ML051260445

Summary of Meeting with the Nuclear Energy Institute (NEI) Operability Determination Process Task Force

ML051260445
Person / Time
Issue date:	06/01/2005
From:	Schulten C NRC/NRR/DIPM/IROB
To:	Schoppman M Nuclear Energy Institute
Schulten C. S., NRR/IROB/TSS, 415-1192
References
Download: ML051260445 (43)

Text

June 1, 2005 Mr. Mike Schoppman Nuclear Energy Institute Suite 400 1776 I Street, NW Washington, DC 20006-3708

SUMMARY

OF MEETING ON APRIL 19, 2005, WITH THE NUCLEAR ENERGY INSTITUTE (NEI) OPERABILITY DETERMINATION PROCESS TASK FORCE The purpose of this letter is to transmit the summary of the Nuclear Regulatory Commission Staff meeting with the Operability Determination Process Task Force. The meeting was held at the Excel Services Corporation offices in Rockville, on April 19, 2005. At the meeting, Staff and task force members discussed proposed changes to operability guidance for resolution of degraded or nonconforming conditions adverse to safety or quality.

The meeting topics discussed were primarily issues from the NEI high priority items list that were first discussed at the February 17, 2005 meeting. The next meeting is scheduled for April 25, 2005, in Rockville, Maryland, to continue discussing open high priority action items.

Sincerely,

/RA/

Carl S. Schulten, Senior Reactor Engineer Technical Specifications Section Reactor Operations Branch Division of Inspection Program Management Office of Nuclear Reactor Regulation

Enclosures:

1. Meeting Summary

2. Agenda

3. Attendance List

4. Purpose - Objectives

5. Review Schedule and Planned Completion Dates

6. Followup - TSS High Priority Items Actions

7. ODPTF_MARKUP_04/18/05 cc w/encls: See attached page

ML051260445 OFFICE TSS:IROB:DIPM SC:TSS:IROB:DIPM NAME CSSchulten THBoyce DATE 06/01/2005 06/01/2005 DISTRIBUTION:

ADAMS RidsNrrDipm RidsNrrDssa RidsNrrDlpm PUBLIC RidsNrrDssaSplb RidsNrrDipmleh EMcKenna (EMM)

IROB R/F JTrapp (JMT1) WReckley HChernoff TSS Staff SAlexander (SDA) RBlough (ARB) SBurton (SXB3)

RidsOgcRp DGraves (DNG) LWert (LXW1) DJNelson (DJN)

RidsAcrsAcnwMailCenter BDesai (BBD) WBJones (WBJ)

SBarber (GSB) BBurgess (BLB)

cc via e-mail:

Mr. Mike Schoppman, Nuclear Energy Institute Mr. Ron Gaston, DTE Energy Ms. Laurie Lahti,Nuclear Management Company Ms. Nancy Chapma,SERCH/Bechtel Mr. Pete LeBlond, LeBlond Associates Mr. Donald Hoffman, Technical Specifications Task Force Mr. Jeff Thomas, Duke Energy Ms. Deann Raleigh, Scientech Mr. Jim Kilpatrick,Constellation Energy Mr. Brian Mann, Technical Specifications Task Force Mr. Getachew Tesfaye, Constellation Energy

SUMMARY

OF THE APRIL 19, 2005, NUCLEAR REGULATORY COMMISSION MEETING WITH THE NUCLEAR ENERGY INSTITUTE OPERABILITY DETERMINATION PROCESS TASK FORCE On April 19, 2005, the Technical Specifications Section Staff met with the Task Force at the Excel Services Corporation offices in Rockville, Maryland. The purpose of the meeting was to discuss Task Force comments on operability and degraded or nonconform conditions guidance (Manual Chapter 9900).

A copy of the agenda (Enclosure 2) and a list of participants (Enclosure 3) is attached. The Staff opening remarks (Enclosure 4) emphasized the goals and technical discipline expectations for the review process with the Task Force and the Staff provided review milestones and planned completion dates (Enclosure 5) for finalizing the revised guidance.

Additionally, both the Staff and the Task Force presented draft revisions to sections of the guidance document (Enclosures 6 and 7, respectfully) in response to agreements made at the meeting February 17.

The RIS changes continues to be an effort to update the inspection manual chapter technical guidance versus a major revision. During the meeting the Staff and the Task Force reviewed the document and considered changes that used simpler more concise phrases to add clarity to the guidance. The Staff and the Task Force also agreed to the following actions:

• Scope/Applicability (Section 2.0) - the scope of the guidance will retain the current licensing basis scope. Applicability guidance will be presented to clearly differentiate between Structures, Systems and Components (SSCs) explicitly stated in TS definition of operability, and SSCs implicit in the TS definition as support system SSCs.

• Definitions (Section 3.0) definition of Specified Safety Function(s) and Function(s) would be best presented in its component terms Specified Safety Function, Specified Function, and Necessary and Related Support Function. The definition of Functionality would only apply to SSCs not specified by TS.

• Identification of Degraded or Nonconforming Conditions (Section 4.0), Subsection 4.4, Fully Qualified would be expanded to include specified safety function to illustrate the use of operability and functionality terminology used to describe the status of SSCs when degraded or nonconforming conditions are identified and evaluated.

The meeting progress included review up to Operations Based on Operability Determinations (Section 6.0). To support the development schedule two future meetings are scheduled for Rockville, Maryland. A meeting on April 25, will be used to discuss remaining open Task Force comments which will be followed by a meeting scheduled for May 10 through 13, to develop a master markup of the guidance document with disposition of all public comments.

Enclosure 1

AGENDA APRIL 19, 2005 PUBLIC MEETING ROCKVILLE, MARYLAND NEI OPERABILITY DETERMINATION PROCESS TASK FORCE 8:30 A.M. - 4:30 P.M.

I. Discuss High Priority Topic Followup Topic 1 - Differentiating Technical Specification Operability from non-TS Functionality Topic 2 - Key terms and definitions Topic 3 - The role of the Corrective Action Program Topic 5 - Checks and balances to emphasize that the RIS is inspector guidance, not requirements Topic 6 - The role of non-licensed personnel in making operability determinations Topic 9 - Timing considerations Topic 11 - Documentation requirements Topic 12 - The role of risk assessment Topic 13 - Interfaces with regulations Topic 16 - Treatment of methods of evaluation II. Discuss New Issues III. Identify Action Assignments for May 9-10, 2005 meeting Enclosure 2

ATTENDEE LIST APRIL 19, 2005 PUBLIC MEETING ROCKVILLE, MD NEI OPERABILITY DETERMINATION PROCESS TASK FORCE Name Affiliation Carl S. Schulten NRC\NRR\TSS\IROB\DIPM Nancy Salgado NRC\NRR\TSS\IROB\DIPM Laurie Lahti Nuclear Management Company laurie.lahti@nmcco.com Peter LeBlond Leblond & Associates, LLC LeBlond@prodigy.net Patricia Campbell Morgan Lewis pcampbell@morganlewis.com C. Jeff Thomas Duke Energy - Mcguire cjthomas@duke-energy.com James Kilpatrick Constellation Energy - Calvert Cliffs james.c.kilpatrick@constellation.com Ron Gaston DTE Energy - Fermi gastonr@dteenergy.com Fred Mashburn Tennessee Valley Authority (Tva) - Corporate fcmashburn@tva.gov Mike Schoppman NEI, mas@nei.org Brian Mann TSTF\EXCEL, brianm@excelservices.com Donald R. Hoffman TSTF\EXCEL, donaldh@excelservices.com R. A. Musser NRC\Region II Thomas Boyce NRC\NRR\TSS\IROB\DIPM Getachew Tesfaye Constellation, getachew.tesfaye@constellation.com Don Woodlin STARS, dwoodla1@txu.com Michael Matheson NPPD, mdmathe@nppd.com Nancy Chapman Search Licensing Bechtel Harold Chernoff NRC/NRR/DLPM Bill Reckley NRC/NRR/DLPM Deann Raleigh LIS, Scientech Enclosure 3

PURPOSE - OBJECTIVES APRIL 19, 2005 PUBLIC MEETING ROCKVILLE, MD NEI OPERABILITY DETERMINATION PROCESS TASK FORCE PRIMARY Reach Consensus on Open High Priority Items Understand Positions in the Task Force Markup GOALS FOR GUIDANCE Guidance for Inspectors but .......

Cooperative Approach Rely on Industry Best Practices Regulatory Override If Necessary Goal Is Clarity of Process for

- Inspectors

- Operators Simple ..... Plain Language Process Document TECHNICAL DISCIPLINE Solve Typical Plant/process

... Not Exceptions to Typical

... Default Will Be Conformance to Sts Do the Right Thing.... Not

...The Requirements or ...Compliance Thing Enclosure 4

SCHEDULE AND PLANNED COMPLETION DATES APRIL 19, 2005 PUBLIC MEETING ROCKVILLE, MARYLAND NEI OPERABILITY DETERMINATION PROCESS TASK FORCE ASSOCIATED TASK PLANNED COMPLETION COMMENTS DATE Issue RIS to endorse September 2005 Yellow Ticket changes to Manual Chapter 9900 Discuss high level changes April 19, 2005 with NEI Resolve all public May 3, 2005 comments Master Markup of MC May 11-12, 2005 Edit documents put in final May 27, 2005 form Provide to the Regions for June 1, 2005 comment OGC and CRGR June 1, 2005 review/concurrence Resolve comments August 1, 2005 Enclosure 5

HIGH PRIORITY TOPICS FOLLOWUP APRIL 19, 2005 PUBLIC MEETING ROCKVILLE, MARYLAND NEI OPERABILITY DETERMINATION PROCESS TASK FORCE I. Identification of Resolution Pending High Priority Action Items The ODP Task Force agreed with Staffs resolution of Topics 4, 7, 8, 10, 14, and 15.

• Differentiating operability issues from Corrective Action Program issues

• Consistency among different sections of the RIS

• Deciding when an operability determination is necessary

• Neutrality of the RIS with respect to plant-specific Tech Specs

• Interfaces with other guidance documents

• Treatment of compensatory measures II. Followup items for the remaining topics are listed below.

Topic 1 - Differentiating Technical Specification Operability from Non-ts Functionality Differentiation between Operability and Functionality was a major topic of discussion. NRC agreed that the main topic of the RIS is Technical Specification Operability, and that guidance on non-Tech-Spec functionality can be merged into one section. The ODPTF will provide (1) additional recommendations on the definition of operability, and (2) a redraft of the guidance on functionality to be located in RIS Section 3.4 (Functionality).

[Action Item - ODPTF]

Topic 2 - Key Terms and Definitions The ODPTF will provide more detailed comments on key terms and what it believes the definitions should be. [Action Item - ODPTF]

Topic 3 - the Role of the Corrective Action Program NRC will revise RIS Section 7.2 (Timing of Corrective Actions) such that extent of condition reviews for functionality are based on applicable regulations/guidance (e.g., Appendix B Criterion XVI, 10 CFR 50.65 maintenance rule, 10CFR50.55a ISI/IST programs, etc.).

[Action Item - NRC]

Enclosure 6

7.2 Timing of Corrective Actions Whenever an SSC that is subject to 10 CFR 50 Appendix B1 is discovered to be degraded or nonconforming, Criterion XVI requires prompt corrective action to correct or resolve the condition. For SSCs that are degraded or nonconforming, the licensee should establish a schedule for completing the corrective actions. For conditions adverse to quality, licensees should conduct a review to determine the extent of condition for all similarly affected SSCs in a timely manner. The extent of condition should be evaluated as required by the licensees corrective action program. The timeliness of the corrective action should be commensurate with the safety significance of the issue. In general, the corrective actions should be made at the first available opportunity. The time period within which corrective action must be completed begins with the discovery of the condition, not when it is reported to the NRC. Whenever an SSC that is subject to 10 CFR 50 Appendix B2 is discovered to be degraded or nonconforming, Criterion XVI requires prompt corrective action to correct or resolve the condition.

In determining whether the licensee is........

Topic 5 - Checks and Balances to Emphasize That the Ris Is Inspector Guidance, Not Requirements

• NRC will edit the RIS to emphasize its role as inspector guidance.

- reword Section 2 first sentence to eliminate applicability boiler plate.

2.0 SCOPE/APPLICABILITY Licensees that hold an operating license, including those who have permanently ceased operations and have certified that fuel has been permanently removed from the reactor vessel, and all holders of operating licenses for nonpower reactors, including those whose licenses no longer authorize operation, should have a process to make determinations of operability and functionality when degraded or nonconforming conditions affecting its SSCs are identified.

1 Appendix B is only applicable to safety-related SSCs. However, The NRC expects licensees to address any degraded or nonconforming conditions in accordance with their corrective action programs in a time frame commensurate with the safety significance of the conditions.

2 Appendix B is only applicable to safety-related SSCs. However, The NRC expects licensees to address any degraded or nonconforming conditions in accordance with their corrective action programs in a time frame commensurate with the safety significance of the conditions commensurate with the safety significance of the conditions.

2

This guidance is applicable to any of the following SSCs which includes SSCs in plant TS and support SSCs defined in Section 3.4, Functionality (specifically, the those that perform related functions that support the SSCs in plant TS). In addition, as part of an effective program for problem identification and corrective action, licensees should also assess any degraded or nonconforming conditions to determine the functionality of SSCs that are not in plant TS, consistent with the safety significance of the SSC.

(i) ........

• NRC intends to conduct agency-wide training on the final RIS. [Action Item - NRC]

- pending issuing the RIS Topic 6 - the Role of Non-licensed Personnel in Making Operability Determinations Non-licensed staff play a help making operability determinations. This contribution is often significant. At the end of the operability determination process, a licensed operator makes a declaration of operability or inoperability. NRC agreed to revise the RIS based on this characterization. [Action Item - NRC]

Licensed reactor operators are responsible for declaring when a system is operable or inoperable. The evaluation to support an operability determination can be provided by non-licensed individuals. Approval for operability determinations must always be provided by a senior licensed operator.

Topic 9 - Timing Considerations Timing was a major topic of discussion. The ODPTF believes that timing considerations are adequately addressed in Generic Letter 91-18, revision 1. The ODPTF will revise the RIS sections that have words on timing considerations to describe the operability decision process. The staff concern with timing considerations is that Completion Times are moving out, thus a value (e.g., 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />) was added to the inspector guidance which is a reasonable expectation to complete a prompt operability determination. The staff expectation is criteria for establishing reasonable assurance for SSC operability when documenting the basis for operability determinations. [Action Item - ODPTF]

Topic 11 - Documentation Requirements 3

Documentation should provide a recoverable basis for each operability/functionality determination. The ODPTF will revise the RIS sections on documentation. [Action Item -

ODPTF]

Topic 12 - the Role of Risk Assessment The ODP TF will incorporate the role of risk assessment in section 3.4 on functionality.

[Action Item - ODPTF]

Topic 13 - Interfaces with Regulations {comment B.4.1}

NRC will revise the RIS to clarify the interface with other regulations, e.g., the maintenance rule, the 10CFR50.59 change process, and 10CFR50.67 (alternative source term).

[Action Item - NRC]

Comment B.4.1 refers to Aging component reliability and connection to the Maintenance Rule. The process for maintenance rule interface with quantitative reliability information is discussed in response to Topic 13. This section, which is new to the RIS guidance, was added by maintenance rule group. The concept was that current PRA models utilize generic information based on average failure rates. The guidance to the inspector was to identify when plant specific or other age related information is available that the licensee is appropriately maintaining the PRA model with respect to managing plant risk in accordance with 50.65. Without specific guidance out there for standardized or validated PRA models this guidance is covered under 50.65.A.3 take into account industry wide operating experience [which include site specific data] . . . and in 50.65.A.4 Before performing maintenance . . . the licensee shall assess and manage the risk . . . [ which would include risk changes form site specific age related impacts on the PRA model].

Guidance beyond the qualitative treatment of aging component reliability information noted above, is beyond the scope of the RIS.

Topic 16 - Treatment of Methods of Evaluation The ODP TF will decide if further comments are needed with respect to methods of evaluation. [Action Item - ODPTF]

NEW ITEM - Rewrite Reasonable Expectation (Section 5.4)

When a licensee discovers a degraded or nonconforming condition, where operability of an SSC is questioned but determines that the SSC is operable, the determination process 4

must be predicated on the licensee=s reasonable expectation that the SSC is operable and the operability determination process (i.e., Section 5.0) will support that expectation. In this case, reasonable expectation does not mean absolute assurance that the SSC is operable, however, the preponderance of evidence should establish that the SSC is more likely than not operable. For example, evidence may show that an SSC probability of failure has increased, but not to the point of eroding reasonable assurance confidence, then an SSC should be declared inoperable with the knowledge that future evidence of reliability degradation may result in the SSC declared inoperable. Regardless, there is no indeterminate state of operability. An SSC is either operable or inoperable at all times Appendix B.4 insert If a degraded or non-conforming SSC has a high probability of failure (i.e., over 0.5), then the SSC should be considered inoperable. This does not imply that all SSCs whose failure probability is less than 0.5 are operable. The probability of failure of an SSC should be compared with its expected random failure probability. For example, based on past performance emergency diesel generators have a failure probability of about 0.05.

Therefore, any significant deviation from this failure probability, as opposed to 0.5 should be the criteria for acceptability.

IROB NRC INSPECTION MANUAL PART 9900: TECHNICAL GUIDANCE ASSESSING OPERABILITY DETERMINATIONS AND RESOLUTION OF DEGRADED AND NON-CONFORMING CONDITIONS Resolution of Comments (draft RIS & GL 91-18) rev 01-17-05.wpd 1.0 INTENT (new) 2.0 SCOPE/APPLICABILITY (revised) 3.0 DEFINITIONS 3.1 Current Licensing Basis 3.2 Design Basis (revised) 3.3 Operability (revised) 3.4 Specified Safety Function(s), and Function(s) 3.5 Functionality (new) 4.0 IDENTIFICATION OF DEGRADED OR NONCONFORMING CONDITIONS 4.1 Review Activities (revised) 4.2 Degraded Condition (revised) 4.3 Nonconforming Condition (revised) 4.4 Fully Qualified (revised) 5.0 OPERABILITY DETERMINATIONS 5.1 Reasonable Expectation (new) 5.2 Scope of Determinations/Comparison to Current Licensing Basis (revised) 5.3 Circumstances Requiring Operability Determinations (revised) 5.4 Timing of Operability Determinations (revised) 5.4.1 Immediate Determination (revised) 5.4.2 Prompt Determination (revised) 5.5 Documentation (new)

Enclosure 7 ODPTF_MARKUP_041805.wpd 9900 Revised 1

ASSESSING OPERABILITY DETERMINATIONS AND RESOLUTION OF DEGRADED AND NON-CONFORMING CONDITIONS Resolution of Comments (draft RIS & GL 91-18) rev 01-17-05.wpd 6.0 OPERATIONS BASED ON OPERABILITY DETERMINATIONS 6.1 Inoperable (revised) 6.2 Operable But Degraded or Nonconforming (revised) 6.3 Operability is Separate from Corrective Action to Restore Full Qualification 6.4 Enforcement Discretion (revised) 7.0 CORRECTIVE ACTION 7.1 The Current Licensing Basis and 10 CFR 50, Appendix B (revised) 7.2 Timing of Corrective Actions (new) 7.3 Compensatory Measures (revised) 7.4 Final Corrective Action (revised) 7.4.1 Change to Facility or Procedures in Lieu of Full Restoration (revised) 7.4.2 Change to the Current Licensing Basis to Accept As-found Condition (revised)

Appendix A SURVEILLANCES A.1 Operability During TS Surveillances A.2 System Configuration during Surveillance and Operability Testing A.3 Missed Technical Specification Surveillance (revised)

Appendix B MAINTENANCE B.1 Assessment and Management of Risk during Maintenance (new)

B.2 Operability during Maintenance (revised)

B.3 Relationship between Operable and Available with Respect to ROP Performance Indicators (PIs) (new)

Appendix C SPECIFIC OPERABILITY ISSUES C.1 Relationship between the General Design Criteria and the Technical Specifications (new)

C.2 Treatment of Single Failures in Operability Determinations ODPTF_MARKUP_041805.wpd 9900 Revised 2

ASSESSING OPERABILITY DETERMINATIONS AND RESOLUTION OF DEGRADED AND NON-CONFORMING CONDITIONS Resolution of Comments (draft RIS & GL 91-18) rev 01-17-05.wpd C.3 Treatment of Consequential Failures in Operability Determinations C.4 Use of Alternative Analytical Methods in Operability Determinations (new)

C.5 Use of Temporary Manual Action in Place of Automatic Action in Support of Operability C.6 Use of Probabilistic Risk Assessment in Operability Decisions C.7 Environmental Qualification (revised)

C.8 Technical Specification Operability vs. ASME Code,Section XI Operative Criteria C.9 Support System Operability (revised)

C.10 Piping and Pipe Support Requirements C.11 Flaw Evaluation (revised)

C.12 Operational Leakage (revised)

C.13 Structural Requirements ODPTF_MARKUP_041805.wpd 3 9900 Revised

ASSESSING OPERABILITY DETERMINATIONS AND RESOLUTION OF DEGRADED AND NON-CONFORMING CONDITIONS Resolution of Comments (draft RIS & GL 91-18) rev 01-17-05.wpd 1.0 INTENT This guidance is for NRC inspectors in their review of licensee determinations of operability. In addition, many facilities have found this guidance useful in developing their plant processes for operability determinations. Although this guidance generally reflects existing staff practices, it may not be directly applicable at specific plants. Consequently, inspectors should discuss significant differences among licensee practices with NRC management to ensure that the guidance is applied in a reasonable and consistent manner.

If, during an inspection, an NRC inspector obtains information reasonably indicating a degraded or nonconforming condition affecting any of the structures, systems, and components (SSCs) listed in Section 2.0, the inspector should promptly inform the appropriate level of licensee management so that the licensee can promptly evaluate the operability or functionality of the SSCs as appropriate.

NRC regulations and a plants operating license, including its technical specifications, provide requirements for SSCs to ensure that plant operation does not pose an undue risk to public health and safety. Although these requirements limit the risk of plant operation, not all events or conditions are addressed. The guidance herein can be used to address degraded or nonconforming conditions.

Licensees should be aware of SSC status on a continuing basis. Operability determinations allow licensees to make timely determinations concerning a SSCs capability to perform its specified safety function(s) upon discovery of degraded or nonconforming conditions.

The licensees immediate and primary attention should be on the safety of the plant. Whether or not explicitly discussed in plant documents, when a degraded or nonconforming condition is identified that may pose an immediate threat to public health and safety, the plant should be placed in a safe condition.

In addition, for unusual circumstances, the licensee must take actions necessary to limit the risk to public health and safety in a safe manner. While conducting an operability determination, there must be a reasonable expectation that the SSC is operable and that the determination will support operability.

2.0 SCOPE/APPLICABILITY Licensee that hold an operating license, including those who have permanently ceased operations and have certified that fuel has been permanently removed from the reactor vessel and all holders of operating licenses for non power reactors, including those whose licenses no longer authorize operation, should have a process to assess operability and functionality when degraded or nonconforming conditions affecting its SSC are identified.

This guidance is applicable to any of the following SSCs:

(i) SSCs explicitly stated in the technical specifications (TS), hereafter referred to as SSCs in TS.

SSCs in TS are required to be Operable by a TS LCO statement. For plants with Standard Technical Specifications (STS), the scope of SSCs in TS is described in the LCO section of the Bases. They may perform required support functions for other SSCs required to Operable by a TS LCO (e.g., emergency diesel generators, service water, etc.).

(ii) SSCs that are not explicitly required to be Operable by a TS LCO statement but perform required support functions (described in the definition of Operability) for SSCs that are required to be Operable by a TS LCO.

In addition, as part of an effective program for problem identification and corrective action, licensees should assess any degraded or nonconforming conditions to determine the functionality of SSCs that are not in plant TS, consistent with the safety significance of the SSC (see section 3.5).

ODPTF_MARKUP_041805.wpd 4 9900 Revised

ASSESSING OPERABILITY DETERMINATIONS AND RESOLUTION OF DEGRADED AND NON-CONFORMING CONDITIONS Resolution of Comments (draft RIS & GL 91-18) rev 01-17-05.wpd 3.0 DEFINITIONS 3.1 Current Licensing Basis The current licensing basis (CLB) is the set of NRC requirements applicable to a specific plant, and a licensee's written commitments for ensuring compliance with, and operation within, applicable NRC requirements and the plant-specific design basis (including all modifications and additions to such commitments over the life of the license) that are docketed and in effect. The CLB includes the NRC regulations in 10 CFR Parts 2, 19, 20, 21, 26, 30, 40, 50, 51, 54, 55, 72, 73, 100 and appendices thereto; orders; license conditions; exemptions, and technical specifications. It also includes the plant-specific design basis information defined in 10 CFR 50.2 as documented in the most recent UFSAR as required by 10 CFR 50.71 and the licensee's commitments remaining in effect that were made in docketed licensing correspondence such as licensee responses to NRC bulletins, generic letters, and enforcement actions, as well as licensee commitments documented in NRC safety evaluations or licensee event reports.

3.2 Design Basis Design basis information, defined by 10 CFR 50.2,3 as documented in the most recent UFSAR (as required by 10 CFR 50.71). The design basis of safety related SSCs was initially established during original plant licensing and relates primarily to the accident mitigation functions of safety related SSCs as described in the plants accident analysis. The design basis of safety related SSCs is a subset of its current licensing basis.

3.3 Operability The Standard Technical Specifications (STS) define OPERABLE or OPERABILITY as follows:

"A system, subsystem, train, component, or device shall be OPERABLE or have OPERABILITY when it is capable of performing its specified safety functions, and when all necessary attendant instrumentation, controls, normal or emergency electrical power, cooling and seal water, lubrication and other auxiliary equipment that are required for the system, subsystem, train, component, or device to perform its function(s) are also capable of performing their related support function(s)."

There are several variations in existing plant specific TS of the above basic definition. Therefore, some judgment is required in application of this guidance on operability. Word differences that exist do not typically result in significant philosophical differences when determining operability, but may result in differences in application. Any questions that result from differences between a plant-specific definition of operability and this guidance should be discussed with regional managers, who should discuss the issues with NRR if deemed necessary. In all cases, a licensee's plant-specific definition is governing.

Note that some licensees use the term Operable in non-TS applications. The Operability Determination Process described in this document does not apply to those applications.

3.4 Specified Safety Function(s), and Function(s) 3 Guidance and examples for identifying 10 CFR 50.2 design bases are contained in Regulatory Guide 1.186, which endorses Appendix B to the Nuclear Energy Institute (NEI) document NEI 97-04, Guidance and Examples for Identifying 10 CFR 50.2 Design Bases.

ODPTF_MARKUP_041805.wpd 5 9900 Revised

ASSESSING OPERABILITY DETERMINATIONS AND RESOLUTION OF DEGRADED AND NON-CONFORMING CONDITIONS Resolution of Comments (draft RIS & GL 91-18) rev 01-17-05.wpd A function performed by a SSC is considered specified if the function is identified in the current licensing basis. The term specified safety function has meaning only within the TS and this Manual Chapter.

The NRCs Final Policy Statement on Technical Specifications Improvements for Nuclear Power Reactors clarifies that the specified safety function(s) performed by SSCs that are in the Technical Specifications are the initial conditions and mitigating actions assumed in the existing design basis accident and transient analyses. These analyses consist of postulated events analyzed in the FSAR for which a structure, system, or component must meet specified functional goals. They are equivalent to the analyses described in Chapters 6 and 15 of NUREG-08004 involving Condition II III, or IV events (ANSI N18.25 or equivalent) that either assume the failure of or present a challenge to the integrity of a fission product barrier. For plants with improved technical specifications, specified safety functions are normally discussed in the TS Bases.

The specified safety functions of TS SSCs are a subset of all the specified functions and other non-CLB functions for those SSCs. Functions of non-TS SSCs are not specified safety functions, and functions of TS SSCs are not specified safety functions unless they satisfy the description in the technical specification policy statement referenced earlier in this section.

The phrase "necessary and required support function" derives from the definition of operability in Section 3.3. The SSCs that provide support functions may be in TS or outside TS. If they are in TS, they are either operable or inoperable. If they are support systems outside TS, the term operable does not apply to them directly, but they are still within the scope of the operability determination process because they can affect the operability of SSCs in TS. A necessary and required support function, as described in Section 3.3, could either be a specified function or a non-CLB function.

2.5 Functionality "Functionality" is an attribute of structures, systems, or components (SSCs) that are not controlled by Technical Specification (TS) Limiting Conditions for Operation (LCOs). Therefore, in the context of this Manual Chapter, functionality does not refer to "specified safety functions," but refers to the ability of non-TS SSCs to perform other "specified functions." Even though the primary purpose of this Manual Chapter is to guide timely operability determinations to verify that SSCs subject to TS LCOs can perform their specified safety functions, it may also be used to determine whether non-TS SSCs can perform their specified functions.

Functionality and operability are similar but separate concepts. While all licensees have a specific process for making operability determinations, they do not as a general rule have a specific process for making functionality determinations. The evaluation of functionality may be performed as part of other plant processes, such as the corrective action process.

The final plant-specific scope is at the licensee's discretion based on ensuring safe operation of the facility. It is appropriate to use risk insights to determine the scope of SSCs subject to functionality determinations. The effect of non-functional SSCs on licensing basis regulatory requirements (e.g.,

Appendix R, station blackout, ATWS, environmental qualification, maintenance rule) should be determined.

When a non-functional non-TS SSC is identified, the licensee may use Appendix B of this document to guide interim operation during the corrective action period. If the SSC is outside the scope of the maintenance rule (10CFR50.65), additional action is at the discretion of the licensee.

4 U.S. Nuclear Regulatory Commission, NUREG 0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants.

5 American National Standards Institute, ANSI N18.2, ___________________________________________________

ODPTF_MARKUP_041805.wpd 6 9900 Revised

ASSESSING OPERABILITY DETERMINATIONS AND RESOLUTION OF DEGRADED AND NON-CONFORMING CONDITIONS Resolution of Comments (draft RIS & GL 91-18) rev 01-17-05.wpd 4.0 IDENTIFICATION OF DEGRADED OR NONCONFORMING CONDITIONS 4.1 Review Activities The process of reviewing the performance of SSCs and ensuring their operability is continual. Many plant processes provide ongoing review of SSCs, where degraded or nonconforming conditions are identified. These activities include, but are not limited to, the following:

1.

Day-to-day operation of the facility 2.

Implementation of programs such as inservice testing and inspection 3.

Plant walkdowns or tours 4.

Observations from the control room 5.

Quality assurance activities such as audits and reviews 6.

Engineering design reviews including design basis reconstitution.

7.

Maintenance activities 8.

Actual SSC performance (including common mode failures) 9.

Review of operational events 10.

Design modifications to facilities 11.

Examinations of records 12.

Additions to facilities 13.

NRC inspections 14.

Vendor reviews or inspections 15.

Plant system walkdowns 16.

Operational experience reports 17.

Part 21 notifications Performance of TS surveillances also periodically verifies that SSCs are operable. Performance of the surveillance requirement is usually considered to be sufficient to demonstrate operability, provided that there is reasonable assurance that the system remains capable of performing its specified safety functions. However, whenever conformance to the criteria in the CLB that are both necessary and sufficient to establish operability is called into question, then performance of the surveillance requirement alone is usually not sufficient to determine operability. Failure to conform to those CLB criteria not needed to demonstrate operability should be addressed by the licensees corrective action program.

ODPTF_MARKUP_041805.wpd 7 9900 Revised

ASSESSING OPERABILITY DETERMINATIONS AND RESOLUTION OF DEGRADED AND NON-CONFORMING CONDITIONS Resolution of Comments (draft RIS & GL 91-18) rev 01-17-05.wpd When any licensee process indicates a degraded or nonconforming condition, the licensee must assess the operability of affected TS SSCs.. An example could be a TS surveillance that passed the given test, but the results exhibited a degrading trend that indicates that the acceptance criteria could be exceeded prior to the next required surveillance performance.

4.2 Degraded Condition A degraded condition is a condition of an SSC in which quality or functional capability has been reduced.

Examples of conditions that can reduce the quality include, but are not limited to, failures, malfunctions, deficiencies, deviations, defective material and equipment. Examples of conditions that can reduce the capability of a system include, but are not limited to, aging, erosion, corrosion, improper operation or maintenance.

4.3 Nonconforming Condition A nonconforming condition is a condition of an SSC that involves a failure to meet requirements or licensee commitments because of such factors as improper design, testing, construction, or modification. The following are examples of nonconforming conditions:

1.

An SSC fails to conform to one or more applicable codes or standards specified in the CLB (e.g., CFR, operating license, technical specifications, UFSAR, and licensee commitments).

2.

As-built or as-modified SSC does not meet CLB requirements.

3.

Operating experience or engineering reviews identify a design inadequacy with respect to conformance to the CLB.

4.

Documentation required by NRC requirements such as 10 CFR 50.49 is unavailable or deficient.

4.4 Fully Qualified An SSC is considered fully qualified when it conforms to all aspects of its CLB, including meeting all applicable codes and standards, design criteria, safety analyses assumptions and specifications, and licensing commitments. Operation with fully qualified SSCs ensures that safety margins are maximized.

An SSC is considered not fully qualified, i.e., degraded or nonconforming, when it does not conform to all aspects of its CLB, including meeting all applicable codes and standards, design criteria, safety analyses assumptions and specifications, and licensing commitments.

The table below illustrates the terminology used to describe the status of SSCs when degraded or nonconforming conditions are identified and evaluated.

QUALIFICATION SSC(s) STATED SSC(s) OUTSIDE SSC(s) STATUS OF IN FACILITY TS FACILITY TS CONDITION SSC(s)

No existing Fully Qualified Operable Functional Condition(s)

ODPTF_MARKUP_041805.wpd 8 9900 Revised

ASSESSING OPERABILITY DETERMINATIONS AND RESOLUTION OF DEGRADED AND NON-CONFORMING CONDITIONS Resolution of Comments (draft RIS & GL 91-18) rev 01-17-05.wpd One or more Not Fully Operable but Functional but Condition(s) exist Qualified degraded or degraded or affecting specified nonconforming nonconforming function(s) or margin in CLB, but SSC determined able to perform specified safety function(s)

One or more Not Fully Inoperable Not Functional Condition(s) exist Qualified affecting specified function(s), and SSC determined not able to perform specified safety function(s)

The SSCs defined in Section 2 are designed and operated, as described in the CLB, to include design margins of safety to ensure, among other things, that some loss of quality does not mean immediate failure. The CLB includes commitments to specific codes and standards, design criteria, and some regulations that also dictate margins. Many licensees add conservatism so that a partial loss of quality does not affect their commitments to the margins. The loss of conservatism that is not credited in the CLB is not a degraded or nonconforming condition.

5.0 OPERABILITY DETERMINATIONS Determinations of operability are appropriate whenever a review, TS surveillance, or other indication calls into question the SSCs ability to perform its specified safety function. If an immediate threat to public health and safety is identified, action to place the plant in a safe condition should be completed expeditiously.

Plant staff that are knowledgeable in the subject matter and possess appropriate knowledge of plant operations should make the operability determinations for the facility.

The processes displayed in the attached flowchart, Regulatory Information Summary Assistance Navigator, identify paths that a licensee may follow for operability and functionality determinations, and to resolve degraded and nonconforming conditions. [Note: this flowchart is still under development.]

5.1 Reasonable Expectation Establishing a reasonable expectation basis for declaring a degraded or nonconforming SSC operable applies to both immediate and prompt operability determinations. Specifically, reasonable assurance means that the licensee has confidence that the degraded or nonconforming SSC is capable of performing its specified safety function as supported by a preponderance of evidence. Reasonable expectation does not imply with absolute certainty that the SSC will perform its specified safety function.

Fore example, evidence may show that an SSC probability of failure has increased but not to the point of eroding reasonable expectation, then as AWSSC should be declared operable with the knowledge that future evidence of reliability degradation may result in the SSC declared inoperable. Regardless, there is no indeterminate state of operability. An SSC is either operable or inoperable at all times.

5.2 Scope of Determinations/Comparison to Current Licensing Basis ODPTF_MARKUP_041805.wpd 9 9900 Revised

ASSESSING OPERABILITY DETERMINATIONS AND RESOLUTION OF DEGRADED AND NON-CONFORMING CONDITIONS Resolution of Comments (draft RIS & GL 91-18) rev 01-17-05.wpd The scope of the operability determination needs to be sufficient to address the capability of the SSC to perform its specified safety function(s)). The licensee should examine the full scope of the CLB, including the TS and UFSAR commitments, to establish the conditions and performance requirements to be met for determining operability. The operability decision may be based on analysis, a test or partial test, experience with operating events, engineering judgment, or a combination of these factors taking into consideration SSC functional requirements. Operability determinations should therefore consider the following actions:

• Determine what SSC is degraded or nonconforming.

• Determine the specified safety function(s) performed by the SSC.

• Determine the effect or potential effect of the degraded or nonconforming condition on the plant.

• Determine the extent of the condition in the plant.

• Determine the requirement or commitment established for the SSC.

• Determine if SSC operability is established and the basis for the determination, including any additional actions or compensatory measures put in place to establish or restore operability When performing operability determinations, the following should be kept in mind:

• Design basis events are plant specific; and technical specifications, bases, and safety evaluations may contain plant-specific considerations related to operability.

• The system operability requirements that are based on safety analysis of specific design basis events for one mode or specified condition of operation may not be the same for other modes or conditions of operation, so all applicable modes and conditions of operation should be considered.

• An SSCs operability requirements extend to all of its necessary support systems (per the TS definition of Operability) regardless of whether the TS explicitly specify operability requirements for those support functions.

• The effect on operability of necessary support systems does not include consideration of the occurrence of multiple (simultaneous) design basis events, unless described in the current licensing basis.

5.3 Circumstances Requiring Operability Determinations At a minimum, licensees should make a determination of the effect on operability in the following circumstances:

• Discovery of degraded conditions of SSCs.

• Discovery of nonconforming conditions of SSCs.

• Discovery of an existing but previously unanalyzed condition or accident.

ODPTF_MARKUP_041805.wpd 10 9900 Revised

ASSESSING OPERABILITY DETERMINATIONS AND RESOLUTION OF DEGRADED AND NON-CONFORMING CONDITIONS Resolution of Comments (draft RIS & GL 91-18) rev 01-17-05.wpd 5.4 Timing of Operability Determinations Timeliness of operability determinations should be commensurate with the safety significance of the issue. Entry into the operability determination process requires performance of an immediate determination and may require performance of a prompt determination.

5.4.1 Immediate Determination An immediate determination of SSC operability should be made following discovery of the circumstances described in Section 5.3. The immediate determination should be based on the best information available. An amount of time commensurate with plant safety is allowed to confirm a condition or determine if industry experience applies to the plant (identify best available information).

However, licensees should not delay immediate operability determinations by doing extensive evaluations While the immediate determination is in progress, operators should remain aware of the status of affected SSCs. In cases where a prompt determination will be performed, the immediate determination should document the basis for concluding that a reasonable expectation of operability exists while the prompt determination is in progress. If a reasonable expectation of operability does not exist utilizing the best available information at any time during the operability determination process, the component shall be declared inoperable. For guidance on documenting an immediate determination, refer to Section 5.6, Documentation.

Licensees routinely make operability determinations outside the operability determination process. If a SSC is clearly inoperable (e.g., loss of motive power, failed surveillance or post-maintenance test),

then a reasonable expectation of operability does not exist and the SSC should be declared inoperable immediately. Similarly, when an SSC is confirmed operable following performance of a periodic surveillance or similar type activity, then the circumstances described in Section 5.3 do not exist. In such cases, an immediate operability determination is made. However, neither of these cases is predicted on a reasonable expectation of operability following discovery of the circumstances identified in Section 5.3. Therefore, entry into the operability determination process is not required and the documentation requirements of Section 5.8 are not applicable.

5.4.2 Prompt Determination Subsequent to the immediate operability determination, a prompt operability determination should be made. A prompt determination may not be necessary in all cases. For example, if a component is clearly inoperable, or if enough information is readily available at the time of the immediate operability determination, then a prompt determination would not be required. In all cases, a reasonable expectation of operability must exist while the prompt determination is completed and the prompt determination must be completed without delay. Licensees should continually make progress to complete the operability determination and not delay because of a perception that additional time is available.

There is not an explicit requirement in the regulations for the timing of the decision. Timeliness is important and is determined by the safety significance of the issue. For example, for some situations involving SSCs with high safety significance, it may be appropriate to make the prompt operability determination within a few hours In most cases, prompt operability decisions can be made within approximately 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of discovery, even though complete information may not be available. There may be instances where additional input is needed that may take significantly longer, such as a vendor analysis or calculation. For these instances, the license should weigh risk significance against the time needed to get the additional input to determine if it is appropriate to delay completion of an operability determination.

ODPTF_MARKUP_041805.wpd 11 9900 Revised

ASSESSING OPERABILITY DETERMINATIONS AND RESOLUTION OF DEGRADED AND NON-CONFORMING CONDITIONS Resolution of Comments (draft RIS & GL 91-18) rev 01-17-05.wpd The TS completion times are one indication of safety significance of an SSC that can be used for determining the time limit for completing the prompt operability determination. However, the completion times should not be considered as absolute limits. Licensees should continually make progress to compete the operability determination and not delay because of a perception that additional time is available.

Where there is reason to question that the determination process is not, or was not prompt, the Region may discuss with the licensee, with NRR consultation as appropriate, the reasoning for the perceived delay.

For guidance on documenting Prompt Determination refer to Section 5.5, Documentation.

5.5 Documentation The immediate determination of operability should be retrievable and should include information related to the degraded or nonconforming condition. This determination should be documented but need not be extensive. The documentation can use plant record systems, such as, operator logs, corrective action program, or the licensees operability determination process. In some cases a simple check mark would be sufficient.

The prompt operability determination should be documented and available for inspection.

Documentation should include the additional information required to support the reasonable expectation conclusion that the SSC(s) is operable but degraded or nonconforming. Supporting information for the operability determinations, if not included in the operability documentation, should be appropriately referenced. This documentation should describe the scope and basis of the determination, which may include items discussed in Section 5.2. Operability determination documentation should be sufficiently detailed so that an individual knowledgeable in the technical discipline of the judgment would be able to review and understand its basis. For example, simple documentation of the assumptions would be sufficient for a very obvious judgment, while detailed calculations may be needed to support more complex judgments. An inadequately documented engineering judgment, no matter how sound, cannot be independently scrutinized and so the basis for it could be misunderstood later by someone working on the affected SSC. In the worst case, the engineering judgment could be inadvertently invalidated by later changes to the SSC or supporting analyses and calculations.

6.0 OPERATIONS BASED ON OPERABILITY DETERMINATIONS 6.1 Inoperable If any SSCs in TS (Section 2.0, item vi) have been determined to be inoperable, then the LCO must immediately be declared not met 6.2 Operable But Degraded or Nonconforming If any SSCs in TS (Section 2.0, item vi) have been determined to be operable, although a degraded or nonconforming condition is present, the SSCs are considered "operable but degraded or nonconforming." For example, an SSC may be operable even though it may be in nonconformance with its environmental qualification requirements (e.g., an EQ SSC with a 30-day post-accident EQ operating time requirement, but demonstrated capable of performing its specified function(s) for only 7 days post-accident, is operable since it will perform its specified safety function within its 24-hour mission time requirement specified in its design basis accident analysis.) Operation at this level ensures that adequate safety margins are maintained.

ODPTF_MARKUP_041805.wpd 12 9900 Revised

ASSESSING OPERABILITY DETERMINATIONS AND RESOLUTION OF DEGRADED AND NON-CONFORMING CONDITIONS Resolution of Comments (draft RIS & GL 91-18) rev 01-17-05.wpd SSCs that are determined to be operable but degraded or nonconforming are considered to be in compliance with the TS, and licensees may continue operation.6 This is consistent with the plant TS being the controlling document for making decisions about plant operations. However, corrective actions must be taken to correct the degraded or nonconforming condition commensurate with the safety significance of the issues, as discussed in Section 7, Corrective Action.

The prompt operability determination for the degraded or nonconforming condition, as documented per Section 5.5, in conjunction with the TS Actions, essentially constitutes a basis for continuing operations.

This basis should continue to be reviewed in an ongoing manner until corrective actions are successfully completed. SSCs that have been determined operable through an operability determination may be considered to remain operable as long as information does not exist that would invalidate the reasonable expectation of operability established in the determination.

There may be situations where a licensee finds itself in noncompliance with a regulation, and the noncompliance is not addressed by the operating license or the TS. In such situations, the licensee should determine if there is an immediate safety issue as a result of the noncompliance. Corrective actions should be commensurate with the safety significance of the noncompliance; immediate action such as shutting down the plant may not be required, unless otherwise specified by NRC requirements.

The licensee should further determine if any other NRC requirements apply to the situation (e.g., 10 CFR Part 50, Appendix B, Criterion XVI, or 10 CFR 50.12) and take the required action.

6.3 Operability is Separate from Corrective Action to Restore Full Qualification Operability determinations are intended to result in timely decisions or actions pertaining to continued plant operation when degraded or nonconforming conditions are identified, while actions to restore qualification are intended to be part of corrective actions. The principle of treating operability and restoration of qualification as separate issues is to emphasize that operability determinations are focused on safety and should not be delayed by decisions or actions necessary to fully plan or implement the corrective action (i.e., restore full qualification).

However, qualification concerns can and should be promptly considered to determine the effect of the concern on the operability of the SSC. Corrective actions must be taken to correct qualification concerns commensurate with the safety significance of the issues, as describe in Section 7, Corrective Action.

6.4 Enforcement Discretion Under certain limited circumstances, a licensee may find that strict compliance with the TS or a license condition would cause an unnecessary action that is not in the best interest of public health and safety.

NRC review and approval is required before a licensee takes actions that are not in compliance with a plants license conditions or TS, except in certain emergency situations when 10 CFR 50.54(x) and (y) are applied. Currently, guidance regarding these limited circumstances is discussed in NRC Inspection Manual Part 9900: Technical Guidance, Operations - Notices of Enforcement Discretion.

7.0 CORRECTIVE ACTION 7.1 The Current Licensing Basis and 10 CFR 50, Appendix B When licensing a plant, the NRC reviews the design information submitted by a license applicant to assure that the plant meets NRC rules and regulations (e.g., the licensing basis). The NRC issues a license authorizing the licensee to operate and maintain the plant in accordance with NRC rules and 6

Exceptions to this general statement are possible. For example, in the case of a facility that is experiencing significant performance problems that have led to issuance of a confirmatory action letter or order preventing that licensee from continuing to operate or resuming operation until approval is granted by the NRC.

ODPTF_MARKUP_041805.wpd 13 9900 Revised

ASSESSING OPERABILITY DETERMINATIONS AND RESOLUTION OF DEGRADED AND NON-CONFORMING CONDITIONS Resolution of Comments (draft RIS & GL 91-18) rev 01-17-05.wpd regulations, the conditions of the license, and plant TS. Licensee operation and maintenance of the plant in accordance with the license, and any changes to the license, ensures that the basis for NRC approval of the plant design remains valid.

The NRC has established various processes for making changes to the plant design in a controlled manner. Changes to the license and TS can be made as part of license amendments. Licensees may make changes to a facility in accordance with 10 CFR 50.59. In addition, for significant conditions adverse to quality, licensees are required by Criterion XVI of 10 CFR Part 50, Appendix B, to promptly identify and correct the conditions, and take action to prevent recurrence. W hen resolving degraded and nonconforming conditions as part of the corrective action, licensees may make changes to a facility in accordance with these processes.

The NRC has also established requirements for plant operation during maintenance within the CLB. For degraded or nonconforming conditions of SSCs in TS (Section 2.0, item i), the license and TS normally specify the required actions to meet NRC requirements. For maintenance, 10 CFR 50.65 may also specify additional requirements for SSCs including risk assessments, enhanced monitoring, and repair and/or replacement activities. If a risk significant change would be encountered, a review of potential contingency plans for entering an increased risk profile should be completed as well as a review of ongoing and planned maintenance evolutions.

In addition, the NRC is kept informed of events and issues resulting from plant operations in part by establishing reporting requirements in the TS, 10 CFR 50.72, 50.73, 50.9(b), 10 CFR Part 21, or by other parts of the CFR.

Collectively, these requirements may be viewed as a process for licensees to continue to operate in accordance with their CLB, or place the plant in a safe condition and take prompt corrective action. Both operability determinations and corrective actions for degraded and non-conforming conditions are intended to be consistent with that process.

6.2 Timing of Corrective Actions The licensee should establish a schedule for performing corrective action when a SSC is found to be degraded or nonconforming. For significant conditions adverse to quality, licensees should conduct a review in a timely manner to determine the extent of condition for all similarly affected SSCs. In accordance with the requirements in 10 CFR 50 Appendix B, the timeliness of the corrective action should be commensurate with the safety significance of the issue.

In determining whether the licensee is making reasonable efforts to complete corrective actions promptly, the NRC will consider the timing of corrective action, taking into account safety significance, effects on operability, significance of degradation, and what is necessary to implement the corrective action. Factors that the NRC may consider are the amount of time required for design, review, approval, or procurement of the repair or modification; the availability of specialized equipment to perform the repair or modification; and whether the plant must be in hot or cold shutdown to implement the actions.

In the event that corrective action for safety significant conditions will not be implemented before startup from the next refueling outage, then specific information should be included in the deficiency tracking documentation justifying the schedule. Factors that should be considered are: 1) an evaluation of the identified cause including any contributing factors and proposed corrective actions, 2) an evaluation of the existing conditions with compensatory measures in place including the acceptability of the schedule for repair and replacement activities, 3) a reason (e.g., time necessary for design/modification prior to outage start, extended procurement time, etc.) why the repair or replacement activities will not be accomplished during the planned outage, and 4) a review and approval for the schedule by the appropriate site management and/or oversight organizations.

7.3 Compensatory Measures ODPTF_MARKUP_041805.wpd 14 9900 Revised

ASSESSING OPERABILITY DETERMINATIONS AND RESOLUTION OF DEGRADED AND NON-CONFORMING CONDITIONS Resolution of Comments (draft RIS & GL 91-18) rev 01-17-05.wpd When evaluating the impact of a degraded or nonconforming condition on plant operation, a licensee may decide to implement compensatory measures as an interim step to enhance the capability of SSCs until final corrective action to resolve the condition is completed. Compensatory measures may be considered when enhancing the status of SSCs that have been determined to be operable but degraded or nonconforming, or as an interim step when restoring SSCs to operable status, or as the logical next step to support corrective maintenance and compensate for the degraded or nonconforming condition.

Compensatory measures for degraded or nonconforming conditions for SSCs that have been determined to be operable are usually implemented to restore plant operating margins (see Section 4.4),

or to reduce or eliminate operator work-arounds (e.g., remove a nuisance alarm).

Compensatory measures may also be used to restore inoperable SSCs to an operable but degraded or nonconforming status. A "reasonable time frame" for completing corrective actions should be established in accordance with a licensees corrective action process as discussed in Section 7.2. In general, these measures should be relatively simple to implement and have minimal operator or plant impact. In addition, the NRC expects that licensees will more quickly resolve degraded or nonconforming conditions using compensatory measures. Greater emphasis is placed on manual actions because reliance on manual actions in place of automatic actions suggests a greater degree of degradation.

Section C.5 contains guidance for evaluating the use of manual actions in place of automatic actions.

The licensee should evaluate the acceptability and effectiveness of a compensatory measure as it relates to the degraded or nonconforming condition. The evaluation should consider the effects of the compensatory measure on other SSCs.

In considering whether a compensatory measure could affect other aspects of the facility, a licensee should pay particular attention to ancillary aspects of the compensatory measure that could result from actions taken to compensate for the degraded condition. For example, a licensee may plan to close a valve as a compensatory measure to isolate a leak. Although that action would temporarily resolve the leaking condition, it may also affect flow distribution to other components or systems, complicate required operator responses to normal or off normal conditions, or have other effects that should be reviewed.

If a compensatory measure involves a temporary facility or procedure alteration, a 10 CFR 50.59 review is necessary in addition to the technical evaluation discussed above. Guidelines for implementing 10 CFR 50.59 are contained in NEI 96-07, which is endorsed by Regulatory Guide 1.187.

7.4 Final Corrective Action The licensee is responsible for corrective action. A licensee's range of corrective action may involve (1) full restoration to the UFSAR-described condition such as through performance of corrective maintenance (see Appendix B to this document), (2) a change to the licensing basis to accept the as-found condition as is, or (3) some modification of the facility or CLB other than restoration to the condition as described in the UFSAR.

If corrective action is taken to restore the degraded or nonconforming condition, no 10 CFR 50.59 screening/evaluation is required. The 10 CFR 50.59 process applies when the final resolution of the degraded or nonconforming condition differs from the established UFSAR requirement. At this point, the licensee plans to make a change to the facility or procedures as described in the UFSAR. The proposed change is now subject to the review process established by 10 CFR 50.59. A change can be safe, but still require NRC approval. The proposed final resolution may require staff review and approval without affecting the continued operation of the plant, because interim operation is being governed by the processes for determining operability and taking corrective action (10 CFR 50 Appendix B).

In two situations, the identification of a final resolution or final corrective action triggers a 10 CFR 50.59 review, unless another regulation applies (e.g., 10 CFR 50.55a): (1) when a licensee decides as the final ODPTF_MARKUP_041805.wpd 15 9900 Revised

ASSESSING OPERABILITY DETERMINATIONS AND RESOLUTION OF DEGRADED AND NON-CONFORMING CONDITIONS Resolution of Comments (draft RIS & GL 91-18) rev 01-17-05.wpd corrective action to change its facility or procedures to something other than full restoration to the UFSAR-described condition, and (2) when a licensee decides to change its licensing basis, as described in the UFSAR, to accept the degraded or nonconforming condition as its revised licensing basis. Each of these situations is discussed in greater detail below.

In both of these situations, the potential need to obtain NRC approval for a change does not affect the licensee's authority to operate the plant. The licensee may make mode changes, restart from outages, etc., provided that necessary SSC is operable and the degraded condition does not violate the TS or the license. The basis for this authority to continue to operate arises because the TS contain the specific characteristics and conditions of operation necessary to obviate the possibility of an abnormal situation or event giving rise to an immediate threat to public health and safety. Thus, if the TS are satisfied and required SSC is operable, and the licensee is correcting the degraded or nonconforming condition in a timely manner, continued plant operation does not pose an undue risk to public health and safety.

7.4.1 Change to Facility or Procedures in Lieu of Full Restoration In the first situation, the licensees proposed final resolution of the degraded or nonconforming condition includes other changes to the facility or procedures to cope with the uncorrected or only partially corrected degraded or nonconforming condition. Rather than fully correcting the degraded or nonconforming condition, the licensee decides to restore capability or margin by making another change. In this case, the licensee must evaluate the change from the UFSAR described condition to the final condition in which the licensee proposes to operate its facility. If the 10 CFR 50.59 screening/evaluation concludes that a change to the TS is involved or the change meets any of the evaluation criteria specified in the rule for prior NRC approval, a license amendment must be requested, and the corrective action process is not complete until the approval is received or some other resolution occurs.

7.4.2 Change to the Current Licensing Basis to Accept As-found Condition In the other situation the licensee proposes to change the current licensing basis to accept the as-found nonconforming condition. In this case, the 10 CFR 50.59 review covers the change from the UFSAR-described condition to the existing condition in which the licensee plans to remain (i.e., the licensee will exit the corrective action process by revising its licensing basis to document acceptance of the condition). If the 10 CFR 50.59 screening/evaluation concludes that a change to the TS is involved or the change meets any of the evaluation criteria specified in the rule for prior NRC approval, a license amendment must be requested and the corrective action process is not complete until the approval is received or some other resolution occurs. To resolve the degraded or nonconforming condition without restoring the affected SSC to its original design, a licensee may need to obtain an exemption from 10 CFR Part 50 in accordance with 10 CFR 50.12 or relief from a design code in accordance with 10 CFR 50.55a. The use of 10 CFR 50.59, 50.12, or 50.55a in fulfillment of 10 CFR 50 Appendix B corrective actions requirements does not relieve the licensee of the responsibility to determine, for significant conditions adverse to quality, the cause, to examine other affected systems, to take action to prevent recurrence, and to report the original condition, as appropriate.

APPENDICES Appendix A: SURVEILLANCES A.1 Operability during TS Surveillances If performance of TS surveillances requires that SSCs required to be operable by the TS be rendered incapable of performing specified safety function, the SSC is inoperable. The LCO must immediately be declared not met. Upon completion of the surveillance, the licensee should verify restoration to ODPTF_MARKUP_041805.wpd 16 9900 Revised

ASSESSING OPERABILITY DETERMINATIONS AND RESOLUTION OF DEGRADED AND NON-CONFORMING CONDITIONS Resolution of Comments (draft RIS & GL 91-18) rev 01-17-05.wpd operable status of at least those portions of the SSCs or system features that were altered to accomplish the surveillance.

Technical specifications permit use of TS action statements to perform surveillance testing for a number of reasons. One reason is that the time needed to perform most surveillance tests is usually only a small fraction of the completion time associated with the required action. Another reason is that the benefits to safety (increased level of assurance of reliability and verification of operability) derived from meeting surveillance requirements is considered to more than compensate for the risk to safety from operating the facility in a TS action statement.

A.2 System Configuration during Surveillance and Operability Testing It is preferable that TS surveillance requirements be performed in a configuration and in conditions representative of those in which the system must perform its specified safety function. However, testing in other configurations or conditions may be required if testing in the accident or transient configuration would result in unwarranted safety concerns or transients. In this case, the surveillance requirement acceptance criteria in the TS for the test condition should be based on an extrapolation from the test condition to the condition in which the specified safety function is performed. Operability is based on meeting the acceptance criteria specified in the TS. The system configuration for TS surveillance requirements is usually prescribed, and the acceptance criteria are established on that basis.

Test failures should be examined to determine the cause and correct the problem before resumption of testing. Repetitive testing to achieve acceptable test results without identifying the root cause or correction of any problem in a previous test is not acceptable as a means to establish or verify operability and may constitute preconditioning.

A.3 Missed Technical Specification Surveillance The Standard Technical Specifications (STS) Revision 3 contains Surveillance Requirement 3.0.1, which states:

SRs shall be met during the MODES or other specified conditions in the Applicability for individual LCOs, unless otherwise stated in the SR. Failure to meet a surveillance requirement, whether such failure is experienced during the surveillance or between successive surveillances, shall be failure to meet the LCO. Failure to perform surveillance within the specified frequency shall be failure to meet the LCO except as provided in SR 3.0.3.

Surveillances do not have to be performed on inoperable equipment or variables outside specified limits.

STS Revision 3 SR 3.0.3 states:

"If it is discovered that a surveillance was not performed within its specified frequency, then compliance with the requirement to declare the LCO not met may be delayed, from the time of discovery, up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or up to the limit of the specified frequency, whichever is greater. This delay period is permitted to allow performance of the Surveillance. A risk evaluation shall be performed for any Surveillance delayed greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and the risk impact shall be managed.

If the Surveillance is not performed within the delay period, the LCO must immediately be declared not met, and the applicable Condition(s) must be entered.

ODPTF_MARKUP_041805.wpd 17 9900 Revised

ASSESSING OPERABILITY DETERMINATIONS AND RESOLUTION OF DEGRADED AND NON-CONFORMING CONDITIONS Resolution of Comments (draft RIS & GL 91-18) rev 01-17-05.wpd When the Surveillance is performed within the delay period and the Surveillance is not met, the LCO must immediately be declared not met, and the applicable Condition(s) must be entered."

Plant-specific TS variations of this statement may exist, in which case the plant-specific TS govern.

STS SR 3.0.3 is based on NRC Generic Letter (GL) 87-09, "Sections 3.0 and 4.0 of the Standard Technical Specifications (STS) of the Applicability of Limiting Conditions for Operation and Surveillance Requirements," dated June 4, 1987. GL 87- 09 was published to address three specific issues with the application of technical specifications. One of those issues was missed surveillances.

The NRC staff has changed STS SR 3.0.3 with regard to missed surveillances as published in the Federal Register [66 FR 49714], and referred to TSTF-358, Revision 6 . The basis for establishing the changes to requirements for missed surveillances in GL 87-09 continues to apply to SR 3.0.3. As evidenced by the discussion in GL 87-09, the intent of the change proposed in the GL was to reduce the impact on plant risk resulting from the performance of a missed surveillance test by allowing some flexibility in the performance of missed tests. The delay time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> was selected using engineering judgment in the absence of suitable tools to determine a delay period on a case-by-case basis. In addition, the staff recognized in GL 87-09 that a 24-hour delay period would not be sufficient in some cases and licensees would need to seek regulatory relief in those cases.

GL 87-09, TS, and TSTF-358 Revision 6 provide extensive guidance on surveillance extension, applicability, and success criteria. The above discussion involves only the operability issues.

Appendix B: MAINTENANCE B.1 Assessment and Management of Risk during Maintenance After identifying a degraded or nonconforming condition, a licensee will typically perform corrective maintenance to restore an SSC to meet all aspects of its current licensing basis. The TS and/or risk assessment should be used to determine the appropriate time frame to complete the maintenance or take other action. The Maintenance Rule, 10 CFR 50.65, provides requirements for monitoring the effectiveness of maintenance at nuclear power plants. The underlying objective is to help maintain plant safety by trending the performance and condition of SSCs within the scope of the rule in terms of reliability and availability to predict their future performance and condition and to assess the effectiveness of maintenance. Specifically, 10 CFR 50.65(a)(3) requires that licensees ensure that the objective of preventing failures of SSCs through maintenance, (i.e., reliability, is appropriately balanced against the objective of maximizing availability (or minimizing unavailability) of SSCs due to monitoring or preventive maintenance (PM)). Additionally, 10 CFR 50.65(a)(4) requires that licensees perform risk assessments before maintenance activities involving SSCs within the scope of paragraph (a)(4) and manage the increase in overall plant risk that may result.

The risk assessment performed by the licensee per 10 CFR 50.65(a)(4) should as a minimum reflect the unavailability of the affected SSCs during the performance of maintenance. The assessment should also consider the unavailability of degraded or nonconforming SSCs determined to be inoperable or nonfunctional. Performing the 10 CFR 50.65(a)(4) risk assessment, however, does not relieve the licensee from compliance with its license (including TS) and other applicable regulations.

The conduct of maintenance may also involve other temporary procedure or facility alterations to allow the maintenance to be performed or to reduce risk. Such alterations include but are not limited to jumpered terminals, lifted leads, and temporary blocks, bypasses, or scaffolding. Temporary alterations associated with maintenance should be assessed consistent with Section 7.3 (Compensatory Measures).

ODPTF_MARKUP_041805.wpd 18 9900 Revised

ASSESSING OPERABILITY DETERMINATIONS AND RESOLUTION OF DEGRADED AND NON-CONFORMING CONDITIONS Resolution of Comments (draft RIS & GL 91-18) rev 01-17-05.wpd The planned removal of hazard barriers for maintenance is considered a temporary alteration. Additional guidance on hazard barriers is provided in Regulatory Issue Summary (RIS) 2001-009, Control of Hazard Barriers, dated April, 2, 2001. Licensees must continue to comply with the plant technical specifications, particularly operability provisions applicable to the protected SSCs. RIS 2001-09 indicates that the operability guidance in the NRC Inspection Manual can be used to evaluate the operability of such protected SSCs.

B.2 Operability during Maintenance During maintenance (preventive, predictive, or corrective), SSCs may be removed from service and rendered incapable of performing the specified safety function(s). When that is done as SSC is clearly inoperable. For SSCs subject to the TS, the maintenance activity and any other action that may be required by the specification is expected to be finished within the completion times for the required actions. As stated above, a licensee may take SSCs out of service to perform maintenance during power operation of the facility but must meet the requirements of 10 CFR 50.65 in addition to (and not as a substitute for) the TS. This is true for maintenance activities under all modes of plant operation.

Intentional entry into an action statement of a specification is not a violation of the TS. Similar to the bases for surveillance testing (NRC Inspection Manual Part 9900 - Technical Guidance, Maintenance -

Voluntary Entry into Limiting Conditions for Operation Action Statements to perform Preventive Maintenance), TS actions applicable to may be entered for maintenance activities. However, the NRC does not recommend intentionally creating a loss of specified safety function situation or entering LCO 3.0.3 simply for operational convenience, e.g., an action that has either operational or economic benefit without adequate regard to safety. As stated in the bases for LCO 3.0.3 in STS Revision 3, LCO 3.0.3 "is not intended to be used as an operational convenience that permits routine voluntary removal of redundant systems or components from service in lieu of other alternatives that would not result in redundant systems or components being inoperable. For additional guidance refer to NRC Administrative Letter 98-10, Dispositioning of Technical Specifications that are Insufficient to Assure Plant Safety.

If licensee activities to conduct maintenance would render TS "nonconservative then a license amendment should be obtained before performing that activity (or other regulatory relief such as a NOED should be sought if needed for corrective maintenance requires faster time for approval). 10 CFR 50.36(b) states that "the technical specifications will be derived from the analyses and evaluation included in the safety analysis report, and amendments thereto, submitted pursuant to '50.34." In this case, a nonconservative TS is no longer consistent with the analyses and evaluation in the facilitys UFSAR.

For SSCs that are not in the TS (i.e., not Section 2.0, item vi), or that are not TS support systems (i.e.,

not Section 2.0, item vii), the licensee's maintenance activities should be consistent with the importance of the SSC's specified function(s) and the risk assessment.

The licensee also may need to reestablish operability for systems or components, in whole or in part, that are actively dependent upon the SSCs being maintained. Operability should be reestablished in accordance with the guidance in Section 5.2.

B.3 Relationship between Operable and Available with Respect to ROP Performance Indicators (PIs)

Operability is a term that is strictly defined in Section 1.1 of the Standard Technical Specifications.

Maintenance Rule "availability" is defined in Appendix B, "Definitions," to NUMARC 93-01, "Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, Revision 2 of April 1996, as modified in the attachment, "Appendix B, Definitions" to revised Section 11, "Assessment of Risk Resulting from Performance of Maintenance Activities, dated February 22, 2000, and endorsed by ODPTF_MARKUP_041805.wpd 19 9900 Revised

ASSESSING OPERABILITY DETERMINATIONS AND RESOLUTION OF DEGRADED AND NON-CONFORMING CONDITIONS Resolution of Comments (draft RIS & GL 91-18) rev 01-17-05.wpd Regulatory Guide 1.182. As such, Maintenance Rule availability arises from the ability of an in-scope SSC, including train as applicable, to perform the function that is being monitored by the maintenance rule process.

The potential difference between "operability" and "availability" lies in the description of the function being reviewed. For instance, when a pump is restored to service from maintenance, but prior to the pump passing associated post maintenance testing (PMT) and being declared operable, the pump may be considered available. (This presumes that the PMT is successful. However, if the pump fails the PMT, availability cannot be credited for this period).

Nevertheless, the ROP PI program has carefully avoided the use of the term operable because of its association with technical specifications. Instead, the ROP PIs monitor availability of important safety systems. The PI guidance document states that the purpose of the indicators is to "monitor the readiness of important safety systems to perform their safety function in response to off-normal events or accidents." The PI program does not evaluate whether a train was operable per the technical specifications.

Appendix C: SPECIFIC OPERABILITY ISSUES C.1 Relationship between the General Design Criteria and the Technical Specifications The General Design Criteria (GDC) and the TS differ in that the GDC set forth requirements for design of nuclear power reactors; whereas, TS generally specify the requirements for operation of nuclear reactors. This discussion is intended to provide a general context of the relationship of GDC and TS.

Some facilities were licensed prior to establishment of the GDC and as a result applicability of the GDC varies at some facilities. The need and ability to comply with both sets of requirements have caused confusion.

The design criteria of the GDC correspond both directly and indirectly to the operational requirements of the TS. The GDC "establish the necessary design, fabrication, construction, testing, and performance requirements for SSCs important to safety." Thus, the GDC cover a broad spectrum of SSCs of which, not all explicitly subject to the TS. The GDC are reflected in the facility design as described in the UFSAR. The licensee derives the TS from the facility design requirements and analyses that support the facility design as described in the UFSAR and the NRC staff's evaluation of those analyses.

While a variety of features must be included in the design of a nuclear power reactor, the TS need control only those aspects of the design and facility conditions required to ensure adequate protection of the health and safety of the public. As stated in 10 CFR 50.36, TS are to be "derived from the analyses and evaluation included in the safety analysis report." TS establish, among other things, limiting conditions for operation which are "the lowest functional capability or performance levels of SSCs required for safe operation of the facility."

Required actions and completion times of the TS are a simple illustration of the relationship between the GDC and the TS. The GDC require redundancy of function for safety systems. This is normally accomplished for each safety system by incorporating at least two redundant trains into the design of each such system. The TS typically allow a facility to continue to operate with only a single train operable of a two-train safety system for a specified time. In such a case, the GDC are met because the system design provides the necessary redundancy, which the TS require to be available for operation most of the time. The TS permits the operation of the same system with only a single train based on an evaluation of the protection that system lineup provides for the specified period.

C.2 Treatment of Single Failures in Operability Determinations ODPTF_MARKUP_041805.wpd 20 9900 Revised

ASSESSING OPERABILITY DETERMINATIONS AND RESOLUTION OF DEGRADED AND NON-CONFORMING CONDITIONS Resolution of Comments (draft RIS & GL 91-18) rev 01-17-05.wpd 10 CFR Part 50, Appendix A, "General Design Criteria for Nuclear Power Plants," defines a single failure as follows:

"A single failure means an occurrence which results in the loss of capability of a component to perform its intended safety functions. Multiple failures resulting from a single occurrence are considered to be a single failure."

Appendix A contains general design criteria (GDC) for SSCs that perform major safety functions. Many of the GDC contain a statement similar to the following:

"Suitable redundancy in components and features and suitable interconnections, leak detection, isolation and containment capabilities shall be provided to assure that for onsite electrical power system operation (assuming offsite power is not available) and for offsite electrical power system operation (assuming onsite power is not available) the system safety function can be accomplished assuming a single failure."

See, for example, GDC 17, 34, 35, 38, 41, and 44. Therefore, capability to withstand a single failure in fluid or electrical systems is a plant-specific design consideration, which ensures that a single failure does not result in a loss of the capability of the system to perform its safety function(s).

A design deficiency in which the capability to withstand a single failure is compromised should be treated as a degraded and nonconforming condition. As with any degraded or nonconforming condition, the operability-determination principles outlined in this Inspection Manual should be followed Credit for redundancy in an operability determination (e.g., one train of a dual train SSC is degraded, but the redundant train is fully qualified) is generally not acceptable because each redundant train needs to be operable independent of the other. An exception would be two 100% redundant SSCs supporting the same specified safety function Similarly, a single failure must be assumed in an operability determination when redundant trains of an SSC are affected by the same degraded or nonconforming condition C.3 Treatment of Consequential Failures in Operability Determinations A consequential failure is a failure of an SSC caused by a postulated accident within the design basis.

For example, if during a loss-of-coolant accident (LOCA) (a design basis event), the broken pipe could whip and incapacitate a nearby pump, then the pump would not be able to function. Such a pump failure is called a consequential failure because the pump would have failed as a result of the design basis event itself. In general, facility design takes any such consequential failures that are deemed credible into consideration. In this case, that would mean that the broken pump was not one that the safety analysis would take credit for to mitigate the LOCA.

When an SSC is found to be degraded or nonconforming, the operability determination should assess credible consequential failures previously considered in the design (i.e., the SSC failures that would be a direct consequence of a design basis event) for which the degraded or nonconforming SSC needs to function. Where consequential failures (i.e., considering the degraded or nonconforming condition) would cause the loss of specified safety function(s) needed for limiting or mitigating the effects of the event, the affected SSC is inoperable because it cannot perform all of its specified safety functions.

Such situations are most likely discovered during design basis reconstitution studies, or when new credible failure modes are identified.

C.4 Use of Alternative Analytical Methods in Operability Determinations ODPTF_MARKUP_041805.wpd 21 9900 Revised

ASSESSING OPERABILITY DETERMINATIONS AND RESOLUTION OF DEGRADED AND NON-CONFORMING CONDITIONS Resolution of Comments (draft RIS & GL 91-18) rev 01-17-05.wpd Occasionally when performing operability determinations, licensees use analytical methods (e.g.,

computer codes) different from those currently used in the calculations supporting the facilities current licensing and design bases. The use of these alternative and typically more recent methods may raise complex plant-specific issues; however, they may be acceptable and useful in operability determinations. Therefore, the inspector should consult with the region and NRR when reviewing such a determination. The use of alternative methods results in three broad categories that should generally be handled as follows:

(1) If the analytical method is specified in a regulation or license condition, operability is based on the results of the analysis using that method. Use of an alternative method is not acceptable without prior NRC approval. The licensee would need a license amendment, an exemption, or a NOED before using the alternative method.

(2) If the analytical method is not subject to a regulation or license condition, but is a method of evaluation described in the UFSAR (as defined in NEI 96-07), the licensee is permitted to use the method provided the plant specific effects of its use are evaluated in accordance with NEI 96-07.

(3) If the analytical method is not specified in a regulation or license condition and is not a method of evaluation described in the UFSAR, the licensee is permitted to use an alternative method provided the licensee evaluates the plant specific effects of its use to ensure it is consistent with the current licensing basis. Acceptable alternative methods include the use of best estimate codes, methods, and techniques.

C.5 Use of Temporary Manual Action in Place of Automatic Action in Support of Operability.

Automatic action is frequently provided as a design feature specific to each safety system to ensure that the specified safety functions of the system will be accomplished. Limiting safety system settings for nuclear reactors are defined in 10 CFR Part 50.36, "Technical Specifications," as settings for automatic protective devices related to those variables having significant safety functions. W here a limiting safety system setting is specified for a variable on which a safety limit has been placed, the setting must be so chosen that automatic protective action will correct the abnormal situation before a safety limit is exceeded. Accordingly, it is not appropriate to take credit for manual action in place of automatic action for protection of safety limits to consider SSCs operable. This does not preclude operator action to put the facility in a safe condition, but operator action cannot be a substitute for automatic safety limit protection.

Credit for manual initiation of a specified safety function should be established as part of the licensing review of a facility. Although the licensing of specific facility designs includes consideration of automatic and manual action in the performance of specified safety functions, not every combination of circumstances has been reviewed from an operability standpoint.

For situations where substitution of manual action for automatic action is proposed as part of an operability determination, the use of manual action must focus on the physical differences between automatic and manual action and the ability of the manual action to accomplish the specified safety function(s). The physical differences to be considered include, but are not limited to, the ability to recognize input signals for action, ready access to or recognition of setpoints, design nuances that may complicate subsequent manual operation such as auto-reset, repositioning on temperature or pressure, timing required for automatic action, minimum manning requirements, and emergency operating procedures written for the automatic mode of operation. The licensee should have written procedures in place and training accomplished on those procedures before substitution of any manual action for the loss of an automatic action.

The assignment of a dedicated operator for manual action requires written procedures and full consideration of all pertinent differences. The consideration of manual action in remote areas must include the ability and timing in getting to the area, training of personnel to accomplish the task, and ODPTF_MARKUP_041805.wpd 22 9900 Revised

ASSESSING OPERABILITY DETERMINATIONS AND RESOLUTION OF DEGRADED AND NON-CONFORMING CONDITIONS Resolution of Comments (draft RIS & GL 91-18) rev 01-17-05.wpd occupational hazards to be incurred such as radiation, temperature, chemical, sound, or visibility hazards. One reasonable test of the reliability and effectiveness of manual action may be the approval of manual action for the same function at a similar facility. Nevertheless, this is expected to be a temporary condition until the automatic action can be promptly corrected in accordance with 10 CFR Pat 50 Appendix B and the licensees corrective action program.

C.6 Use of Probabilistic Risk Assessment in Operability Decisions Probabilistic risk assessment (PRA) is a valuable tool for the relative evaluation of accident scenarios while considering, among other things, the probabilities of occurrence of accidents or external events.

The definition of operability states, however, that the SSC must be capable of performing its specified safety function(s). The inherent assumption is that the event occurs and that the safety function can be performed. The use of PRA or probabilities of the occurrence of accidents or external events is not acceptable for making operability determinations decisions.

However, PRA may provide valid and useful supportive information for a license amendment as part of corrective actions. The PRA is also useful for determining the safety significance of SSCs. The safety significance, whether determined by PRA or other analyses, is a necessary factor in decisions on the appropriate "timeliness" of operability determinations. Specific guidance on the timeliness of determinations is presented in Section 5.6.

C.7 Environmental Qualification When a licensee identifies a degraded or nonconforming condition that could affect compliance with 7

10CFR50.49, the licensee is expected to apply the operability, reporting, and corrective action guidance of this Inspection Manual chapter. If full qualification cannot be demonstrated, the licensee should perform and document an operability determination (or assess functionality if the SSC is not in technical specifications). The licensee may use analyses or partial test data to establish a reasonable expectation that SSCs will perform necessary safety function(s). Compensatory action, corrective action, and reporting should be initiated as necessary.

C.8 Technical Specification Operability vs. ASME Code,Section XI Operative Criteria The TS normally apply to overall system performance but sometimes contain limiting values for certain component performance, which are specified to ensure that the design basis and safety analysis are satisfied. The values (e.g., pump flow rate, valve closure time, valve leakage rate, safety/relief valve set point pressure) are operability verification criteria. If these values are not met at any time, the system shall be declared inoperable, the LCO must be declared not met and the applicable Condition(s) must be entered.

The ASME Section XI acceptance criteria include "required action ranges" or limiting values for certain component performance parameters. These required action ranges or limiting values, defined by the code as component performance parameters, may be less conservative than the TS values which are safety analysis limits. However, action must be taken when the TS requirements are not met.

GL 89-04 Attachment 1, Position 8, defines the starting point for the completion time in TS Actions for ASME Section XI pumps and valves. When performance data fall in the required action range, regardless of whether the limit is equal to the TS limit or more restrictive, the pump or valve must be declared inoperable immediately (the term "inoperative" is used in the text of ASME Section XI; the pump or valve is both "inoperative" and inoperable) and the Limiting Condition for Operation (LCO) must be declared not met, and the applicable Condition(s) must be entered.

7 10 CFR 50.49, Environmental qualification of electric equipment important to safety for nuclear power plants.

ODPTF_MARKUP_041805.wpd 23 9900 Revised

ASSESSING OPERABILITY DETERMINATIONS AND RESOLUTION OF DEGRADED AND NON-CONFORMING CONDITIONS Resolution of Comments (draft RIS & GL 91-18) rev 01-17-05.wpd In cases where the required action range limit is more conservative than its corresponding TS limit, the corrective action may not be limited to replacement or repair; it may be an analysis to demonstrate that the specific performance degradation does not impair operability and that the pump or valve will still fulfill its function, such as delivering the required flow. A new required action range may be established after such analysis which would then allow for a new determination of operability.

The durations specified by the ASME Code for analyzing test results have not been accepted by the NRC for postponing entry into a TS action statement. As soon as data are recognized as being within the required action range for pumps or as exceeding the limiting value of full-stroke time for valves, the associated component must be declared inoperable and, if subject to the TS, the completion time specified in the action statement must be started at the time the component was declared inoperable.

For inoperable pumps and valves considered by ASME Section XI but not subject to specific TS, the action shall be consistent with the safety significance of the issue and the functions served by the affected system(s).

Recalibrating test instruments and then repeating pump or valve tests is an acceptable alternative to the corrective action of repair or replacement, but is not an action that can be taken before declaring the pump or valve inoperable. However, if during a test it is obvious that a test instrument is malfunctioning, the test may be halted and the instruments promptly recalibrated or replaced. During a test, anomalous data with no clear indication of the cause must be attributed to the pump or valve under test. For this occurrence, a prompt determination of operability is appropriate with follow-on corrective action as necessary.

Note: In the above discussion, "required action range" and "inoperative" are ASME Section XI terms.

C.9 Support System Operability The definition of operability embodies the principle that a SSC explicitly subject to facility technical specifications (Section 2.0, item vi) can perform its specified safety function(s) only when all necessary support systems are capable of performing their related support functions. It is incumbent upon each licensee to understand which support systems are necessary to ensure operability of supported TS systems.

When a support system that is not explicitly addressed in TS (Section 2.0, item vii) is determined to be incapable of performing one of its related support functions, the licensee must declare inoperable each supported TS SSC whose operability depends on that support function When a support system is determined to be incapable of performing its related support function(s), the licensee should employ the same operability determination process for the supported systems as for any other degraded system. In particular, the scope and timing of operability decisions should follow the guidance in Sections 5.1 and 5.6.

There are cases where judgment on the part of the licensee is appropriate in determining whether a support system that is not explicitly addressed in TS (Section 2.0, item vii) is necessary and is, therefore, required to be capable of performing its related support function(s). For example, a ventilation system may be required to ensure that other safety-related systems can perform their specified safety functions in the summer, but may not be required in the winter. Similarly, the electrical power supply for heat tracing may be required in the winter to ensure that a specified system can perform its specified safety function, but may not be required in the summer. In all such cases, the licensee should regularly review the basis for determining that a support system is not required to ensure (a) its decision remains valid, and (b) timely restoration of the support system (this may be accomplished as part of the corrective action program). As an alternative to restoration, the licensee may modify the support function as it would make any other change to the facility by following the 10 CFR 50.59 change process and updating the UFSAR.

ODPTF_MARKUP_041805.wpd 24 9900 Revised

ASSESSING OPERABILITY DETERMINATIONS AND RESOLUTION OF DEGRADED AND NON-CONFORMING CONDITIONS Resolution of Comments (draft RIS & GL 91-18) rev 01-17-05.wpd Upon discovery of a support system that is not capable of performing its related support function(s), the most important safety concern is the possibility of having lost all capability to perform a specified safety function. A loss of safety function condition can exist when the licensee concurrently declares multiple trains of specified support and supported systems inoperable. Therefore, upon declaring a support or supported system inoperable in one train, the required actions in the TS should be implemented. This verification ensures that the facility has not lost the complete capability to perform the specified safety function. The term "verify" as used here, allows for an administrative check by examining logs or other information to determine if required features are out of service for maintenance or other reasons. In addition to determining whether a loss of functional capability condition exists, the licensee should also take the TS required actions specified for the inoperable systems. However, upon determining that a loss of functional capability condition does exist, the licensee should mitigate the condition by taking the TS required actions specified for the systems that have lost the capability to perform their specified safety function(s).

As discussed in Section 3.3, for those licensees that have converted to the improved standard technical specifications, STS LCO 3.0.6 provides the requirements for supported system LCOs not met solely due to the support system LCO not being met. The above guidance is consistent with the STS requirements.

C.10 Piping and Pipe Support Requirements Piping and pipe supports found to be degraded or nonconforming and that support SSCs in TS (Section 2.0, item vi), should be subjected to an operability determination. To assist licensees in the determinations, the following criteria are provided to address various components. These components include the piping, supports, support plates, and anchor bolts. IE Bulletin 79-14, dated July 2, 1979, addressed the seismic analysis for as-built safety-related piping systems. The supplement to IE Bulletin 79-14, dated August 15, 1979, and Supplement 2 to IE Bulletin 79-14, dated September 7, 1979, provide additional guidance.

Concrete anchor bolts and pipe supports are addressed with specific operability criteria in Revision 2 of IE Bulletin 79-02 as well as Supplement 1 to Revision 1 of IE Bulletin 79-02. These Bulletins are dated November 8, 1979 and August 20, 1979, respectively. The criteria for evaluating operability of seismic design piping supports and anchor bolts relating to Bulletins 79-02 and 79-14 are detailed in the E.

Jordan memo to the regions dated July 16, 1979 (ADAMS Accession Number ML993430206), and the V. Noonan memorandum dated August 7, 1979 (NUDOCS Accession Number 9010180274). Upon discovering a degradation or nonconformance associated with piping and pipe supports, the licensee should use the criteria in Appendix F of Section III of the ASME Code for operability determinations. The licensee should continue to use these criteria and Appendix F until the next refueling outage when the support(s) are to be restored to the UFSAR criteria.

For systems determined to be otherwise operable but which do not meet the above criteria, licensees should treat the systems or components as inoperable until NRC approval is obtained for any additional criteria or evaluation methods used to determine operability. Where a piping support is determined to be inoperable, the licensee should determine the operability of the associated piping system.

C.11 Flaw Evaluation 10 CFR 50.55a(g) requires that structural integrity be maintained in conformance with ASME Section XI for those parts of a system that are subject to ASME Code requirements.Section XI contains rules describing acceptable means of inspecting welds in piping and vessels and areas of high stress concentration in vessels.Section XI also describes a series of acceptable flaws based on the location and service of the system within which the flaw is discovered. If the flaw exceeds these generally acceptable limits, ASME Section XI also describes an alternate method by which a refined calculation may be performed to evaluate the acceptability of the flaw. At no time does the ASME Code allow a thru-ODPTF_MARKUP_041805.wpd 25 9900 Revised

ASSESSING OPERABILITY DETERMINATIONS AND RESOLUTION OF DEGRADED AND NON-CONFORMING CONDITIONS Resolution of Comments (draft RIS & GL 91-18) rev 01-17-05.wpd wall flaw to be returned to service. If a flaw is discovered by any means (including surveillance, maintenance activity, or inservice inspection) in a system under the jurisdiction of ASME Code, during normal plant operation, plant transition, or during shut-down, the flaw must be promptly evaluated using the rules of the ASME Code. If the flaw is through-wall or does not meet the thresholds established by the Code the system containing the flaw is inoperable. If the flaw meets the thresholds established by the Code, the system is operable and an operability determination is not required.

Generic Letter 90-05 and Code Case N-513 describe alternate acceptable means for evaluating and accepting flaws in moderate energy piping. Generic Letter 90-05 describes a method by which a flaw, not acceptable under ASME Code, may be returned to service without NRCs prior approval. GL 90-05 describes a method, acceptable to the NRC, that will result in the NRC granting relief from ASME Code requirements under 10 CFR 50.55a. Because an evaluation and acceptance of a flaw, using the guidance contained in GL 90-05, is not in conformance with the requirements of ASME Code, it must be reported to the NRC in conformance with the requirements described in GL 90-05. If a flaw meets the guidance of GL 90-05, the system containing the flaw is operable.

Code Case N-513 describes an acceptable alternative to the methods described in the ASME Code for the acceptance of a flaw in a moderate energy piping system. W hen a Code Case describes methods, criteria, or requirements different from the Code when it was accepted in 10 CFR 50.55a, and the NRC does not automatically endorse a Code Case, its use must be approved separately by the NRC. Code Cases that are acceptable to the NRC are published in Regulatory Guidance (RG) 1.147. Code Case N-513 has been approved by the NRC. A flaw that is evaluated using Code Case N-513 is acceptable to both the NRC and to the ASME Code. If a flaw meets the requirements of Code Case N-513, the system containing the flaw is operable. Code Case N-513 has been accepted by the NRC for application in the licenseesSection XI inservice inspection programs with the following conditions imposed by the NRC staff:

(1) Specific safety factors in paragraph 4.0 must be satisfied (2) Code Case N-513 may not be applied to:

(a) Components other than pipe and tubing (b) Leakage through a gasket (c) Threaded connections employing nonstructural seal welds for leakage prevention (through seal weld leakage is not a structural flaw; thread integrity must be maintained).

(d) Degraded socket welds.

If a flaw exceeds the thresholds of the ASME Code, GL 90-05, Code Case N-513, or any other NRC approved Code Case, the system containing the flaw is inoperable until the NRC approves an alternative analysis, evaluation, or calculation to justify the flaws return to service and the subsequent operability of the system. Prior to receiving the NRCs approval for the alternative analysis, evaluation, or calculation, the inoperable system is subject to the applicable LCO.

C.12 Operational Leakage Leakage from the reactor coolant system is limited to specified values in the TS depending on whether the leakage is from identified, unidentified, or specified sources such as the steam generator tubes or reactor coolant system pressure isolation valves. If the leakage exceeds the TS limits, the Limiting Condition for Operation (LCO) must be declared not met. For identified reactor coolant system leakage within the limits of the TS, the licensee should determine operability for the degraded component and include in the determination the effects of the leakage on other components and materials.

Existing regulations and TS require that the structural integrity of ASME Code Class 1, 2, and 3 components be maintained according to Section XI of the ASME Code. If a leak is discovered in a Class ODPTF_MARKUP_041805.wpd 26 9900 Revised

ASSESSING OPERABILITY DETERMINATIONS AND RESOLUTION OF DEGRADED AND NON-CONFORMING CONDITIONS Resolution of Comments (draft RIS & GL 91-18) rev 01-17-05.wpd 1, 2, or 3 component in the conduct of inservice inspections, maintenance activities, or during facility operation, IWA-5250 of Section XI corrective measures may require repair/replacement activities be taken based on repair or replacement in accordance with IWA-4000 of Section XI. In addition, if a leak is discovered, the component should be evaluated for flaws according to IWB-3600, which addresses the analytical evaluation and acceptability criteria for flaws.

The TS do not permit any reactor coolant pressure boundary (RCPB) leakage. The Operational Leakage LCO must be declared not met when pressure boundary leakage is occurring. Upon discovery of leakage from Class 1 or 2 component pressure boundary (i.e., pipe wall, valve body, pump casing, etc.),

the licensee must declare the component inoperable. For leakage from a Class 3 pressure boundary component moderate energy system, the licensee may evaluate the structural integrity of the component using the criteria of GL 90-05. If the component meets the criteria it can be deemed degraded but operable until relief from the applicable ASME Code requirement(s) is obtained from the NRC.

As an alternative, the licensee can evaluate the structural integrity of a leaking Class 3 moderate energy pressure boundary component or piping using the criteria of ASME Code Case N-513, "Evaluation Criteria for Temporary Acceptance of Flaws in Class 3 Piping Section XI, Division 1," which is approved with limitations imposed by the NRC staff and incorporated by reference in 10 CFR 50.55(a)(b)(2)(xiii).

The limitations imposed by the NRC staff are as follows:

(1) Specific safety factors in paragraph 4.0 must be satisfied.

(2) Code Case N-513 may not be applied to:

(a) Components other than pipe and tubing (b) Leakage through a gasket (c) Threaded connections employing nonstructural seal welds for leakage prevention (through seal weld leakage is not a structural flaw; thread integrity must be maintained).

(d) Degraded socket welds.

However, the licensee may also decide to evaluate the structural integrity of a leaking Class 2 or 3 moderate energy pressure boundary component or piping using the criteria of ASME Code Case N-513-1 "Evaluation Criteria for Temporary Acceptance of Flaws in Moderate Energy Class 2 or 3 Piping Section XI, Division 1." The same limitations imposed by the NRC staff on Code Case N-513 apply to Code Case N-513-1. Code Case N-513-1 has been reviewed and approved by the NRC. However, the approval of Code Case N-513-1 has not yet been incorporated into RG 1.147 or the Code of Federal Regulations for generic use. Therefore, until Code Case N-513-1 is approved for generic use in either RG 1.147 or 10 CFR 50.55a, the licensee would need to obtain relief to use Code Case N-513-1 from the NRC.

If the component meets the criteria of ASME Code Case N-513, continued temporary service of the degraded piping components is permitted. If the licensee decides to control the leakage by mechanical clamping means, the guidelines of Code Case N-523-2, "Mechanical Clamping Devices for Class 2 and 3 Piping Section XI, Division 1," may be followed, as referenced in 10 CFR 50.55a(b)(2)(xiii). It should be noted that this Code Case is to maintain the structural integrity of Class 2 and 3 piping, NPS 6 and smaller and shall not be used on piping larger than NPS 2 when the nominal operating temperature or pressure exceeds 200EF or 275 psig. These and other applicable Code Cases which have been determined by the NRC to be acceptable to be used by the licensee without a request or authorization from the NRC are listed in RG 1.147. These Code Cases do not apply to Class 1 pressure boundary components.

For Class 2 heat exchanger leakage, the licensee can evaluate the structural integrity using the criteria of ASME Code Class N-513-1 "Evaluation Criteria for Temporary Acceptance of Flaws in Moderate Energy Class 2 or 3 Piping Section XI, Division 1." Currently, Code Case N-513-1 has been reviewed and accepted by the NRC but its approval has not yet been incorporated into RG 1.147 or the Code of Federal Regulations. The same limitations imposed by the NRC on Code Case N-513 apply to Code ODPTF_MARKUP_041805.wpd 27 9900 Revised

ASSESSING OPERABILITY DETERMINATIONS AND RESOLUTION OF DEGRADED AND NON-CONFORMING CONDITIONS Resolution of Comments (draft RIS & GL 91-18) rev 01-17-05.wpd Case N-513-1. Therefore, until Code Case N-513-1 is approved for generic use in either RG 1.147 or 10 FR 50.55a, the licensee would need to obtain relief to use Code Case N-513-1 from the NRC. If the component meets the criteria of ASME Code Case N-513-1, continued temporary service of the degraded component is permitted.

C.13 Structural Requirements Category I structures and supports (referred to herein as "structures") which are subject to periodic surveillance and inspection in accordance with TS requirements (e.g., Structural Integrity TS and the old STS specification 4.0.5) shall be considered operable if the limits stipulated in the TS are met. If these limits are not met, the LCO for the affected structure must be declared not met. If the degradation affects the ability of the structure to provide the required design support for systems attached to the structure, an operability determination must be performed for these systems as well.

Degradation affecting Category I structures includes, for example, concrete cracking and spalling, excessive deflection or deformation, water leakage, rebar corrosion, missing or bent anchor bolts, degradation of door and penetration sealing, etc.. If these degradations are identified in Category I structures which are not subject to periodic surveillance and inspection, the licensee should assess the structures to determine their capability to perform their specified function. As long as the identified degradation does not result in the exceedance of acceptance limits specified in applicable design codes and standards, referenced in the design basis documents, the affected structures are operable.

Significant degradation resulting in the exceeding of the acceptance limits must be promptly reported in accordance with the requirements in 10 CFR 50.72 and evaluated by the licensee for determination of operability. These evaluations should include the criteria used for the operability determination and the rationale for continued plant operation in a degraded condition outside of the design basis. The licensee's evaluations should also include the plan for corrective action, as required by Criterion XVI of Appendix B to 10 CFR Part 50, to restore degraded structures to their original design requirements. As stated above, any system which depends upon the degraded structure for required support should also be examined for operability if the degradation or nonconformance calls into question the performance of the system. NRC inspectors, with possible support by headquarters, should review licensees' evaluations of structural degradations to determine their technical adequacy and conformance to licensing and regulatory requirements.

Attachment 1 ODPTF_MARKUP_041805.wpd 28 9900 Revised