an SSC, potentially affecting operability or functionality, in which quality or functional capability has been reduced. Examples of conditions that can reduce the capability of a system include, but are not limited to, aging, erosion, corrosion, improper operation or maintenance.

4.3 Nonconforming Condition A condition of an SSC, potentially affecting operability or functionality, that involves a failure to meet requirements or licensee commitments because of such factors as improper design, testing, construction, or modification. The following are examples of nonconforming conditions:

C An SSC fails to conform to one or more applicable codes or standards specified in the CLB (e.g., CFR, operating license, technical specifications, UFSAR, and licensee commitments).

C As-built equipment or as-modified equipment does not meet UFSAR design requirements.

C Operating experience or engineering reviews demonstrate a design inadequacy.

C Documentation required by NRC requirements such as 10 CFR 50.49 is unavailable or deficient.

4.4 Fully Qualified An SSC is considered fully qualified when it conforms to all aspects of its CLB, including meeting all applicable codes and standards, design criteria, safety analyses assumptions and specifications, and licensing commitments. Operation with fully qualified SSCs ensures that safety margins are maximized.

The table below illustrates the terminology used to describe the status of SSCs when degraded or nonconforming conditions are identified and evaluated. Operable refers to SSCs that are in TS and functional refers to those SSCs that are not in TS. For SSCs not in TS, the assessment of functionality and the resolution of degraded or nonconforming conditions are part of an effective licensee problem identification and corrective action program.

State of SSCs in plant TS SSCs not in TS Qualification Fully Qualified Operable Functional Condition exists, Operable but degraded Functional but degraded but only affects margin 9900 Revised Issue Date:

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS Condition exists Operable but degraded Functional but degraded affecting function, but SSC deter-mined able to per-form function Condition exists Not Operable Not Functional affecting function, and SSC deter-mined not able to perform function The SSCs defined in Section 2 are designed and operated, as described in the CLB, to include design margins and engineering margins of safety to ensure, among other things, that some loss of quality does not mean immediate failure. The CLB includes commitments to specific codes and standards, design criteria, and some regulations that also dictate margins. Many licensees add conservatism so that a partial loss of quality does not affect their commitments to the margins. The loss of conservatism not taken credit for in the safety analyses and not committed to by the licensee to satisfy licensing requirements does not require a system to be declared inoperable. All other losses of quality or margins are subject to a prompt operability determination and corrective action.

5.0 OPERABILITY DETERMINATIONS Determinations of operability are appropriate whenever a review, TS surveillance, or other indication calls into question the SSCs ability to perform its specified safety function. If an immediate threat to public health and safety is identified, action to place the plant in a safe condition should be completed expeditiously.

Plant staff that are knowledgeable in the subject matter and possess appropriate knowledge of plant operations should make the operability determinations for the facility. This means licensed operators because they are the individuals responsible for operating the plant. However, individuals in other organizations such as Engineering or Licensing may assist in performing operability determinations.

The processes displayed in the attached flowchart, Generic Letter 91-18 Assistance Navigator, identifies paths that a licensee may follow for operability and functionality determinations, and to resolve degraded and nonconforming conditions. [Note: this flowchart is still under development.]

5.1 Timing of Operability Determinations Timeliness of operability determinations should be commensurate with the safety significance of the issue. The completion times2 contained in TS generally provide reasonable guidelines for safety 2

Section 1.3 of the Standard Technical Specifications describes the Completion Time as the amount of time allowed for completing a Required Action, and does not define an allowed outage time (AOT). Allowed outage time is a vernacular term for completion time. Regardless, they are referenced to the time of discovery of a situation (e.g., inoperable equipment or variable Issue Date: 9900 Revised

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS significance. This generally occurs in two steps called immediate and prompt operability determinations.

5.2 Immediate Determination An immediate determination of SSC operability should be made by licensed operators at the time a potential degraded or nonconforming condition is identified. In most cases, it is expected that the decision can be made immediately (e.g., loss of motive power, etc.) even though complete information may not be available. The immediate determination should be based on the best information available. An immediate determination concluding that the SSC is operable must be predicated on the licensees reasonable expectation that the SSC is operable, and that the prompt determination will support that expectation. If reasonable expectation of operability does not exist utilizing the best available information at any time during the operability determination process, the component shall be declared inoperable. The immediate operability determination should be revised as appropriate, as new or additional information becomes available.

5.3 Prompt Determination Subsequent to the immediate operability determination, a prompt operability determination should be made by licensed operators. Other groups, such as Engineering or Licensing, may be required to provide input into the prompt operability determination. For SSCs in TS, 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is usually a reasonable time frame for completion of the prompt operability determination. However, the completion times contained in TS provide reasonable guidelines for safety significance of the SSC.

The safety significance of the SSC may be used as part of a reasonable safety justification to extend the completion time of the prompt determination to the completion time specified in TS. In all cases, a reasonable expectation of operability must exist while the prompt determination is completed.

For those SSCs with completion times less than or equal to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, where a reasonable expectation of operability exists, the prompt determination of operability should be completed within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. In each case noted above, the operability decision shall be reevaluated as more information is received.

In all cases, the operability determination should be completed within the time frames discussed above. Where there is reason to question that the determination process is not, or was not prompt, the Region may discuss with the licensee, with NRR consultation as appropriate, the reasoning for the perceived delay.

5.4 Reasonable Expectation When a licensee has cause to question the operability of an SSC, the determination process must be predicated on the licensees reasonable expectation that the SSC is operable and the operability determination process will support that expectation. In this case, reasonable expectation does not mean absolute assurance that the SSC is operable, however, the SSC should be more likely than not operable. Regardless, there is no indeterminate state of operability. An SSC is either operable or inoperable at all times.

not within limit) that requires entering an ACTIONS Condition unless otherwise specified, providing the unit is in a MODE or specified condition stated in the Applicability of the LCO.

9900 Revised Issue Date:

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS 5.5 Circumstances Requiring Operability Determinations At a minimum, licensees should make an operability determination in the following circumstances:

C Discovery of degraded conditions of equipment where performance is called into question.

C Discovery of nonconforming conditions where the qualification of equipment (such as conformance to codes and standards) is called into question.

C Discovery of an existing but previously unanalyzed condition or accident. Upon discovery of an existing but previously unanalyzed condition or accident that significantly degrades plant safety, the licensee is required to report it in accordance with 10 CFR 50.72 and 50.73, and put the plant in a safe condition. For a previously unanalyzed condition or accident that is considered a significant safety concern, but is not part of the design basis, the licensee may subsequently be required to take additional action after consideration of backfit issues (See 10 CFR 50.109(a)(5)).

C Discovery of an error in a design calculation, a nonconformance with an industry standard specified in the CLB, or an incorrect underlying assumption for ensuring the operability of an SSC. In some cases, a design calculation or industry standard is used to define surveillance acceptance criteria but the specifics are not explicitly included in the TS (e.g.,

the TS surveillance requirement is to verify a capability for providing power or cooling and a reference document or the TS bases discuss the details of how this is determined).

C Discovery of the introduction of discrepancies that can result in the affected requirement being nonconservative. Guidance related to nonconservative TS is provided in Administrative Letter 98-10, Dispositioning of Technical Specifications That Are Insufficient to Assure Plant Safety. If a licensee does not satisfy an LCO or surveillance requirement that is included explicitly in the TS, then associated actions should be taken or relief should be sought.

5.6 Scope of Determinations/Comparison to Current Licensing Basis The scope of the prompt operability determination needs to be sufficient to address the capability of the equipment to perform its specified function(s) consistent with its 10 CFR 50.2 design bases, including acceptance criteria. The licensee should examine the full scope of the current licensing basis (CLB), including the TS and UFSAR commitments, to establish the conditions and performance requirements to be met for determining prompt operability. The prompt operability decision may be based on analysis, a test or partial test, experience with operating events, engineering judgement, or a combination of these factors taking into consideration equipment functional requirements. Prompt operability determinations should therefore consider the following actions:

C Determine what equipment is degraded or nonconforming.

C Determine the safety function(s) performed by the equipment.

C Determine the effect or potential effect of the degraded or nonconforming condition on the plant.

Issue Date: 9900 Revised

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS C Determine the circumstances of the degraded on nonconforming condition, including the possible failure mechanism, and the extent of the condition in the plant.

C Determine the requirement or commitment established for the equipment, and why the requirement or commitment may not be met.

C Determine by what means and when the nonconforming equipment was first discovered.

C Determine safest plant configuration including the effect of transitional action.

C Determine if SSC operability is established and the basis for the determination, including any additional actions or measures put in place to establish or restore operability (note:

manual actions must be thoroughly evaluated in accordance with guidance provided in Information Notice 91-78).

When performing operability determinations, the following should be kept in mind.

C Design basis events are plant specific, and technical specifications, bases, and safety evaluations may contain plant-specific considerations related to operability.

C The system operability requirements that are based on safety analysis of specific design basis events for one mode or specified condition of operation may not be the same for other modes or conditions of operation, so all applicable modes and conditions of operation should be considered.

C An SSCs operability requirements extend to its necessary support systems regardless of whether the TSs explicitly specify operability requirements for those support systems.

C The operability of necessary support systems does not include consideration of the occurrence of multiple (simultaneous) design basis events.

5.7 Presumption of Operability The TS are organized and implemented presuming a system is operable. The licensee should examine carefully the specific circumstances of each presumption of operability. The presumption of operability might be appropriate, if: 1) the record of the results of a test or surveillance is found to be missing, 2) the data results are not required for trending that might require the system to be declared inoperable (such as that required by ASME Section XI for pumps and valves), and 3) plant conditions prevent the licensee from performing the activity again. If in such a case, the licensee has other methods to verify that the activity was in fact successfully accomplished (i.e., log entries) such a judgement might be appropriate. However, it would be inappropriate to presume operability based simply on the fact that an analysis had yet to demonstrate inoperability in a case where the mounting evidence suggests that the system cannot perform its specified safety function. Thus, reasonable expectation of operability and presumption of operability are based largely on judgements made from specific set of facts.

Without any information to the contrary, once a component or system is established as operable, it is reasonable to assume that the component or system should continue to remain operable, and the previously stated verifications should provide that assurance.

9900 Revised Issue Date:

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS Operability is presumed in the 24-hour or specified frequency extension for completing a missed surveillance discussed in Appendix A.3 of this document and in GL 87-09. In allowing up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to perform the missed surveillance and delaying the LCO action requirement for a system defined as inoperable in the TS, the GL 87-09 guidance presumes the system will perform its specified safety function because of the history of successfully completed surveillances and the absence of other information indicating an operability problem. For those licensees who have adopted STS SR 3.0.4, the performance of the missed surveillance can be delayed greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> only when a risk evaluation is performed and the risk impact managed.

5.8 Documentation The immediate determination of operability should include information related to the degraded or nonconforming condition and the licensees basis for the reasonable expectation of operability. This determination should be documented but need not be extensive. The documentation can use plant record systems, such as, operator logs, corrective action program, or the licensees operability determination program.

The prompt operability determination should be documented and available for inspection.

Supporting calculations for the operability determinations, if not included in the operability documentation, should be appropriately referenced and available for inspection. This documentation should describe the scope and basis of the determination, which may include items discussed in Section 5.6.

If a licensee uses engineering judgement to help determine safety significance, operability, or qualification, the licensee should document the judgement in sufficient detail so that an individual knowledgeable in the technical discipline of the judgement would be able to review and understand its basis. For example, simple documentation of the assumptions would be sufficient for a very obvious judgement, while detailed calculations may be needed to support more complex judgements. An inadequately documented engineering judgement, no matter how sound, cannot be independently scrutinized and so the basis for it could be misunderstood by individuals later working on the affected SSC. In the worst case, the engineering judgement could be inadvertently invalidated by later changes to the equipment or supporting analyses and calculations.

6.0 OPERATIONS BASED ON OPERABILITY DETERMINATIONS 6.1 Not Operable If any SSCs in TS have been determined to be not operable, then the appropriate Action Statements in the TS should be entered. [Similarly, if SSCs not in TS have been determined to be not functional, then the appropriate corrective actions should be taken.]

6.2 Operable But Degraded or Nonconforming If any SSCs in TS have been determined to be operable, although a degraded or nonconforming condition is present, the SSCs are considered operable but degraded or nonconforming. [Similarly, SSCs not in TS that have been determined to be functional, although a degraded or nonconforming condition is present, are considered functional but degraded or nonconforming. ] For example, an SSC may be operable and not meet all of its qualification requirements (e.g. a safety related SSC with a 30 day post-accident EQ requirement, but an actual EQ life of only 7 days, may be found Issue Date: 9900 Revised

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS to be operable if it meets its 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> time requirement specified in its design basis accident analysis). Operation at this level ensures that adequate safety margins are maintained.

SSCs that determined to be operable but degraded or nonconforming are considered to be in compliance with the TS, and licensees may continue operation.3 This is consistent with the plant TS being the controlling document for making decisions about plant operations. However, corrective actions must be taken to correct the degraded or nonconforming condition commensurate with the safety significance of the issues, as discussed in Section 7, Corrective Actions.

The prompt operability determination for the degraded or nonconforming condition, as documented per Section 5.8, essentially constitutes a basis for continuing operations. This evaluation should continue to be reviewed in an ongoing manner until corrective actions are successfully completed.

SSCs that have been determined operable through an operability determination may be considered to remain operable as long as required surveillances continue to be met and information does not exist that would invalidate the reasonable expectation of operability established in the determination.

There may be situations where a licensee finds itself in noncompliance with a regulation, and the noncompliance is not addressed by the operating license or the TS. In such situations, the licensee should determine if there is an immediate safety issue as a result of the noncompliance. Corrective actions should be commensurate with the safety significance of the noncompliance; immediate action such as shutting down the plant may not be required, unless otherwise specified by NRC requirements. The licensee should further determine if any other NRC requirements apply to the situation (e.g., 10 CFR Part 50, Appendix B, Criterion XVI, or 10 CFR 50.12) and take the required action.

6.2.1 Operability and Corrective Actions to Restore Full Qualification are Separate Issues Operability determinations are intended to result in timely decisions or actions pertaining to continued plant operation when degraded or nonconforming conditions are identified, while actions to restore qualification are intended to be part of a corrective actions. The principle of treating operability and restoration of qualification as separate issues is to emphasize that operability determinations are focused on safety and should not be delayed by decisions or actions necessary to fully plan or implement the corrective action (i.e., restore full qualification).

However, qualification concerns, whether due to degraded and nonconforming conditions, can and should be promptly considered to determine the effect of the concern on the operability of the SSC.

A licensees corrective action program should restore the SSC to full qualification in a timely manner commensurate with the safety significance.

6.3 Enforcement Discretion/Justification for Continued Operations Under certain limited circumstances, the licensee may find that strict compliance with the TS or a license condition would cause an unnecessary plant action that is not in the best interest of public 3

An exception to this general statement is the case of a facility that is experiencing significant performance problems that have led to issuance of a confirmatory action letter or order preventing that licensee from continuing to operate or resuming operation until approval is granted by the NRC.

9900 Revised Issue Date:

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS health and safety. NRC review and approval is required before the licensee takes actions that are not in compliance with the license conditions or the TS, except in certain emergency situations when 10 CFR 50.54(x) and (y) are applied. This review can be in the form of a Notice of Enforcement Discretion (NOED), which is discussed in more detail in Inspection Manual Chapter Part 9900.

The phrase Justification for Continued Operation (JCO) has been used by NRC in past guidance and by some licensees to refer to a licensees technical basis for requesting authorization from the NRC to operate in a manner that is prohibited (e.g., by TS or the operating license). However, with the exception of the provisions in 10 CFR 50.49 for equipment qualification and certain generic communications described below, the NRC no longer uses the phrase JCO.

Certain NRC generic communications may provide direction on how to establish bases for continued operation for specific issues, but licensees may not need to submit these determinations to the NRC.

The determinations in Generic Letter 88-07, Environmental Qualification of Electrical Equipment, and Generic Letter 87-02, Seismic Adequacy, are referred to as JCOs. Licensees should continue to follow existing guidance regarding the preparation and use of these determinations for these specific issues.

7.0 CORRECTIVE ACTION 7.1 The Current Licensing Basis and 10 CFR 50, Appendix B When licensing a plant, the NRC reviews the design information submitted by a license applicant to assure that the plant meets NRC rules and regulations (e.g., the licensing basis). The NRC issues a license authorizing the licensee to operate and maintain the plant in accordance with NRC rules and regulations, the conditions of the license, and plant TS. Licensee operation and maintenance of the plant in accordance with the license, and any changes to the license, ensures that the basis for NRC approval of the plant design (e.g., the CLB) remains valid.

The NRC has established various processes for making changes to the plant design in a controlled manner. Changes to the license and TS can be made as part of license amendments. Licensees may make changes to a facility in accordance with 10 CFR 50.59. In addition, for significant conditions adverse to quality, licensees are required by Criterion XVI of 10 CFR Part 50, Appendix B, to promptly identify and correct the conditions, and take action to prevent recurrence. When resolving degraded and nonconforming conditions as part of the corrective action, licensees may make changes to a facility in accordance with these processes.

The NRC has also established requirements for plant operation and maintenance within the CLB.

For degraded or nonconforming conditions of SSCs in TS, the license and TS normally specify the required actions to meet NRC requirements. For SSCs not in TS, the licensee should have reasonable expectation that the SSCs are functional. In addition, the NRC is kept informed of events and issues resulting from plant operations in part by establishing reporting requirements in the TS, 10 CFR 50.72, 50.73, 50.9(b), 10 CFR Part 21, or by other parts of the CFR.

For maintenance, 10 CFR 50.65 may also specify additional requirements for SSCs including risk assessments, enhanced monitoring, and repair and/or replacement activities. In addition, in instances when a risk significant SSC (as defined in the licensees 10 CFR 50.65(a)(4) program) is degraded or nonconforming, a risk assessment equivalent to that performed in accordance with 10 CFR 50.65(a)(4), should be completed to determine the potential change in the plants risk Issue Date: 9900 Revised

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS profile. If a risk significant change would be encountered, a review of potential contingency plans for entering an increased risk profile should be completed as well as a review of ongoing and planned maintenance evolutions.

Collectively, these requirements may be viewed as a process for licensees to continue to operate in accordance with their CLB, or place the plant in a safe condition and take prompt corrective action. The guidance in this document is consistent with that process.

7.2 Timing of Corrective Actions For SSCs that are degraded or nonconforming, the licensee should establish a schedule for completing the corrective actions. For conditions adverse to quality, licensees should conduct a review to determine the extent of condition for all similarly affected SSCs in a timely manner. The timeliness of the corrective action should be commensurate with the safety significance of the issue.

In general, the corrective actions should be made at the first available opportunity. The time period within which corrective action must be completed begins with the discovery of the condition, not when it is reported to the NRC. Whenever an SSC that is subject to 10 CFR 50 Appendix B4 is discovered to be degraded or nonconforming, Criterion XVI requires prompt corrective action to correct or resolve the condition.

In determining whether the licensee is making reasonable efforts to complete corrective actions promptly, NRC will consider whether corrective action was taken at the first available opportunity, taking into account safety significance, effects on operability, significance of degradation, and what is necessary to implement the corrective action. Factors that the NRC may consider are the amount of time required for design, review, approval, or procurement of the repair or modification; the availability of specialized equipment to perform the repair or modification; and whether the plant must be in hot or cold shutdown to implement the actions. Normally, the NRC expects licensees to implement repair or replacement activities at the next on-line maintenance window or outage of sufficient duration to adequately plan and implement the proposed corrective action. If the proposed corrective actions are extensive, the NRC expects them to be performed at the next refueling outage. If the corrective actions were not taken at the first available opportunity, then the inspector should consider the compensatory measures as defacto design changes to the facility.

In the unlikely event that corrective action can not be implemented during the next refueling outage, then specific information should be included in the deficiency tracking documentation. This justification should include 1) a re-evaluation of the identified cause including any contributing factors and proposed corrective actions, 2) a thorough re-evaluation of the existing conditions with compensatory measures in place including the acceptability of delaying repair and replacement activities (this evaluation should also evaluate the effect of the delay on overall plant risk), 3) a detailed reason (e.g. insufficient time for design/modification prior to outage start, extended procurement delays, etc.) why the repair or replacement activities could not be accomplished during the planned outage, and 4) a review and approval for the delay by the appropriate site management and/or oversight organizations.

4 Appendix B is only applicable to safety-related SSCs. However, NRC expects licensees to address any degraded or nonconforming conditions in accordance with their corrective action programs in a time frame commensurate with the safety significance of the conditions.

9900 Revised Issue Date:

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS 7.3 Compensatory Measures When evaluating the impact of a degraded or nonconforming condition on plant operation, a licensee may decide to implement a compensatory measure as an interim step to enhance the capability of SSCs until final corrective actions to resolve the conditions are completed.

Compensatory measures may be considered when enhancing the status of SSCs that have been determined to be operable but degraded or nonconforming, or as an interim step when restoring SSCs to operable status.

Compensatory measures for degraded or nonconforming conditions for SSCs that have been determined to be operable but degraded are usually implemented to restore plant operating margins (see Section 4.4). A reasonable time frame for completing corrective actions should be established in accordance with a licensees corrective action process as discussed in Section 7.2.

Compensatory measures may also be used to establish or restore SSCs to an operable status.

In general, these measures should be relatively simple to implement and have minimal operator or plant impact. In addition, the NRC expects that licensees will more quickly resolve degraded or nonconforming conditions using these compensatory measures. The reason for the greater emphasis is because reliance on such remedial measures suggests a greater degree of degradation, particularly if operator action is relied on in place of automatic actions. Use of manual actions in place of automatic actions is discussed further in Appendix C.5 to this guidance.

The impact of the compensatory measures themselves on the plant should be considered by licensees. The approved regulatory guidance (Regulatory Guide 1.187, endorsing NEI 96-07, Revision 1) for implementing the revised 10 CFR 50.59 rule states:

If an interim compensatory action is taken to address the condition and involves a temporary procedure or facility change, 10 CFR 50.59 should be applied to the temporary change. The intent is to determine whether the temporary change/compensatory action itself (not the degraded condition) impacts other aspects of the facility or procedures described in the UFSAR.

In considering whether a compensatory measure may affect other aspects of the facility, a licensee should pay particular attention to ancillary aspects of the compensatory measure that may result from actions taken to compensate for the degraded condition. For example, a licensee may plan to close a valve as a compensatory measure to isolate a leak. Although that action would temporarily resolve the leaking condition, it may also affect flow distribution to other components or systems, complicate required operator responses to normal or off normal conditions, or have other effects that should be evaluated in accordance with 10 CFR 50.59 before the compensatory measures are implemented.

7.4 Final Corrective Action The licensee is responsible for corrective action. A licensee's range of corrective action may involve (1) full restoration to the UFSAR-described condition such as through performance of corrective maintenance (see Appendix B to this document), (2) a change to the licensing basis to accept the as-found condition as is (with NRC approval, if required), or (3) some modification of the facility or CLB other than restoration to the condition as described in the UFSAR.

Issue Date: 9900 Revised

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS If corrective action is taken to restore the degraded or nonconforming condition, no 10 CFR 50.59 screening/evaluation is required. The 10 CFR 50.59 process applies when the final resolution of the degraded or nonconforming condition differs from the established UFSAR requirement. At this point, the licensee plans to make a change to the facility or procedures as described in the UFSAR.

The proposed change is now subject to the review process established by 10 CFR 50.59. A change can be safe, but still require NRC approval. The proposed final resolution may require staff review and approval without affecting the continued operation of the plant, because interim operation is being governed by the processes for determining operability and taking corrective action (10 CFR 50 Appendix B).

In two situations, the identification of a final resolution or final corrective action triggers a 10 CFR 50.59 review, unless another regulation applies (e.g., 10 CFR 50.55a): (1) when a licensee decides as the final corrective action to change its facility or procedures to something other than full restoration to the UFSAR-described condition, and (2) when a licensee decides to change its licensing basis, as described in the UFSAR, to accept the degraded or nonconforming condition as its revised licensing basis. Each of these situations is discussed in greater detail below.

In both of these situations, the potential need to obtain NRC approval for a change does not affect the licensee's authority to operate the plant. The licensee may make mode changes, restart from outages, etc., provided that necessary equipment is operable and the degraded condition does not violate the TS or the license. The basis for this authority to continue to operate arises because the TS contain the specific characteristics and conditions of operation necessary to obviate the possibility of an abnormal situation or event giving rise to an immediate threat to public health and safety. Thus, if the TS are satisfied, and required equipment is operable, and the licensee is correcting the degraded or nonconforming condition in a timely manner, continued plant operation does not pose an undue risk to public health and safety.

7.4.1 Change to Facility or Procedures in Lieu of Restoration In the first situation, the licensees proposed final resolution of the degraded or nonconforming condition includes other changes to the facility or procedures to cope with the uncorrected or only partially corrected degraded or nonconforming condition. Rather than fully correcting the degraded or nonconforming condition, the licensee decides to restore capability or margin by making another change. In this case, the licensee must evaluate the change from the UFSAR-described condition to the final condition in which the licensee proposes to operate its facility. If the 10 CFR 50.59 screening/evaluation concludes that a change to the TS is involved or the change meets any of the evaluation criteria specified in the rule for prior NRC approval, a license amendment must be requested, and the corrective action process is not complete until the approval is received or some other resolution occurs.

7.4.2 Change to the Current Licensing Basis In the other situation the licensee proposes to change the current licensing basis to accept the as-found nonconforming condition. In this case, the 10 CFR 50.59 review covers the change from the UFSAR-described condition to the existing condition in which the licensee plans to remain (i.e., the licensee will exit the corrective action process by revising its licensing basis to document acceptance of the condition). If the 10 CFR 50.59 screening/evaluation concludes that a change to the TS is involved or the change meets any of the evaluation criteria specified in the rule for prior NRC approval, a license amendment must be requested and the corrective action process is not complete 9900 Revised Issue Date:

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS until the approval is received or some other resolution occurs. To resolve the degraded or nonconforming condition without restoring the affected equipment to its original design, a licensee may need to obtain an exemption from 10 CFR Part 50 in accordance with 10 CFR 50.12 or relief from a design code in accordance with 10 CFR 50.55a. The use of 10 CFR 50.59, 50.12, or 50.55a in fulfillment of 10 CFR 50 Appendix B corrective action requirements does not relieve the licensee of the responsibility to determine, for significant conditions adverse to quality, the cause, to examine other affected systems, to take action to prevent recurrence, and to report the original condition, as appropriate.

Issue Date: 9900 Revised

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS APPENDICES 9900 Revised Issue Date:

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS Appendix A: SURVEILLANCES A.1 Operability During TS Surveillances If TS surveillances require that safety equipment be removed from service and rendered incapable of performing its specified safety function, the equipment is inoperable. The LCO action statement shall be entered unless the TS explicitly direct otherwise. Upon completion of the surveillance, the licensee should verify restoration to operable status of at least those portions of the equipment or system features that were altered to accomplish the surveillance.

For example, TS allow licensees to perform surveillance testing during power operation, even though such testing requires entry into LCO action statements. Technical specifications permit entry into LCO action statements to perform surveillance testing for a number of reasons. One reason is that the time needed to perform most surveillance tests is usually only a small fraction of the completion time associated with the action statement. Another reason is that the benefits to safety (increased level of assurance of reliability and verification of operability) derived from meeting surveillance requirements is considered to more than compensate for the risk to safety from operating the facility in an LCO action statement for a small fraction of the completion time for the required actions.

NOTE: With regard to surveillances or other similar activities, such as inservice testing that render systems inoperable for extended periods (i.e., those that may exceed the completion time), licensees must have prior NRC approval by license amendment for the surveillance requirement or redefine the tests. It is not the intent of surveillance testing or other similar program requirements to cause unwarranted plant shutdowns or to unnecessarily challenge other safety systems.

A.2 Surveillance and Operability Testing in the Safety Configuration Many systems are designed to perform both normal operational and safety functions. It is preferable that both the TS surveillance requirement testing and any other operability testing be performed in the same configuration as would be required to perform the safety function, (i.e., safety mode).

However, testing in the normal configuration or mode of operation may be required for systems if testing in the safety mode will result in unwarranted safety concerns or transients. The mode of operation for the TS surveillance requirements test is usually prescribed, and the acceptance criteria are established on that basis.

If a system should fail while it is being tested in the safety mode of operation, the system is to be declared inoperable. For ongoing periodic testing that must be performed during normal mode operation, the licensee should establish normal mode operational acceptance criteria that are based on a direct relationship to the safety mode requirements. Operability verification is then provided by acceptable normal mode operational test results.

Test failures should be examined to determine the root cause and correct the problem before resumption of testing. Repetitive testing to achieve acceptable test results without identifying the root cause or correction of any problem in a previous test is not acceptable as a means to establish or verify operability and may constitute preconditioning.

Issue Date: 9900 Revised

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS A.3 Missed Technical Specification Surveillance The Standard Technical Specifications (STS) Revision 3 contains Surveillance Requirement 3.0.1, which states:

Failure to meet a Surveillance, whether such failure is experienced during the performance of the Surveillance or between performances of the Surveillance, shall be failure to meet the LCO. Failure to perform a Surveillance within the specified Frequency shall be failure to meet the LCO except as provided in SR 3.0.3.

Surveillances do not have to be performed on inoperable equipment or variables outside specified limits.

STS Revision 3 SR 3.0.3 has also been revised to state the following:

If it is discovered that a Surveillance was not performed within its specified Frequency, then compliance with the requirement to declare the LCO not met may be delayed, from the time of discovery, up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or up to the limit of the specified Frequency, whichever is greater. This delay period is permitted to allow performance of the Surveillance. A risk evaluation shall be performed for any Surveillance delayed greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and the risk impact shall be managed.

If the Surveillance is not performed within the delay period, the LCO must immediately be declared not met, and the applicable Condition(s) must be entered.

When the Surveillance is performed within the delay period and the Surveillance is not met, the LCO must immediately be declared not met, and the applicable Condition(s) must be entered.

Plant-specific TS variations of this statement may exist, in which case the plant-specific TS govern.

The previous requirements in STS SR 3.0.3 were based on NRC Generic Letter (GL) 87-09, Sections 3.0 and 4.0 of the Standard Technical Specifications (STS) of the Applicability of Limiting Conditions for Operation and Surveillance Requirements, dated June 4, 1987. GL 87-02 was published to address three specific issues with the application of technical specifications. One of those issues was missed surveillances.

The NRC staff has changed STS SR 3.0.3 with regard to missed surveillances as published in the Federal Register [66 FR 49714], and referred to TSTF-358, Revision 8. The basis for establishing the changes to requirements for missed surveillances in GL 87-09 continues to apply to the current changes to SR 3.0.3. As evidenced by the discussion in GL 87-09, the intent of the change proposed in the GL was to reduce the impact on plant risk resulting from the performance of a missed surveillance test by allowing some flexibility in the performance of missed tests. The delay time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> was selected using engineering judgement in the absence of suitable tools to determine a delay period on a case-by-case basis. In addition, the staff recognized in GL 87-09 that even a 24-hour delay period would not be sufficient in some cases and licensees would need to seek regulatory relief in those cases.

GL 87-09, TS, and TSTF-358 Revision 8 provide extensive guidance on surveillance extension, applicability, and success criteria. The above discussion involves only the operability issues.

9900 Revised Issue Date:

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS Issue Date: 9900 Revised

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS Appendix B: MAINTENANCE B.1 Assessment and Management of Risk During Maintenance After identifying a degraded or nonconforming condition, a licensee will typically perform corrective maintenance to restore an SSC to meet all aspects of its current licensing basis. The TS and/or risk assessment should be used to determine the appropriate time frame to complete the maintenance or take other action. The Maintenance Rule, 10 CFR 50.65, provides requirements for monitoring the effectiveness of maintenance at nuclear power plants. The underlying objective is to help maintain plant safety by trending the performance and condition of SSCs within the scope of the rule in terms of reliability and availability to predict their future performance and condition and to assess the effectiveness of maintenance. Specifically, 10 CFR 50.65(a)(3) requires that licensees ensure that the objective of preventing failures of SSCs through maintenance, (i.e., reliability, is appropriately balanced against the objective of maximizing availability (or minimizing unavailability) of SSCs due to monitoring or preventive maintenance (PM)). Additionally, 10 CFR 50.65(a)(4) requires that licensees perform risk assessments before maintenance activities involving SSCs covered by paragraph (a)(4) and manage the increase in risk that may result from the proposed activities.

The risk assessment performed by the licensee per 10 CFR 50.65(a)(4) should reflect the unavailability of the affected equipment during the performance of maintenance. However, the subsequent performance of the equipment, as monitored under the Maintenance Rule or as tracked for the Reactor Oversight Process (ROP) Performance Indicators (if applicable) should be trended and failure probabilities in the PRA adjusted accordingly in order to justify the expectation of improved safety from the performance of maintenance. Performing the 10 CFR 50.65(a)(4) risk assessment, however, does not relieve the licensee from compliance with its license (including TS) and other applicable regulations.

The conduct of maintenance may also involve other temporary procedure or facility alterations to allow the maintenance to be performed or to reduce risk. Such alterations include but are not limited to jumpering terminals, lifting leads, and using temporary blocks, bypasses, or scaffolding.

Additional guidance on hazard barriers is provided in Regulatory Issue Summary (RIS) 2001-09 dated April, 2, 2001. These temporary alterations associated with maintenance are to be assessed as part of the 10 CFR 50.65(a)(4) risk assessment and, consistent with NRC regulatory guidance, a separate 10 CFR 50.59 review of the measures is not required unless (1) during power operations, the temporary alteration will remain in effect for more than 90 days, or (2) the temporary alteration is not removed and the plant is fully restored upon completion of the maintenance (see Regulatory Guide 1.187).

B.2 Operability During Maintenance During maintenance (preventive, predictive, or corrective), equipment may be removed from service and rendered incapable of performing the function(s) specified for safety. When that is done the equipment is clearly inoperable. For equipment subject to the TS, the maintenance activity and any other action that may be required by the LCO is expected to be finished within the completion times for the required actions. As stated above, a licensee may take equipment out of service to perform maintenance during power operation of the facility but must meet the requirements of 10 CFR 50.65 9900 Revised Issue Date:

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS in addition to (and not as a substitute for) the TS. This is true for maintenance activities under all modes of plant operation. When performing maintenance on equipment not in TS (i.e., equipment that has no TS completion time) licensees should be sensitive to the principles embodied by the definition of operability and functionality and the effect upon the operability of TS equipment.

Intentional entry into an action statement of an LCO is not a violation of the TS. Similar to the bases for surveillance testing, LCOs may be entered for maintenance activities. However, the NRC does not recommend intentionally creating a loss of function situation or entering LCO 3.0.3 simply for operational convenience. As stated in the bases for LCO 3.0.3 in STS Revision 3, LCO 3.0.3 is not intended to be used as an operational convenience that permits routine voluntary removal of redundant systems or components from service in lieu of other alternatives that would not result in redundant systems or components being inoperable.

If licensee activities to conduct maintenance would render TS nonconservative, then a license amendment request should be submitted before performing that activity (or other regulatory relief such as a NOED should be sought if need for corrective maintenance requires faster time for approval). 10 CFR 50.36(b) states that the technical specifications will be derived from the analyses and evaluation included in the safety analysis report, and amendments thereto, submitted pursuant to §50.34. In this case, a nonconservative TS is no longer consistent with the analyses and evaluation in the facilitys UFSAR.

For safety equipment not subject to the TS either explicitly by direct inclusion in the TS or implicitly through the definition of operability, the licensee's maintenance activities should be consistent with the importance of the equipment's specified function(s) and the risk assessment.

The licensee should reestablish operability/functionality prior to exiting any TS LCO. The licensee also may need to reestablish operability for systems or components, in whole or in part, that are actively dependent upon the equipment being maintained. Operability should be reestablished in accordance with the guidance in Section 5.2.

B.3 Relationship Between Operable and Available with Respect to the ROP Performance Indicators (PIs)

Operability is a term that is strictly defined in Section 1.1 of the Standard Technical Specifications.

Maintenance Rule availability is defined in Appendix B, Definitions, to NUMARC 93-01, Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, Revision 2 of April 1996, as modified in the attachment, Appendix B, Definitions to revised Section 11, Assessment of Risk Resulting from Performance of Maintenance Activities dated February 22, 2000, and endorsed by Regulatory Guide 1.182. As such, Maintenance Rule availability arises from the ability of an in-scope SSC, including train as applicable, to perform the function that is being monitored by the maintenance rule process.

The potential difference between operability and availability lies in the description of the function being reviewed. For instance, when a pump is restored to service from maintenance, but prior to the pump passing associated post maintenance testing (PMT) and being declared operable, the pump may be considered available. (This presumes that the PMT is successful. However, if the pump fails the PMT, availability cannot be credited for this period).

Issue Date: 9900 Revised

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS Nevertheless, the ROP PI program has carefully avoided the use of the term operable because of its association with technical specifications. Instead, the ROP PIs monitor availability of important safety systems. The PI guidance document states that the purpose of the indicators is to "monitor the readiness of important safety systems to perform their safety function in response to off-normal events or accidents." The PI program does not evaluate whether a train was operable per the technical specifications.

B.4 Aging Component Reliability and Connection to the Maintenance Rule (10 CFR 50.65)

An SSC that is not reliable (not meeting the design assumptions) should be treated as degraded and nonconforming and the licensee should have sufficient basis for continued operation. As aging components become less reliable, the inspector may evaluate whether the pertinent values of the PRA and other risk tools are being updated to reflect the actual risk environment.

As component reliability decreases with age, it is the NRC expectation that the licensee should review more carefully and/or frequently the preventive maintenance programs for those aging components. The performance measures should be changed as needed to provide an earlier indication of degradation. Also, pertinent reliability data input to risk tools/calculations should be more closely monitored. In accordance with 10 CFR 50.65(a)(3), licensees are required to periodically evaluate the performance of SSCs and balance their reliability and availability. Although a licensee should consider reliability when evaluating the effectiveness of plant maintenance, the Maintenance Rule does not explicitly require a licensee to monitor SSC reliability. Furthermore, the focus of Maintenance Rule monitoring activities is on maintenance effectiveness, rather than overall SSC reliability. Even when licensees elect to use a reliability approach to meet Maintenance Rule requirements, the performance-based nature of the Maintenance Rule allows licensees to use a variety of monitoring methods. Consequently, the Maintenance Rule does not lend itself to the development of a consistent generic standard for use of quantitative reliability information in operability determinations. Additional guidance is provided in Inspection Procedure IP 71111.12 and NUMARC 83-01.

9900 Revised Issue Date:

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS Appendix C: SPECIFIC OPERABILITY ISSUES C.1 Relationship Between the General Design Criteria and the Technical Specifications The General Design Criteria (GDC) and the TS differ in that the GDC set forth requirements for design of nuclear power reactors; whereas, TS generally specify the requirements for operation of nuclear reactors. This discussion is intended to provide a general context of the relationship of GDC and TS. Some plants were licensed prior to establishment of the GDC and as a result applicability of the GDC varies at some plants. The need and ability to comply with both sets of requirements have caused confusion.

The design criteria of the GDC correspond indirectly to the operational requirements of the TS. The GDC "establish the necessary design, fabrication, construction, testing, and performance requirements for SSCs important to safety." Thus, the GDC cover a broad spectrum of SSCs of which, not all are directly reflected in the TS. The GDC are reflected in the plant design as documented in the UFSAR. The licensee derives the TS from the analyses that support the plant design, many of which are contained in the UFSAR, and the NRC staff's evaluation of those analyses.

While a variety of features must be included in the design of a nuclear power reactor, the TS need control only those aspects of the design and plant conditions required to ensure adequate protection of the health and safety of the public. As stated in 10 CFR 50.36, TS are to be "derived from the analyses and evaluation included in the safety analysis report." TS establish, among other things, limiting conditions for operation which are "the lowest functional capability or performance levels of equipment required for safe operation of the facility."

Required actions and completion times of the TS are a simple illustration of the relationship between the GDC and the TS. The GDC require redundancy of function for safety systems. This is normally accomplished for each safety system by incorporating at least two redundant trains into the design of each such system. The TS typically allow a plant to continue to operate with only a single train operable of a two-train safety system for a specified time. In such a case, the GDC are met because the system design provides the necessary redundancy, which the TS requires to be available for operation most of the time. The TS permits the operation of the same system with only a single train based on an evaluation of the protection provided by using that system lineup for only the specified period.

C.2 Treatment of Single Failures in Operability Determinations 10 CFR Part 50, Appendix A, "General Design Criteria for Nuclear Power Plants," defines a single failure as follows:

"A single failure means an occurrence which results in the loss of capability of a component to perform its intended safety functions. Multiple failures resulting from a single occurrence are considered to be a single failure."

Appendix A contains general design criteria (GDC) for SSCs that perform major safety functions.

Many of the GDC contain a statement similar to the following:

Issue Date: 9900 Revised

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS "Suitable redundancy in components and features and suitable interconnections, leak detection, isolation and containment capabilities shall be provided to assure that for onsite electrical power system operation (assuming offsite power is not available) and for offsite electrical power system operation (assuming onsite power is not available) the system safety function can be accomplished assuming a single failure."

See, for example, GDC 17, 34, 35, 38, 41, and 44. Therefore, capability to withstand a single failure in fluid or electrical systems is a plant-specific design consideration, which ensures that a single failure does not result in a loss of the capability of the system to perform its safety function(s).

A design deficiency in which the capability to withstand a single failure is lost shall be evaluated and treated as a degraded and nonconforming condition. As with any degraded or nonconforming condition, a prompt determination of operability is required.

C.3 Treatment of Consequential Failures in Operability Determinations A consequential failure is a failure of an SSC caused by a postulated accident within the design basis. For example, if during a loss-of-coolant accident (LOCA) (a design basis event), the broken pipe could whip and incapacitate a nearby pump, then the pump would not be able to function. Such a pump failure is called a consequential failure because the pump would have failed as a result of the design basis event itself. In general, facility design takes any such consequential failures that are deemed credible into consideration. In this case, that would mean that the broken pump was not one that the safety analysis would take credit for to mitigate the LOCA.

Operability determinations should be performed for those potential consequential failures (i.e., an SSC failure that would be a direct consequence of a design basis event) for which the SSC in question needs to function. Where consequential failures would cause a loss of function needed for limiting or mitigating the effects of the event, the affected SSC is inoperable because it cannot perform all of its specified functions. Such situations are most likely discovered during design basis reconstitution studies, or when new credible failure modes are identified.

C.4 Use of Alternative Analyses in Operability Determinations Occasionally when performing operability determinations, licensees use analytical methods or computer codes different from those originally used in the calculations supporting the plant design.

The use of these alternative and normally more recent methods or codes may raise complex plant-specific issues and may be acceptable in operability determinations. Therefore, the inspector should consult with the region and NRR when reviewing such a determination. The use of such methods results in three broad categories of determinations which should generally be handled as follows:

(1) If the analytic method for a particular function of an SSC is specified in a regulation or license condition, operability is based on the results of the analysis using that method. Use of alternative methods may be useful in supporting a request for a license amendment, an exemption, or for enforcement discretion but not to determine operability.

(2) If the analytic method in question is described only in the UFSAR, the licensee should evaluate the plant specific effects of the use of a new method. Simply accepting a new method because it has been approved for use at a similar facility does not alone constitute adequate justification.

9900 Revised Issue Date:

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS (3) If the specific analytic method originally used is not specified in a regulation or license condition, the licensee is permitted to use an alternative method after ensuring that its use is consistent with the current licensing basis, including applicable acceptance criteria.

C.5 Use of Manual Action in Place of Automatic Action Automatic action is frequently provided as a design feature specific to each safety system to ensure that the specified functions of the system will be accomplished. Limiting safety system settings for nuclear reactors are defined in 10 CFR Part 50.36, "Technical Specifications," as settings for automatic protective devices related to those variables having significant safety functions. Where a limiting safety system setting is specified for a variable on which a safety limit has been placed, the setting must be so chosen that automatic protective action will correct the abnormal situation before a safety limit is exceeded. Accordingly, it is not appropriate to take credit for manual action in place of automatic action for protection of safety limits to consider equipment operable. This does not preclude operator action to put the plant in a safe condition, but operator action cannot be a substitute for automatic safety limit protection.

The licensing of specific plant designs includes consideration of automatic and manual action. While approvals have been granted for either or both types of actions, not every combination of circumstances has been reviewed from an operability standpoint. Although it is possible, it is not expected that many determinations of operability will be successful for manual action in place of automatic action. Credit for manual initiation to mitigate the consequences of design basis accidents should have been established as part of the licensing review of a plant.

For any other situation in which substitution of manual action for automatic action may be acceptable, the licensees determination of operability with regard to the use of manual action must focus on the physical differences between automatic and manual action and the ability of the manual action to accomplish the specified function. The physical differences to be considered include, but are not limited to, the ability to recognize input signals for action, ready access to or recognition of setpoints, design nuances that may complicate subsequent manual operation such as auto-reset, repositioning on temperature or pressure, timing required for automatic action, minimum manning requirements, and emergency operating procedures written for the automatic mode of operation.

The licensee should have written procedures in place and training accomplished on those procedures before substitution of any manual action for the loss of an automatic action.

The assignment of a dedicated operator for manual action is not acceptable without written procedures and full consideration of all pertinent differences. The consideration of manual action in remote areas must include the ability and timing in getting to the area, training of personnel to accomplish the task, and occupational hazards to be incurred such as radiation, temperature, chemical, sound, or visibility hazards. One reasonable test of the reliability and effectiveness of manual action may be the approval of manual action for the same function at a similar plant.

Nevertheless, this is expected to be a temporary condition until the automatic action can be promptly corrected in accordance with 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action.

C.6 Use of Probabilistic Risk Assessment in Operability Decisions Probabilistic risk assessment (PRA) is a valuable tool for the relative evaluation of accident scenarios while considering, among other things, the probabilities of occurrence of accidents or external events. The definition of operability states, however, that the SSC must be capable of Issue Date: 9900 Revised

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS performing its specified safety function(s). The inherent assumption is that the occurrence conditions or event exists and that the safety function can be performed. The use of PRA or probabilities of the occurrence of accidents or external events is not acceptable for making operability decisions.

However, PRA may provide valid and useful supportive information for a license amendment as part of corrective actions. The PRA is also useful for determining the safety significance of SSCs.

The safety significance, whether determined by PRA or other analyses, is a necessary factor in decisions on the appropriate "timeliness" of operability determinations. Specific guidance on the timeliness of determinations is presented in Section 5.2.

C.7 Environmental Qualification When the NRC or licensee identifies a potential deficiency in the environmental qualification of equipment (i.e., a licensee does not have an adequate basis to establish qualification), the licensee is expected to make a prompt determination of operability, to take immediate steps to establish a plan with a reasonable schedule to correct the deficiency, and to write a JCO (See Note below),

which will be available for NRC review. The licensee may be able to make a finding of operability using analysis and partial test data to provide reasonable assurance that the equipment will perform its specified safety function(s) in its accident environment when called upon to do so. The licensee should also show that subsequent failure of the equipment will not result in significant degradation of any specified safety function or give misleading information to the operator.

NOTE: The JCO referred to in questions of equipment qualification is specifically addressed by GL 88-07 dated April 7, 1988. This environmental qualification "JCO" includes an operability determination. It also states that the licensee should evaluate whether the findings are reportable under 10 CFR 50.72, 10 CFR 50.73, 10 CFR Part 21, the TS or any other pertinent reporting requirements, including 10 CFR 50.9.

C.8 Technical Specification Operability vs. ASME Code,Section XI Operative Criteria The TS normally apply to overall system performance but sometimes contain limiting values for certain component performance, which are specified to ensure that the design basis and safety analysis are satisfied. The values (e.g., pump flow rate, valve closure time, valve leakage rate, safety/relief valve set point pressure) are operability verification criteria. If these values are not met at any time, the applicable LCO shall be entered.

The ASME Section XI inservice testing plans required under 10 CFR 50.55(a) for pumps and valves may contain the same or different limits and additional component performance acceptance values, which if not met will indicate that the pump or valve has seriously degraded so that corrective action would be required to ensure or restore the operability and operational readiness of the pump or valve. The ASME Section XI acceptance criteria include "required action ranges" or limiting values for certain component performance parameters. These required action ranges or limiting values, defined by the code as component performance parameters, may be less conservative than the TS values which are safety analysis limits. However, action must be taken when the TS requirements are not met.

GL 89-04 Attachment 1, Position 8, defines the starting point for the allowed outage time (AOT) in TS action statements for ASME Section XI pumps and valves. When performance data fall in 9900 Revised Issue Date:

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS the required action range, regardless of whether the limit is equal to the TS limit or more restrictive, the pump or valve must be declared inoperable immediately (the term "inoperative" is used in the text of ASME Section XI; the pump or valve is both "inoperative" and inoperable) and the TS action statement for the associated system must be entered.

In cases where the required action range limit is more conservative than its corresponding TS limit, the corrective action may not be limited to replacement or repair; it may be an analysis to demonstrate that the specific performance degradation does not impair operability and that the pump or valve will still fulfill its function, such as delivering the required flow. A new required action range may be established after such analysis which would then allow for a new determination of operability.

The durations specified by the ASME Code for analyzing test results have not been accepted by the NRC for postponing entry into a TS action statement. As soon as data are recognized as being within the required action range for pumps or as exceeding the limiting value of full-stroke time for valves, the associated component must be declared inoperable and, if subject to the TS, the completion time specified in the action statement must be started at the time the component was declared inoperable. For inoperable pumps and valves considered by ASME Section XI but not subject to a specific TS, the action shall be consistent with the safety significance of the issue and the functions served by the affected system(s).

Recalibrating test instruments and then repeating pump or valve tests is an acceptable alternative to the corrective action of repair or replacement, but is not an action that can be taken before declaring the pump or valve inoperable. However, if during a test it is obvious that a test instrument is malfunctioning, the test may be halted and the instruments promptly recalibrated or replaced.

During a test, anomalous data with no clear indication of the cause must be attributed to the pump or valve under test. For this occurrence, a prompt determination of operability is appropriate with follow-on corrective action as necessary.

Note: In the above discussion, "required action range" and "inoperative" are ASME Section XI terms.

C.9 Support System Operability The definition of operability embodies the principle that a system can perform its specified safety function(s) only when all necessary support systems are capable of performing their related support functions. It is incumbent upon each licensee to understand which support systems are necessary to ensure operability of systems that perform specified safety functions.

When a support system that is not explicitly addressed in TS is determined to be incapable of performing one of its necessary related support functions (i.e., non-functional), the licensee must immediately (a) declare inoperable each specified system whose own operability depends on that support function, and (b) enter the supported systems TS LCO. In addition, the licensee must take the appropriate remedial measures specified by the supported systems TS LCO action requirements.

When a support system is determined to be inoperable (or non-functional if not explicitly addressed in TS), the licensee should employ the same operability/functionality determination process for the Issue Date: 9900 Revised

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS supported systems, as for any other degraded system. In particular, the scope and timing of such operability/functionality decisions should follow the guidance in Sections 5.1 and 5.6.

There are cases where judgement on the part of the licensee is appropriate in determining whether a support system that is not explicitly addressed in TS is necessary and is, therefore, required to be functional. For example, a ventilation system may be required to ensure that other safety-related systems can perform their specified safety functions in the summer, but may not be required in the winter. Similarly, the electrical power supply for heat tracing may be required in the winter to ensure that a specified system can perform its specified safety function, but may not be required in the summer. In all such cases, the licensee should regularly review the basis for determining that a support system is not required to ensure (a) its decision remains valid, and (b) timely restoration of the support system to functional status when its related support function is necessary for the operability of the specified supported system.

Regulatory Issue Summary 01-009 - Control of Hazard Barriers contains additional guidance on control of hazard barriers during plant maintenance and modification activities.

Exercise reasonable judgement in reviewing what individual licensees do in specific cases. If a licensee determines that a specified system is capable of performing its specified safety function(s) with a non-functional support system, then no action by the licensee would be needed other than restoring the support system to functional status (this may be accomplished as part of its corrective action program). As an alternative to restoration, the licensee may modify the support function as it would any other change to the facility by following the 10 CFR 50.59 change process and updating the UFSAR.

Support systems explicitly expressed in TS LCOs have specific required action completion times.

Ideally, the specified completion time to restore a support system to operable status (also known as the allowed outage time, or restoration completion time) should be equal to or less than the restoration completion time for any system that requires the support system function for its own operability. Discuss with regional managers any problems stemming from inconsistencies between restoration completion time for a necessary support system and its supported system. Regional managers should discuss the issue with NRR if deemed necessary. While such inconsistencies are being resolved, the more restrictive restoration completion time should be used. In all cases, licensees should consider whether an amendment to the TS is necessary as discussed in NRC Administrative Letter 98-10.

Upon discovery of a non-functional or inoperable support system, the most important safety concern is the possibility of having lost all capability to perform a specified safety function. A loss of safety function condition can exist when the licensee concurrently declares multiple trains of specified support and supported systems inoperable. Therefore, upon declaring a support or supported system inoperable in one train, the licensee should verify the operability of corresponding independent support or supported systems and all other associated support systems in the opposite train(s). This verification ensures that the facility has not lost the complete capability to a perform the specified safety function. The term "verify" as used here, allows for an administrative check by examining logs or other information to determine if required features are out of service for maintenance or other reasons. In addition to determining whether a loss of functional capability condition exists, the licensee should also take the TS required actions specified for the inoperable systems. However, upon determining that a loss of functional capability condition does exist, the 9900 Revised Issue Date:

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS licensee should mitigate the condition by taking the TS required actions specified for the systems that have lost the capability to perform their specified safety function(s).

As discussed in Section 3.3, for those licensees that have converted to the improved standard technical specifications, STS LCO 3.0.6 provides the requirements for supported system LCOs not met solely due to the support system LCO not being met. The above guidance is consistent with the STS requirements.

C.10 Piping and Pipe Support Requirements Piping and pipe supports found to be degraded or nonconforming should be subjected to an operability/functionality determination. To assist licensees in the determinations, the following criteria are provided to address various components. These components include the piping, supports, support plates, and anchor bolts. IE Bulletin 79-14, dated July 2, 1979, addressed the seismic analysis for as-built safety-related piping systems. The supplement to IE Bulletin 79-14, dated August 15, 1979, and Supplement 2 to IE Bulletin 79-14, dated September 7, 1979, provide additional guidance.

Concrete anchor bolts and pipe supports are addressed with specific operability criteria in Revision 2 of IE Bulletin 79-02 as well as Supplement 1 to Revision 1 of IE Bulletin 79-02. These Bulletins are dated November 8, 1979 and August 20, 1979, respectively. The criteria for evaluating operability of seismic design piping supports and anchor bolts relating to Bulletins 79-02 and 79-14 are detailed in the E. Jordan memo to the regions dated July 16, 1979 (ADAMS Accession Number ML993430206), and the V. Noonan memorandum dated August 7, 1979 (NUDOCS Accession Number 9010180274). Upon discovering a nonconformance with piping and pipe supports, the licensee may use the criteria in Appendix F of Section III of the ASME Code for operability determinations. The licensee may use these criteria and Appendix F until the next refueling outage when the support(s) are to be restored to the UFSAR criteria.

For systems determined to be otherwise operable but which do not meet the above criteria, licensees should treat the systems or components as inoperable until NRC approval is obtained for any additional criteria or evaluation methods used to determine operability. Where a piping support is determined to be inoperable, the licensee should determine the operability/functionality of the associated piping system.

C.11 Flaw Evaluation Regulation 10 CFR 50.55a(g) requires that structural integrity be maintained, in conformance with ASME Section XI, for those parts of a system that are under the jurisdiction of the ASME Code.

Section XI contains rules describing acceptable means of inspecting welds in piping and vessels and areas of high stress concentration in vessels.Section XI also describes a series of acceptable flaws based on the location and service of the system within which the flaw is discovered. If the flaw exceeds these generally acceptable limits, ASME Section XI also describes an alternate method by which a refined calculation may be performed to evaluate the acceptability of the flaw. At no time does the ASME Code describe a flaw or evaluation that would allow a thru-wall flaw to be returned to service. If a flaw is discovered, by any means (including surveillance, maintenance activity, or inservice inspection), in a system under the jurisdiction of ASME Code, during normal plant operation, plant transition, or during shut-down, the flaw must be promptly evaluated using the rules of the ASME Code. If the flaw is through-wall or does not meet the thresholds established by the Issue Date: 9900 Revised

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS Code the system containing the flaw is inoperable. If the flaw meets the thresholds established by the Code, the system is operable and an operability determination is not required.

Generic Letter 90-05 and Code Case N-513 describe alternate acceptable means for evaluating and accepting flaws in moderate energy piping. Generic Letter 90-05 describes a method by which a flaw, not acceptable under ASME Code, may be returned to service without NRCs prior approval.

GL 90-05 describes a method, acceptable to the NRC, that will result in the NRC granting relief from ASME Code requirements under 10 CFR 50.55a. Because an evaluation and acceptance of a flaw, using the guidance contained in GL 90-05, is not in conformance with the requirements of ASME Code it must be reported to the NRC in conformance with the requirements described in GL 90-05.

If a flaw meets the guidance of GL 90-05, the system containing the flaw is operable.

Code Case N-513 describes an acceptable alternate to the methods described in the ASME Code for the acceptance of a flaw in a moderate energy piping system. When a Code Case describes methods, criteria, or requirements different from the Code when it was accepted in 10 CFR 50.55a, and the NRC does not automatically endorse a Code Case, its use must be approved separately by the NRC. Code Cases that are acceptable to the NRC are published in Regulatory Guidance (RG) 1.147. Code Case N-513 has been approved by the NRC. A flaw that is evaluated, using Code Case N-513, is acceptable to both the NRC and to the ASME Code. If a flaw meets the requirements of Code Case N-513, the system containing the flaw is operable. Code Case N-513 has been accepted by the NRC for application in the licenseesSection XI inservice inspection programs with the following conditions imposed by the NRC staff:

(1) Specific safety factors in paragraph 4.0 must be satisfied (2) Code Case N-513 may not be applied to:

(a) Components other than pipe and tubing (b) Leakage through a gasket (c) Threaded connections employing nonstructural seal welds for leakage prevention (through seal weld leakage is not a structural flaw; thread integrity must be maintained).

(d) Degraded socket welds.

If a flaw exceeds the thresholds of the ASME Code, GL 90-05, Code Case N-513, or any other NRC approved Code Case the system containing the flaw is inoperable until the NRC approves of the alternative analysis, evaluation, or calculation used to justify the flaws return to service and the subsequent operability of the system. Prior to receiving the NRCs approval for the alternate analysis, evaluation, or calculation the inoperable system should be entered into the applicable limiting condition of operation as described in the plants technical specification.

C.12 Operational Leakage Leakage from the reactor coolant system is limited to specified values in the TS depending on whether the leakage is from identified, unidentified, or specified sources such as the steam generator tubes or reactor coolant system pressure isolation valves. If the leakage exceeds the TS limits, the Limiting Condition for Operation (LCO) must be entered. For identified reactor coolant system leakage within the limits of the TS, the licensee should determine operability for the degraded component and include in the determination the effects of the leakage on other components and materials.

9900 Revised Issue Date:

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS Existing regulations and TS require that the structural integrity of ASME Code Class 1, 2, and 3 components be maintained according to Section XI of the ASME Code. If a leak is discovered in a Class 1, 2, or 3 component in the conduct of inservice inspections, maintenance activities, or during plant operation, IWA-5250 of Section XI corrective measures may require repair/replacement activities be taken based on repair or replacement in accordance with IWA-4000 of Section XI. In addition, if a leak is discovered, the component should be evaluated for flaws according to IWB-3600, which addresses the analytical evaluation and acceptability criteria for flaws.

The TS do not permit any reactor coolant pressure boundary (RCPB) leakage. The Operational Leakage LCO must be promptly entered when it is more likely than not that pressure boundary leakage is occurring. Upon discovery of leakage from Class 1 or 2 component pressure boundary (i.e., pipe wall, valve body, pump casing, etc.), the licensee must declare the component inoperable.

For leakage from a Class 3 pressure boundary component moderate energy system, the licensee may evaluate the structural integrity of the component using the criteria of GL 90-05. If the component meets the criteria it can be deemed degraded but operable until relief from the applicable ASME Code requirement(s) is obtained from the NRC. As an alternative, the licensee can evaluate the structural integrity of a leaking Class 3 moderate energy pressure boundary component or piping using the criteria of ASME Code Case N-513, Evaluation Criteria for Temporary Acceptance of Flaws in Class 3 Piping Section XI, Division 1, which is approved with limitations imposed by the NRC staff and incorporated by reference in 10 CFR 50.55(a)(b)(2)(xiii). The limitations imposed by the NRC staff are as follows:

(1) Specific safety factors in paragraph 4.0 must be satisfied.

(2) Code Case N-513 may not be applied to:

(a) Components other than pipe and tubing (b) Leakage through a gasket (c) Threaded connections employing nonstructural seal welds for leakage prevention (through seal weld leakage is not a structural flaw; thread integrity must be maintained).

(d) Degraded socket welds.

However, the licensee may also decide to evaluate the structural integrity of a leaking Class 2 or 3 moderate energy pressure boundary component or piping using the criteria of ASME Code Case N-513-1 Evaluation Criteria for Temporary Acceptance of Flaws in Moderate Energy Class 2 or 3 Piping Section XI, Division 1. The same limitations imposed by the NRC staff on Code Case N-513 apply to Code Case N-513-1. Code Case N-513-1 has been reviewed and approved by the NRC. However, the approval of Code Case N-513-1 has not yet been incorporated into RG 1.147 or the Code of Federal Regulations for generic use. Therefore, until Code Case N-513-1 is approved for generic use in either RG 1.147 or 10 CFR 50.55a, the licensee would need to obtain relief to use Code Case N-513-1 from the NRC.

If the component meets the criteria of ASME Code Case N-513, continued temporary service of the degraded piping components is permitted. If the licensee decides to control the leakage by mechanical clamping means, the guidelines of Code Case N-523-2 Mechanical Clamping Devices for Class 2 and 3 Piping Section XI, Division 1" may be followed, as referenced in 10 CFR 50.55a(b)(2)(xiii). It should be noted that this Code Case is to maintain the structural integrity of Class 2 and 3 piping, NPS 6 and smaller and shall not be used on piping larger than NPS 2 when the nominal operating temperature or pressure exceeds 200EF or 275 psig. These and other applicable Code Cases which have been determined by the NRC to be acceptable to be used by the licensee without a request or authorization from the NRC are listed in RG 1.147.

Issue Date: 9900 Revised

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS These Code Cases do not apply to Class 1 pressure boundary components.

For Class 2 heat exchanger leakage, the licensee can evaluate the structural integrity using the criteria of ASME Code Class N-513-1 "Evaluation Criteria for Temporary Acceptance of Flaws in Moderate Energy Class 2 or 3 Piping Section XI, Division 1." Currently, Code Case N-513-1 has been reviewed and accepted by the NRC but its approval has not yet been incorporated into RG 1.147 or the Code of Federal Regulations. The same limitations imposed by the NRC on Code Case N-513 apply to Code Case N-513-1. Therefore, until Code Case N-513-1 is approved for generic use in either RG 1.147 or 10 CFR 50.55a, the licensee would need to obtain relief to use Code Case N-513-1 from the NRC. If the component meets the criteria of ASME Code Case N-513-1, continued temporary service of the degraded component is permitted.

C.13 Structural Requirements Category I structures and supports (referred to herein as "structures") which are subject to periodic surveillance and inspection in accordance with TS requirements shall be considered operable if the limits stipulated in the TS are met. If these limits are not met, the LCO is to be entered for the affected structure. If the degradation affects the ability of the structure to provide the required design support for systems attached to the structure, an operability determination must be performed for these systems as well.

Degradation affecting Category I structures includes, for example, concrete cracking and spalling, excessive deflection or deformation, water leakage, rebar corrosion, missing or bent anchor bolts, degradation of door and penetration sealing, etc.. If these degradations are identified in Category I structures which are not subject to periodic surveillance and inspection, the licensee should assess the structures to determine their capability to perform their specified function. As long as the identified degradation does not result in the exceedance of acceptance limits specified in applicable design codes and standards, referenced in the design basis documents, the affected structures are operable.

Significant degradation resulting in the exceeding of the acceptance limits must be promptly reported in accordance with the requirements in 10 CFR 50.72 and evaluated by the licensee for determination of operability. These evaluations should include the criteria used for the operability determination and the rationale for continued plant operation in a degraded condition outside of the design basis. The licensee's evaluations should also include the plan for corrective action, as required by Criterion XVI of Appendix B to 10 CFR Part 50, to restore degraded structures to their original design requirements. As stated above, any system which depends upon the degraded structure for required support should also be examined for operability/functionality if the degradation or nonconformance calls into question the performance of the system. NRC inspectors, with possible support by headquarters, should review licensees' evaluations of structural degradations to determine their technical adequacy and conformance to licensing and regulatory requirements.

C.14 Use of an Alternative Source Term in Operability Determinations In addressing control room envelope in-leakage testing, if in-leakage is greater than the amount assumed in the licensing basis radiological consequence analyses, the licensee may use AST analytical methods in performing its operability determination to verify that the control room ventilation system can accomplish its specified safety function. However, a licensee must ensure 9900 Revised Issue Date:

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS that results of analysis performed using AST analytical methods are expressed in a manner consistent with its current licensing basis acceptance criteria for control room habitability.

Specifically, a licensee that has implemented an AST under the provisions of 10 CFR 50.67, in whole or for specific analyses, would have total effective dose equivalent-based limits as its current licensing basis acceptance criteria for analyses that have been revised pursuant to 10 CFR 50.67.

However, a licensee with its current licensing basis source term based on Technical Information Document - 14844, dated March 23, 1962, that desires to use the AST methodology in operability determinations must calculate whole body and critical organ doses for comparison with its current licensing basis acceptance criteria.

Any proposed changes to the licensing basis acceptance criteria must be reviewed in accordance with the requirements of 10 CFR 50.59 and 10 CFR 50.67. If the corrective action taken to resolve the degraded/ nonconforming condition involves a change to the licensing basis, such as changing the source term used in its design basis radiological consequence analyses ( i.e., the alternative source term described in 10 CFR 50.67), then a license amendment must be submitted for review and approval.

Issue Date: 9900 Revised

OPERABILITY DETERMINATIONS AND RESOLUTION OF NONCONFORMANCES OF STRUCTURES, SYSTEMS, AND COMPONENTS 9900 Revised Issue Date: