ML17150A350

NEI Presentation for 06/01/2017 Operability Meeting

ML17150A350
Person / Time
Site:	Nuclear Energy Institute
Issue date:	06/01/2017
From:	Joseph Holonich Licensing Processes Branch (DPR), Nuclear Energy Institute
To:
Holonich J
References
Download: ML17150A350 (37)

Text

NRC Public Meeting Industry Operability Guidance Initiative June 1, 2017

Operability Guidance Initiative NRC Public Meeting - June 2, 2017

• Meeting Objective

- Discuss the meaning of the term specified safety function as used in the TS definition of Operability

- Determine the next steps to establish a consistent understanding of the term by the industry and the NRC 2

BACKGROUND 3

Operability

• Operability

- The term "operable" can be traced to the 1968 AEC staff publication, "Guide to Content of Technical Specifications for Nuclear Reactors," that reflected the 1968 revision to 10 CFR 50.36.

- It stated that TS should "establish the lowest acceptable level of performance for a system or component, or the minimum number of components or portion of the system that must remain operable in order that plant operation may continue."

4

Operability

- The first standard TS reflecting the 1968 rule and AEC guidance were published in 1975-1977, and contained the following definition:

• A system, subsystem, train, component or device shall be OPERABLE or have OPERABILITY when it is capable of performing its specified function(s). Implicit in this definition shall be the assumption that all necessary attendant instrumentation, controls, normal and emergency electrical power sources, cooling or seal water, lubrication or other auxiliary equipment, that are required for the system, subsystem, train, component or device to perform its function(s), are also capable of performing their related support function(s).

5

Operability

- Before the STS were published in 1975 through 1977, 33 operating licenses had been issued. These licenses had varying definitions of operability.

- In April 1980, the NRC issued a letter to all licensees (later referred to as Generic Letter (GL) 80-30), that required all licensees to submit proposed changes to the TS within 30 days to revise the definition of operability to that given in the STS.

6

Operability

- The 1991 draft improved STS included the GL 80-30 definition of Operability.

- It also included Section 5.8, "Operability Definition Implementation Principles and Rules," that stated, "The specified function(s) of the system, subsystem, train, component, or device (hereafter referred to as system) is that specified safety function(s) in the licensing basis for the facility."

- Section 5.8 was not included in the 1993 published version of the improved STS, but the equivalence of "safety functions" with "specified safety functions" was made in the definition.

7

Operability

- The improved STS definition of operability states:

• A system, subsystem, train, component, or device shall be OPERABLE when it is capable of performing its specified safety function(s) and when all necessary attendant instrumentation, controls, normal or emergency electrical power, cooling and seal water, lubrication, and other auxiliary equipment that are required for the system, subsystem, train, component, or device to perform its specified function(s) are also capable of performing their related support function(s).

- The improved STS definition will be used in the industry operability guidance.

- The industry guidance will state that the term "specified function(s)" in the GL 80-30 definition is equivalent to the improved STS term "specified safety function(s)."

- This usage is consistent with IMC-0326.

8

SPECIFIED SAFETY FUNCTION 9

Specified Safety Function

• Specified Safety Function isn't Defined

- The industry and the NRC have never established a usable definition of specified safety function, yet it can be critical in determining whether an SSC is operable.

- In Generic Letter 91-18 through IMC-0326, the operability guidance stated that the specified safety functions were those specified safety functions in the CLB for the facility.

- The industry and the NRC agree that the "specified safety functions" required for operability are not all CLB functions performed by an SSC.

10

Specified Safety Function

• From the NRC's 2005 internal training on Operability:

11

Application

• This lack of definition has led to inconsistent application

• For example, Bulletin 79-14, Seismic Analyses for As-built Safety-related Piping Systems, stated:

- Evaluate the effect of the nonconformance upon system operability under specified earthquake loadings and comply with applicable action statements in your technical specifications including prompt reporting.

• Appears to state that withstanding earthquake loading is a specified safety function 12

Application

• Alternate example: The NRC's response to TIA 2009-02, "Requirements for Testing Station Batteries for Station Black-out Conditions at the San Onofre Nuclear Generating Station,"

(ADAMS ML12109A349) discusses that not all design functions are TS functions:

- "In accordance with 10 CFR 50.36, TSs are derived from the analyses and evaluation in the safety analysis report and TS testing is for structures systems and components that meet one or more criterion in 50.36(c)(2)(ii). SBO equipment is not represented in SONGs FSAR Chapters 6 and 15; therefore the capability of this equipment to meet the coping strategies of the SBO rule would not be tested in accordance with TS."

13

Proposal

• We are proposing that the industry and the NRC decide on a definition of specified safety function that we will use going forward

• Because there has never been a definition, there will be NRC and industry historical cases that are inconsistent with any definition thats adopted 14

How to Define Specified Safety Function

• Similar to the NRC discussion in the response to TIA 2009-02, we believe the criteria for selecting Limiting Conditions for Operation (LCOs) in 10 CFR 50.36 can be used as the regulatory basis for defining specified safety functions.

- We are not stating that the criteria have always been the basis of operability.

- Again, we acknowledge that the terms "operability,"

"safety functions, and specified safety functions, were used before the Final Policy Statement and the change to 10 CFR 50.36 were issued.

15

The 50.36(c)(2)(ii) Criteria

• The four criteria in 10 CFR 50.36(c)(2)(ii) were added in August, 1995, and are based on the July 16, 1993, "Final Policy Statement on Technical Specifications Improvements for Nuclear Power Reactors."

• The statements of consideration for the 10 CFR 50.36 rule change stated:

- "The Commission has decided not to withdraw the final policy statement because it contains detailed discussions of the four criteria and guidance on how the NRC staff and licensees should apply the criteria."

16

The 50.36(c)(2)(ii) Criteria

• The Final Policy Statement established four criteria describing requirements that should be captured in LCOs:

- Criteria 1: Installed instrumentation that is used to detect, and indicate in the control room, a significant abnormal degradation of the reactor coolant pressure boundary.

- Criteria 2: A process variable, design feature, or operating restriction that is an initial condition of a Design Basis Accident or Transient analysis that either assumes the failure of or presents a challenge to the integrity of a fission product barrier.

- Criteria 3: A structure, system, or component that is part of the primary success path and which functions or actuates to mitigate a Design Basis Accident or Transient that either assumes the failure of or presents a challenge to the integrity of a fission product barrier.

- Criteria 4: A structure, system, or component which operating experience or probabilistic safety assessment has shown to be significant to public health and safety.

17

Specified Safety Function

• The following seems a logical approach to defining specified safety function:

1. 10 CFR 50.36(c)(2)(ii) requires an LCO be established on an SSC if it meets one of the criteria. CRITERIA = LCO

2. A TS LCO requires an SSC to be operable, equating LCO compliance with SSC operability. LCO = OPERABILITY

3. The TS definition of operability states that an operable SSC must be capable of performing its specified safety functions, equating operability with specified safety functions. OPERABILITY=SSF

4. Therefore, the regulations and the TS establish a link between the criteria in 10 CFR 50.36(c)(2)(ii) and the specified safety functions of an SSC.

CRITERIA = LCO = OPERABILITY = SPECIFIED SAFETY FUNCTIONS 18

Approach to Defining Specified Safety Function

• When adopting improved STS, each plant evaluated their plant-specific design and licensing basis against the 50.36 criteria

• The proposed approach links a plant's design and licensing basis, as described in Chapters 6 and 15 of the UFSAR, with the LCOs in TS and the specified safety functions required for operability 19

Approach to Define Specified Safety Function

• Example:

- If the only purpose of a system was to respond to an ATWS (not a chapter 15 event), it wouldnt meet a 50.36 criteria and wouldnt be in TS.

- If that same system had both Chapter 15 and ATWS functions, it is logical that the ATWS function is not a specified safety function required for operability.

- A licensee would not declare the system inoperable because it cant perform the ATWS function as long as it can perform the Chapter 15 function.

- Nonconforming ATWS condition would be addressed through the corrective action program.

• Key idea: An LCO can only be declared not met for a failure to perform a function that would require an LCO to be established.

20

APPLICATION 21

Application

• How could the 50.36 criteria be used to determine if a function performed by an SSC is a specified safety function required for operability under the plant-specific design and licensing basis?

22

Criterion 1

• Criterion 1:

- Installed instrumentation that is used to detect, and indicate in the control room, a significant abnormal degradation of the reactor coolant pressure boundary.

• Only the "RCS Leakage Detection Instrumentation" LCO meets Criterion 1.

• TSTF-513 and TSTF-514, Revise PWR/BWR Operability Requirements and Actions for RCS Leakage Instrumentation, approved in 2010 and 2011, revised and clarified the LCO Bases describing the operability requirements for each instrument type.

• The LCO Bases are clear on whats functions must be performed for Operability, and further clarification isnt needed.

• If needed, non-ITS plants could modify their TS Bases under 50.59 and the Bases Control Program to incorporate the guidance in the ITS Bases.

23

Criterion 4

• Criteria 4:

- A structure, system, or component which operating experience or probabilistic safety assessment has shown to be significant to public health and safety.

• LCOs that satisfy Criterion 4:

- Remote Shutdown

- Hydrogen Ignitors

- Residual Heat Removal

- PWR RCS Loops in Modes 4 and 5

- BWR Standby Liquid Control System

- BWR ATWS-RPT

- BWR RCIC and RCIC Instrumentation

- BWR Drywell Purge 24

Criterion 4

• The Criterion 4 LCO were evaluated against the plant-specific design and licensing basis.

• The Criterion 4 functions are not tied to Chapter 6 or Chapter 15 accidents.

• The ITS LCO Bases, as modified to reflect the plants CLB, generally describe what is significant about the system and other requirements, such as single failure protection and safety-related power requirements.

25

Criterion 2 or 3

• The majority of specifications satisfy Criteria 2 or 3:

- A process variable, design feature, or operating restriction that is an initial condition of a Design Basis Accident or Transient analysis that either assumes the failure of or presents a challenge to the integrity of a fission product barrier.

- A structure, system, or component that is part of the primary success path and which functions or actuates to mitigate a Design Basis Accident or Transient that either assumes the failure of or presents a challenge to the integrity of a fission product barrier.

26

Criterion 2 or 3

• What are the Design Basis Accident or Transient analyses that either assume the failure of or present a challenge to the integrity of a fission product barrier?

- The Final Policy Statement states:

• The applicable design basis accidents or transients are those described in the Chapters 6 and 15 of the FSAR (or equivalent chapters in the plant-specific FSAR) in the analyses of ANSI N18.2 Condition II, III and IV events that either assume the failure of or present a challenge to the integrity of a fission product barrier.

27

Criterion 2 or 3

• Determination must be made based on the plant-specific FSAR description in the equivalent of Chapters 6 and 15

• Generically (will vary by plant):

- NUREG-0800, Standard Review Plan, Section 15, divides events into Anticipated Operational Occurrences (AOOs) and Postulated Accidents.

• AOOs are ANSI N18.1 Condition II and III events.

• Postulated Accidents are Condition IV events.

- A review of SRP Chapter 15 determined all are ANSI N18.2 Condition II, III, or IV events that assume the failure of or presents a challenge to the integrity of a fission product barrier except:

• containment pressure analysis, and

• maximum hypothetical incident 28

Criterion 2 or 3

• What is a Criterion 2 Initial Condition?

- The Final Policy Statement states:

• An initial condition includes process variables that have initial values assumed in the design basis accident and transient analyses, and that are monitored and controlled during power operation even if they cannot be directly observed in the control room (e.g., moderator temperature coefficient and hot channel factors).

- The initial conditions are readily identified and are typically a TS required parameter or system configuration.

• Identified during TS development based on the plants CLB

• Not usually difficult to assess for operability 29

Criterion 2 or 3

• What is a primary success path?

- The Final Policy Statement states:

• The primary success path is the combination and sequences of equipment needed to operate (including consideration of the single failure criteria), so that the plant response to design basis accidents and transients limits the consequences of these events to within the appropriate acceptance criteria.

- Defined in the plant-specific CLB as reviewed and approved by the staff.

30

Criterion 2 or 3

• The TS Bases frequently discuss the primary success path, such as the Applicable Safety Analysis section of the Pressurizer Power Operated Relief Valve (PORV) TS.

- For the Steam Generator Tube Rupture (SGTR) event, the safety analysis assumes that manual operator actions are required to mitigate the event. ...

The PORVs are assumed to be used for RCS depressurization, ...

- The PORVs are also modeled in safety analyses for events that result in increasing RCS pressure for which departure from nucleate boiling ratio (DNBR) criteria are critical (Ref. 2). By assuming PORV actuation, the primary pressure remains below the high pressurizer pressure trip setpoint; thus, the DNBR calculation is more conservative. As such, this actuation is not required to mitigate these events, and PORV automatic operation is, therefore, not an assumed safety function.

• This states that the primary success path is manual action of the Pressurizer PORVs to mitigate a SGTR; the other assumed functions are not primary success paths.

• The LCO Bases are customized to the plants CLB during ITS conversion.

31

Criterion 2 or 3

• Separating primary success paths from other credited functions can be important when determining whether a function is a specified safety function

• For SSCs that are initial conditions or primary success paths, review Chapter 6 of the plants FSAR (or equivalent) to determine the critical aspects of the SSCs 32

Key Take-Aways

• Applying the 50.36 criteria to the plant-specific CLB can be the basis for distinguishing between specified safety functions and other licensing basis functions

• It is a reasonable approach consistent with the existing regulations and the plants CLB

• The approach is not a panacea, but provides a starting point grounded in the relationship between the licensing basis of the plant and the Technical Specifications 33

NEXT STEPS 34

Next Steps

• Agree on whether to proceed with this approach to defining specified safety function.

• Industry to provide a document for NRC review and comment.

• NRC and industry review the proposed approach, identify obstacles, and meet to discuss specific issues

• Incorporate resulting agreement in the industry operability guidance

• Consider incorporation in the Standard Technical Specifications or Bases through a TSTF traveler 35

Questions and Discussion 36

Criterion 2 or 3

• ANSI N18.2 Condition II, III, or IV events.

- Condition II: Incidents of Moderate Frequency . may occur during a calendar year .[examples include structure, system and component malfunctions and operator errors that may be expected to occur with moderate frequency] .

- Condition III: Infrequent Incidents . May occur during the lifetime of a particular plant . [examples include more significant, less frequent structure, system and component malfunctions and more significant, less frequent operator errors] .

- Condition IV: Limiting Faults . Faults that are not expected to occur, but are postulated because their consequences would include the potential for the releases of significant amounts of radioactive material. [examples include major structure, system and component malfunctions] .

37