ML17241A028

NEI 16-16, Draft 2, Staff Comments (Jul 13, 2017) and NEI Discussion Points (Aug 10, 2017)

ML17241A028
Person / Time
Site:	Nuclear Energy Institute
Issue date:	08/29/2017
From:	Nuclear Energy Institute
To:	Office of Nuclear Reactor Regulation
Holonich J
References
NEI 16-16
Download: ML17241A028 (24)

Text

NEI 16-16 [Draft 2]

NRC Staff Comments NEI Discussion Points for Telecon 8-10-2017 The staff has reviewed Nuclear Energy Institute (NEI) 16-16 Guidance for Addressing Digital Common Cause Failure [Draft 2] [Agencywide Document Access and Management System (ADAMS) Accession Number ML17135A253] which was submitted on May 12, 2017. The enclosed comments are provided solely on the contents of the as-written document.

Before engaging and moving forward on resolving the attached comments, however, the staff requests resolution of the following:

1. The NRC needs to understand the relationship between NEI 96-07, Appendix D and NEI 16-16.

For example

• NEI 96-07, Appendix D uses terms such as CCF credible but not attributable and CCF credible and attributable, but negligible in the Evaluation Section Guidance. These terms are not considered, nor defined, in NEI 16-16 even though Appendix D states in Section 1.1 that NEI 16-16 can be used as a technical guidance for Appendix D. NEI 16-16 only provides guidance to evaluate the likelihood of a credible CCF based on applying defensive measures, and thus determine if a CCF likelihood is significantly reduced, and whether it is design-basis or beyond design-basis.

NEI Discussion Point: NEI views the attributable and negligible terms as used for licensing purposes, not technical. NEI 16-16 is only evaluating the likelihood of a CCF to determine 1) is it credible or not, and 2) if its credible, is it in the design basis or beyond the design basis? There is no need to discern attributable and/or negligible in these two determinations.

• NEI 96-07, Appendix D provides guidance to use qualitative assessments to reduce the likelihood of the CCF. However, NEI 16-16 does not consider qualitative assessments in its discussion to address credible CCF, reducing its likelihood. Thus, NEI 16-16 does not provide guidance to use qualitative assessment.

NEI Discussion Point: At face value, NEI understands this comment to say that NEI 16-16 does not consider qualitative assessments, when in fact the CCF susceptibility analysis described in NEI 16-16 is nothing but a qualitative assessment. In addition, a qualitative assessment cannot by itself reduce the likelihood of the CCF, which is only a function of the technical attributes of the system.

2. Will guidance and terminology in RIS 2017-XX, Clarification of the Staff Endorsement of the Use of EPRI/NEI Joint Task Force Report, Guideline on Licensing Digital Upgrades: EPRI TR-102348, 1

Revision 1, NEI 01-01: A Revision of EPRI TR-102348 to Reflect Changes to the 10 CFR 50.59 Rule be incorporated into NEI 16-16? If so, what is the process and timing for incorporation?

NEI Discussion Point: NEI is open to discussing the coordination of guidance, terminology and underlying technical bases from the RIS.

The staff recommends a public meeting to better understand the relationship between NEI 96-07, Appendix D and NEI 16-16. After clarity has been reached on the relationship between the two documents, the attached comments also need to be addressed.

Comments from NEI 16-16 [Draft 1] and additional comments identified during the staffs review of Draft 2 have been merged and are presented in the table below.

These comments are being provided for the purpose of early engagement on identified concerns and to support future meetings on the linkage and similar terminology between NEI 16-16 and 96-07, Appendix D and meetings to resolve NEI 16-16 specific comments.

2

No. Text NRC Comments Proposed Action NEI Discussion Points on Section (i.e., addition, deletion or Comment modification)

1. General This guidance proposes using the results NRC and NEI should continue NEI agrees.

from the coping analysis in a comparison discussions to determine if results to analyses described in the FSAR. from an FSAR can be compared to results obtained using best estimate methods during upcoming interactions.

2. General At what level (at the system level or at NRC and NEI should discuss and NEI agrees that plant level the plant level) can results be evaluated resolve this difference during versus system level results and compared to analysis in the FSAR? upcoming interactions. should be discussed. The presentation by Pete LeBlond at the 8/1/17 App. D meeting provides a basis for evaluating malfunction results at the plant level.

3. General Follow-up to comments 3 and 4 from Clarify how the qualitative NEI would like to discuss this Draft 1. assessments proposed in the question to gain a better What methodology or deterministic document can address deterministic understanding of what type criteria are used for determining the licensing criteria. clarification the NRC is likelihood that a CCF can occur? seeking. There are two comments in this comment.

The question in the cell to the left is technical and is answered by NEI 16-16 via CCF susceptibility analysis.

The comment in the middle cell is about licensing criteria, but not sure which specific 3

No. Text NRC Comments Proposed Action NEI Discussion Points on Section (i.e., addition, deletion or Comment modification) criteria

4. General During NRC-NEI public meetings, NEI To facilitate this review:

representatives have stated that some 1. If any measures have already There are several examples defensive measures in NEI 16-16 have been endorsed, please cite the of where the NRC staff has previously been endorsed by the NRC. endorsed guidance. Please do approved highly integrated No citations to NRC endorsed guidance not rephrase or change digital I&C designs, where was found in the document. Citations endorsed content if it is design techniques and design would facilitate and expedite review of included in this document. attributes (aka Defensive NEI 16-16. Measures) were used by the designers. These are available to the NRC staff, and NEI has no intention of citing them in NEI 16-16, as much of this material is proprietary.

During the public meetings, examples such as the Watts Bar Unit 2 SER, and some new plant Design Certifications were used as an example.

NEI 16-16 is not a copied and pasted list of endorsed defensive measures. But neither are they made of 4

No. Text NRC Comments Proposed Action NEI Discussion Points on Section (i.e., addition, deletion or Comment modification) whole cloth. NEI would like to agreement on the defensive measures via discussions and workshops using the RIS as a backdrop.

5. General The document claims that preventive Justify why the defensive measures The NEI position is that measures, when applied as a set, provide proposed in Appendix A eliminate CCF reasonable assurance is what reasonable assurance that a CCF from a concerns (i.e., lead to CCF not is required, not absolute specific I&C failure source is not credible. credible) from further consideration. assurance. This concept has What is the technical basis for this claim? been discussed and is Appendix A provides preventive addressed in the current measures for various sources of common version of the RIS 2017-xx.

cause failures but does not provide the technical basis that leads one to conclude NEI 16-16 provides methods that a CCF is not credible. and design techniques and practices to support the reasonable assurance approach. For example, the technical bases for many of the design attributes in Section 3.2.1 of the RIS should be the same technical bases staff is seeking for NEI 16-16.

6. 1.1 Comment 1 from Draft 1. The staff did NRC and NEI should discuss and NEI requests that the NRC not locate content in Draft 2 that resolves resolve this difference during staff please provide the this comment. upcoming interactions. formal NRC position and 5

No. Text NRC Comments Proposed Action NEI Discussion Points on Section (i.e., addition, deletion or Comment modification)

This section, as well as elsewhere in the technical basis for the NRC document, considers the occurrence of definition of CCF.

CCF, which does not fully align with the NRC definition and interpretation of CCF. This will allow a better During the December 2016 meeting NEI understanding of this and NRC, staff identified the differences question.

on definition of CCF. The meeting summary report summarizes this as: The NRC staff uses the term to identify an error in software regardless of the consequences of that error. NEI uses the term to identify an error in software that has been triggered to affect multiple instances of the software, and it then focuses attention on the plant effect rather than on the software error itself.

7. 1.1 Comment 2 from Draft 1. The staff did Since 100% testing and diversity NEI agrees that diversity and not locate content in Draft 2 that resolves remain viable options for eliminating 100% testing are viable this comment. concerns related to further options. They are included in This section states there are only two consideration of CCF, consider NEI 16-16 Appendix A, design attributes that may be credited to mentioning them in the document. measures A33-P4, A35-P1, eliminate the need for further A35-P2, A35-P4, A37-P1, and consideration of CCF: diversity within the A37-P5.

digital I&C system, or testability based on device simplicity. The staff understands that the guidance in this document seeks to expand the use of 6

No. Text NRC Comments Proposed Action NEI Discussion Points on Section (i.e., addition, deletion or Comment modification) design attributes and methods beyond diversity and 100% testing.

8. 1.1 In section 1.1, NEI states: This guideline Clarify the relationship between NEI The results of NEI 16-16 is applicable to facility changes done 16-16 and NEI 96-07, Appendix D. technical work is used in the under 10 CFR 50.59 and facility changes same way as other technical that require a license amendment. analyses that are developed However, this guidance does not indicate as part of the plant how to use the results or provide a cross- modification process, that reference to the guidance being are used for input to licensing developed in Appendix D of NEI 96-07. processes.

9. 1.1 This section states that one of the Clarify the scope of applicability for NEI understands this primary barriers in the current regulation this guidance. question to mean that the is software common cause failure. scope of NEI 16-16 should be However, the guidance addresses more clear that it applies to other than software CCF. sources of common cause failure other than software.

Please validate this understanding.

10. 1.1 This section states that This document NRC and NEI should discuss and It is not the intent of NEI 16-provides technical guidance for resolve this issue during upcoming 16 to be consistent with addressing CCF for compliance to interactions. current NRC guidance. The deterministic licensing criteria and NRC intent of NEI 16-16 is to policies and positions such as SRM-SECY- introduce alternate 93-087 and BTP 7-19. It is not clear how approaches to address the the guidance provided in this draft is potential impact of common consistent with NRC current position, as cause failure for digital I&C described in the SRM-SECY 93-087 and designs.

7

No. Text NRC Comments Proposed Action NEI Discussion Points on Section (i.e., addition, deletion or Comment modification)

BTP 7-19.

NEI agrees that this should be a point of discussion.

11. 1.2 (1) This item states: Part 1 determines if a Provide clarifications to the NEI agrees that clarification is CCF in the target digital equipment is a statements and question. required. The intent is to safety analysis or licensing concern. Not describe the scope of digital clear what this means. Please provide SSCs to which NEI 16-16 clarification.

applies.

Also, how does this statement relate to NEI proposes to use design the scope defined in the previous functions described in the paragraph, which states digital I&C FSAR. This is consistent systems or components that can affect a with what the approach is in design function described in the FSAR. the current version of RIS Please clarify. 2017-xx. However, NEI 16-16 will still direct the focus on the specific SSCs affected by an I&C failure and how they relate to one or more design functions, because design functions may be described nebulously in some FSARs.

12. 1.2 Comment 6 from Draft 1. The staff did NRC and NEI should continue NEI agrees that discussion is Flowchart not locate content in Draft 2 that resolves discussions on the question Is a CCF needed on this subject. The this comment. Credible? and proposed engineering preventive measures are The process and reasoning advocated for method to answer the question during formulated with sufficient determining Is a CCF Credible? is not upcoming interactions. depth and criteria so that any sufficiently articulated. residual uncertainty in CCF likelihood still leaves that 8

No. Text NRC Comments Proposed Action NEI Discussion Points on Section (i.e., addition, deletion or Comment modification)

Section 4.2.2.2 states that preventive The staff recommends that the likelihood in the range of measures provide reasonable assurance discussion focus on the level of sufficiently low enough to be that a CCF from a specific I&C failure uncertainty remaining in a digital considered not credible. This source is not credible but does not state is why NEI 16-16 states that a system to a CCF vulnerability and that why they provide that assurance. partial P measure from independent parties can reach the Appendix A is not good same conclusion after the proposed enough to conclude that a engineering method is applied. CCF is not credible.

13. 1.2 Comment 7 from Draft 1. The staff did During the February 2017 meeting, NEI NEI agrees that more Flowchart not locate content in Draft 2 that resolves clarified that NEI 16-16 considers all discussion is required with this comment. type of CCF, not only software, and respect to beyond design During the December 2016 meeting, the therefore this question was necessary basis, and how that is to be staff provided a comment about the question in Part 2 to determine if CCF is to address CCF resulting from single addressed within NEI 16-16.

beyond design basis. At the time, the failures or AOOs (design basis).

staff understood that this document was intended to only address software CCF The staff recommends that the due to software errors - which is document be revised to clarify why the currently considered beyond design basis question Is the CCF Beyond Design in SRM-SECY-93-087.

Basis is relevant with examples.

14. 1.2 Comment 8 from Draft 1. The staff did NRC and NEI should discuss and See response to comment Flowchart not locate content in Draft 2 that resolves resolve this issue during upcoming #8..

this comment. interactions. NEI and NRC staff should Expansion of the process diagram or an discuss this point further.

additional diagram that specifically outlines how technical results of the CCF analysis support specific sections of the Draft Appendix D to NEI 96-07, with respect to CCF issues, would be helpful.

The staff needs this information to 9

No. Text NRC Comments Proposed Action NEI Discussion Points on Section (i.e., addition, deletion or Comment modification) determine if endorsement or partial endorsement of the guidance as an acceptable methodology to address CCF concerns for use in Appendix D is possible.

15. 2 Comment 9 from Draft 1. The staff did Recommend that formal definitions, NEI agrees that definitions not locate content in Draft 2 that resolves similar to those recommended by the should be consistent with this comment. staff for use with NEI 96-07 Appendix other guidance.

The definitions provided in these sections D, be used. This should be a topic of read more like descriptions and discussion going forward.

approaches rather than formal definitions of the terms.

Some definitions are not consistent with how the terms have been used in regulations and regulatory guidance.

Endorsement or partial endorsement would be facilitated if the terms are defined consistently with other regulatory guidance documents or that the terms are consistently used in this document and in any documents that may later refer to it.

16. 2.1 Comment 10 from Draft 1. The staff did The staff recommends clarification of This should be discussed not locate content in Draft 2 that resolves the definition. further. Relaxed criteria has this comment. been used in the past. For The definition for best estimate method example, the Oconee in this section implies that relaxed criteria can be used for this method. Rather, RPS/ESFAS upgrade applied best estimate methods use the same relaxed acceptance criteria acceptance criteria, but apply realistic for RCS pressure (ASME 10

No. Text NRC Comments Proposed Action NEI Discussion Points on Section (i.e., addition, deletion or Comment modification) plant conditions and parameters. Service Level C at 3250 psia) and containment pressure (125 psi, or 98% of ultimate strength).

17. 2.4 Comment 11 from Draft 1. The staff did Clarify that the method proposed in This point needs to be not locate content in Draft 2 that resolves NEI 16-16 refers to all types of CCFs, discussed further.

this comment. not only to the CCFs covered in SRM-The definition for CCF Beyond Design SECY-93-087.

Basis is not clear.

The text provided comes across as a description, not a definition and is not consistent with SRM-SECY-93-087.

18. 2.5 The relationship of the terminology used Clarify relationship between the NEI agrees that more in NEI 16-16 to terminology used in NEI terminology used in NEI 96-07, discussion is needed on key 96-07 is not clear. For example, the use Appendix D to the terminology in NEI terms.

of the terms credible and not credible in 16-16. Where appropriate, ensure NEI 16-16 are not consistent with NEI 96-07, Appendix D. The word bounding alignment of the terms used in both also seems to be inconsistent. Staff documents.

reviewing NEI 96-07, Appendix D have also asked about how the words negligible and attributable (which are used in Appendix D) relate to content in NEI 16-16 (which does not use these words).

19. 2.5 The definition provided for CCF Not The staff recommends defining what a NEIs view is that a credible Credible is based on the likelihood of a Credible CCF is instead of defining CCF is the inverse of the CCF. This is confusing because the 11

No. Text NRC Comments Proposed Action NEI Discussion Points on Section (i.e., addition, deletion or Comment modification) guidance provided requires what CCF not credible means. definition of not credible in determination of a credible CCF and how 16-16. Credible would then likely the CCF is. NRC and NEI should continue be defined as (emphasis discussions to address CCF credibility added): A CCF can be and its likelihood. considered not credible only if the likelihood of a CCF Discussions should include the caused by an I&C failure proposed graded approach to source is no greater than the eliminating the need for further likelihood of a CCF caused by consideration of CCF in safety support other failure sources that are systems (such as chillers as have been not considered in a presented by NEI) as mentioned in deterministic safety analysis comment 12 on Draft 1. described in the FSAR. This definition of credible is consistent with Figure 4-3 in NEI 01-01.

20. 2.8 Comment 13 from Draft 1. The staff did Consider eliminating the definition of The term digital engineer not locate content in Draft 2 that resolves Digital Engineer. was expunged and replaced this comment. with design engineer in It is not clear why this guidance needs to Draft 2.

define the role of the Digital Engineer.

21. 2.12 Since Section 2.12 defines mitigating Include a definition for event initiator. NEI will consider defining system, consider defining event this.

initiator.

22. 3.1 Comment 15 from Draft 1. The staff did The staff recommends that NEI use the This comment needs to be not locate content in Draft 2 that resolves exact text from SRM-SECY-93-087 discussed further. Section this comment. where applicable. 3.1 does not refer to the 12

No. Text NRC Comments Proposed Action NEI Discussion Points on Section (i.e., addition, deletion or Comment modification)

This section paraphrases the information SRM.

in SRM-SECY-93-087 which may lead to confusion.

23. 3.3, Comment 20 from Draft 1 (originally in Suggest define preferred malfunction NEI would like to discuss this 4.2.2.3 section 4.1.2.2.2). The staff did not state or rewording the sentences further, and align with the locate content in Draft 2 that resolves using this term. Perhaps something NRC on this term and the this comment. like preferred state when a safe state term used in the What is a preferred malfunction state? malfunction occurs. current version of RIS 2017-xx.

24. 3.4 Comment 18 from Draft 1. The staff did NRC and NEI should continue The 3 possible conditions are not locate content in Draft 2 that resolves discussing the appropriate correct. Conditions 2 and 3 this comment. characterization of CCF in terms of may be further conditioned It appears that this draft guidance is credibility, design basis, and beyond as a) bounded by a previous treating 3 possible conditions: (1) CCF is design basis during upcoming analysis, or b) not bounded not credible; (2) CCF is credible but interactions by a previous analysis.

beyond design basis; or (3) CCF is credible and is within design basis. NEI agrees that examples would be useful. These will Review of the document would be aided be pursued once better by specific examples of digital alignment between NEI and modifications that could fall with the NRC on the NEI 16-16 three categories proposed in the content and methods are document. The staffs review will be achieved.

aided by a practical understanding on the implications and use of this methodology.

25. 3.4 The description provided in this section Clarify this statement: a credible CCF NEI agrees to discuss this does not explain how a credible CCF is within the plant licensing basis. point with NRC staff and 13

No. Text NRC Comments Proposed Action NEI Discussion Points on Section (i.e., addition, deletion or Comment modification) affects the plants licensing basis and clarify. A credible CCF that is design basis. It describes the use of considered within the plant preventive measures to determine if a licensing basis does not CCF is credible, and then the method to necessarily mean that it is perform a coping analysis. already described as-is in the UFSAR (the converse is that if the CCF is not credible, then it is not considered within the plant licensing basis). In Section 3.4, considering a credible CCF within the plant licensing basis means it must be further addressed using the balance of the guidance in 16-16. The user needs to determine if the credible CCF is previously analyzed, and if the results are bounded by the previous analysis, end the CCF technical evaluation.

Otherwise, perform a new analysis.

26. 3.4 The description from the second Add content that describes how a CCF NEI would like to discuss this paragraph to the end seems to belong to can affect the plants licensing basis further with NRC staff to Part 2 in Figure 1. This section, however, and design basis. better understand the exact does not describe how a CCF can affect question. See comment the plants licensing basis and design response above.

14

No. Text NRC Comments Proposed Action NEI Discussion Points on Section (i.e., addition, deletion or Comment modification) basis.

27. 4.0 This statement: The design engineer Clarify how the results of the See response to comment #8.

should document the completed CCF evaluation will be used.

technical evaluation, and preserve the document as a quality record, tells the design engineer what to do with the results of the evaluation. However, this document does not describe how to use the result of this evaluation when performing changes under 10 CFR 50.59 or license amendments.

28. 4.1 This section lists three criteria. However, Please clarify what the three criteria in NEI agrees to clarify this it is not clear what that criteria is this section are referring to. section. As the comment referring to. It seems that this is to says, the three criteria are for determine if the digital system is an determining if the digital event initiator or credited for event system is an event initiator or mitigation. credited for event mitigation.

29. 4.1 Comment 17 from Draft 1 (content was in Consider adding examples that result NEI agrees that these type of Section 3.3 of Draft 1). The staff did not in a NO answer. Examples would examples would be useful.

locate content in Draft 2 that resolves clarify what types of systems result in These will be pursued via this comment. a NO answer. new Appendices once better Examples of support systems that result alignment between NEI and in a YES to the question is the digital NRC on the NEI 16-16 equipment an initiator, or credited for content and methods are event mitigation? in the flowchart, Part achieved.

1 are provided in this section. The staff finds that these examples are useful for 15

No. Text NRC Comments Proposed Action NEI Discussion Points on Section (i.e., addition, deletion or Comment modification) clarifying which types of systems result in a YES answer.

30. 4.2 This section mostly focuses on using Provide more information in this The purpose of Section 4.2 is preventive measures, but it does not section on how to perform and to articulate how CCF clearly articulate how the susceptibility implement the susceptibility analysis. susceptibility analysis is to be analysis is performed. Before using performed. For example, the preventive measures, the design design engineer can engineer should assess the hazards, determine if available P or L vulnerabilities or susceptibilities. will address susceptibility of CCF caused by various I&C failure sources.

31. 4.2 Comment 23 from Draft 1. The staff did The staff recommends adding a NEI would like to discuss this not locate content in Draft 2 that resolves description on what constitutes an point further with the NRC this comment. analysis of the CCF malfunction, staff. Section 4.2 only covers This section does not describe how to methods, and acceptance criteria. Part 2 of the CCF Technical perform an analysis of the CCF Evaluation. However, an malfunction. overview of CCF malfunction, methods and acceptance criteria is provided In Section 4.2.1, on page 14. Detailed guidance on these issues is provided in Section 4.3.

32. 4.2 This section states: Note that the CCF Explain/describe how the use of NEI would like to discuss this susceptibility analysis can make use of a preventive or limiting measures can be point further with the NRC wide range of potentially applicable used and what they can accomplish (in staff. The purpose of the preventive or limiting measures provided terms of eliminating CCF from further paragraph from which the in Appendix A but does not elaborate on consideration). sentence is quoted is simply 16

No. Text NRC Comments Proposed Action NEI Discussion Points on Section (i.e., addition, deletion or Comment modification) how preventive or limiting measures can to point out that one cannot be used nor what they can accomplish. read the title of a defensive measure and apply it. The details matter. In addition, the remainder of Section 4.2 explains/describes how the use of preventive or limiting measures can be used and what they can accomplish (in terms of eliminating CCF from further consideration).

33. 4.2.1 This section is labeled as an overview but Consider moving specific details to the NEI will review the content in is fairly detailed. This section provides a subsections in which these details are this section and consider detailed description of the CCF addressed? For example, any moving detailed content to susceptibility analysis, including steps description related to the use of other sections. However, that are performed later in the process. preventive measures should be part of Section 4.2.1 provides Section 4.2.2.2 guidance for addressing issues not addressed in later sections, such as what to do with a new, previously unidentified failure source, or an incomplete defensive measure. NEI feels that it is necessary to summarize these issues in an overview, before the user gets involved in a detailed analysis.

17

No. Text NRC Comments Proposed Action NEI Discussion Points on Section (i.e., addition, deletion or Comment modification)

34. 4.2.1 Comment 19 from Draft 1 (content was in The technical basis provided should be NEI proposes to discuss Section 4.1.1 of Draft 1). The staff did strengthened by additional adding some of these key not locate content in Draft 2 that resolves information that includes design points to NEI 16-16, in a way this comment rationale, analyses, data, or that is consistent with the This section states that the digital operational experience to justify a information in the current engineer confirms the applicability of at credibility determination. version of RIS 2017-xx. For least one P measure, L measure, or LR example, the technical bases measure from Appendix A. If an for many of the design alternate P, L, or LR measure is credited, attributes in Section 3.2.1 of the digital engineer is responsible for the RIS should be the same providing documented justification for technical bases staff is each alternate measure. The section, in seeking for NEI 16-16.

part, later states that a CCF that is not credible requires no further assessment.

35. 4.2.1 This section should require that any Require that any preventive, limiting The executive summary and preventive, limiting or likelihood or likelihood reduction measure, section 1.2 already state that reduction measure, described or not in described or not in the Appendices, CCF technical evaluations the Appendices, used should be used should be documented in the CCF shall be documented. To documented in the CCF susceptibility susceptibility analysis. improve clarity regarding CCF analysis. susceptibility analysis, NEI can add a paragraph at the front of Section 4.2.1 that states the analysis shall be documented per the worksheet in Appendix C.

36. 4.2.1 This section does not provide guidance to NRC and NEI should discuss the use of Section 4.2.1 is only an determine if a CCF is credible or not. these terms. overview. To improve clarity, 18

No. Text NRC Comments Proposed Action NEI Discussion Points on Section (i.e., addition, deletion or Comment modification)

NEI can add a sentence in an appropriate paragraph that points the reader to Section 4.2.2.2, which provides guidance for determining CCF credibility.

37. 4.2.1 This section does not describe what the Describe what one should do if the Section 4.2.1 is only an design operator should do if the result of malfunction result is similar to the one overview. However, to that malfunction is similar to the system described. improve clarity, NEI can add a level or component level malfunction sentence that says if the results included in a previous system or component level deterministic analysis. The guidance only results are the same as addresses what to do if they are previously analyzed, then the different. CCF technical evaluation ends here (as already illustrated in Figure 1).

38. 4.2.1 This section states: If the FSAR identifies NRC and NEI should discuss at what NEI agrees that further a malfunction result at the plant system level the malfunction result can be discussion is required on this level, with or without a description of evaluated and compared with existing point. The presentation by component level malfunctions that can results (at the plant or system level). Pete LeBlond at the 8/1/17 lead to this plant system level malfunction result, only the plant system App. D meeting provides a level malfunction result is pertinent to basis for evaluating the CCF malfunction assessment. malfunction results at the plant level.

39. 4.2.1 This section states: the design engineer Provide guidance to describe how to Section 4.2.1 is on overview.

assesses the likelihood of the CCF based assess the CCF likelihood using the NEI can add a sentence in the on available likelihood reduction likelihood reduction measures. last paragraph of Section 19

No. Text NRC Comments Proposed Action NEI Discussion Points on Section (i.e., addition, deletion or Comment modification) measures to determine the appropriate 4.2.1 that will point the method and acceptance criteria for the reader to Sections 4.2.2.3 analysis of the plant-level CCF and 4.2.2.4 where LR malfunction result. This guidance does measures are used, if not describe how to assess the CCF applicable, to determine that likelihood using the likelihood reduction a credible CCF is BDB.

measures. Otherwise, a credible CCF is DB.

40. 4.2.1 This section states: The plant-level Explain how to use CCF likelihood to Section 4.2.1 is an overview.

analysis uses analytical methods and perform a plant-level analysis and the In the last paragraph, it related acceptance criteria acceptance criteria. states: The plant-level commensurate with the CCF likelihood. analysis uses analytical However, it is not clear how the CCF methods and related likelihood can be used to perform plant- acceptance criteria level analysis. commensurate with the CCF likelihood. Therefore, if a CCF is credible and the subsequent malfunction result is different at the system or component level, the design engineer assesses the likelihood of the CCF based on available likelihood reduction measures to determine the appropriate method and acceptance criteria for the analysis of the 20

No. Text NRC Comments Proposed Action NEI Discussion Points on Section (i.e., addition, deletion or Comment modification) plant-level CCF malfunction result, which follows, using the guidance in Section 4.3.

41. 4.2.2 For consistency, use the same text in This section title should be consistent 4.2.2 does not appear in the Figure 1 for this section title. with the terminology used in Figure 1. flow chart, please clarify the comment. It would probably be too busy, but NEI could add a box to Figure 1 that encapsulates 4.2.2.2, 4.2.2.3 and 4.2.2.4, and label the new box as 4.2.2.

42. 4.2.2 Are the CCF sources listed in Appendix A Clarify that Appendix A describes NEI agrees that a note in the only potential CCF sources? potential CCF sources, but that there Section 4.2.2 to this effect could be others not described in the would be helpful, to reiterate Appendix. what Section 4.2.1 states:

the design engineer identifies any other potential sources of CCF not listed in Appendix A that may be unique to a specific application.

43. 4.2.2 If this section is describing the sources, Edit Figure 1 or the content in this Further discussion is needed why does it include determination of CCF section to ensure consistency within with the staff to better credibility and likelihood? These the document. understand this comment.

determinations seem to belong in other Section 4.2.2 is not just about sections to be consistent with Figure 1. failure sources. It describes how defensive measures can be used to determine 21

No. Text NRC Comments Proposed Action NEI Discussion Points on Section (i.e., addition, deletion or Comment modification) likelihood (aka credibility) of a CCF, and depending on likelihood of a credible CCF, whether or not its DB or BDB.

44. 4.2.2.1 This section states that fire, smoke, and Remove the defensive measures in NEI feels that the clarifying operations or maintenance human errors sections A.2.5and A.4 and reference information in the body of are also sources of CCF but that they are the appropriate guidance. NEI 16-16 is sufficient to addressed in other industry guidance and cover this point.

that the defensive measures on fire, smoke, and human error are included for interested users. No note to reflect this is placed in Appendix A (Sections A.2.5 and A.4).

45. 4.2.2.1 This section states: If a proposed I&C Please provide a reference to a section NEI agrees that an expanded system or component design has a failure in the guidance that explains how it discussion on this point is source that is not on the list provided should be addressed. needed in the document.

above, it should be identified and The idea here is that a new addressed using this guide. It is unclear failure source may or may how this guide should be used for a not be prevented per se; if failure source not on the list in this its not, then the CCF is section. credible and should be analyzed using the remaining guidance. In other words, just because a new failure source is identified doesnt mean NEI 16-16 is N/A.

46. 4.2.2.4 This section seems to cover two different Recommend dividing this section in NEI will consider this in the 22

No. Text NRC Comments Proposed Action NEI Discussion Points on Section (i.e., addition, deletion or Comment modification) subjects: likelihood reduction and two: (1) likelihood reduction and (2) next update to NEI 16-16.

determination of analysis. determination of analysis. Simply put, if an LR measure is applied, the CCF results are BDB; if not, the CCF results are DB.

47. 4.2.2.4 What is the justification or basis for this Provide justification or technical basis NEI would like to have text: A likelihood reduction measure for the statement. Why does a further discussion with the allows a credible CCF to be considered likelihood reduction method allow NRC staff on this point.

beyond design basis. this? Industry believes staff views quality and independence as the bases for treating SCCF as BDB per SECY/SRM 93-087.

Conversely, without quality and independence, SCCF must be treated as DB.

48. 4.2.2.4 This section should refer to other Provide appropriate references to NEI agrees that an expanded sections in the guidance if likelihood other sections. discussion on this point is reductions cannot be used. needed in the document. If an LR cannot be used for a credible CCF, then the CCF results are to be analyzed using conservative DB methods.

49. 4.2.2.4 Comment 21 from Draft 1 (content was in The staff recommends that NEI NEI requests that the NRC Section 4.1.2.2.3 of Draft 1). The staff did incorporate or reference NRC guidance staff provide the NRC not locate content in Draft 2 that resolves on acceptable implementation of documents that address this comment conservative and best estimate implementation of 23

No. Text NRC Comments Proposed Action NEI Discussion Points on Section (i.e., addition, deletion or Comment modification)

The document partially describes the use methods. Otherwise, provide conservative methods and of Conservative Methods and Best justification for using alternate best estimate methods.

Estimate Methods. The staffs review methods. These will be considered for would be facilitated by incorporating and incorporation into NEI 16-16.

referencing NRC guidance on acceptable implementation of these methods.

50. 4.2.2.5 This comment is a follow up to comment NRC and NEI should discuss this NEI agrees that further and 22 from Draft 1 (content was in Section comment during upcoming discussion is needed with the 4.2.2.6 4.1.2.2.4 of Draft 1) which stated that the interactions to increase understanding staff to better understand staff is willing to consider the use of risk on the purpose and key takeaways of these points. The purpose of insights in this document or future these two sections. 4.2.2.5 is to explain that revisions. some defensive measures, The purpose and key takeaways of not all, provide a graded sections 4.2.2.5 and 4.2.2.6 are not clear. approach based on safety Do some defensive measures apply only classification (for example, a to non-safety equipment? measure to protect against high temperature requires formal EQ for 1E, good practice for non-1E).

The purpose of 4.2.2.6 is to explain that the PRA can be used to provide risk insights to influence system design.

24